Abstract:
Disclosed herein is a “real time” Time Limited Dispatch (TLD) fault management system and method for evaluating the operational suitability of an engine&#39;s electronic control system. The TLD system disclosed herein uses a software algorithm to compute or predict the probability of mission success for a given upcoming mission length (e.g., two hours) and the time remaining to repair control system faults before dispatch is disallowed or the flight suspended, regardless of the probability of success.

Description:
CROSS-REFERENCE TO RELATED APPLICATIONS  
       [0001]    This application claims priority to U.S. Provisional Patent Application No. 60/350,709, filed Nov. 13, 2001, entitled “Aircraft Fault Management System,” which is herein incorporated by reference in its entirety to the extent that it is not inconsistent with this disclosure. 
     
    
     GOVERNMENT RIGHTS STATEMENT  
       [0002] The U.S. Government has a paid-up license in this invention and the right in limited circumstances to require the patent owner to license others on reasonable terms as provided for by the terms of DAAH10-99-2-0005, awarded by the U.S. Department of the Army. 
     
    
     
       BACKGROUND OF THE INVENTION  
         [0003]    1. Field of the Invention  
           [0004]    The subject disclosure relates to a control system for use with aircraft gas turbine engines, and more particularly to, a control system which includes a “real-time” Time Limited Dispatch fault management system which evaluates engine electronic component failures and determines the allowable engine operational running time with failures present in the control system based on predicted component failure rates.  
           [0005]    2. Background of the Related Art  
           [0006]    Often aircraft engine control systems have redundant components or elements to improve flight safety or for increasing the operational running time between maintenance periods. In engine control systems which have redundant components or elements, Time Limited Dispatch (TLD) methodologies are applied to evaluate whether an engine can continue to operate for a predetermined length of time with faults present in the redundant components/elements, before repairs are required. More specifically, the TLD methodologies are a means for substantiating and obtaining approval for dispatching and operating a Full Authority Digital Engine Control (FADEC) equipped aircraft, for limited time periods, with faults present in the system, after which, appropriate repairs shall be made to bring the system to the “full up” configuration. The term “full up” is used to indicate that the FADEC system is free of faults which affect the loss of thrust control (LOTC) failure rate.  
           [0007]    The FADEC system controls the operation of the engine over an entire performance range, usually from engine start-up to maximum power or thrust. The FADEC system consists generally of an electronic engine control (EEC) unit, a fuel metering unit (i.e. hydromechanical control unit), sensors, actuators, valves, an alternator and interconnecting electrical harnesses. FIG. 1 b  provides a schematic representation of a typical FADEC system for a dual channel EEC unit.  
           [0008]    In multiengine aircraft, TLD methodologies are applied independently to each engine when determining the allowable operating time (i.e., dispatch service time). Thus the aircraft could be dispatched with faults present in more than one engine&#39;s FADEC system.  
           [0009]    SAE, the engineering society for advancing mobility on land, sea, air and space, publishes aerospace recommended practice (ARP) 5107 which provides methodologies and approaches which are presently used for conducting and documenting the analysis associated with the application of TLD to FADEC systems. Traditionally, under the SAE approach, maintenance or dispatch crews are required to perform a multitude of calculations on the ground to determine if the aircraft can be dispatched for a particular mission. This approach is performed while the aircraft is on the ground, is often very time consuming, and results in a less than optimal maintenance schedule.  
           [0010]    There is a need therefore, for a fault management system which is integrated with the aircraft&#39;s control system and is capable of analyzing fault scenarios in “real-time” so as to assist pilots or maintenance personnel in making intelligent decisions on the dispatch capability of the aircraft.  
         SUMMARY OF THE INVENTION  
         [0011]    The disclosure of the present application relates to a “real time” Time Limited Dispatch (TLD) fault management system for use in evaluating the operational suitability of an engine&#39;s FADEC system. The TLD system disclosed herein uses a software algorithm to compute the probability of mission success for a given upcoming mission length (e.g., two hours) and compares this probability with the ARP 5107 and FAA guidelines for dispatch. It also computes the time remaining to repair control system faults before dispatch is disallowed, regardless of the probability of success.  
