Device and method for protecting an aircraft turbomachine computer against speed measurement errors

A device protecting an aircraft turbomachine computer against speed measurement errors, including: on a speed regulation channel: a speed sensor of a turbomachine gearbox shaft, a speed measurement circuit, and a speed regulation circuit; on a monitoring channel: a speed sensor of a turbomachine gas generator shaft, a speed measurement circuit, and a turbomachine stop control circuit. Each channel uses dissimilar characteristics eliminating common mode errors. Each speed sensor delivers a pseudo-sine frequency signal. On each channel, speed monitoring circuits compare the frequency signal with a minimum threshold, delivering an error signal when the measured frequency is lower than the minimum threshold. A common speed cross checking circuit detects exceeding a determined deviation between both frequencies, the monitored deviation being higher or lower than a maximum deviation corresponding to loss of a frequency period on either sensor. Analyzing the error signals, exceeding the determined deviation can control stopping the turbomachine.

TECHNICAL FIELD

The invention relates to a device and a method for protecting a turbomachine computer, for example an Auxiliary Power Unit (APU), on board an aircraft, for example a helicopter, against speed measurement errors.

STATE OF THE PRIOR ART

The field of the invention is that of aircraft turbomachines, and more particularly that of aircraft turbomachine computers used to regulate the behavior of these turbomachines. These computers can accommodate a regulation channel and a monitoring channel or a channel protecting against speed measurement errors in a same casing, which enables a more economical cost and a lower weight than a solution in which these channels would be fitted into two separated casings.

The function of the regulation channel is to regulate the turbomachine speed. However, a failure of this regulation channel can lead to an overspeed of the turbine shaft. Indeed, when this shaft breaks, the power supplied by the gases to the turbine is no longer absorbed by the equipments driven by this shaft and the turbine rotational speed increases extremely quickly. Such an overspeed very quickly results in a breakage of the rotating parts and/or to their separation from the turbine disk. These rotating parts are then violently projected outwardly due to the centrifugal force and can pass through the case surrounding the turbine, causing very important damages in the engine, and even able to endanger the aircraft and its passengers.

The object of the monitoring channel is to prevent the consequences of such an overspeed. The monitoring channel comprises an electronic member associated with a hydromechanic member. The electronic member measures the rotational speed of the rotor. If the electronic member detects a speed measurement error, then it controls the hydromechanic member, which totally cuts off the fuel supply of the turbomachine.

In a known manner, the rotational speed of the turbine is measured with at least two independent sensors, one for the regulation channel, the other for the monitoring channel. The representative frequencies of the turbomachine gearbox and gas generator rotational speeds are the primary variables for regulating the rotational speed (regulation) and for protecting against an associated overspeed start (monitoring).

Since a safety analysis has revealed a direct link between these frequencies and an overspeed occurrence of the turbomachine, the object of the invention is to provide a device and a method for protecting the turbomachine computer against the speed measurement errors enabling the accuracy of the frequency measurements to be ensured in order in particular to avoid any underestimated speed measurement, by guaranteeing the absence of a common mode error that could lead to an unprotected overspeed. This constraint is imposed by the need to guarantee the highest safety level according to the ARP4754 FDAL A standard (catastrophic).

DISCLOSURE OF THE INVENTION

The invention relates to a device for protecting an aircraft turbomachine computer against speed measurement errors comprising:on a speed regulation channel:a speed sensor of the turbomachine gearbox shaft,a speed measurement circuit,a speed regulation circuit,on a monitoring channel:a speed sensor of the turbomachine gas generator shaft,a speed measurement circuit,a turbomachine stop control circuit,

characterized in that each channel uses dissimilar characteristics able to eliminate the common mode errors, in that each speed sensor delivers a pseudo-sine frequency signal and in that this device comprises, on each channel, a speed monitoring circuit which carries out a comparison of the frequency signal to a minimum threshold and which delivers an error signal when the measured frequency is lower than this minimum threshold, and a common speed cross checking circuit to detect the exceeding of a determined deviation between both frequencies such that the monitored deviation is higher than a maximum deviation or the monitored deviation is lower than a minimum deviation corresponding to the loss of a frequency period on either sensor, and means for analyzing these error signals and the exceeding of the determined deviation to control the turbomachine stop.

Advantageously, the speed sensors are wheels of different technologies and having different numbers of teeth.

Advantageously, the shafts are different shafts rotating at different rotational speeds.

Advantageously, the frequency signals are signals of different frequencies such that the loss of a period on one of the signals or even of both signals simultaneously leads to an abnormal deviation between both speeds higher than the maximum acceleration of an APU and greatly higher than a speed deviation upon a shaft maximum torsion.

