GB2044485A - Test system for a dynamic machine - Google Patents

Abstract

A control and test system for a dynamic machine, eg an aircraft auxiliary power unit, uses sensors to gather information concerning machine operation and provides control signals to actuate the machine. The processor monitors the machine operation and shuts the machine down in the event of serious fault. The cause of a shutdown is recorded in a nonvolatile memory 55. The test system has a passive mode during operation of the machine monitoring inputs from the sensors and the machine operation. Intermittent and continuous faults which do not cause machine shutdown are recorded in the memory. An active test mode is performed when the machine is shut down, checking sensor circuits, machine control elements and the control and protection processor programs. Faults are recorded in the memory. The cause of a machine shutdown and other faults stored in the memory are retrieved and displayed on unit 56 for a serviceman. <IMAGE>

Description

SPECIFICATION Test system for a dynamic machine This invention is concerned with a test system for a dynamic machine or the like in which fault conditions are recognized and recorded to aid in servicing.

The invention is illustrated with an auxiliary power unit (APU) for an aircraft, and some of the features of the system disclosed are particularly suited therefor. Other features of the invention are of more general application and can be used in the protection and testing of other dynamic machines.

A general discussion of the construction and operation of an APU will aid in appreciation of the problems of the prior art and an understanding of the significance of the invention. A typical APU includes an engine which drives a generator and a compressor to provide electrical power for selected loads and compressed air for environmental and other purposes, when the aircraft is on the ground.

The APU is also operated in an emergency when the aircraft is airborne to supplement or replace faulty equipment. The APU engine uses jet fuel which is burned to form a gas that operates a turbine to drive the generator and the compressor. Various conditions of the APU are sensed to provide inputs to a controller which controls the fuel to the APU, other functions related to the APU and which shuts the APU down in the event of a malfunction.

Prior APU test systems have monitored sensed APU conditions. Upon the occurrence of a condition which is out of tolerance, an indication of a unit failure is given, based on a statistical analysis of probable cause. This is unsatisfactory in practice as the indicated probable cause is at best an educated guess.

Furthermore, the statistical failure analysis made during development of a dynamic machine is not accurate for a mature system.

Service personnel have learned that the test system fault indications are unreliable and often ignore them.

A principle feature of the invention is the provision of test system which monitors individual components of dynamic machine and identifies faults. When a fault occurs that causes a shutdown, the test system determines the shutdown cause. The test system includes a memory in which the identity of the faulty element is stored. A visual display is connected with the memory and displays the stored fault information.

One optional feature of the invention is the provision of a passive test system which monitors outputs of the machine condition sensors and various controller parameters.

Another optional feature is the provision of an active test system which checks sensors and actuating elements that cannot be checked when the machine is operating, stimulates control outputs and checks the actuating elements and which supplies inputs to the machine control and checks for appropriate responses.

A A further optional feature of the invention is that fault information including information regarding the cause of plural successive shutdowns is stored in a memory and available through a visual display.

Further features and advantages of the invention will readily be apparent from the following specification and from the drawings, in which: Figure 1 is a diagrammatic perspective illustration of an aircraft auxiliary power unit.

Figure 2 is a general block diagram of the APU control and protection circuits; Figure 3 is a detailed block diagram of the APU with condition sensors and actuator elements relevant to an understanding of the invention; Figures 4 and 5 are flow charts for the passive and active test systems, respectively; Figure 6 is a flow chart for the protective functions; Figure 7 is a flow chart for the operation of the protective functions; Figure 8 is a flow chart for the initialization procedure; Figure 9 is a flow chart for the status procedure; Figures 10, 11 and 12 are flow charts for the processor on occurrence of a fault; Figure 13 is a flow chart for the shutdown procedure; Figure 14 is a flow chart illustrating storage of fault information in the memory; Figure 15 is a flow chart of the passive test system; Figure 16 is a flow chart of the active test system display routine;; Figure 17 is a flow chart for the check of protective functions which is a part of the active test system; Figure 18 is a flow diagram for the check of control functions which is a part of the active test system; Figure 19 is a flow chart for the isolation of a defective unit which is a part of the active test system; Figure 20 is a flow chart for the procedure of clearing of the memory; Figure 21 is a block diagram of a circuit for stimulating an output of the machine control; Figure 22 is a block diagram illustrating the application of an AC stimulating signal to an input of the machine control; and Figure 23 is a block diagram illustrating the application of a DC stimulating signal to an input of the machine control.