           [0012]    The subject disclosure is also directed to a fault management method for use with a dual channel electronic engine control system. The fault management method disclosed herein includes the steps of; providing an electronic engine control system having a first channel and a second channel, designating, for each of the plurality of components in the first channel, which of the plurality of components in the second channel are single thread components required to cover a failure of that particular first channel component; and detecting whether any one of the plurality of components in the first channel have failed.  
           [0013]    Each of the first and second channels has a plurality of components associated therewith, each having a predicted failure rate. Additionally, the components in the second channel are substantially identical to the components in the first channel.  
           [0014]    The method further includes the steps of; estimating a total failure rate based on the failure rates for all of the single thread components required to cover any failed components; and predicting the time remaining to fix the electronic control system faults based on the total failure rate.  
           [0015]    Preferably, the step of estimating a total failure rate based on the failure rates for all of the single thread components includes summing the failure rates for all of the single thread components and failure rates for common prime reliable components. Additionally, in a representative embodiment of the method, the step of predicting the time remaining to fix the electronic control system faults based on the total failure rate includes the step of assigning a desired probability for maintaining normal engine control.  
           [0016]    It is presently envisioned that the fault management method disclosed herein may further include the steps of; establishing an estimated mission length; comparing the estimated mission length to the predicted time remaining to fix the system faults; and providing an go/no-go signal based on the comparison of the time remaining to fix the electronic control system faults to estimated mission length.  
           [0017]    In an alternative embodiment, the fault management method of the present invention further includes the steps of; detecting whether any of single thread components in the second channel have failed; and providing a no-go signal if a single thread component in the second channel has failed.  
           [0018]    Still further, the fault management method may further include the steps of; estimating a probability of mission success based on the total failure rate; assigning a minimum probability of success for the mission; and providing a no-go signal if the estimated probability of mission success does not exceed the assigned minimum probability of success.  
           [0019]    Prior to predicting based on the total failure rate the time remaining to fix the electronic control system faults, the method disclosed herein may further include the steps of; designating for each of the plurality of components in the second channel which of the plurality of components in the first channel are single thread components required to cover a failure of that particular second channel component and maintain normal engine control; detecting which of the plurality of components in the second channel have failed; and estimating the total failure rate based on the failure rates for all of the single thread components in the first and second channels which are required to cover the failed first and second channel components.  
           [0020]    It is further envisioned that the steps of detecting which of the plurality of components in the first channel have failed; estimating a total failure rate based on the failure rates for all of the single thread components in the second channel which are required to cover the failed first channel component; and predicting based on the total failure rate the time remaining to fix the electronic control system faults are iteratively preformed.  
           [0021]    The present disclosure is also directed to a fault management model for a dual channel electronic engine control system. The fault management model disclosed herein including, among other things, an electronic engine control system having a first channel and a second channel, a mechanism for designating for each of the plurality of components in the first channel which of the plurality of components in the second channel are single thread components required to cover a failure of that particular first channel component; and a mechanism for detecting whether any of the plurality of components in the first channel have failed. The first and second channels of the electronic control system have a plurality of components associated therewith each having an assigned failure rate. Additionally, the components in the second channel are substantially identical to the components in the first channel; The fault management model further includes a mechanism for estimating a total failure rate based on the failure rates for all of the single thread components required to cover any failed components; and a device for predicting the time remaining to fix the electronic control system faults based on the total failure rate.  
           [0022]    In a preferred embodiment, the mechanism for estimating a total failure rate based on the failure rates for all of the single thread components includes a system for summing the failure rates for all of the single thread components and failure rates for common prime reliable components.  
           [0023]    It is presently envisioned that the device for predicting based on the total failure rate the time remaining to fix the electronic control system faults includes mechanism for assigning a desired probability for maintaining normal engine control.  
           [0024]    In a representative embodiment, the fault management model further includes a mechanism for establishing an estimated mission length; means for comparing the estimated mission length to the predicted time remaining to fix the system faults; and a device for providing a go/no-go signal based on the comparison of the time remaining to fix the electronic control system faults to estimated mission length.  
