FR3037155A1 - METHOD AND DEVICE FOR MANAGING TROUBLES WITH A SYSTEM FOR MANAGING A TURBOMOTIVE OF AN AIRCRAFT - Google Patents

Abstract

The present invention relates to a fault management method with a management system controlling a motor of an aircraft. During a preparation step (STPA), at least two failures of the management system that are likely to occur are identified and stored in the aircraft (1), each failure being associated with a level of failure to be chosen between a first level for a given aircraft. failure having no impact on the piloting of the aircraft (1) and a second level. Each first level fault is associated with an authorized flight time. If at least one of the failures occurs, the failure level of each failure is detected during a detection step (STP4). During a display step (STP6) at least one first-level failure is reported. has occurred if no fault detected is a second level failure, the flight can then be continued for at least a predetermined duration.

Description

The present invention relates to a method and a device for managing failures with a system for managing a turbine engine 5 of an aircraft. Such an aircraft can notably be a rotorcraft. The invention is therefore in the technical field of turbine engine management systems, in particular a rotorcraft. A rotorcraft has at least one main rotor participating in the lift, or even the propulsion of this aircraft. This main rotor is rotated by a power plant comprising at least one motor. Such an engine can be a heat engine, and in particular a turbine engine for example. For example, a rotorcraft comprises at least one heat engine mechanically connected to a power transmission gearbox called "main power transmission gearbox". This power transmission gear rotates a rotor mast of the main rotor. Therefore, an engine can be controlled by a management system. For example, a management system of a turbine engine 20 comprises in particular a calculator and a fuel dispenser. Such a management system can then be a system known by the acronym "FADEC" corresponding to the English expression "Full Authority Digital Engine Control". In addition, the calculator may be known by the acronym "EECU" corresponding to the English expression "Engine Electronic Control Unit", or simply under the acronym "ECU" corresponding to the English expression "Engine Control Unit". . 3037155 2 The computer communicates with various equipment, including various measuring systems to control the fuel dispenser. In particular, the computer can communicate with measurement systems determining the value of monitoring parameters of the heat engine. To control a turbine engine, the measuring system can for example measure a rotational speed of a gas turbine engine, a temperature prevailing within the turbine engine, a torque developed by a body of the turbine engine. The computer may also communicate with an avionics system of the aircraft to obtain data that may affect the performance of the engine controlled. For example, the computer is connected to an anemobarometric system 15 determining the pressure and temperature of the air outside the rotorcraft. For safety, some organs can be redundant. For example, the calculator may comprise two separate calculation units each able to control the fuel metering unit. Such sets are referred to as "channels" or "channels", the calculator being referred to as a two-channel or dual-channel calculator. Similarly, measurement systems can be redundant, each measurement system communicating with each set of calculation. In addition, each measurement system can communicate through redundant links with each channel of the computer. In addition, the management system is monitored in flight to tend to limit the risk of accident in case of failure. Thus, a management system is able to detect a plurality of failures by analyzing the data circulating within the various organs of the management system. For example, a computer can detect a failure of a temperature sensor if this sensor transmits an aberrant temperature to the computer or a malfunction of the engine. The various failures of a power plant obviously have distinct impacts on the aircraft and the safety of the flight. Thus, for example, a classification provides for three levels of failure. The first level of failures identifies failures that do not have an impact on the piloting of the aircraft. For example, the loss of a redundant temperature sensor does not have an impact on the piloting of the aircraft. The second and third echelons, on the other hand, refer to breakdowns having an impact on the control of the rotorcraft. If a failure is detected by a management system, this failure can be reported to a pilot. For example, a rotorcraft may include a multifunction screen capable of displaying a page listing the failures listed. Such a list is sometimes called "Master list" in English. In addition, a builder can establish a master list of minimal equipment. Such a list is also known by the acronym MMEL corresponding to the English expression "Master Minimum Equipment List". 3037155 4 For a failure of the first rung, the manufacturer may authorize the flight for a limited number of hours before repair if such a particular failure occurs. This function is known by the acronym TLD which corresponds to the English expression "Time Limit Dispatch". Therefore, the manufacturer can associate at least one fault with an authorized flight time in the main list of minimal equipment. As a result, the manufacturer establishes ground faults that may occur and assign them to a failure level.