The auxiliary power unit - APU - of Figs. 1 and 2 is an illustration of a controlled dy- namic machine with which the test system of the invention is particularly useful. Glennon U.S. Patent No. 4,1 8,688 shows a prior test system used with an aircraft electrical generator driven by a constant speed drive, an illustration of another controlled dynamic machines or apparatus of greater or lesser complexity for which the passive and active test systems and fault recording is useful.

The term "dynamic machine", or "controlled dynamic machine", is used herein to designate an apparatus which has active functions, as starting, operating and stopping, as directed by actuator elements. Sensors or operator controls, or a combination thereof, provide information to a machine control which in turn generates control signals that are directed to the actuator elements. The nature of the operation of the machine is often established in accordance with a predetermined function or program based on the input information from the sensors or from an operator.

The auxiliary power unit 30 illustrated diagrammatically in Fig. 1 is powered by a turbine engine 31 which uses aircarft jet fuel.

The fuel is delivered from an aircraft fuel system through line 32 and fuel pump 35 to a fuel metering valve 33 which controls the fuel flow to the APU. A solenoid operated valve 34 affords an on-off control of the APU.

Fuel is delivered from pump 35 through line 36 to a gas chamber 37 in which the fuel is mixed with air from engine compressor 38 and burned to generate gas which drives the turbine 31. The APU is started by a battery powered motor (not shown) which drives the engine compressor 38. At the appropriate speed, fuel valve 34 and metering valve 33 are opened delivering fuel to the gas producer where it is ignited.

The turbine shaft 40 is connected through gearing indicated generally at 41 to drive an air compressor 42 and three-phase electrical generator 43. Air inlet ducts 45, 46 and 47 direct air to the gas generator compressor, compressor 38, compressor 42 and to a cooling fan 48 which circulates air through the APU compartment of the aircraft.

Air from compressor 42 is utilized in the aircraft environmental system, e.g., to circulate fresh air through the cabin, for main engine starting and for powering an emergency hydraulic pump. Other apparatus capable of being operated by compressed air may also be connected with the compressor.

Generator 43 provides electrical power to loads, as lights, controls, communication equipment and the like when the aircraft is on the ground. The APU may be operated when the aircraft is airborne and the generator 43 may be connected to supplement the electrical supply, as when one of the main generators is inoperative.

The APU controller 50 illustrated in block form in Figs. 2 and 3 is preferably a programmed microprocessor which responds to inputs from sensors in the APU and from the aircraft, providing outputs to APU actuator elements and to operation displays in the aircraft. The controller 50 is divided into two portions, a control processor 52 and protection processor 53. The control processor is in charge of the start-up and operation of the APU. The protection processor detects faults, orders APU shutdown and tests the system.

The protection processor 53 is connected through a multiplexer 54 with the APU sensors and actuator elements and the control processor inputs to conduct tests, as will appear. When a fault is detected, the identity of that fault is communicated from the protection processor 53 to a fault indicating memory 55. The serviceman can call up the recorded fault information on a visual fault display 56.

The APU and aircraft interconnection with the controller is shown in more detail in Fig.

3. APU sensor inputs to the controller 50 include: 61 - incoming fuel temperature Tf 62 - gas producer compressor, discharge pressure CDP 63, 63' - gas producer speed sensors NG #1, &num;2 (two speed sensors are used for added reliability) 64 - measured gas temperature - MGT in the gas producer 65, 65' - power turbine speed sensors Npt #1 and &num;2 67 - differential pressure AP in the load compressor 42 68 - inlet pressure PIN for the load compressor 69 - output pressure POUT for the load compressor 70 - low oil pressure - LOP - in the load compressor 71 - high oil temperature - HOT - in the load compressor 72 - low oil quantity - LOO - in the load compressor.