           [0025]    Alternative embodiments of the fault management model may further include a mechanism for detecting whether any of the single thread components in the second channel have failed; and a device for providing a no-go signal if a single thread component in the second channel has failed.  
           [0026]    A still further embodiment of the present invention includes a means for estimating a probability of mission success based on the total failure rate; a mechanism for assigning a minimum probability of success for the mission; and a device for providing a no-go signal if the estimated probability of mission success does not exceed the assigned minimum probability of success.  
           [0027]    A mechanism for designating for each of the plurality of components in the second channel which of the plurality of components in the first channel are single thread components required to cover a failure of that particular second channel component may be further included in the model of the present application. Additionally, in this embodiment it is envisioned that the model further includes a mechanism for detecting whether any of the plurality of components in the second channel have failed; and means for estimating the total failure rate based on the failure rates for all of the single thread components in the first and second channels which are required to cover the failed first and second channel components.  
           [0028]    The present disclosure is also directed to a fault management method for electronic engine control systems. The disclosed method includes the steps of; providing an electronic engine control system having a first plurality of components for normal engine control and second plurality of components which are substantially redundant to the first plurality of components, designating for each of the first plurality of components which of the second plurality of components are single thread components required to cover a failure of that particular first component; and iteratively detecting whether any of the first plurality of components have failed. Each of the first and second plurality of components has an assigned failure rate.  
           [0029]    It is further envisioned that the disclosed method includes the steps of; iteratively estimating a total failure rate based on the failure rates for all of the single thread components required to cover the failed first plurality of components; and iteratively predicting the time remaining to fix the electronic control system failure based on the total failure rate.  
           [0030]    The fault management system of the subject application analyzes, in real-time, electronic control system fault scenarios and helps pilots and maintenance personnel make intelligent decisions on the dispatch capability of aircraft. It also allows maintenance to be scheduled appropriately, thereby lowering the operating cost of the aircraft.  
       
    
    
     BRIEF DESCRIPTION OF THE DRAWINGS  
       [0031]    So that those having ordinary skill in the art to which the present application appertains will more readily understand how to make and use the same, reference may be had to the drawings wherein:  
         [0032]    [0032]FIG. 1 a  is a schematic representation of a dual engine fault management system which includes left and right electronic engine control units interfacing with an aircraft computer;  
         [0033]    [0033]FIG. 1 b  is a schematic representation of a simplified FADEC system;  
         [0034]    [0034]FIG. 2 is a schematic representation of a control system operating in the Dual Channel mode;  
         [0035]    [0035]FIG. 3 is a schematic representation of the control system of FIG. 2, operating in the single channel mode wherein channel A is active and controls the fuel flow (WF), the inlet guide vane angle (IGV) and the bleed valve position (HBV);  
         [0036]    [0036]FIGS. 4 a - 4   c  provide a hardware diagram for Channel A which illustrates the essential equipment for dispatch in the “normal” mode;  
         [0037]    [0037]FIGS. 5 a - 5   b  illustrate a TLD failure matrix for a Dual Channel FADEC system which identifies the single-thread components required to cover a failure of a particular component;  
         [0038]    [0038]FIGS. 6 a - 6   b  provide a schematic representation of the FADEC system operating in the normal mode wherein the TLD failure rate (λ TLD ) is determined in failures per million hours for all of the single-thread components in the dual channel system that are necessary for “normal” mode operation;  
         [0039]    [0039]FIG. 7 is a logic diagram illustrating the manner in which the time remaining to fix (T FIX ) in hours is determined based on the real-time failure rate (λ TLD );  
         [0040]    [0040]FIGS. 8 a - 8   b  provide a logic diagram of the fault management system of the present disclosure wherein input signals are received from a FADEC fault detection component, an engine vibration component and an engine exceedance component and are used to determine if both the left and right engines are cleared for dispatch;  
         [0041]    [0041]FIG. 9 is a graph comparing the time remaining before maintenance is required to the flight hours following first partial failure of the FADEC system on one of the two engines; and  
         [0042]    [0042]FIG. 10 is a graph depicting the probability of not operating in the normal mode during a two hour mission. 