For certain failures of the first rung, the manufacturer establishes a number of flight hours authorized from the moment the failure occurs. When a single minor failure of first step is indicated by the management system, either the theft is prohibited or the flight remains possible for the period specified by the manufacturer. When the management system detects multiple minor first-level failures or at least second-level failure or third-level failure, theft is not permitted.

According to this state of the art, the manufacturer thus establishes the simple failures that can be envisaged and classifies these failures according to a three-step classification system. In addition, some failures of the first rung may be associated with an authorized flight time. If a single first-level fault occurs, the flight may be authorized within the flight time specified for that failure. In other cases, theft is prohibited. This procedure is interesting but necessarily leads to the prohibition of a flight if two minor breakdowns occur. This situation can be damaging, for example when the aircraft is at sea on a platform. This aircraft is then blocked on the platform while the aircraft can possibly join its base. The document ARP5107 index B of November 2001 5 refers to the "Time Limit Dispatch" function mentioned above. The acronym ARP stands for "Aerospace Recommended Practice". According to this document ARP5107, if a failure is associated with a failure occurrence rate greater than 100 * 10-6 failure per hour, the failure can not be associated with a permitted flight time before repair. If a failure is associated with a failure occurrence rate between 75 * 10-6 and 100 * 10-6 failure per hour, the failure may be associated with a short flight time allowed before repair.

If a failure is associated with a failure occurrence rate of less than 75 * 10-6 failure per hour, the failure may be associated with a long allowable flight time before repair. This document suggests that a breakdown may be associated with a single number of flight hours authorized before repair, this number of hours being established according to the rate of occurrence of the failure. The document EP1444658 aims to determine in real time, namely in flight, the probabilities of success of a mission of a given time for example of two hours. An algorithm also establishes the flight time allowed following said failure. According to the method described, a failure rate is assigned to each two-channel component of a computer of a management system.

For each component of a first channel, a manufacturer determines second channel components necessary to cover normal operation in the event of failure of the examined component of the first channel.

As a result, aircraft systems detect whether a particular component of the first channel has failed. If so, a total failure rate is calculated based on the individual failure rates of the second channel components required for normal operation of the management system in case of failure of the particular component concerned. A predicted flight time remaining before repairing the fault is then established based on this total failure rate. The predicted flight time is compared to a mission objective, the achievement of the mission being dependent on the comparison made. The object of the present invention is therefore to propose an alternative fault analysis method on an engine management system of an aircraft to determine whether the aircraft can fly following at least one failure.

The invention therefore relates to a fault management method with a management system controlling an engine of an aircraft to determine whether the aircraft can fly following at least one failure, the management system comprising at least one computer equipped with two calculation channels as well as a fuel metering device and a measurement system, at least one control channel connecting each calculation channel to a fuel metering unit. The measuring system comprises a plurality of measuring members, each measuring member being connected to each calculation channel of the calculator for transmitting at least one piece of information relating to the operation of the aircraft to each calculation channel. Each measuring device is to be chosen from a list including at least one measuring device of an avionic system of the aircraft and a measuring device measuring at least one piece of information relating to a monitoring parameter of the engine. During a preparation step, at least two failures of the management system that may occur are stored in the aircraft. Each failure is associated with a level of failure to be selected between a first level for a failure having no impact on the piloting of the aircraft and a second level for a failure having an impact on the piloting of the aircraft. The term "failure" cited in isolation refers, on the one hand, to a failure of a single component called "elementary failure", and, on the other hand, to a combination of elementary failures called "multiple failure" which occur during a flight of the aircraft. A combination of elementary failures of the first level can lead to a multiple failure of first level or second level. For example, an aircraft may have two torque meters per security. The malfunction of a single torque meter is a basic first-level failure. On the other hand, the joint failure of the two torque meters is a second level multiple failure. A builder therefore establishes a list of faults including elementary failures and / or multiple failures, each failure being associated with a level of failure. In addition, at least each failure of the first level is associated with a flight time authorized following the occurrence of the fault and before repair of this fault, each authorized flight time being stored in the aircraft. During a fault detection step, it is determined whether at least one of the failures occurs.

