Patent Description:
A conventional fixed-wing aircraft flight control system consists of flight control surfaces, the respective cockpit controls, connecting linkages, and the operating mechanisms to control an aircraft's direction or behaviour in flight.

Aircraft flight control surfaces are aerodynamic devices allowing a pilot to adjust and control the aircraft's flight attitude. For example, a high lift system of an aircraft includes flight control surfaces such as slats, flaps, and/or variable-sweep wings. Conventionally, control surface drive apparatuses for driving movement of such control surfaces comprise a control surface drive device which generates the mechanical power for the movement, a transmission device for transmitting this mechanical power to the control surfaces, and a control device comprising a power control unit.

For example, typical high lift systems of commercial and military aircraft are powered by a centralized PCU mounted in the fuselage with computerized control.

Commonly, the PCU is connected to transmission device including a torque shaft system which provides the mechanical power to geared actuators at the flap or slat panel drive stations. Additionally, a braking device, especially comprising a wing tip brake (WTP) in each wing, may be an integrated part of the transmission device.

The WTB is capable to arrest and hold the system in failure cases. First and second independent slat flap computers (SFCC) control and monitor the system. Common PCUs have first and second independent motors which are connected by a speed summing differential gear (DIFG). Each motor is provided with a power-off brake (POB) to arrest the motor in the commanded position. Depending on the aircraft power supply system and the availability requirements, the PCU can be purely hydraulically or electrically driven or includes each of an electric motor and a hydraulic motor (hybrid PCU). For the electric drive digitally controlled brushless DC motors are commonly used.

Motor control is usually established by a closed loop layout to maintain speed and torque command inputs. The control algorithms can be implemented in a controller (e.g. SFCC) which is provided with all required data to control the motors.

The electric motor is supplied by the aircraft electrical busbar. A motor control electronic (MCE) is interfacing with the SFCC and the aircraft electrical busbar.

The MCE converts the electric power as required for the brushless DC motor and provides motor control. It is also possible that the control algorithm is implemented in the MCE. In this case the SFCC provides corresponding drive states (e.g. via a data bus system).

In the default high-lift operating mode the WTBs are released and the PCU is providing the power to operate the high-lift system (HLS) with the commanded speed into any gated position.

As a result, the PCU is usually only operating for a very small time frame (starting and landing) of a flight.

Other common driving apparatuses for driving movement of at least one control surface may have first and second central linear actuators outputting a linear movement to the transmission device. The transmission device transmits this movement by a linearly movable element, e.g., of a push rod, a cable or the like to mechanical actuators of the control surface.

<CIT> discloses a method for testing a component in a high lift system of an aircraft. A brake coupled with a hydraulic motor is activated, and a rotation of the motor is commanded for a period of time, wherein the brake remains activated. A motion sensor determines a motion. The determined motion is compared to a predetermined threshold value. In case the determined motion exceeds the predetermined motion threshold value, a brake indication signal is indicated.

<CIT> discloses a method to measure an aircraft high lift system brake response time. For testing the brake, a motion of a motor operably coupled with the brake is determined by a sensor. The brake is activated, and an elapsed time until the brake has arrested the motion is measured. A brake failure signal is indicated, if the elapsed time exceeds the threshold.

The invention aims to improve the driving of movement of aircraft flight control surfaces, especially of a high-lift device, in terms of long-time reliability, early detecting of wear and reduction of maintenance work.

The invention provides a health monitoring method, a flight control surface driving apparatus, a flight control system, an aircraft and a computer program in accordance with the independent claims.

Advantageous embodiments are subject-matter of the dependent claims.

The invention provides according to one aspect thereof a health monitoring method for checking a functionality of a flight control surface driving apparatus comprising a control surface drive device for generating mechanical power for moving at least one control surface, a transmission device for transmitting mechanical power from the control surface drive device to the at least one control surface, at least one brake device for braking movement of the transmission device, at least one load sensor for sensing a load imposed on the control surface drive device, and a control device configured to receive a load sensor output signal from the at least one load sensor and to control the control surface drive device in response to the load sensor output signal, wherein the health monitoring method comprises automatically checking proper functionality of at least one of the at least one load sensor and the transmission device by.

The health monitoring method can be conducted any time when the control surface is not active.

Preferably, the health monitoring method is part of a performance test routine for other devices of the control surface driving apparatus, for example of a performance test for the brake device and/or of a performance test for an internal brake device within the control surface drive device such as a Power Off Brake (POB).

Preferably, step b) comprises:
b1) sending a load command signal to the control surface drive device corresponding a commanded load to be applied.

Preferably, step b) comprises:
b2) commanding the control surface drive device to apply a rising load on the blocked transmission device.