Advantageously, the frequency signals are conveyed on different electrical routings.

Advantageously, the frequency signals are used by different electronic boards.

Advantageously, the device of the invention comprises a wiring break detection circuit on each channel.

Advantageously, the turbomachine can be an Auxiliary Power Unit (APU). The invention can relate to an aircraft, for example a helicopter, implementing such a device.

The invention also relates to a method for protecting an aircraft turbomachine computer against speed measurement errors, comprising a gas generator, an air compressor, a gearbox and an electrical power supply unit, this computer comprising a speed regulation channel and a monitoring channel, the speed regulation channel using the frequency of a speed sensor of the gearbox shaft, the monitoring channel using the frequency of a speed sensor of the gas generator shaft,

characterized in that it comprises the following steps:

measuring a frequency signal on each channel,checking the coherence of each frequency signal by comparison with a minimum threshold,comparing these frequency signals to each other to detect the deviation between the frequencies,stopping the turbomachine in case of a deviation higher than a determined value.

Advantageously, the turbomachine is stopped in case of the absence of a frequency signal, on at least one channel, during a determined time after the turbomachine start control. Advantageously, the turbomachine is stopped in case of loss of a frequency signal in operation.

Advantageously, when the minimum frequency Fmin is reached and the signals seem coherent, the following additional checks occur:on the regulation channel side, the turbomachine is stopped in case of detection of an unlikely speed variation, the confirmed loss of one or several periods leading to this detection, the regulation channel establishing this defect and stopping the turbomachine,on the monitoring channel side, the turbomachine is stopped in case of detection of a tooth loss on the speed signal of the monitoring channel, the monitoring channel establishing this defect and stopping the turbomachine.

Advantageously, in the case where the minimum frequency Fmin is not reached, the following additional checks occur:on the regulation channel side, the turbomachine is stopped in case of detection that the speed of the regulation channel has not exceeded an underspeed, within the allotted time, the regulation channel establishing this defect and stopping the turbomachine.

DETAILED DISCLOSURE OF PARTICULAR EMBODIMENTS

The device for protecting an aircraft turbomachine computer against speed measurement errors according to the invention, as illustrated inFIG. 1, comprises a speed regulation channel10and a channel for monitoring speed measurement errors11. At the input E1, the regulation channel10measures the rotational speed of the gearbox shaft using a speed sensor, for example a magnetic sensor21provided facing the teeth of a phonic wheel20fitted on this shaft.

At the input E2, the monitoring channel11measures the rotational speed of the turbomachine gas generator shaft using a speed sensor, for example a magnetic sensor31provided facing the teeth of a phonic wheel30fitted on this shaft. These two channels producing different frequencies, a coherence check36of both frequencies thus produced is carried out inside the monitoring channel11.

FIG. 1illustrates the different circuits of the device of the invention respectively provided in the turbomachine12, in the sensor13, in the wiring14and in the electronic control unit (ECU)15, for both channels10and11.

In the regulation channel10, the device of the invention comprises:a phonic wheel20,a speed sensor21of the turbomachine gearbox shaft which delivers a pseudo-sine frequency signal which can reach at most 35 volts peak-to-peak,a wiring circuit22which conveys this pseudo-sine signal,a circuit23, detailed inFIG. 2, for shaping this pseudo-sine signal, which delivers a square frequency signal varying between both 0 and 5 volts levels, and detects a possible wiring break,a speed measurement circuit24which delivers a speed measurement in revolutions per minute,a speed monitoring circuit25which carries out a comparison with a minimum threshold, checks the exceeding of the underspeed within the allotted time, monitors an unlikely speed variation, and which possibly delivers a speed problem detection signal S1,a speed regulation circuit26.

In the monitoring channel11, the device of the invention comprises:a phonic wheel30having a technology, rotational axis, rotational speed, and a number of teeth different from those of the phonic wheel20,a speed sensor31of the turbomachine gas generator shaft, which delivers a pseudo-sine frequency signal, of a frequency different from that of the sensor21, which can reach at most 35 volts peak-to-peak,a wiring circuit32which conveys this pseudo sine signal using a specific electrical harness with a routing different from that of the circuit22,a circuit33for shaping this pseudo-sine signal, different from that of the circuit23, which delivers a square frequency signal varying between both 0 and 5 volts levels, and detects a possible wiring break,a speed measurement circuit34which delivers a speed measurement in revolutions per minute which is different from that of the circuit24,a speed monitoring circuit35which carries out a comparison with a minimum threshold and which possibly delivers a speed problem detection signal S2,a circuit36for cross checking the speeds obtained by the circuits24and34, which enables an abnormal deviation between both speeds to be detected, by detecting the loss of a period on one of both signals or even of both signals simultaneously, which leads to an abnormal deviation between both speeds which is higher than the maximum acceleration of an APU and greatly higher than the speed deviation upon the shaft maximum torsion, and which delivers a signal S3for detecting the cross checking of the speeds from both channels10and11,a circuit37for possibly controlling the turbomachine stop in case of detection of an overspeed, or in case of detection of a tooth loss on the speed signal.

