The invention relates to aircraft engine control devices of the turbojet type. It relates more particularly to devices implementing redundant calculations based on measurements from sensors configured to measure engine parameters.

STATE OF THE ART

A turbojet engine is conventionally equipped with a control device which also provides protection against events whose consequences are hazardous (dreaded) or catastrophic, such as cases of engine overspeed. Thus, one and the same device implements these two functions.

Such a control device generally comprises two identical channels which make it possible to redundant the acquisition of parameters and the setpoint calculation to control one or more actuator(s).

The channels are ideally independent from each other but often they exchange information in order to allow a consolidation of the measurements.

The objective of the consolidation is to ensure that the two channels do the same calculations at the same time in order to ensure the warm redundancy of the control device: one channel is active and controls actuators and one channel is passive and is ready at any time to become active in the event of a failure occurring on the system. Indeed, a failure on a track can lead to hazardous or catastrophic events.

In the case where the control of the motor and the protection against these events are ensured by the same device, it is necessary to provide monitoring of the processors carrying out the calculations to ensure that they are not faulty. Indeed, a failure of the processor can trigger an overspeed start of the engine.

Such monitoring is implemented by comparing the results of the calculations of each of the channels, a so-called active channel commands actuating them (for example the variable geometries and/or fuel meters of the engine). In the event of a discrepancy between the calculations, the passive channel is deactivated and the controller becomes single channel.

A problem is that by comparing only the results of the calculations on each of the channels, it is not possible to discriminate a processor failure or an exchange problem between the channels.

In fact, a break in the inter-channel link, even fleeting, stops mutual monitoring and makes it necessary to secure the system because this can generate a difference in calculations. Securing consists in isolating the passive channel for the rest of the mission, thus penalizing the availability of redundancy for the mission and the availability of computers in maintenance to ensure the search for problems.

As a result, the discarded channel may be the healthy channel because during a communication problem, it is not known whether the error is located on the transmitting or receiving channel. If the remaining channel is faulty and this fault is detectable by hardware self-tests, it ends up also being isolated, thus leading to the motor shutting down. This type of behavior therefore penalizes the in-flight shutdown rate of the engine.

PRESENTATION OF THE INVENTION

The object of the invention therefore consists in making the system more robust (that is to say resistant) to inter-channel link losses in order to make it possible to locate the anomalies in a sure manner and thus to ensure that only the faulty channel isolated.

To this end, the invention proposes, according to a first aspect, a motor control device comprising a first control channel and a second control channel, each control channel comprising a first sensor and a second sensor each configured to supply respectively a first measurement and a second measurement at each channel, each of the channels comprising an active or passive state defining an active channel or a passive channel, the active channel being intended to drive at least one actuator of the motor while the passive channel is intended to take over on the active channel in the event of failure of the latter, the device being such that each channel comprises:

- a measurement consolidation unit, each receiving as input the measurements from the two channels via at least one inter-channel communication link so as to obtain a consolidation parameter,

- a processing unit for at least one command of at least one motor actuator, the device comprising:

- a nominal operation according to which the calculation unit of each channel calculates the command according to the consolidation parameter and the command calculated at the previous calculation instant, the actuator being controlled by the active channel,

- degraded operation, in the event of a break in the communication link, according to which the calculation unit of the passive channel calculates the command according to the command calculated by the active channel at the previous calculation time.

The invention is advantageously completed by the following characteristics, taken alone or in any of their technically possible combination

- each channel further comprises a process monitoring unit configured to detect a difference in the value of the command calculated by the two channels

- the process monitoring unit is configured to disable

temporarily or permanently the passive channel in the event that a difference in the value of the command calculated by the two channels is detected.

- the consolidation unit performs an average of the values ​​measured by the two channels.

- the processing unit of each channel performs a calculation requiring at least one result calculated by itself at a previous time step.

- the processing unit of each channel performs a calculation requiring at least one intermediate result calculated by itself at a previous calculation step.

- the degraded operating mode is activated for a duration corresponding to the duration of the cut in the at least one inter-channel communication link.

- the degraded operating mode is activated for a duration corresponding to the time between the calculation of an intermediate value and the furthest instant of time during which a calculation uses this value as initial data.

- the degraded operating mode is activated for a predetermined duration, estimated by communication link failure tests.

