WO2017125694A1

WO2017125694A1 - Device for overspeed protection of an aircraft engine

Info

Publication number: WO2017125694A1
Application number: PCT/FR2017/050129
Authority: WO
Inventors: Rafaël SAMSON; Antoine MOUTAUX
Original assignee: Safran Helicopter Engines
Priority date: 2016-01-22
Filing date: 2017-01-20
Publication date: 2017-07-27
Also published as: FR3047041A1; FR3047041B1

Abstract

The invention relates to a device for overspeed protection of an aircraft engine, said engine comprising a fuel-supply system (10), a logic controller (ECA) also being configured to open or close the supply system (10), the protection device comprising: a first line (LA) configured to supply the logic controller (ECA); a second line (LB) configured to supply the logic controller (ECA); a first surveillance channel (VA) configured to output a first command (SVA) as a function of the speed of the engine, and a first locking command (KOA.SVA) as a function of the speed of the engine and a failure of the first surveillance channel; a second surveillance channel (VB) configured to output a second command (SVB) as a function of the speed of the engine, and a second locking command (KOB.SVB) as a function of the speed of the engine and a failure of the second surveillance channel; the first line and/or the second line (LA, LB) for supplying the logic controller (ECA) being configured to supply a logic controller (ECA) when the command to lock one and/or the other of the supply lines (LA, LB) is inactive (KOx.SVx ='0'), i.e. one of the surveillance channels is failing and/or detects an overspeed and/or when the command which is a function of the speed of the engine is active (SVx='1'), i.e. the engine is in overspeed.

Description

Device for overspeed protection of an engine of an aircraft

GENERAL TECHNICAL FIELD

The invention relates to the regulation of aircraft engines and more particularly concerns their protection against overspeeds.

STATE OF THE ART

In an aircraft engine, an excessive rotational speed of a shaft can have serious consequences, namely, in particular, cause the bursting of rotors disks mounted on the shaft. Also, such an engine is usually equipped with an overspeed protection device that receives information representative of the rotational speed of a motor shaft and controls a cut, a regulation or a limitation of the fuel supply of the engine. when, for example, this speed of rotation exceeds a predetermined threshold or when an acceleration, a function of this speed exceeds a threshold.

The overspeed safety function must be ensured by a control system and its computer integrated within the engine bay. This calculator is bi-channel and is split into two separate boxes around the engine.

However, the engine zone has environmental levels that are relatively more severe than the current calculator locations (for example the locations in the aircraft hold dedicated to the engine control computers).

The electronic overspeed protection must therefore be compatible with such a topology while having the least possible impact on the design of the computer.

PRESENTATION OF THE INVENTION

An object of the invention is to propose a solution that allows:

to provide a protection function against overspeed: sensor architecture, calculator and electro-shut-off valve;

Present a simple interface with the computer: use of discrete signals for the transmission of commands;

- Impact in low manner signals passing between the channels of the computer: the invention has no inter-channel signal dedicated to overspeed protection;

Limit the power dissipation of the computer to perform this overspeed protection function: the power circuit is external to the computer.

For this purpose, the invention proposes an overspeed protection device for an aircraft engine, said engine comprising a fuel supply system, a device for logic controller being further configured to open or close the power system, the protection device comprising:

a first line configured to supply the logic control device;

a second line configured to supply the logic control device;

a first monitoring channel configured to deliver a first command depending on the speed of the engine and a first lock command depending on the speed of the engine and a failure of the first monitoring channel;

a second monitoring channel configured to deliver a second command depending on the speed of the engine and a second locking command depending on the speed of the engine and a failure of the second monitoring channel;

the first line and / or the second power line of the logic controller being configured to power a logic controller whenever the lock command of one and / or the other of the lines of power supply is inactive, that is to say that one of the monitoring channels has a fault or detects an overspeed and that the control function of the engine speed is active that is to say that the engine has an overspeed .