Outputs from the electronic controller 50 are connected with the following APU actuator elements: 75 - rotary actuator for fuel metering valve 33 sets the fuel flow to the APU. A valve position feedback 75 provides an input to electronic controller 50 completing a servo loop for the fuel valve 76 - start contactor provides electrical power to the start motor (not shown) 77 - igniter ignites the fuel in the gas producer 78 - surge valve actuator opens a bypass valve on the load compressor 42 to minimize a surge condition. Valve position feedback 79 completing a servo loop with actuator 78 for the surge valve 81 - inlet guide vane ac.tuator for the inlet guide vanes of the load compressor. Inlet guide vane position feedback 82 completes a servo loop for the inlet guide vane actuator.

Additional inputs to electronic controller 50 include: 85 - ambient temperature,Tamb 86 - Start/On command from the aircraft 87-AIR/GROUND signal from the aircraft 88 - a signal indicating the status of the main aircraft electrical generating system 89 - main engine start signal.

Other outputs of electronic controller 50 include the following display signals to the aircraft: 92 - load compressor unload 93-APU fault 94-APU shutdown 95 - APU ready to load 96 - gas temperature for a meter display.

The invention is concerned with the test system and its relation to the protection processor 53. Accordingly, the programming of control processor 52 will not be considered in detail. It is sufficient to understand that upon initiation of the APU operation the start motor is energized to drive engine compressor 38, the igniter is turned on and fuel valve 34 opened. These operations are controlled sequentially primarily on the basis of gas producer speed NG and time delays. For shutdown, the fuel valves are closed.

The operation of the pasive and active test systems will be described, primarily with refer- ence to the program flow diagrams, Figs.

4-20, which represent the protection and test programs performed by protection processor 53.

A principal feature of the invention is the provision of passive and active test systems with a memory which records faulty components and the causes of shutdown for subsequent display. The operation of these test systems is illustrated diagrammatically in Figs.

4 and 5.

The passive test, Fig. 4, functions continually during operation of the auxiliary power unit. At block 100 passive identification of nonshutdown faults is conducted. Any faults that are noted are stored at block 101 in the nonvolatile memory 55. In the event of a shutdown, the passive system identifies the cause at block 102. If a shutdown is indicated at block 103, the pertinent symptoms are identified at block 104 and recorded in the memory 55 at block 105. If shutdown is not indicated, the program returns from block 103 to block 100 and continues.

The active test is manually initiated following an APU shutdown as indicated at block 107, Fig. 5. At block 108 controller 50, its various inputs, the APU sensors and the APU actuating element, all shown in Fig. 3, are checked. At block 109 a determination is made whether the controller is functioning properly. If it is, a check is made at block 110 of the aircraft inputs and APU sensor signals.

The results of this check and of previous shutdown causes is displayed at 111. If a unit of the APU which is replaceable on the flight line (LRU) can be isolated, this information is displayed at block 112. If the controller is determined to be inoperative, block 109, this information and the causes of previous shutdowns are displayed at block 113, followed by a display that the controller has failed, block 114.

The overall protective function flow chart is shown in Fig. 6. Following power up and initialization of the APU at block 11 8, fault checks are made at block 119 and operation of the passive test system commences at block 120. The active test system is checked and the memory cleared at block 121.

Fig. 7 shows in more detail the steps included in the protective functions. Following power up block 124 and initialization of the system block 125 (see Fig. 8 below), a determination is made at block 126 whether the gas producer speed NG is below or above 8% of operating speed. If the speed is less than 8%, the system status is checked at block 127 (see Fig. 9 below). If the gas producer speed is greater than 8%, the passive test system, block 128, is made operative.

The initialization procedure, Fig. 8, precedes the startup of operation of the APU. All system outputs are disabled at block 130.

Then all data and program flags are reset at block 131. The watchdog timer WTD for the controller is tested at 132 and a determination is made whether it is operating properly at block 133. WTD cycles periodically. If a system failure prevents its operation, the APU is shutdown, block 134. If the watchdog timer operates properly, the controller counters are reset or initialized at 135. The frequency to digital F/D signal converters which operate with the speed sensors 63, 63' and 65, 65' are started at block 136. The system clock is started at block 137 and the system interrupts are enabled at block 138. This completes the initialization procedures.

The system status program, block 127, Fig.7, is illustrated in Fig. 9. After determining the status of manual switches at block 142, the BITE button is checked at block 143, and if it has been actuated the active test system is initiated at block 144, see Fig.

16. If the BITE button is not actuated, the clear button is checked and if it is actuated the memory is cleared at block 146, see Fig.