During an evaluation step, the failure level of each fault detected during the detection step is determined using the data established during the preparation step. During a display step, a pilot is informed that at least one first level failure has occurred if no fault detected is a second level fault, the flight can then be continued for at least a predetermined duration by the constructor regardless of the first level failure detected. The aircraft is thus provided with at least one engine, such as a heat engine. The operation of each engine is controlled by a management system. This management system is provided with a computer comprising at least two calculation channels for security. Each calculation channel communicates with conventional measuring devices measuring controlled motor parameters. In addition, each calculation channel can communicate with an avionic system, and for example with a power supply system, a measuring device measuring information useful for the operation of the engine and a computing unit of the avionics system. According to the invention, a builder thus lists, prior to the use of the aircraft, aircraft breakdowns likely to occur. This preparation step is carried out by applying the known techniques.

In addition, the manufacturer determines a failure level for each failure. All failures that can be detected by the aircraft are classified according to at least two levels. The first level is assigned to each minor failure 5 that does not have an impact on the flyability of the aircraft. A failure having no impact on the controllability of the aircraft may in particular be a failure having no impact on the operation of at least one engine being for example automatically processed.

Conversely, the second level is assigned to each failure having an impact on the controllability of the aircraft. This second level can be broken down into at least two sub-levels for example. Thus, the second level can be decomposed into a first sub-level and a second sub-level of failure. The classification then has three levels of failure, namely the first level of failure corresponding to the first level mentioned above, the first sub-level of failure which represents a second level corresponding to the second level mentioned above, and the second sub-level of failure. which represents a third level 20 corresponding to the third echelon mentioned above. The first sub-level is thus conferred on major breakdowns affecting the control of the engine, this engine operating with minimal degradation following the treatment of the failure. The second sub-level includes the 25 failures leading to the loss of control of the fuel meter and therefore the loss of power developed by the engine.

Moreover, the first level failures having no impact on the flyability of the aircraft, the flight is likely to be authorized for a certain time before being repaired. Therefore, the manufacturer assigns a permitted flight time before repair at least 5 at each first level failure. Optionally, at least one second level failure is also associated with an authorized flight time. As a result and prior to the use of the aircraft, at least two fault lists are for example established during the preparation step, namely a list of failures of the first level associating each first level fault with a time of authorized flight and a list of failures of the second level possibly associating at least one second-level fault with an authorized flight time. These fault lists are stored and embedded in the aircraft. In the use of the aircraft, the equipment of the aircraft examines the operation of the power plant during the step of detecting faults. If at least one failure occurs, the equipment of the aircraft 20 determine the nature of the failure to know the level of the fault using the lists of faults stored and embarked in the aircraft. Finally, if no fault detected is a second level fault, a display indicates the occurrence of at least one first level failure. The flight can then be continued for at least a predetermined duration by the manufacturer before the breakdown of the aircraft is repaired. For example, calculator channels of a calculator may be connected to an outdoor temperature sensor of the avionics system. A first level failure can then correspond to the loss of the information transmitted by the temperature sensor. If such a failure occurs, the flight may be continued for at least the predetermined duration.

A first degree of signaling therefore consists in signaling the presence, if necessary, of first-level failures. When a message is displayed to signal the presence of at least one first level failure, the equipment of the aircraft announces the presence of one or more first level faults. The pilot does not know at this stage which are the first level failures or their number. All first level faults can be present at the same time. Nevertheless, the pilot knows that in this case the flight remains possible for at least the predetermined duration.

On the other hand, a breakdown of the second level may possibly lead to the prohibition of theft, at least in the presence of passengers. A second degree of reporting is to examine the individual nature of the failures to determine if the failures allow a flight time greater than the predetermined duration. ARP5107 proposes to determine a permitted flight time if a failure occurs based on a failure occurrence rate. EP 1444658 proposes to establish in flight a predicted flight time.