The invention is advantageously completed by the following features, taken alone or in any of their technically possible combination:

each supply line comprises a voltage source connected in series with the logic controller and a ground,

each supply line comprises, in series, between the voltage source and the logic controller a normally open switch and a normally closed switch,

each supply line comprises, in series between the ground and the logic controller, a normally open switch,

the normally open switches are controlled by the motor speed function control and the normally closed switches by the interlock control,

each monitoring channel comprises a speed sensor configured to measure an engine speed converted to a first command and a second command respectively having:

a high state for an overspeed of the engine, for example for a speed of the engine V engine such that V motor> Vseuill, with Vseuill a threshold characteristic of an overspeed; - A low state otherwise, for example for a motor speed such that 0 <Vmoteur <Vseuill.

each monitoring channel comprises an engine failure detector configured to, if the overspeed protection device has a fault, deliver a discrete signal having a high state if the engine has a failure, a low state otherwise.

The invention also relates to an overspeed protection assembly of an aircraft engine, said engine comprising a fuel supply system, the assembly comprising a logic control device configured to open or close the fuel system and a overspeed protection device according to the invention.

And the invention also relates to an aircraft comprising a set of protections according to the invention, in which the monitoring channels are integrated in one or more electronic engine control computer (s) or in one or more electronic box (s) ( s) dedicated to the protection of the engine. Aircraft in which, in a complementary manner, the supply lines are arranged: in a dedicated housing in the airplane zone, preferably in a so-called out-of-fire zone; or in a dedicated housing in the engine zone; or in the electronic box (es) incorporating the monitoring channels.

The advantages of the invention are manifold.

The invention makes it possible to protect the engine in an available and safe manner against overspeeds.

The use of a discrete and electrical logic makes it possible to simplify the operations of control / control of the computer and this contrary to the current architectures which make use of too many security and redundancies which make the systems very complex.

The invention makes it possible to limit the overall complexity of the protection device.

The concept architecture also segregates monitoring channels that generate controls and power paths (power lines). This aspect is beneficial to the calculator: its dissipation, its complexity and its cost are diminished. PRESENTATION OF FIGURES

Other features, objects and advantages of the invention will emerge from the description which follows, which is purely illustrative and nonlimiting, and which should be read with reference to the appended drawings in which:

FIG. 1 illustrates a general diagram of a protection device according to the invention; FIG. 2 illustrates a first state of a protection device according to the invention;

FIG. 3 illustrates a second state of a protection device according to the invention;

FIG. 4 illustrates a third state of a protection device according to the invention;

FIGS. 5a to 5c schematically illustrate arrangements of a device according to the invention.

In all the figures, similar elements bear identical references.

DETAILED DESCRIPTION OF THE INVENTION

FIG. 1 illustrates an overspeed protection device for an engine of an aircraft according to one embodiment of the invention.

Such a device interfaces with an electronic control computer (FADEC) with two separate channels.

The engine (not shown) of the aircraft comprises, for example, a fuel supply line which can be closed or limited by the overspeed protection device. In order to be able to open or close the power supply 10 the motor comprises a logic control device such as an electro-valve ECA. As is known in the art, this electro-valve ECA moves from an "open" state (open supply line) to a "closed" state (closed supply line) only if it is energized.

The overspeed protection device comprises a first power supply line LA of the logic control device ECA; and a second LB supply node of the ECA logic controller.

Thus, the logic control device ECA can be powered according to two separate supply lines LA, LB under certain conditions which will be described later.

One purpose of the protection device is to supply the logic controller

ECA in case of detection of an overspeed of the engine and / or in the event of a failure of the protection device.

As such, the protection device comprises a first motor monitoring channel VA configured to deliver a first command SVA function of the engine speed and a first KOA lock command. VAS depending on the speed of the motor and a failure of the monitoring channel concerned.

Similarly, the protection device comprises a second monitoring channel VB configured to deliver a second SVB command based on the engine speed and a second KOB lock command. SVB depending on the speed of the motor and a failure of the monitoring channel concerned. It is considered that the lock command is inactive when KOx. SVx = '0' with x = A or B ie the first channel and / or the second channel has detected failure and / or overspeed. Thus, the protection device of a channel is inhibited by an opposite monitoring channel if the latter does not detect overspeed and if it does not go back to failure.