20. If there has been a momentary loss of DC power, the check at block 147 will shut the APU down, block 148. The system can be restarted only after manual actuation of the ON/OFF switch.

Figs. 10, 11 and 12 illustrate the tests performed to detect the occurrence of a fault.

In Fig. 10, at block 150 the analog/digital controller inputs are checked. These include, for example, temperature and pressure sensors in the APU. At block 151 the status of input is checked. At block 152, control functions of the control processor 52 are obtained through the handshake connection, Fig. 2. At block 153 checks are made of the speed from the various APU speed sensors. At block 154 a fire condition is checked; and at block 155 the position of the inlet door is examined. At block 156 the engine compressor discharge pressure is checked. Block 157 examines the load compressor oil pressure while block 158 checks the load compressor oil temperature.

In each of blocks 154-158, if a fault condition is detected, the APU is shut down at block 160.

The ambient temperature is checked at 161. If the reading is not reasonable, a fault identification is stored at block 162, see Fig.

14. Similarly, fuel temperature Tf is checked at block 163. Blocks 164, 165, the outputs of two temperature sensors for the measured gas temperature, MGT, are checked. If one is out of the reasonable range, the fault information is stored in the memory at block 166. if both temperature sensor outputs are faulty, the APU is shut down at block 160.

The fault program continues in Fig. 11. At block 175 the load compressor oil pressure is checked. If it is excessive, the load compressor inhibit flag is set at 171 and the fault information recorded in the memory at block 1 72. If the load compressor oil pressure is low at block 173, the APU is shut down at block 174. if the oil pressure is not low, a time delay is provided by blocks 175, 176 and 177. At block 178 the APU is enabled, with the load compressor unloaded. Generator 43 is driven to supply electrical loads.

The check of faults continues in Fig. 12. If the start flag is set at block 180, the ready to load (load compressor) is removed and a shutdown command given at block 181. The unload flag is set at block 182 and load compressor protective steps taken at block 183. The system proceeds to shut down at block 184 and also checks the engine compressor surge valve at block 185.

If the start flag was not set at block 180, and the ready to load flag is set at block 186, the ready to load indication is given to the aircraft at block 187. At block 188 the APU is enabled and the program proceeds to load compressor protection block 183. Again, if the compressor is ready to operate, shutdown 184 is bypassed and the program continues as will be described below. If the RTL flag is not set at block 186, power turbine speed is checked at 190. If the speed is below 95% the program proceeds to blocks 181, 182 and 183 as described above. If the count is complete, the program continues through block 192 to block 187. If the count is incomplete, the program continues to block 181.

Assuming that the load compressor protection checks are favorable, a series of checks are conducted to determine whether the APU will be shut down or will continue to operate.

These include loss of DC at block 194 and excessive gas measured gas temperature at block 195, low oil pressure at block 196, sequencying failute at block 197, normal shutdown procedure, block 198, shutdown circuit failure at block 199. Failure of any of these tests as the program proceeds to shut down at block 184.

Fig. 13 illustrates the shutdown sequence.

The condition of the fuel metering valve inhibit flag indicates whether the shutdown is normal or fault caused. It is checked at block 202. If it is set, all outputs of the APU except that to the fuel metering valve are disabled. If the inhibit flag is not set, a fault indication is provided to the aircraft and all APU outputs are disabled in block 205. At block 206 various APU sensor circuits are disabled, including low oil pressure, sequency failure, underspeed and flameout. At block 207 if the shutdown enable flag is set, the gas producer speed is checked at block 208. If it is less than 8% of rated speed, a signal that the APU is shut down is given to the aircraft, block 209. The program continues to block 210 which checks the absence of a start command and gas producer speed less than 8%.It both conditions are not present, the program continues to block 211 for another cycle of the watchdog timer. If both conditions are present, block 212 stores shut down system information in the memory. Power to the controller is removed at block 213. At block 214 if the power has been properly removed, the program proceeds to block 215 to wait for the next startup command. If power is not properly removed, block 216 indicates a fault in the aircraft systems which is entered in the memory at block 217.