The invention follows another strategy. This invention proposes to classify failures to determine if a failure is a minor failure that does not impact the flyability of the aircraft. The presence of minor breakdowns of this type does not result in the direct immobilization of the aircraft, the aircraft being able to fly for at least the predetermined duration. In the framework of an "Offshore" mission in English, this function allows a pilot to bring the aircraft 5 back to its original base in the event of minor breakdowns, and does not oblige the aircraft to remain at sea by example. This process can then increase the availability of the aircraft in the context of minor breakdowns. In addition, this method is easily used for a pilot because the pilot does not have to perform an analysis of the faults present. The mere display of first-level faults allows the pilot to know that the aircraft is at least able to fly for the predetermined duration. This method may further include one or more of the following additional features. For example, each failure is to be selected from a list comprising: a failure causing the absence of transmission of one of said information by the measurement system to at least one calculation channel; a failure causing the transmission to the computer of information by the measuring system having a value identified as being abnormal, - failure causing the measurement system to transmit a first value to a calculation channel that does not correspond to a second value transmitted to the other. calculation path for the same information.

Thus, by "failure" is meant a real incident preventing, for example, the transmission of information to the management system calculator, or the transmission of erroneous or inconsistent information with other information.

The manufacturer then memorizes during the preparation step all the failures corresponding to at least one of the preceding criteria. Furthermore, a first level failure without impact on the pilot is a failure that does not modify the operation of said engine. Conversely, a second level failure having an impact on the pilot is a failure generating a malfunction of the management system requiring the implementation of at least one procedure described in a flight manual.

In another aspect, the predetermined duration is less than or equal to each allowed flight time. In addition, the predetermined duration is the time required to complete a mission and return to a starting point.

As an illustration, when an aircraft is heading towards a platform at sea from an original ground base, the pilot knows that the aircraft can reach the platform and return to the original base. Therefore, the predetermined duration can be equal to 5 hours.

Moreover, a list of values that can be assigned to an authorized flight time is established, each value of said list of values being associated with a degree of criticality of a failure, during the preparation step, it is possible to determine the criticality degree of each failure which is associated with a permitted flight time and the flight time allowed for an examined failure is assigned the value corresponding to the degree of criticality of this fault examined.

According to this variant, the manufacturer establishes a list of values that may constitute an authorized flight time. For example, a permitted flight time may be one of the following: 100 hours, 50 hours, 15 hours, and the predetermined time.

Each value is associated with a degree of criticality. According to the preceding example, the first degree of criticality is then associated with an authorized flight time equal to the predetermined duration, the second degree of criticality being associated with an authorized flight time equal to 15 hours, the third degree of criticality being Associated with an authorized flight time equal to 50 hours, the fourth degree of criticality being associated with a permitted flight time equal to 100 hours. For each fault to be associated with an authorized flight time, the manufacturer determines a degree of criticality to determine the flight time allowed to associate with this failure. The degree of criticality can be defined in relation to the operational consequences of the failure examined and the probability of loss of motor function following the failure examined. This degree of criticality is determined during a so-called "AMDEC analysis well known to those skilled in the art". The AMDEC acronym stands for "Failure Modes, Effects and Criticality Analysis". The invention can then provide not one but two degrees of failure reporting.

During the implementation of the method, the first degree of signaling consists, for example, in signaling the presence of first level failures. The second degree of reporting consists of presenting at least one piece of information to determine whether the authorized flight times of the failures made it possible to fly for a total duration greater than the predetermined duration. This total duration is then equal to the lowest allowed flight time for all the failures that have occurred.

For example, if two failures are associated respectively with two authorized flight times of 50 hours and 100 hours, the aircraft can fly 50 hours before being repaired. Optionally, a message indicates the presence of first level failures and the lowest allowed flight time.

The degrees of signaling can also be implemented successively. For example, during a step of refining the flight time authorized before repair, a detailed list of the failures occurred is displayed, the flight time remaining before repair being equal to the lowest flight time relating to failures occurring. The detailed list of faults present must be analyzed by an operator. According to a first degree of reporting, the presence of first level failures is reported.

According to the second degree of signaling, the detected failures are displayed, for example being classified according to their degree of criticality.

