Abstract:
Fault-tolerant apparatus for controlling first and second input members of a mechanical actuator includes first and second electrical machines and at least two controllers. The first and second electrical machines, which apply braking forces to the first and second input members, respectively, are provided with stators having pluralities of isolated phase windings. Each controller is coupled to a phase winding of the first electrical machine, and also to a phase winding of the second electrical machine. Any one controller can excite the first electrical machine to apply the braking force to the first input member or the second electrical machine to apply the braking force to the second input member.

Description:
FIELD OF THE INVENTION 
     This invention relates in general to blade pitch and in particular to fault-tolerant apparatus for controlling fan blade pitch of variable-pitch turbofan engines. 
     BACKGROUND OF THE INVENTION 
     There is a great need for fault-tolerant apparatus for controlling fan blade pitch of turbofan engines. In the event of a single failure, non-fault tolerant apparatus would not be able to control the position of the fan blades. 
     Apparatus for controlling blade pitch can be made fault-tolerant by providing redundant controllers. One controller is designated as a primary controller and the remaining controllers provide backups in succession. Two controllers provide tolerance to a single failure, three controllers provide tolerance to two failures and so on. 
     There are drawbacks to such fault-tolerant apparatus. To provide tolerance to a single fault, the number of components must be doubled. Also doubled is the weight and cost of the system. As the redundancy is further increased, the weight and cost of the system is increased proportionately. 
     SUMMARY OF THE INVENTION 
     Apparatus according to the present invention provides fault tolerance without providing the proportional increase in cost and weight. The fault tolerant apparatus, which is suitable for use with mechanical actuator means having first and second movable input means, comprises first and second electrical machines and at least two controller means. The first and second electrical machines have their rotors secured to the first and second movable input means, and their stators held stationary with respect to their respective rotors. Both stators includes a plurality of isolated phase windings. Each controller means is coupled to a phase winding of the first electrical machine and also to a phase winding of the second electrical machine. Any one controller means can excite either electrical machine to cause a relative displacement between the first and second movable input members. 
     The fault tolerant apparatus is especially suitable for a mechanical actuator of a variable-pitch turbofan engine having a turbine shaft and a plurality of output shafts upon which fan blades are mounted. The mechanical actuator, which mechanically couples the turbine shaft to the plurality of output shafts, has first and second input shafts which are rotated at the same speed when the turbine shaft is rotating. The mechanical actuator means rotates the output shafts in one direction when the turbine shaft is rotating and when the first input shaft is slowed relative to the second input shaft, and it rotates the output shafts in an opposite direction when the turbine shaft is rotating and when the second input shaft is slowed relative to the first input shaft. Rotation of the output shafts causes blade pitch to change. 
     The rotor of the first electrical machine is secured for rotation with the first input shaft of the mechanical actuator, and the rotor of the second electrical machine is secured for rotation with the second input shaft of the mechanical actuator. The controller means cooperate to provide excitation currents to selected phase windings of the first and second electrical machines when the blade pitch is to be adjusted. Any one controller means can cause an electrical machine to be excited. The excited machine, in turn, causes the mechanical actuator to adjust the blade pitch. 
    
    
     BRIEF DESCRIPTION OF THE DRAWINGS 
     FIG. 1 depicts a mechanical actuator for adjusting blade pitch; 
     FIG. 2 is a block diagram of fault-tolerant apparatus for controlling blade pitch according to the present invention, said apparatus being employed to drive the mechanical actuator shown in FIG. 1; 
     FIG. 3 is a logic diagram of the fault-tolerant apparatus shown in FIG. 2; 
     FIG. 4 is a flowchart of a microprocessor routine for each microprocessor in the fault-tolerant apparatus; 
     FIG. 5 is a logic diagram of a microprocessor routine for generating current commands; and 
     FIG. 6 is a logic diagram of an alternate embodiment of the fault-tolerant apparatus according to the present invention. 
    