     
    
       [0043]    These and other features of the subject disclosure will become more readily apparent to those having ordinary skill in the art from the following detailed description of preferred embodiments.  
       DETAILED DESCRIPTION OF PREFERRED EMBODIMENTS  
       [0044]    Referring now to the drawings wherein like reference numerals identify similar elements of the subject invention there is illustrated in FIG. 1 a  a schematic representation of a fault management system designated generally by reference numeral  100 . Portions of fault management system  100  reside in the aircraft&#39;s central computer  10 , the Full Authority Digital Engine Control (FADEC) system  20  associated with the left engine and the FADEC system  40  associated with the right engine.  
         [0045]    FADEC systems  20  and  40  control the operation of the left and right engines, respectively, over an entire performance range, usually from engine start to maximum power or thrust. FIG. 1 b  schematically illustrates representative FADEC system  20  which consists of, among other things, an electronic engine control (EEC) unit  22 , a fuel metering unit (i.e., hydromechanical control unit)  24 , engine sensors  26 , critical engine systems (effectors, etc.)  28 , a dedicated power supply  30  and FADEC components and interfaces  32 . FADEC systems  20  and  40  are dual-channel systems, i.e., each EEC unit  22  and  42  includes two redundant channels, a first channel A and a second redundant channel B. Channels A and B consist of identical components and provide redundancy in the engine control and operation, and enhance the dispatch capability of the aircraft.  
         [0046]    [0046]FIG. 1 a  illustrates the communication interfaces that exist between EEC unit  22  and EEC unit  42  and between the EEC units  22  and  42 , and the aircraft computer  10 . This figure is not intended to limit or dictate the number of interfaces that can exist between the components of fault management system  100 , but is merely a representative embodiment of the aspects of the present invention used for illustrative purposes.  
         [0047]    Left engine EEC unit  22  communicates with the right engine EEC unit  42  through digital data links  32   a  and  32   b . Digital data link  32   a  allows channel A of EEC unit  22  to communicate with channels A and B of EEC unit  42 . In a similar manner, channel B of EEC unit  22  and channels A and B of EEC unit  42  communicate through data links  32   a ,  42   a  and  42   b  with the other channels in the system. As will be discussed in detail hereinbelow, the cross channel data links  32   a ,  32   b ,  42   a  and  42   b  enable the aircraft FADEC systems  20  and  40  to communicate and exchange data for use in engine operation and control. This becomes particularly important when components within a FADEC system fail and the other FADEC system must be relied upon to provide engine control through its complementary or redundant components.  
         [0048]    As shown in FIG. 1 b , channels A and B within EEC unit  22  also communicate with each other through cross channel data link  34  and status discretes  36   a  and  36   b  (FIGS. 2 and 3). FIGS. 2 and 3 represent two operating conditions within EEC unit  22 . In FIG. 2 the cross channel data link  34  is intact and therefore channel A can communicate and exchange data with channel B. As a result, either channel can control critical engine effectors  28 . Shown herein, the effectors  28  consist of the amount of fuel flow (WF), the inlet guide vane angle (IGV), and the bleed valve position (HBV). Those skilled in the art will readily appreciate that EEC unit  22  as shown in FIG. 2 can control other critical engine systems.  
         [0049]    Since cross channel data link  34  is intact, the control of the engine effectors  28  can be distributed, if necessary due to a component failure, between the channels to enhance dispatch capability. In FIG. 2, components within channel A or B have failed and therefore, switch  37   a  is positioned such that channel A controls WF  38   a  and switches  37   b  and  37   c  are positioned such that channel B controls IGV  38   b  and HBV  38   c.    
         [0050]    In FIG. 3, the cross channel data link has failed and the status discretes  36   a  and  36   b  determine which channel is in control or “active”. The control of engine effectors  28  is dedicated to-the active channel. As shown in this figure, switch  38  is positioned such that channel A is active and controls all engine effectors  28 .  