The device of the invention operates in the following way:

If both speed sensors21and31do not supply a signal:on the regulation channel10side, the turbomachine is stopped by the circuit25in case of detection of the absence of a frequency signal during a determined time, for example 3 seconds, after the turbomachine start control or in case of a frequency signal loss in operation. If the regulation channel10establishes one of these defects, it stops the turbomachine;on the monitoring channel11side, the turbomachine is stopped by the circuit35, in case of detection of the absence of a frequency signal during a determined time, for example 3 seconds, after the turbomachine start control or in case of a frequency signal loss in operation. If the monitoring channel11establishes one of these defects, it stops the turbomachine.

In operation and beyond a minimum frequency threshold (Fmin) on either speed sensors21and31, as checked in the circuits25and35, the measured frequencies are compared in the circuit36in order to detect the exceeding of an abnormal deviation sized as follows:the monitored deviation is higher than a mechanically established maximum deviation,the monitored deviation is lower than a deviation corresponding to the loss of a frequency period on either sensor21and31.

This abnormal deviation guarantees that one of the measures is incoherent. The device of the invention then ensures the safety of the turbomachine by cutting off the fuel supply through a specific cut-off mean of the monitoring channel11.

If the speed sensor21of the regulation channel10does not provide a frequency or provides an underestimated frequency (loss of periods on the signal) the monitoring channel11functions normally. When the sensor31reaches the minimum frequency Fmin, the monitoring channel11establishes an abnormal deviation and stops the turbomachine.

If the speed sensor31of the monitoring channel11does not provide a frequency or provides an underestimated frequency (loss of periods on the signal), the regulation channel10functions normally. When the sensor21reaches the minimum frequency Fmin, the monitoring channel11establishes an abnormal deviation and stops the turbomachine.

If both speeds sensors21and31provide an underestimated frequency (loss of periods on the frequency signals) we have the following three cases:Case 1: the frequency Fmin is reached and the signals are perceived as incoherent. The monitoring channel11establishes a deviation and stops the turbomachine.Case 2: the frequency Fmin is reached and the signals seem coherent (on certain combinations of pulse loss). In this case the following additional checks occur:on the regulation channel10side, the turbomachine is stopped in case of detection of an unlikely speed variation (based on maximum accelerations/deceleration). The confirmed loss of one or more periods leads to this detection (this includes any pulse loss configuration in operation). The regulation channel10establishes this defect and stops the turbomachine.on the monitoring channel11side, the turbomachine is stopped in case of detection of a tooth loss on the speed signal of the monitoring channel11(a defect is monitored on the periodicity of the frequency signal and an abnormally long period is detected). The monitoring channel11establishes this defect and stops the turbomachine.Case 3: the frequency Fmin is not reached, in this case the following additional checks occur:on the regulation channel10side, the turbomachine is stopped in case of detection that the speed of the regulation channel10has not exceeded the underspeed within the allotted time (with a frequency>Fmin). The regulation channel10establishes this defect and stops the turbomachine.

It is noted that using only two speed sensors21and31of identical technology, but which are independent, guarantees, thanks to the invention, a speed measurement integrity level which is compatible with requirements applicable to the functions the errors of which can have catastrophic effects, in particular the common mode errors on both channels10and11. Experience shows that certain malfunctions have caused the simultaneous failure of the regulation and monitoring channels. These errors referred to as “common mode” errors cancel the independence of both channels if adequate precautions are not taken.

FIG. 2illustrates an exemplary embodiment of the signal measurement circuit23. This circuit comprises a hysteresis operational amplifier (300 mV centered on 2.5 volts) receiving the input signal which has gone through a low-pass filter40the input of which is connected to a resistance bridge followed by two capacitors C1and C2the mid-point of which is connected to two grounded diodes D1and D2, and the output of which is connected to a gate45to deliver a square signal (0-5 volts) by peak-clipping the input pseudo-sine signal. A second low-pass filter42delivers a DC output (ohmic test detecting a possible wiring break). A third low-pass filter43followed by a capacitor C3and by a fourth low-pass filter44delivers a DC output (AC signal level), a diode D3grounding the input of the fourth low-pass filter.

In an exemplary embodiment, certain circuits can be made as a software, such as circuits24and25. Certain circuits can be made as dedicated circuits (FPGA), such as circuits33,34and37.