    
     DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS 
     FIG. 1 shows a mechanical actuator 10 which utilizes torque from a turbine shaft 12 to adjust the pitch of fan blades 14 on a turbofan engine 16. The mechanical actuator 10 includes a differential gear train 18 which couples the turbine shaft 12 to a plurality of output shafts 20, two of which are shown. The fan blades 14 are mounted to the output shafts 20. The differential gear train 18 is provided with first and second input shafts 22 and 24. When the differential gear train 18 is rotated by the turbine shaft 12, the first and second input shafts 22 and 24 are rotated at the same speed as the turbine shaft 12. Unless a braking force is applied to one of the input shafts 22 or 24, the differential gear train 18 does not change blade pitch. However, when the rotation of the first input shaft 22 is slowed relative to the second input shaft 24, the differential gear train 18 changes blade pitch in one direction; and when the rotation of the second input shaft 24 is slowed relative to the first input shaft 22, the differential gear train 18 changes blade pitch in the opposite direction. Such a mechanical actuator 10 is described in application Ser. No. 07/699,398 filed on May 13, 1991. This application is incorporated herein by reference. 
     Fault-tolerant apparatus includes first and second induction machines 26 and 28 whose squirrel cage rotors 30 and 32 are secured for rotation with the first and second input shafts 22 and 24, respectively, and whose respective stators 34 and 36 are affixed to a non-rotating engine structure 38. Each stator 34 and 36 has three isolated windings. Thus, each induction machine 26 and 28 is a three-phase machine whose windings are split out as three single phase windings. 
     Referring now to FIG. 2, the fault-tolerant apparatus further includes first, second and third channels A, B and C, a channel for each phase of the induction machines 26 and 28. The channels A, B and C provide DC excitations to their isolated stator windings φA, φB and φC in response to blade position commands POSCMD from an engine control unit (ECU) over serial data buses 40. Either the first or second induction machine 26 or 28 is excited, but not both at the same time. When the first induction machine 26 is excited, it applies a braking torque to the first input shaft 22. The speed of the first input shaft 22 is slowed relative to that of the second input shaft 24 and, as a result, blade pitch is changed in a positive direction. When the second induction machine 28 is excited, blade pitch is changed in a negative direction. Aircraft power or dedicated alternator output power is rectified by a rectifier 42 and supplied to the channels over a power distribution bus 44. The channels A, B and C intercommunicate, i.e., pass data, over a data transmission bus 46. 
     Referring now to FIG. 3, the first channel A includes a first microprocessor 48 which receives position commands POSCMD over the serial data bus 40. In response to the position command POSCMD, the first microprocessor 48 generates positive and negative current commands PCURCMD and NCURCMD on its first and second outputs 50 and 52, respectively. One current command PCURCMD or NCURCMD will always be zero. 
     The first output 50 of the first microprocessor 48 is coupled to a current loop control 54 which regulates the current in the stator winding φA 1  of the first induction machine 26. A subtracter 56 provides an error signal CURERR indicating the difference between the positive current command PCURCMD and a feedback current CURFBK measured from the stator winding φA 1 . A current regulator 58 amplifies the error signal CURERR to provide a duty cycle command DC. The duty cycle command DC is supplied to power electronics 60 such as a pulse width modulator or pulse density modulator. The power electronics 60 generates commutation commands that are supplied to a solid state, single phase inverter 62 such as a hard-switching or resonant type. In response to the commutation commands, the inverter 62 provides current ia which energizes the stator winding φA 1 . Such current loop controls 54 are well known to those skilled in the art. 
     Similarly, the second output 52 of the first microprocessor 48 is coupled to the stator winding φA 2  by a current loop control 54. When the blade pitch must be adjusted in a positive direction, the first microprocessor 48 generates a positive current command PCURCMD, which causes the inverter 62 to energize the stator winding φA 1 . Flux from stator winding φA 1  produces positive currents in quadrature within the rotating rotor 30 of the first induction machine 26. When the blade pitch must be adjusted in a negative direction, the first microprocessor 48 generates a negative current command NCURCMD which causes stator winding φA 2  of the second induction machine 28 to be excited. 
     In a similar manner, the second channel B employs a second microprocessor 64 and two current loop controls 54 to energize the stator windings φB 1  and φB 2  of the first and second induction machines 26 and 28, respectively. And, the third channel C employs a third microprocessor 66 and two current loop controls 54 to energize the stator windings φC 1  and φC 2  of the first and second induction machines 26 and 28, respectively. 
     To provide optimum braking torque, the spatially distributed windings φA, φB and φC of the excited induction machine must produce an appropriately distributed magneto motive force (mmf). Torque is a function of rotor speed and stator current. To achieve this spatial distribution, the currents ia, ib and ic in the windings φA, φB and φC must be regulated such that they sum to zero (i.e., ia+ib+ic=0). To simplify the current control, one current ia, ib or ic is commanded to zero. For example, current ic=0, leaving currents ia=-ib. However, the manner in which these currents are applied is a matter of design choice. 
     For the microprocessors 48, 64 and 66 to achieve correct spatial distribution of mmf within the induction machine 26 or 28, there must be communication between the three channels A, B and C such that each microprocessor 48, 64 and 66 can sum the currents ia, ib and ic to zero in the excited induction machine 26 or 28 and thereby generate the appropriate current commands PCURCMD and NCURCMD. The data transmission bus 46 allows for such communication. From the data transmission bus 46, each channel A, B and C receives current commands PCURCMD and NCURCMD. Each channel A, B and C further receives the sensed pitch of the fan blade as measured by the other two channels and measured speed from the first and second induction machines 26 and 28 as measured by the other two channels. Rotor speeds of the induction machines 26 and 28 can be measured by any well-known means, such as pulse pickups. 
     The data transmission bus 46 not only provides data measured by the other channels, but also receives/transmits information relative to its status (e.g., active/inactive). Table 1 shows the minimum information that each channel requires. 
     