- the process monitoring unit is configured to definitively deactivate the passive channel in the event that a difference in the value of the command calculated by the two channels is detected immediately after the end of the degraded operating mode.

- when one of the two channels is waiting to receive measurements from the other channel, said other channel performs in advance the next planned calculations not requiring a measurement from the second channel which it does not have at this time . The advantages of the invention are multiple.

The availability of redundancy by increasing the robustness of the link to transient failures. This also helps to improve the availability of protection against catastrophic and hazardous risks.

The availability of computers in maintenance by facilitating the search for faults as well as by reducing the proportion of computers with unconfirmed faults or computers wrongly removed.

The in-flight engine shutdown rate linked to a failure of one of the two channels of the control device.

PRESENTATION OF FIGURES

Other characteristics, objects and advantages of the invention will emerge from the description which follows, which is purely illustrative and not limiting, and which must be read in conjunction with the appended drawings in which:

- Figure 1 illustrates an example of a motor control device comprising two channels according to one embodiment of the invention;

- Figure 2 illustrates an embodiment of a processing unit of the control device according to the invention;

- Figures 3 to 5 schematically illustrate processing steps implemented in the control device.

In all of the figures, similar elements bear identical references.

DETAILED DESCRIPTION OF THE INVENTION

There is illustrated in Figure 1 a motor control device according to one embodiment of the invention. The engine is preferably that of an aircraft such as a turbomachine.

The control device comprises two control channels: a first control channel V1 and a second control channel V2.

Each control channel V1, V2 makes it possible to control at least one actuator ACT according to a command or calculated instruction C v1 , C v2 . In operation a

only of the two channels drives the ACT actuator, this is the active channel. The other channel is considered as passive and makes it possible to take over on the active channel in the event of failure of said active channel.

Each control channel V1, V2 receives as input quantities A, B to be measured from which the control of the actuator ACT is calculated. These quantities are for example: temperature, etc.

In the example illustrated in FIG. 1, each channel each receives two different quantities A, B to be measured, each channel measuring the same quantities. In particular, for each channel V1 , V2 these quantities are measured by different or identical sensors:

- For the first channel V1: a first measurement MAV1 of the first quantity A is measured by a first sensor CAV1 and a second measurement MBV1 of a second quantity B is measured by a second sensor CBV1

- For the second channel V2: a first measurement MAV2 of the first quantity A is measured by a first sensor CAV2 and a second measurement MBV2 of the second quantity B is measured by a second sensor CBV2.

The sensors used depend on the quantities measured: a temperature sensor for the temperature, etc.

In order to determine a command C v1 , C v2 each channel will carry out a certain number of processing operations on the measurements carried out.

In particular, each channel comprises a consolidation unit UC1, UC2 making it possible to unify the data measured by the sensors of each of the two channels by a process of consolidation, for example by performing an average of the values ​​measured by the sensors of each of the two ways.

As will have been understood, there is an exchange of data between the channels V1, V2 by means of an inter-channel communication link LCOM.

For each channel, the result of the consolidation is then used by a processing unit UT1, UT2 which will calculate the setpoints C v1 , C v2 for the actuator ACT.

Advantageously, the processing unit UT1, UT2 can use as input data the commands calculated at one or more times of previous calculations as well as intermediate results calculated at one or more times of previous calculations. In this case, the processing unit may comprise a first calculation module MOD1 and a second calculation module MOD2: one of them performs the first part of the calculations, and the second performs the calculations

requiring the intermediate calculations carried out previously (see figure 2). The data from the first module are recovered by the second module with a delay, typically from 1 to 4 calculation instants.

In nominal operation, the setpoints C v1 , C v2 calculated by each of the channels are identical. To ensure that this is indeed the case, each channel also comprises a monitoring unit US1, US2, responsible for verifying that the commands C v1 , C v2 calculated are indeed identical. In order to be able to carry out this comparison of the calculated commands, the monitoring unit US1, US2 receives the commands calculated by the channel to which it belongs, as well as those calculated by the other channel via a communication link LVER2, LVER1.

When a difference is detected between the two calculated commands C v1 , C v2 of the self-testing mechanisms of the processing units UT 1 , UT2 make it possible to identify where the errors may come from and deactivate one of the channels which in this case does not sends no information to the other channel. In this case, it is possible to select the channel which will be in the “active” state or in the “passive” state and to deactivate the one which is in the “passive” state.