         [0051]    Referring again to FIG. 1 a , wherein each channel in EEC unit  22  is shown communicating with the aircraft&#39;s central computer  10  through hardwired connections  12   a  and  12   b  and digital data link  12   c . In a representative embodiment, hardwired connection  12   a  provides to the aircraft computer  10  the degradation mode of the channel&#39;s components and hardwired connection  12   b  identifies whether the channel has failed. Digital data link  12   c  provides to aircraft&#39;s central computer  10  fault management data. The fault management data can include for example, the failure rate of all the healthy “single thread” components in the dual channel system that are needed for normal mode operation (λ TLD ), the time remaining to fix the FADEC system faults (T FIX ), the time remaining to probable engine mechanical failure (T VIBE ), and the time remaining to cycle count exceedance (time left at contingency power) (T LIFE ). The system and method for determining λ TLD , T FIX , T VIBE , and T LIFE  will be described in detail hereinbelow with respect to FIGS. 4 through 8. The output signal  14  from aircraft computer  10  and fault management system  100  is provided to a go/no-go data display in the cockpit (not shown) which indicates whether the aircraft can satisfactorily complete the intended mission.  
         [0052]    Referring now to FIGS. 4 a - 4   c , there is shown a schematic representation of the FADEC system electronic components that are essential to engine operation in the “normal” mode. Normal mode is defined as being able to control the engine operation over the entire performance range, from engine start-up to maximum power or thrust. Identified adjacent to each component is a predicted failure rate of the component per million hours of operation. These figures represents the components of channel A in a dual channel FADEC system. The list of components for channel B would be identical. The failure rates or probabilities are typically provided by the component manufacturer and will be used as described hereinbelow in fault management system  100  for evaluating whether the engine can operate for a predetermined length of time with faults present in the redundant elements, before repairs are required.  
         [0053]    The schematic diagram of FIGS. 4 a - 4   c  is illustrative of one representative FADEC system configuration and is not intended to be limiting as to the “essential” components, the relationship and intercommunication between the components or the failure rates assigned to each component. Components can be added or removed from the essential component list and the failure rates can be adjusted based on experience or testing.  
         [0054]    The following is an index that provides a description for the acronyms and abbreviations used in FIGS. 4 through 6:  
                                                       NH   High Pressure Turbine Spool Speed           NP   Power Turbine Spool Speed           NR   Rotor Speed           NL   Low Pressure Turbine Spool Speed           Q   Engine Torque           Cond.   Conditioning Amplifiers           F/D   Frequency to Digital Converter           PLA   Power Level Angle           C/P   Collective Pitch           POT   Potentiometer           WF   Fuel Flow           IGV   Inlet Guide Vane Angle           HBV   Bleed Valve Position           LVDT   Linear Variable Differential Transformers           CJC   Cold Junction Compensation           RTD   Resistive Temperature Device           T4.5   Power Turbine Inlet Gas Temperature           T1   Compressor Air Inlet Temperature           TC   Theremocouple           PAMB   Pressure Ambient           P3   Compressor Discharge Pressure           XENG   Cross Engine           XCHAN   Cross Channel           PGA   Programmable Gain Amplifier           RECT   Rectifiers           MUX   Multiplexers           D/A   Digital to Analog Converter           A/D   Analog to Digital Converter           TM   Torque Motor           MFP   Main Fuel Pump           HMU   Hydromechanical Unit           A/F   Airframe           PMA   Permanent Magnet Alternator           CH   Channel           S/O   Shutoff           ARINC   Aeronautical Radio, Inc.           DIFF   Differential                      
 
         [0055]    [0055]FIGS. 4 a - 4   c  provide a schematic illustration of the interconnection and communication between the electronic components in channel A. The  1  and  5  MHz clocks are real time clocks that are used for various conversions. ARINC  429  is a data bus link which provides a communication link between channel A and the aircraft&#39;s central computer and cross-engine communication with the both channels. RS  423  is a serial data link which provides the cross channel data link between channels A and B.  