                       TABLE 1______________________________________Channel A         Speed rotor 1Channel B         Speed rotor 1Channel C         Speed rotor 1Channel A         Speed rotor 2Channel B         Speed rotor 2Channel C         Speed rotor 2Channel A         Blade PositionChannel B         Blade PositionChannel C         Blade PositionChannel A         statusChannel B         statusChannel C         statusChannel A         Current CommandChannel B         Current CommandChannel C         Current Command______________________________________ 
    
     Although the data transmission bus 46 can transmit data in analog form, digital data transmission is preferred. All channels A, B and C must be electrically isolated from one another to prevent single events from propagating between channels. Such an event can be a high voltage short to logic power. Electrical isolation between the channels A, B and C can be attained by such means as optical isolation or transformer isolation. 
     FIG. 4 shows a routine that is executed by each microprocessor 48, 64 and 66. First, each microprocessor reads the data off the data bus and position command off the serial bus (module 100). Based on information received over the data transmission bus 46, the microprocessor selects a current multiplier MULTA, MULTB or MULTC as shown in Table 2 (module 104). 
     
                       TABLE 2______________________________________        Channel A  Channel B Channel CChannel Status        Multiplier Multiplier                             MultiplierA    B       C       (MULTA)  (MULTB) (MULTC)______________________________________OK   OK      OK      1        -1      0OK   Fail    OK      1        0       -1Fail OK      OK      0        1       -1OK   OK      Fail    1        -1      0OK   Fail    Fail    1        0       0Fail OK      Fail    0        1       1Fail Fail    OK      0        0       -1______________________________________ 
    