To deliver these commands, each monitoring channel VA, VB comprises on the one hand a fault detector PA, PB of the control / command over-speed protection (sensor, electronics) and on the other hand a speed sensor CA, CB configured to measure an engine speed. A speed sensor is of the reluctance or hall effect sensor type.

Each fault detector PA, PB delivers a discrete signal KOA, KOB which has a high state () if the computer or the logic output has a failure, a low state () otherwise.

In addition, each fault detector makes it possible to put back one or more logical information (one here) in the event of a proven failure of the control / command system (computer, sensor or logic output).

Each speed sensor CA, CB makes it possible to measure the speed of rotation of the rotating parts of the motor and respectively delivers, respectively, speed information which is converted (not detailed) into a first command SVA and a second command SVB having:

an active state ^λ under the conditions of overspeed, for example for a speed of the engine Vmotor such that Vmotor> Vseuill, with Vseuill a threshold characteristic of an overspeed;

an inactive state ^λ 0 'outside the overspeed conditions, for example for a motor speed such that 0 <Vmotor <Vseuill.

Thus, the first line and / or the second line LA, LB for supplying the logic controller ECA are configured to supply the logic control device ECA as soon as the lock control of one and / or either of the LA, LB power supply lines is inactive KOx. SVx = '0', ie one of the monitoring channels has a fault or an overspeed and the control function of the motor speed is active SVx = T, i.e. that the engine has an overspeed.

As illustrated in FIG. 1, each supply line supplies the logic control device ECA between two points common to the two lines.

Each line extends in parallel to the first common point and comprises in series a voltage source + VB, + VA delivering for example a voltage of + 28V, a switch 12, 14 normally open (that is to say that it is open without any order) a switch 12, 13 normally closed (that is to say it is closed without any command).

Furthermore, each line extends in parallel to the second common point and comprises a ground line GNDA, GNDB and a switch 15, 16 normally open.

Switches II, 12, 13, 14, 15, 16 are activated (they change state with respect to their state without control or idle) when the lock command is active or an overspeed is detected. Thus, the overspeed protection device is activated in the following cases:

Overspeed detected on both surveillance channels; or

- Overspeed detected on the first monitoring channel and failure detected on the second monitoring channel; or

Overspeed detected on the second monitoring channel and failure detected on the first monitoring channel.

It is noted that the serialization at the power source of two switches (switches 12, 15 of the first line and switches 14, 16 of the second line with the same control logic) performing the same logic function allows to protect itself from short-circuit cases that can supply the ECA logic controller.

The activation logic of the protection device can be summarized below under the following equation, where SV is the state of ECA 00 'open, ^λ 1' closed):

SV = (VWA + SVB). (SVB (KOB.SV) + SVB (SV) SV = (SVB + SVB) (SVB (KOB + SVB) + SVB (KOA + SVA))

SV = (VWA + SVB). (SVA. (KOB + SVB) + SVB. (KOA + VAS))

SV = SVA.KOB SVA.SVB + + + SVB.KOA SVA.SVB

SV = + SVA.SVB SVA.KOB + SVB.KOA

The truth table is as follows:

FIG. 2 shows a state of the protection device when there is no breakdown and when there is no overspeed.

In this case the detection system is in nominal operating state and no overspeed is detected, the system is in the following state:

The first and second commands depending on the speed SVA and SVB are inactive

The lock commands are active: no failure and no overspeed. All switches are open, the ECA logic controller is not powered, the protection device is thus inactive, the power supply system is open.

FIG. 3 shows a state of the protection device in the event of overspeed and no breakdown.

In that case :

the first and second commands depending on the speed SVA and SVB are active, the overspeed detection is ensured on both channels;

The lock commands are inactive: there is no fault and an overspeed is detected (SV =, KÔ SV = 0).

All switches are closed, the ECA logic controller is powered through the two power lines, so the protection device is active, the power system is closed.

FIG. 4 shows a state of the protection device when a fault is detected (here on the first monitoring channel VA) and there is an overspeed.

Since there is a fault on the first monitoring channel VA, the first control SVA is undetermined, the switches 14 and 15 can be opened or closed (note X in Figure 4).