On the other hand, during the display step, it can be pointed out to a pilot that at least one first-level failure has occurred by displaying a single generic formulation. The term "generic formulation" refers to a formulation announcing the presence of at least one first-level failure without detailing the failures. All first level failures are grouped under a generic name and presented to the pilot. The displayed message may then include the minimum authorized flight time. In addition, during the display step, it can be signaled to a driver that at least one second level failure has occurred if at least one detected fault is a second level failure. If the displayed message corresponds to major breakdowns of second level, the pilot knows that the aircraft can not fly again until the maintenance actions have been performed. Moreover, during the preparation stage, at least one second level failure may be associated with an authorized flight time, the flight being authorized only in the absence of a passenger. According to this variant, certain major breakdowns may also give rise to a limited-time flight authorization. Nevertheless and in this case, the flight is limited to a technical flight performed without passengers.

In addition to a method, the invention relates to a fault management device provided with at least one engine management system of an aircraft for determining whether the aircraft can fly following at least one failure.

The management system comprises at least one computer provided with two calculation channels, as well as a fuel metering device and a measurement system, at least one control channel linking each calculation channel to a fuel metering device, said metering system. 5 measurement comprising a plurality of measuring members, each measuring member being connected to each calculation channel for transmitting at least one information relating to the operation of the aircraft to each calculation channel, each measuring member being to be selected in a list including at least one member of an avionics system of the aircraft and a measuring member measuring at least one piece of information relating to a parameter for monitoring the engine. The fault management device then applies the method described above, said fault management device comprising: a memory unit storing each fault identified during the preparation step, as well as the level of each failure and the time of failure; flight authorized for at least first level failures, 20 - a processing unit implementing the fault detection step and the evaluation step, - a display unit implementing the display step The avionic system comprising a calculation unit, said processing unit may comprise at least one of the following equipment: said calculation unit, said management system calculator. The implementation of the method can be carried out in the management system computer or in an avionics system calculation unit or any other computer which has all the information and which has a sufficient level of security. In addition to a management device, the invention relates to an aircraft. The aircraft is provided with at least one engine.

This aircraft comprises a fault management device of the type described above. The invention and its advantages will appear in more detail in the following description with examples given by way of illustration with reference to the appended figures which represent: FIG. 1, a diagram illustrating an aircraft according to the invention and FIG. 2 is a diagram illustrating the method according to the invention.

The elements present in several separate figures are assigned a single reference. Figure 1 shows an aircraft 1 according to the invention. In particular, this aircraft can comprise at least one rotor 2 participating in the lift and / or the propulsion of the aircraft.

The aircraft can then be a rotorcraft, for example. Furthermore, the aircraft 1 may comprise a power transmission gearbox 3 rotating the rotor 2. To set the power transmission gear 3 in motion, the aircraft comprises a powerplant 4.

This power plant 4 is provided with at least one motor 5. For convenience, FIG. 1 shows a single motor 5.

Each engine 5 may be a heat engine, such as a turbine engine, for example. Conventionally, each engine 5 can be controlled by a management system 10, such as a FADEC type system.

The term "management system" then refers to a system controlling the operation of an engine. Each management system 10 comprises a management computer more simply called "calculator 15". This calculator is of the ECU type for example.

10 Therefore, the computer can be provided with two calculation channels 16, 17 separate for security. The calculation channels 16, 17 communicate with each other. Each calculation channel 16, 17 can then be respectively provided with a processor 16 ', 17' or equivalent, and a storage unit 18, 18 'able to store information and instructions. The storage unit can store software code segments and variable values. Each calculation channel may communicate with an avionics system 50 of the aircraft. The term "avionics system" refers to all electronic, electrical and computer equipment that assist in flying aircraft, except for management systems. In particular, each calculation channel can be connected to a power supply system 55.

In addition, each calculation channel can communicate with equipment 51, 52 of the avionics system via an interface system 19.

In addition, each management system 10 has a fuel dispenser 20. The fuel dispenser 20 controls the flow of fuel transmitted to the engine 5 controlled by this management system 10.

Therefore, each calculation channel 16, 17 communicates with the fuel dispenser via a control channel 21, 22 to position the fuel dispenser in the proper position. In particular to determine this appropriate position, each management system comprises a measurement system 30.

The term "measuring system" refers to a system determining the value of parameters used to control the engine 5. These parameters include at least information relating to the operation of the aircraft, and in particular the operation of the engine being controlled.