The fault store sequence for the memory is illustrated in Fig. 14. Fault information is temporarily stored in a register, block 220. At block 221 it is determined whether the fault is serious enough to cause a shutdown of the APU. If it is not, block 222 selects a memory pointer number 2 which is incremented in block 223 and the fault information stored at block 224. If the fault caused a shutdown, pointer No. 1 is selected at block 225, incremented at 226 and the fault identification stored at the appropriate location, block 224.

An outline of the passive test is provided by the diagram of Fig. 15. Internal voltage checks are made at block 227. If any voltage check is bad, the APU is shut down, block 228, Fig. 1 3. If the internal voltage checks are good, a series of other passive checks are made. At block 229, the oil quantity in the load compressor is checked. If it is low, the procedure preceeds to a time delay 230 and when it is complete as determined at block 231, a low oil quantity output signal is given to the aircraft, block 232.

Correlation of the control and position feedback signals for the fuel metering valve 33 is checked at block 234. If they do not agree, the program proceeds to shut down at block 228. If they do agree, the next check is on the correlation of the surge valve actuator and position feedback. Here if they do not agree, the fault information is stored at 236. The compressor inlet guide vane actuator and feedback position are checked at 237 and if not in agreement, the fault information is stored at 238. Control functions of the control processor 52 which do not cause a shutdown, are checked at 239. Faults found are stored at 240. The passive test repeats so long as the APU is operative.

The active BITE system is enabled with APU shutdown, and is activated by operator control of a test switch, Fig. 16. System interrupts are disabled at clock 225 so that the test program can be carried out. At block 246 the light emitting diodes of the visual display are all turned on so that the display may be checked by the operator. The message "test in progress" is then displayed, block 247, while the active test continues.

Control functions, the operation of the control processor 52, are checked at block 248 (Fig.

18). Any failure is communicated to and presented by display 56, followed by the legend "Controller Failure", blocks 249, 250. Following a check of the control functions, the protective functions of protection processor 53 are checked, block 251 (Fig. 17). A failure is similarly indicated by the displays of blocks 249, 250.

Following check of the control and protective functions, block 252 (Fig 19) isolates the line replaceable unit (LRU) or other component of the APU which has failed. At block 253, 254, the present and previous shutdown causes are displayed. A "Test Complete" display completes the process, block 255.

A check of protective functions in protection processor 53 is illustration in Fig. 17. At block 260 the inputs to the protection processor 53 are stimulated successively and the resulting input signals are read at block 261.

If there is disagreement, the conclusion is that the controller has failed, block 262 and this information is displayed at block 263. If the inputs and the input signals are in agreement, block 264 detects unit or aircraft harness failures which are stored at block 265. Output commands from the protection processor are injected at block 266 and read with an analog/digital converter at 267. Again, a failure in the outputs indicates that the controller has failed and this information is transmitted to block 262 and displayed at 263. If the out puts are appropriate, block 268 detects aircraft harness problems in the output circuits.

Information regarding a failed replaceable unit is stored at 269. Finally the software of the protection processor is checked at block 270 by stimulating program modules separately.

The outputs actuated thereby are also checked. A failure is detected as a failed controller, block 262. In the absence of failure, block 271 determines that the protective functions are operating.

In Fig. 18 the control functions of control processor 52 are checked by stimulating the inputs at block 275. At block 276 the inputs are checked using the handshake connection with the control processor to interrogate the related control functions. A failure of any of these checks indicates that the controller has failed, block 277, and this information is displayed at 278. If the checks indicate the control functions and inputs are satisfactory, block 279 checks for a failed APU replaceable unit or an aircraft harness problem. Failure information is stored at 280.

Control function outputs are provided from the protection processor 53 to control processor 52 through the handshake connection, at block 281. If the signals from the analog to digital converter are not correct, a control processor failure is indicated at 282 and communicated though block 277 to display 278.

A failed APU unit associated with the output of the controller processsors, or an aircraft harness failure is detected at block 283 and recorded at block 284. The control processor functions are checked through the handshake connection at block 285. A failure is displayed at block 278. If the controller functions properly, this is verified at block 286.

Figs. 21, 22 and 23 illustrate the typical circuits for checking the APU actuator elements and the processor input circuits. In Fig.

21 protection processor 53 actuates a driver 290 in the output of the control processor 52.