In that case : The first KOA lock command. SVA is inactive and the switch controlled by this command is closed II;

The first command SVA function of the speed of the engine is undetermined, the switches controlled by this first command are either open or closed;

There is an overspeed and no failure on the second monitoring channel so the second command SVB function of the speed of the motor is active, the switches controlled by this second command are closed.

Thus, because of having two power supply lines, the failure of a monitoring channel does not affect the protection device that is active here, the logic control device ECA is powered via the second power supply line, the power supply system is closed.

The architecture presented above can be arranged in several ways in an aircraft, knowing that the monitoring channels can be integrated:

in the engine control electronic computer,

or in a computer dedicated to monitoring.

The supply lines can be located in several places:

FIG. 5a describes an installation where the supply lines are arranged in a motor zone

FIG. 5b describes an installation where the supply lines are arranged in the airplane zone (outside the fire zone)

Figure 5c describes an installation where power lines are an integral part of the monitoring channels. This arrangement makes it possible to reduce the sensitivity to lightning or electromagnetic disturbances.

Claims

claims

An overspeed protection device of an aircraft engine, said engine comprising a fuel supply system (10), a logic control device (ECA) being further configured to open or close the system (10) of the engine. power supply, the protection device comprising:

a first line (LA) configured to supply the logic control device (ECA);

a second line (LB) configured to supply the logic control device (ECA);

a first monitoring channel (VA) configured to deliver a first command (SVA) according to the speed of the engine and a first lock command (KOA SVA) according to the speed of the engine and a failure of the first lane; monitoring ;

a second monitoring channel (VB) configured to deliver a second command (SVB) according to the speed of the engine and a second lock command (KOB SVB) according to the speed of the engine and a failure of the second channel monitoring ;

the first line and / or the second line (LA, LB) for supplying the logic controller (ECA) being configured to power a logic controller (ECA) when the latch command of the one and / or the other of the supply lines (LA, LB) is inactive (KÔ. SV = Ό '), that is to say that one of the monitoring channels has a breakdown or detects an overspeed and that the control function of the speed of the motor is active (SVx = T) that is to say that the motor has an overspeed.

The device of claim 1, wherein each supply line (LA, LB) comprises a voltage source (+ VA, + VB) connected in series with the logic controller (ECA) and a ground (GNDA, GNBD).

The device according to claim 2, wherein each supply line (LA, LB) comprises, in series, between the voltage source and the logic controller (ECA) a normally open switch (12, 14) and a normally closed switch (II, 13).

4. Device according to one of claims 2 to 3, wherein each supply line (LA, LB) comprises, in series between the ground (GNDA, GNDB) and the logic control device (ECA) a normally open switch (15, 16).

5. Device according to one of claims 3 to 4, wherein the normally open switches are controlled by the control function of the motor speed and switches normally closed by the lock control.

6. Device according to one of the preceding claims, wherein each monitoring channel (VA, VB) comprises a speed sensor (CA, CB) configured to measure a converted engine speed in a first control (SVA) and a second order (SVB) presenting:

a high state 0) for an overspeed of the engine for example for a motor speed V motor such that V motor> Vseuill, with Vseuill a threshold characteristic of an overspeed;

- a low state 00 ') if not for example for a motor speed such that 0 <Vmoteur <Vseuill.

7. Device according to one of the preceding claims, wherein each monitoring channel (VA, VB) comprises an engine failure detector configured to, if the overspeed protection device has a failure, deliver a discrete signal (KOA, KOB ) with a high state () if the motor has a failure, a low state (00 ') otherwise.

An overspeed protection assembly of an aircraft engine, said engine comprising a fuel supply system (10), the assembly comprising a logic control device (ECA) configured to open or close the system (10). power supply and an overspeed protection device according to one of the preceding claims.

An aircraft comprising a protection assembly according to claim 8, wherein the monitoring channels are integrated:

- in one or more electronic engine control computer (s);

- in one or more electronic housing (s) dedicated to motor protection.

An aircraft according to claim 9, wherein the supply lines are arranged:

- In a dedicated box in the aircraft zone, preferably in a so-called out-of-fire zone;

- or in a dedicated box in the engine zone;

- or in the electronic box (es) incorporating the monitoring channels.