This measuring system 30 is provided with a plurality of conventional measuring members 31, 52 connected to each calculation channel. Each measuring device is connected to each calculation channel 16, 17 via a connection channel 33. Therefore, the measuring system may comprise at least one measuring device 31 measuring at least one piece of information relating to a monitoring parameter of the device. 5. For example, at least one measuring member 31 is to be selected from a catalog comprising: a speed measuring member measuring a rotational speed of a gas generator of the motor, a temperature measuring member measuring a temperature inside the engine, a torque meter measuring a torque developed by the engine.

In addition, each calculation channel can receive information from measurement devices 52 of the avionics system, through the interface system 19 for example. In particular, measuring elements 52 can measure an outside pressure PO and an outside temperature TO of the ambient air prevailing outside the aircraft. Furthermore, the aircraft includes a fault management device 40 to manage breakdowns of the power plant. This fault management device 40 includes each management system 10, and possibly at least one equipment of the avionics system. Therefore, the fault management device 40 comprises a processing unit 60 cooperating with a memory unit 65 and a display unit 70.

Each computer can be part of the processing unit 60, the memory unit 65 comprising the storage units 18 of this computer. Similarly, the processing unit 60 may comprise a computing unit 51 of the avionics system. Such a computing unit may comprise a processor 53 or the like, and a storage unit 54. The memory unit 65 may include the storage unit 54 of the computing unit. In addition, the management device comprises a display unit 70 connected to the processing unit. The display unit 70 is notably provided with a screen 71. Such a display unit may comprise a multifunction screen, such as the known multifunction screen which displays a list called "MASTER LIST" in 3037155 22 English language . Such MASTER LIST usually displays the information of faults reported by the systems of the aircraft. The fault management device 40 applies the method according to the invention illustrated in FIG. 2.

During a preparation step, a list of failures in the aircraft is stored before use of the aircraft. This list of failures classifies management system failures that may occur, each failure being associated with a level of failure and possibly a permitted flight time before a repair is to be undertaken. For example, the STPA preparation step can be decomposed into an STP1 analysis step, an STP2 classification step, and a STP3 authorized flight time allocation step.

During the STP1 analysis step, at least two failures of the management system that may occur are identified. Therefore, the manufacturer studies the various equipment of the management system to perform a fault analysis. In particular, all the failures which cause the absence of transmission of information by the measuring system 30 to at least one calculation channel 16, 17 can be recorded. In addition, the failures which cause the transmission to each computer of information by the measurement system 30 having a value identified as being abnormal can be recorded. A value is abnormal, for example if this value is not in a range of theoretical values. For example, if the temperature determined by a sensor is not included in a predetermined range, the computer receiving this information deduces the presence of a failure. In addition, faults which cause the measurement system 30 to transmit a first value to a calculation channel 16 which does not correspond to a second value transmitted to the other calculation channel 17 for the same information may be identified. For example, the value of the temperature measured by a temperature sensor received by the first calculation channel 16 is different from the value of this same temperature received by the second calculation channel. The computation voices 16, 17 communicating with each other to check the coherence of the information received, the computer deduces the presence of a failure. Furthermore, during the STP2 classification step performed for each of said failures, each failure at a level of failure. This method suggests establishing a first level of failure and a second level of failure having different impacts on the aircraft. The failures of the second level are more severe than the 20 breakdowns of the first level. Indeed, the failures of the first level correspond to failures having no impact on the flyability of the aircraft. For example, a failure without impact on the pilot is a failure that does not modify the operation of the engines 5.

Conversely, a failure having an impact on the pilot is a failure generating a malfunction of the management system 10. Such a failure requires the implementation of at least one procedure described in a flight manual.

Optionally, the failures of the second level can be decomposed into a plurality of sub-levels depending on their impact on the operation of the engine and the aircraft. The constructor then lists all the failures listed and 5 assigns each failure to a level of failure. During a step of assigning an authorized flight time STP3, the manufacturer also assigns, at least each failure of the first level to an authorized flight time. This allowed flight time is the amount of time that the aircraft can fly if the examined fault occurs. Optionally, an authorized flight time is also assigned to failures of the second level. Moreover, the authorized flight time is greater than or equal to a predetermined duration. Thus, each failure associated with an authorized flight time is likely to not hinder the flight for at least the predetermined duration. This predetermined duration may correspond to the time required to perform a mission and return to a starting point, for example being substantially equal to 5 hours.