The driver is connected through circuit 291 with an APU actuator element 293 and a power supply. A voltage sensing circuit 294 is connected across the driver and a current sensing circuit 295 is connected in series therewith. Outputs of the sensing circuits are connected through a multiplexer 296 with a protection processor input and an analog to digital converter. The voltage and current conditions in the circuit are analyzed to determine whether the actuator element and the interconnecting circuit 291 and driver 290 are operating properly. With the voltage and current information, the nature of a fault in the driver, actuator element or interconnecting circuit can be determined.

In Fig. 22, the circuit for stimulating a speed sensor input is illustrated. The signal from an oscillator 300 is connected through a switch 301 controlled by the protection processor to a frequency/digital converter 302 in the control processor 303. Other processor input circuits are provided with a suitable signal, as an analog signal, from the protection processor 53 through a demultiplexer 305 having outputs connected with the various input circuits 306 of control processor 52. Similar circuits may be used to test the inputs of the protection processor 53.

In Fig. 19, the program for isolating the failed replaceable unit of the APU is illustrated, block 252, Fig. 16. At block 310, information regarding APU shutdowns is derived from memory 55, Fig. 2. If this information identifies the unit which has failed, this situation is determined at block 311 and the appropriate information displayed at block 312. If the failed unit is not indicated directly by the shutdown information in the memory, block 312 analyzes the various information available to determine the failed unit. At block 313, if the information available identifies the failed unit, this is displayed at block 312. If the unit cannot be isolated, then the symptoms of the system which occurred at shutdown are selected by block 314 and displayed along with aircraft harness problems at block 315.

Fig. 20 is the flow diagram for clearing the memory, block 121, Fig. 6. At block 318, zeros are written in all memory location. Block 319 then initiates a display "NVM Cleared".

The display is maintained so long as the clear button is depressed, block 320.

Nonvolatile memory 55 is operated to retain data when the power is removed. The memory action depends on a trapped injected charge and each bit of storage is a dual transistor pair. Ones and zeros are entered by forcing one of each pair to a high impedance state and the other to a low impedance state.

Inputs to the memory are isolated during power up and power down of the APU so that the stored data is not affected by transients.

Claims (12)

1. A dynamic machine comprising sensors for providing condition signals respresentative of operating conditions of the machine, a programmed operating controller responsive to the condition signals for generating control signals for the operation and shut down of the machine on command or on occurrence of a fault condition, actuator elements responsive to the control signals to operate or shut down the machine, and a test system for identifying machine faults, the rest system comprising:: a passive test means operative during operation of the machine for monitoring the sensors to detect abnormal sensed operating conditions, an active test means actuable when the machine is shut down to detect the cause of machine shutdown, a memory connected with the passive and active test means to record the identity of sensors indicating abnormal sensed operating conditions and the detected causes of machine shutdown, and a visual display connected with the memory of displaying the identities of those sensors and the cause of machine shutdown.

2. A machine according to claim 1, wherein the active test means is effective to determine whether the cause of machine shutdown is a fault condition in the operating controller, in one of the sensors or the circuit connecting that sensor to the operating controller, or in an actuator element.

3. A machine according to claim 1, wherein the memory is a nonvolatile digital memory.

4. A machine according to any preceding claim, wherein the active test system includes means for applying operating potentials to the actuator elements, and means for detecting the resulting current and voltage conditions of the actuator element circuits, thereby to detect and identify any faulty circuits.

5. A machine according to any preceding claim, wherein the active test system includes means for applying stimulating signals, representing the condition signals, to the operating controller and means for monitoring the resulting control signal outputs of the operating controller, thereby to detect and identify a fault in the operating controller.

6. A machine according to claim 5, wherein the programmed operating controller has a control function and a protective function and the active test system is effective to check both such functions, to detect and identify a fault in either.

7. A machine according to claim 5 or claim 6, wherein the active test system includes means for checking the programme of the operating controller.

8. A machine according to any preceding claim, wherein the active test system is manually operable.

9. A machine according to any preceding claim, wherein the visual display is manually actuable.

10. A machine according to any preceding claim, wherein the memory records the detected causes of a succession of machine shutdowns.

11. A machine according to claim 10, wherein the memory records the detected causes of the last three machine shutdowns due to faults.

12. An aircraft auxiliary power system having a test system for identifying machine faults, substantially as described herein with reference to the drawings.