         [0056]    Referring now to FIGS. 5 a - 5   b , which provide a TLD failure matrix  200  that lists in the first column  210  all channel A essential components and in the first row  220 , all of the channel B essential components. An “X” in a row denotes the single-thread components required to compensate for a failure of a particular component. For example, if the high pressure turbine spool speed sensor for channel A fails (NH(A)), then the high pressure turbine spool speed sensor for channel B (NH(B)), CPU(B), PS(B) and the XCHAN data link are required to be operational, as denoted by an “X” in cells  216 ,  222 ,  218 , and  224 , respectively. In matrix  200 , CPU(B) has been defined as the combination of the microcompute, the multiplexers, A/D, F/Ds, the clocks and the digital input from FIGS. 4 a - 4   c . More specifically, if NH(A) fails, in order to continue operating in the normal mode, cross channel communication must be intact, the redundant component NH(B) must be operational, and the computer (CPU) and power supply for channel B must be online.  
         [0057]    For the purposes of simplifying the failure analysis many of the essential components and their assigned failure rates have been grouped together. This provides a conservative approach to the failure analysis that minimizes computer-processing time. For example, in cell  212 , NH(A) has been grouped with the associated conditioning circuit (see FIGS. 4 a - 4   c ) for a combined failure rate of 11 failures per million hours. Similarly, in cell  214 , the XENG and Airframe data links have been grouped with the three buffers (signal to channel A and channel B, signal from channel A, and signal from channel B) for a combined failure rate of 13.2 (0.7+4.16+4.16+4.16≈13.2) failures per million hours.  
         [0058]    Referring now to FIGS. 6 a - 6   b , there is illustrated a failure tree designated generally as reference numeral  300 . Failure tree  300  is a representation of the TLD fault or failure management approach illustrated in matrix  200  of FIGS. 5 a - 5   b . The essential components for single channel and dual channel operation are provided in regions  320  and  340  of failure tree  300 . Common prime reliable components, such as the boost stage pump and main fuel pump are grouped in region  360 .  
         [0059]    If a channel has failed based on the data from the status discretes, switches  322  and  324  move in the direction of the dashed arrows and the engine&#39;s FADEC system is operating in the single channel mode defined in region  320 . In this mode, the FADEC system has a single channel failure rate (λ TLD single ) of 206.9 fpmh. The single channel failure rate equals the total failure rate of all of the healthy single thread components in region  320 .  
         [0060]    A signal representing λ TLD.single  is added to signals representing the uncovered fault failure rate (λ UC ) and the failure rate for the common prime reliable components (λ TLD.prime ) at summing junction  326 . The method for determining λ uc  is outlined in Section 7 of SAE Aerospace Recommended Practice 5107, which is herein incorporated by reference. The λ uc  can be approximated by the following formula:  
         λ UC   =X *(2.0*Σλ TLD.single )  
         [0061]    X is generally between 0 and 0.05  
         [0062]    For the purpose of simplifying the example calculations to follow, λ uc  will be ignored (X=0, therefore, λ uc =0).  
         [0063]    The output of summing junction  326  is the failure rate of all of the healthy “single thread” components in the dual channel FADEC system that are needed for “normal” mode operation (λ TLD ). In the single channel operating mode identified above, λ TLD =209.2 (i.e., 206.9+2.3=209.2) fpmh.  
         [0064]    If for example, the FADEC system is operating in the dual channel mode with the cross channel communication intact, but NH(A) has failed, the switches would be positioned as shown in FIGS. 6 a - 6   b . More specifically,  342   a ,  348  and  350  are closed. If any sensor or effector in channel A or B fails, switch  348  closes. If any channel A component fails, switch  348  and  350  close and if any B component fails, switch  348  and  352  close. If any individual sensor or effector fails in channel A or B, the switch that represents that component closes. The individual sensor/effector switches in the dual channel operating mode are identified as switches  342   a  through  342   v.    
         [0065]    Consistent with failure matrix  200 , if NH(A) has failed, in order to continue operating in the normal mode, cross channel communication must be intact, the redundant component NH(B) must be operational, and the computer (CPU) and power supply for channel B must be online. Therefore, a signal representing the failure rate of NH(B), namely 11 fpmh, is provided to summing circuit  344 . Since all of the other components are healthy, the total failure rate at summing circuit  344  is 11 fpmh. The signal representing the failure rate of NH(B) is provided to summing junction  346  and is combined with a signal representing the total failure rate for the remaining components required for continued operation in the normal mode (i.e., the power supply, microcomputer, and XCHAN data link). The total failure rate for the remaining components is 23.9 fpmh and therefore the output signal from summing junction  346  represents a combined rate of 34.9 fpmh.  