In addition, the authorized flight time assigned to a failure can be chosen from a list pre-established by the manufacturer. For example, the method suggests establishing a list of values that can be assigned to an authorized flight time. Each value in this list of values corresponds to a degree of criticality of a failure. This degree of criticality is defined in relation to the operational consequences of the failure examined and the probability of loss of motor function following the failure examined.

Accordingly, during the step of assigning an authorized flight time STP3, the method proposes to determine the degree of criticality of each failure. The manufacturer studies the fault examined, and assigns it a degree of criticality depending on the consequences of this failure. Therefore, the manufacturer assigns to the failure examined the allowed flight time to the degree of criticality of this failure examined. At the end of the preparation step, the failures of the management system that may occur are listed, each failure being associated with a level of failure or even an authorized flight time. These failures as well as their level of failure and the corresponding authorized flight time are stored in the memory unit. For example, at least one database identifies faults and associated information. At the end of the preparation step, the aircraft can be used during an STPB functional step. The functional step STPB performs iteratively and successively the following steps. During an STP4 detection step, the processing unit 60 monitors the operation of the management systems to detect possible failures. If a failure is detected, during an evaluation step STP5, the processing unit 60 requests the memory unit 65 to determine the level of failure of each detected fault.

Thus, during an STP6 display step, the processing unit 60 requests the display unit 70 to signal that at least one first level failure has occurred if no detected fault 3037155 is detected. second level. For example, a message is displayed in the list called "MASTER LIST". For example, the screen 71 displays a unique generic formulation such as "first level failure" to signal the presence of at least one first level failure, if only first level failures have occurred. If only first level failures have occurred, the predetermined time of each first level failure being at least equal to the predetermined duration, the pilot knows that the flight can be continued for at least the predetermined duration. Therefore, the pilot can devote himself to piloting the aircraft without seeking to know the nature of the breakdowns. However, during an STP7 refining step of the authorized pre-repair flight time, the processing unit may display a detailed list of faults occured at the request of a pilot to determine whether the authorized flight time may be greater than the predetermined duration. In addition, the processing unit can display a finite flight time that can be achieved, this refined time being equal to the lowest flight time of failures occurred. According to one variant, the message signaling the presence of at least one first level failure contains this refined duration. If desired, the processing unit prompts the display unit to signal to a driver that at least one second level failure has occurred if at least one detected fault is a second level failure. If the second level fault is associated with an authorized flight time, the flight may be authorized in the absence of a passenger only during this authorized flight time before a repair is undertaken. Naturally, the present invention is subject to many variations as to its implementation. Although several embodiments have been described, it is well understood that it is not conceivable to exhaustively identify all possible modes. It is of course conceivable to replace a means described by equivalent means without departing from the scope of the present invention. 10

Claims (16)