Indeed, as already indicated in the introduction, it is noted that the control channels V1, V2 each have an “active” or “passive” state indicator. This makes it possible to determine which channel effectively controls the

engine ACT actuator(s). These states are exclusive: the two channels V1, V2 cannot be in the same state, one must be active and the other passive.

On the other hand, if the source of the error is not detected by the self-testing mechanisms of the processing units, the passive channel is always deactivated. The redundancy ensured by the latter is then lost. As will have been understood, it is in this case possible to deactivate a channel even though it does not present any problem, the problem possibly coming from at least one inter-channel communication link LCOM.

Consequently, rather than deactivating the passive channel and assuming that the problem comes from the inter-channel communication link LCOM, the control device will present a degraded mode of operation according to which one will proceed to a transmission of the commands calculated by the processing units UT1, UT2. In particular, this transmission is carried out from the active path to the passive path. It allows when the calculations made by the processing unit are based on results calculated at a previous time step to unify the

input data from the calculation units of the two channels in order to allow the convergence of the commands after a certain number of time steps.

Advantageously, for a processing unit, the calculation time is fixed at a duration t, for example between 5 and 50 ms, typically t = 15 ms, which is limited and exceeding this duration generates an exception of the unit of processing and the deactivation of the channel concerned by the exception. It is therefore necessary to be vigilant to the calculation load executed on the processing unit. In the event of a communication break between channels V1, V2, it is necessary, to re-establish the inter-channel LCOM communication link, to follow the mechanisms for transmitting the commands calculated to ensure the

reconvergence of calculations. This generates a calculation overload of the processing unit. It is therefore necessary to optimize the duration of the exchanges and

the scheduling of the calculations to respect the time constraint of the processing unit.

Example of Implementation of the Degraded Operation of the Control Device According to a Preferred Embodiment of the Invention

Such an example is illustrated in Figures 3 to 5. The example presented is that of a calculation taking into account only a result at the previous time step (
in this example, it is assumed that

. As long as the system does not experience an inter-channel link failure, the calculations proceed as shown in Figure 3. Also, in this example, channel V1 is the active channel while channel V2 is the active channel. passive way.

To determine the command to apply to the ACT actuator at a time step
calculations are made from the data measured by the sensors associated with the control channels. In a simplified example, the following calculations are performed:

with :

This corresponds to FIG. 2 in which the operators OP1, OP2 are for example sums of the two terms taken as input. Other operators can also be considered.

It is obvious here that after the calculations described previously, within the framework of a nominal mode of operation, if one admits that with the step preceding calculation one has well:

, then at the current calculation step, the following equality is verified:

On the other hand, when a break occurs on the inter-channel communication link at a time

the consolidation units are no longer able to exchange the data measured by the sensors connected to their respective channels. The calculations carried out by the processing unit then take place as represented in FIG. 4: each of the two channels carries out the calculations presented above without the consolidation step (here the average). The processing unit therefore performs the following calculations:

However, the data of the same nature measured by the sensors of each of the two channels are in practice always different (this is why consolidation is necessary). So we have :

And in this case the commands calculated by the two channels are no longer identical:

This divergence of the calculated commands is detected as an error by the monitoring units. Moreover, even if the link is restored, the previous calculations being different after processing, the calculated commands will remain different from one channel to another.

In order to overcome this problem, the solution consists in sending the results calculated by the active channel (in this example channel V1) to the passive channel (in this example channel V2) when the link is re-established at an instant

as shown in Figure 5. The calculations made here are as follows:

Thereby :

It can be seen that the values ​​of the commands C v1 , C v2 are identical to the re-establishment of the inter-channel LCOM communication link.