         [0066]    Since switch  352  is in the open position only the output of summing junction  346  is provided to summing junction  354 . The output from summing junction  354  represents the dual channel failure rate λ TLD.dual , which in this example would be 34.9 fpmh. In this operating example, the XCHAN data link and both channels A and B are operational. Therefore, switch  324  remains closed and a signal λ TLD.dual  is provided to summing junction  326  and added with signals representing the uncovered fault failure rate (λ UC ) and the failure rate for the common prime reliable components (λ TLD.prime ). The output of summing junction  326 , λ TLD , is a signal representing 37.2 fpmh.  
         [0067]    The above-described failure scenarios are just two of the many possible scenarios and are intended to provide an overview of how failure tree  300  operates. It should be noted that FIGS. 6 a - 6   b , in a similar manner to the previously described figures, provide a representative approach to the failure analysis and those skilled in the art would readily appreciate that essential components can be added to or removed from the list of components considered in the analysis. Additionally, the failure rates can be changed or adjusted based on experience or a desire to provide a more or less conservative fault management system.  
         [0068]    Referring now to FIG. 7, represented schematically is the manner in which the time remaining to fix (T FIX ) existing faults in the FADEC system is determined by logic  400 . Initially, the output of summing junction  326  (see FIG. 6 b ), λ TLD , is provided to converter  410 . Converter  410  applies the following equation to determine a new or initial time remaining to fix (T FIXNEW ) the FADEC system fault(s):  
         −ln(0.99)/[λ TLD *10 −6   ]=T   FIXNEW    
         [0069]    T FIXNEW  is calculated every time λ TLD  changes value, i.e., every time a new FADEC system fault occurs. The 0.99 represents a 99% probability that the FADEC system can get through the computed time period without degrading below the “normal” mode of operation for the given failure rate. This probability can be adjusted as desired to increase or reduce the conservatism in the calculations or predictions.  
         [0070]    As an example of the representative operation of logic  400 , assuming that NH(A) has failed and therefore, λ TLD  equals 37.2 fpmh, the output of converter  410  or T FIXNEW  would be a signal representing 270 hours. This signal is provided to auctioning logic  412  and is compared to a previously calculated time remaining to fix (T FIX ). The lower of the two values becomes the “reset” time remaining to fix the existing faults (T FIXRESET ). If the failure of NH(A) is the first fault encountered by the FADEC system, switch  414  was in the open position prior to the failure and the default initial count down time setting for the engine is 10,000 hours. T FIXNEW  is compared to a T FIX  which equals the initial 10,000 hours minus the operating time according to the countdown timer.  
         [0071]    Countdown timer  416  tracks the amount of operational time that has elapsed since the last calculation of T FIXRESET . The output of countdown timer  416  is T FIX  which represents T FIXRESET  minus the amount of running time. The countdown timer is updated every second, and T FIX  is stored in volatile memory every minute. The countdown timer  416  is reset continually for fault free conditions and to T FIXRESET  at the instant a new fault is encountered. If a FADEC system fault is encountered and the engine is running, logic gates  418  and  420  signal the countdown timer  416  to operate. However, if the engine is not operating, the logic gate  422  stops countdown timer  416 .  
         [0072]    When a new FADEC system fault occurs, T FIX  is cycled back to auctioning circuit  412  and compared to the new T FIXNEW . It should be noted that switch  414  remains in the open position until a FADEC system fault is encountered.  
         [0073]    Referring now to FIGS. 8 a - 8   b , there is illustrated a fault management system for a dual engine aircraft designated generally as reference numeral  500 . Fault management system  500  includes, among other things, a left engine FADEC system fault predictor  510 , a left engine vibration fault predictor  530  and a left engine exceedance fault predictor  550 . Similar elements are provided for the right engine but are not shown. The left engine FADEC fault predictor  510  and the fault management approach for essential components identified with respect to FIGS.  1 - 7  is the subject of the present application. The engine vibration predictor  530  and exceedance fault predictor  550  are representative of other failure inputs that can be included in determining engine suitability for a predetermined operational period. The determination of these inputs is not the subject of this application and will not be described hereinbelow, as it is not necessary to an understanding of the present invention.  