REVENDICATIONS1. A fault management method with a management system (10) controlling an engine (5) of an aircraft (1) to determine if the aircraft (1) can fly following at least one failure, said management system (10) ) comprising at least one computer (15) having two calculation channels (16, 17) and a fuel doser (20) and a measuring system (30), at least one control channel (21, 22) connecting each calculation channel (16, 17) to a fuel meter (20), said measuring system (30) having a plurality of measuring members (31, 52), each measuring member being connected to each calculation (16, 17) for transmitting at least one piece of information relating to the operation of the aircraft to each calculation channel (16, 17), each measuring member to be chosen from a list including at least one measuring member (52) an avionic system (50) of the aircraft (1) and a measuring device (31) measuring at least one information relating to a monitoring parameter of the oteur (5), characterized in that. during a preparation step (STPA), at least two failures of the management system likely to occur are stored in the aircraft, each failure being associated with a level of failure to be chosen between a first level for a failure having no effect. no impact on the piloting of the aircraft (1) and a second level for a failure having an impact on the piloting of the aircraft (1), at least each failure of the first level being associated with an authorized flight time memorized at the occurrence of the fault and before repair of this fault, during a step of detection (STP4) of the failures, it is determined whether at least one of said failures occurs, - during an evaluation step (STP5), determining the failure level of each fault detected during the detection step (STP4), - during a display step (STP6), a pilot is notified that at least one first level failure has occurred if there is no fault detected is a second-level failure, the flight can then be continued for at least a predetermined duration by the manufacturer regardless of the detected first level failure. 2. Method according to claim 1, characterized in that each failure is to be selected from a list comprising: a failure causing the absence of transmission of one of said information by the measurement system (30) to at least one channel; of calculation (16, 17), - a failure causing the transmission (15) of information to the computer (15) by the measuring system (30) having a value identified as being abnormal, a failure causing transmission by the measuring system (30) from a first value to a calculation channel (16) not corresponding to a second value transmitted to the other calculation channel (17) for the same information. 3. Method according to any one of claims 1 to 2, 3037155 characterized in that a failure without impact on the steering is a failure that does not alter the operation of said engine (5). 4. Method according to any one of claims 1 to 3, characterized in that a failure having an impact on the control is a failure generating a malfunction of the management system (10) requiring the implementation of at least a procedure described in a flight manual. 5. Method according to any one of claims 1 to 4, characterized in that said predetermined duration is less than or equal to each authorized flight time. 6. Method according to any one of claims 1 to 5, characterized in that said predetermined duration corresponds to the time required to perform a mission and return to a starting point. 15 7. Method according to any one of claims 1 to 6, characterized in that said predetermined duration is equal to 5 hours. 8. Method according to any one of claims 1 to 7, characterized in that a list of values which can be assigned to an authorized flight time is established, each value of said list of values being associated with a degree of criticality. during the preparation step (STPA), the degree of criticality of each fault associated with an authorized flight time is determined and the flight time allowed for an examined fault is assigned the value corresponding to the degree of criticality of this breakdown. examined. 9. Method according to claim 8, characterized in that the degree of criticality is defined with respect to the operational consequences of the failure examined and the probability of loss of motor function following the failure examined. 5 10. Method according to any one of claims 1 to 9, characterized in that during a refining step (STP7) of the flight time authorized before repair, a detailed list of failures is displayed, the flight time remaining before repair being equal to the lowest flight time for failures. 11. Method according to any one of claims 1 to 10, characterized in that during the display step (STP6), a pilot is notified that at least one first level failure has occurred 15 by displaying a unique generic formulation. 12. The method as claimed in claim 1, characterized in that during said display step (STP6), a pilot is notified that at least one second level fault has occurred if at least one detected fault is detected. a second level breakdown. 13. Method according to any one of claims 1 to 12, characterized in that during the preparation step (STPA), at least one second-level failure is associated with an authorized flight time, the flight being authorized in the absence of passengers only. 3037155 32 14. Fault management device (40) provided with at least one management system (10) of an engine (5) of an aircraft (1) for determining whether the aircraft (1) can fly due to the least one failure, said management system (10) comprising at least one computer (15) provided with two calculation channels (16, 17) and a fuel metering device (20) and a measurement system (30), at least one control channel (21, 22) connecting each calculation channel (16, 17) to a fuel meter (20), said measuring system (30) having a plurality of measuring members (31, 52) each measuring member (31, 52) being connected to each calculation channel (16, 17) for transmitting at least one information relating to the operation of the aircraft (1) to each calculation channel (16, 17), each measuring member being chosen from a list including at least one measuring member (52) of an avionic system of the aircraft and a measuring member (31) measuring at least one piece of information relating to a parameter motor monitoring unit (5), characterized in that said fault management device (40) applies the method according to any one of claims 1 to 13, said fault management device (40) comprising: - a memory unit (65) configured to store each fault identified during the preparation step (STPA), as well as the level of each failure and the flight time allowed for at least first level failures, - a processing unit (60) configured to implement the fault detection (STP4) step and the evaluation step (STP5), - a display unit (70) configured to implement the display step (STP6). 3037155 33 The fault management device according to claim 14, characterized in that said avionic system (50) comprising a computing unit (51), said processing unit (60) comprises at least one of the following equipment: said unit of calculation (51), said calculator (15). 16. Aircraft (1) provided with at least one engine (5), characterized in that said aircraft (1) comprises a fault management device (40) according to any one of claims 14 to 15.