Example of possible implementation

By way of example, the processing units of each of the two channels can be split into two modules MOD1, MOD2 as illustrated in FIG. 2. In this case, the calculations carried out are based on several preceding results. More precisely, the calculations carried out use the results of the 4 commands

preceding as well as intermediate results coming from the 3 moments of preceding calculations. In such a case, it is therefore necessary to exchange the commands calculated for several moments of calculation, in order to optimize as much as possible the duration of these exchanges which are costly in terms of calculation time, these must be carried out for a duration as short as possible:

- when one or more previous commands are used as input to the processing units with a time delay

, measured in number of calculation instants, the commands must be transmitted from the active channel to the passive channel for a number of calculation instants equivalent to the duration of the break in the link;

- when one or more previous intermediate results are used with a delay

commands must be transmitted from the active path to the passive path during

no calculations.
Moreover, in order to satisfy the real-time system requirements specific to any on-board piloting device, the duration of each cycle cannot exceed a predetermined duration, for example 15 ms, therefore, it is necessary to optimize the order of operations. added in order to continue to respect this constraint. For this, the scheduling of the tasks carried out by the processing units is modified in order to carry out calculations when the latter are awaiting the reception of data on a data link. In this way, computing time is freed up:

- In nominal operating mode, in the absence of a fault;

- In degraded operating mode, during the communication failure;

- In degraded operating mode, after the return of the inter-channel link, during the exchange of data from the active channel to the passive channel.

This freed up computing time thus makes it possible to respect the time constraints imposed as well as to carry out additional self-tests in order to detect a malfunction of a component of one of the two channels.

CLAIMS

1. Engine control device comprising a first control channel (V1) and a second control channel (V2), each control channel comprising a first sensor (CAV1, CAV2) and a second sensor (CBV2, CBV2) each configured to supply respectively a first measurement (A) and a second measurement (B) to each channel, each of the channels comprising an active or passive state defining an active channel (V1) or a passive channel (V2), the active channel ( V1) being intended to control at least one actuator (ACT) of the motor while the passive channel (V2) is intended to take over from the active channel in the event of failure of the latter, the device being such that each channel (V1 , V2) includes:

- a measurement consolidation unit (UC1, UC2), each receiving as input the measurements from the two channels via at least one inter-channel communication link (LCOM) so as to obtain a

consolidation,

- a processing unit (UT1, UT2) of at least one command (C v1 , C v2 ) of at least one motor actuator (ACT), the device comprising:

- nominal operation according to which the calculation unit (UT1, UT2) of each channel (V1, V2) calculates the command (C v1 , C v2 ) according to the consolidation parameter and the command calculated at the moment of previous calculation, the actuator being controlled by the active channel,

- degraded operation, in the event of a break in the communication link (LCOM), according to which the calculation unit (UT2) of the passive channel calculates the command (C v2 ) according to the command (C v1 ) calculated via the active channel (V1) at the previous calculation instant.

2. A motor control device according to claim 1, wherein each channel (V1, V2) further comprises a process monitoring unit (US1, US2) configured to detect a difference in the value of the command (C v1 , C v2 ) calculated by the two channels (V1 , V2).

3. Motor control device according to claim 2, in which the process monitoring unit (US1, US2) is configured to deactivate

temporarily or permanently the passive channel (V2) in the event that a difference in the value of the command (C v1 , C v2 ) calculated by the two channels (V1 , V2) is detected.

4. Motor control device according to one of the preceding claims, in which the consolidation unit (UC1, UC2) performs an average of the values ​​measured by the two channels (V1, V2).

5. Motor control device according to one of the preceding claims, in which the processing unit (UC1, UC2) of each channel (V1, V2) performs a calculation requiring at least one result calculated by itself. at an earlier time step.

6. Motor control device according to one of the preceding claims, in which the processing unit (UT1, UT2) of each channel performs a calculation requiring at least one intermediate result calculated by itself at a step of previous calculation.

7. Motor control device according to claim 5, in which the degraded operating mode is activated for a duration corresponding to the duration of the cut-off of the at least one inter-channel communication link (LCOM).

8. Motor control device according to claim 6, in which the degraded operating mode is activated for a duration corresponding to the time between the calculation of an intermediate value and the furthest instant of time during which a calculation uses this value as initial data.

9. Motor control device according to one of the preceding claims, in which the degraded operating mode is activated for a predetermined duration, estimated by communication link failure tests.

10. Device for controlling a motor according to one of claims 2 to 9, in which the monitoring unit (US1, US2) of the processes is configured to permanently deactivate the passive path (V2) in the event that a difference in the value of the command calculated by the two channels (V1, V2) is detected immediately after the end of the degraded operating mode.

11. Motor control device according to one of the claims

previous steps, in which when one of the two channels (V1, V2) waits to receive measurements from the other channel, said other channel (V1, V2) performs in advance the next scheduled calculations not requiring a measurement coming from the second channel which it does not have at this moment.