         [0074]    FADEC fault predictor  510  receives input signals from failure tree  300  and logic  400 , namely the inputs of λ TLD  and T FIX , respectively. Either or both logic circuits  511   a  and  511   b  are accessed depending on the operational status of the channels, to determine if the left engine is capable of satisfying the operational criteria.  
         [0075]    Assuming that channel A is capable, λ TLD  is provided to converter  512  which applies the following formula to determine the probability of mission success:  
         1−(λ t /1*10 6 )=probability of mission success  
         [0076]    Where “t” is set at 2 hours  
         [0077]    The resulting signal, representing the probability of mission success, must be greater than 0.9995 in order to satisfy the criteria of logic gate  514 . Additionally, the T FIX  provided from logic  400  must be greater than “t” or 2 hours in order to satisfy the criteria of logic gate  516 . If the criteria of both gates  514  and  516  are satisfied, since channel A has not failed and is not degraded then gate  518  is also satisfied and the left engine FADEC system is a go. If channel B is capable, then circuitry  511   b  is accessed and in a same manner evaluates the probability of mission success and the deferred maintenance time remaining.  
         [0078]    In order for the left engine to be considered capable of performing the intended mission, logic gate  560  requires that the criteria established by the engine vibration predictor  530  and the exceedance fault predictor  550  also are satisfied. The evaluation of the right engine is conducted in a similar manner. If both engines satisfy the fault management criteria, a signal is sent from logic gate  562  indicating that both engines are a go or capable of operating in the normal mode for the entire mission.  
         [0079]    Referring now to FIG. 9, there is illustrated a graphical representation of the time remaining to fix existing faults in the FADEC system of one engine versus the flight hours following the first component failure. This graph illustrates an operational scenario wherein an initial failure occurred in the channel A high pressure turbine spool speed sensor (NH(A)) and after 100 hours of operation in the initial fault mode channel A failed. As described with respect to FIGS. 6 and 7, a failure of the NH(A) sensor results in a λ TLD  of 37.2 and a T FIX  of 270 hours. Therefore, the initial data point on the graph represents a time remaining to fix of 270 hours and zero hours following the failure of the NH(A) sensor. After 100 hours of operation, channel A fails and a new time remaining to fix is calculated based on the fault management approach described in FIGS. 4 through 7. The failure of channel A results in a new λ TLD  of 209.2 and a T FIX  of 48 hours. Therefore, the fault management system disclosed herein predicts that there is a 99% probability that the aircraft can operate with the existing faults in the FADEC system for another 48 hours before maintenance is required. As discussed with respect to FIG. 7, the 99% probability is based on converter  410  and can be adjusted to a desired probability.  
         [0080]    Referring now to FIG. 10, there is provided a graph that illustrates the probability (in percent) of operating in the normal mode during a 2 hour mission based on the operating scenario discussed in FIG. 9. After a first failure of the NH(A) sensor, resulting in a λ TLD(A)  of 37.2 fpmh, the probability of mission failure based on converter  512  (FIG. 8 a ) is 0.007% and therefore, the probability of mission success is 99.993%. After a 100 hours of operation with the existing failure of the NH(A) sensor, channel A fails and a new probability of failure and success are 0.0438% and 99.956%, respectively, based on a λ TLD  of 209.2 fpmh.  
         [0081]    [0081]FIG. 10 also compares the results of the fault management approach disclosed herein to the criteria or guidelines specified in SAE ARP 5107. As shown, the fault management approach disclosed herein provides an approach which is within the guidelines provided in ARP 5107.  
         [0082]    While the invention has been described with respect to preferred embodiments, those skilled in the art will readily appreciate that various changes and/or modifications can be made to the invention without departing from the spirit or scope of the invention as defined by the appended claims.