     The computed current commands will be multiplied by these current multipliers MULTA, MULTB and MULTC to allow, for example, current ic=0 and currents ia=-ib. 
     Next, the microprocessor takes an average (module 106) of the position feedbacks and first and second rotor speeds. This average ensures that each channel A, B and C generates an identical current command. All first and second rotor speeds, as well sensed positions, will be examined by each channel. If any of the rotor speeds or sensed positions differ by a predetermined error (derived from an error analysis), that data will be discarded, and the average value of the remaining data will be taken. If all three channels indicate the data is within a specified error tolerance, the average of the data is taken. 
     Using the averages of blade position and rotor speeds, the microprocessor generates the positive and negative current commands PCURCMD and NCURCMD (module 108). With each channel A, B and C performing the source computation on the same data, identical current commands can be guaranteed, ensuring that the correct spatial distribution of mmf is achieved within the motor. 
     Finally, built-in test of the controller is performed to ensure the controller is operating correctly (module 110). Failure to pass the BIT (module 112) will result in the microprocessor setting its status signal low (module 114) and shutting down the affected channel (module 116). By setting its status signal to a low state, the microprocessor allows the other channels to provide braking torque. The alternate channels will recognize the failure via data transmitted over the data transmission bus 46. If no failures are detected (module 110), the microprocessor returns to the first block and reads data off the data buses (module 100). 
     FIG. 5 shows the microprocessor routine for generating current commands. The first microprocessor 48 is used by way of example. The position command POSCMD is compared to the average blade position POS by a first subtracter 68, whose output provides an error signal POSERR. The error signal POSERR is amplified within a position regulator 70, whose output produces a speed command SPDCMD. A second subtracter 72 derives a differential rotor speed by subtracting signals N1 and N2 indicating average rotor speeds of the first and second induction machines 26 and 28. A signal NERR indicating the differential rotor speed is subtracted from the speed commands SPDCMD by a third subtracter 74, whose output signal SPDERR is amplified within a speed regulator 76. An output of the speed regulator 76 provides a signal which is limited between upper and lower limits, by an authority limiter 78 and multiplied by this channel multiplier MULTA via a multiplier 80. An output of the multiplier 80 provides a current command CURCMD. 
     The current command CURCMD is divided into two paths. A first function block 82 provides current commands PCURCMD having values greater than or equal to zero, and a second function block 84 provides current commands NCURCMD having values less than or equal to zero. These current commands PCURCMD and NCURCMD are provided on first and second outputs 50 and 52, respectively, of the first microprocessor 48. 
     In the event one winding becomes open or shorted, or in the event that the power electronics 60 of one current loop control 54 fails, the fault-tolerant controller can still energize two windings to provide full braking torque. The inoperative channel is deactivated and the remaining two channels are made active. For example, if channel A fails, the status signal for channel A goes low. In response to this status signal, channels B and C select current multipliers such that current ia=0 and currents ib=-ic. Thus, failure of one channel, if detected, does not reduce the performance of the system provided that the remaining two channels are configured to provide opposite and equal currents. It can be readily appreciated by those skilled in the art that the mmf produced by any two currents can be controlled to the same equivalent amplitude as all three currents; therefore, no loss in performance results from the failure of one channel. Thus, the system operates at full performance following the first failure. 
     If a second failure occurs, brake torque is reduced for a given current level since only one winding is energized. Thus, if channels A and B fail, current -ic is applied to either stator winding φC 1  or φC 2  only. Still, a braking torque is still produced. The fault-tolerant apparatus operates at approximately 80% performance following the failure of a second channel. Full performance can be restored if current -ic is increased. 
     Thus disclosed is a fault-tolerant apparatus which can accurately position fan blades despite one or two failures within a microprocessor, power electronics or induction machine. The fault-tolerant apparatus has significant weight advantages over apparatus that would provide duplicate machines, microprocessors and power electronics to achieve redundancy. 
     The fault-tolerant apparatus can be modified to perform two additional modes of operation for the mechanical actuator 10. It can change pitch on a non-operational engine by applying AC excitation to one stator to turn either the first or second input shaft 22 or 24; and it can allow for electric power generation by exciting one or both stators and using the excited induction machine as an induction generator. However, the apparatus is not fault-tolerant for these modes of operation. 
     FIG. 6 presents an alternate embodiment of apparatus which achieves a degree of redundancy associated with induction machine windings φA, φB and φC current loop controls 54. Three channels A, B and C are controlled by a single microprocessor 86 that adjusts the necessary current commands ia, ib and ic to the three channels A, B and C. Two channels are active and the other one is held in reserve. When the active channel fails, the microprocessor 86 disables the failed channel and continues to provide the required torque via the remaining two channels. Failure of another channel would then enable the remaining channel to operate. Although a data transmission bus is not required, such a configuration has single point failures, most notably the microprocessor 86. 
     It must be emphasized that the fault-tolerant apparatus is not limited to use with the mechanical actuator 10 shown in FIG. 1. Rather, the fault tolerant apparatus is suitable for use with any mechanical actuator that has input means to which braking torques can be applied. 
     It will be understood that the embodiments described herein are merely exemplary and that many modifications and variations of the present invention are possible in light of the above teachings. For example, the fault-tolerant apparatus can employ two-phase induction machines and two channels, thereby providing a tolerance to one failure. Alternatively, the fault-tolerant apparatus can be modified to accommodate more than three channels. Therefore, the scope of the present invention is limited only by the appended claims.