Preferably, step b) comprises:
b3) commanding a closed-loop controller, configured to control a speed and load of the control surface drive device by a close-loop control, to drive the control surface drive device with a predetermined speed and automatically generating load command signals commanding rising loads by the close-loop controller.

Preferably, step c) comprises:
c1) determining whether a difference between the commanded load and a load corresponding to the at least one load sensor output signal exceeds a predetermined maximum value.

Preferably, step c) comprises:
c2) setting the predetermined range depending on a load command signal.

Preferably, step c) comprises:
c3) ending the determination when the load command signal achieves a predetermined load limit.

Preferably, step c) comprises:
c4) ending the determination when the at least one load sensor output signal achieves a predetermined load limit of a load limiting function of the flight control surface driving apparatus.

Preferably, step c) comprises:
c5) determining whether a commanded load signal generated in step b) is within a predetermined range.

Preferably, the at least one load sensor for sensing a load imposed on the control surface drive device includes a first load sensor for sensing the load imposed on the control surface drive device and a second load sensor for sensing the load imposed on the control surface drive device. Preferably, the health monitoring method checks the functionality of the first load sensor and the functionality of the second load sensor at the same time by conducting step c) on their output signals. Preferably, the flight control surface driving apparatus to be monitored comprises at least one rotating element for transmitting mechanical power to the at least one control surface, wherein the at least one load sensor is at least one torque sensor for determining a torque on the rotating element. Especially, the rotating element is an output shaft of the control surface drive device. Preferably, the flight control surface driving apparatus comprises a first torque sensor unit (TSU) and a redundant second torque sensor unit (TSU) on each rotating output element of the control surface drive to sense the torque thereon.

Preferably, a failure message signal is issued when step c) leads to the result that the output of the at least on load sensor lies outside an expected range defined by at least one threshold. Preferably, the threshold is set depending on a load command signal. Most advantageous, a load command signal of a closed-loop motor controller is used.

According to another aspect, the invention provides a flight control surface driving apparatus comprising:.

Preferably, the control device is configured to automatically conduct the health monitoring method according to any of the above-mentioned embodiments.

Preferably, the control surface drive device comprises at least one rotating output shaft, and the at least one load sensor comprises at least one torque sensor for sensing a torque on the rotating output shaft.

Preferably, there is at least a first and a second load sensor for sensing torque on an output member of the control surface drive device or on an input member of the transmission device.

Preferably, there is at least a first and a second torque sensor for sensing torque on an input end of an input rotating shaft of the transmission device. Preferably, the first and second torque sensors determine the torque on an output of the control surface drive device connected to the input end.

Preferably, the control surface drive device includes an electric motor controlled by a close-loop controller with regard to speed and torque, wherein the close-loop controller is configured to send a torque command signal commanding gradually rising torque when an output of the electric motor is blocked, wherein the control device is configured to compare the output of the at least one load sensor with the torque command signal.

Preferably, the brake device comprises left-hand and right-hand wing tip brakes acting on an output element of the transmission device arranged near a wing tip.

According to another aspect, the invention provides a flight control system for an aircraft, comprising at least one flight control surface and at least one flight control surface driving apparatus according to any of the above-mentioned embodiments for driving the movement of the at least one flight control surface.

Preferably, the flight control system further comprises left-hand and right-hand series of slats and flaps of a high lift system as the at least one control surface.

Preferably, the at least one load sensor for sensing a load imposed on the control surface drive device includes a first load sensor for sensing the load imposed on the control surface drive device and a second load sensor for sensing the load imposed on the control surface drive device.

Preferably, the flight control system further comprises the second load sensor and a second controller receiving a load sensor output signal of the second load sensor and controlling the movement of the at least one control surface in response to the load sensor output signal of the second load sensor.

According to the invention, the flight control system comprises at least one brake device for braking or blocking movement of the transmission device. Preferably, the brake device has at least one brake element imposing a braking force to an output element of the transmission device. Especially, the braking device is a wing tip brake to be disposed near to a wing tip of the aircraft to be equipped with a slat and/or flap drive system including the flight control surface drive apparatus for driving movements of slats and/or flaps.

Preferably, the control device is configured to compare the load sensor output signal of the at least one load sensor with a predetermined maximum load value in a flight and ground condition and to trigger, when the load sensor output exceeds the predetermined maximum load value, a reverse movement and a subsequent load control sequence for controlling the load to achieve a lower load level. According to another aspect, the invention provides an aircraft comprising the flight control surface driving apparatus according to any one of the above-mentioned embodiments and/or the flight control system according to any one of the above-mentioned embodiments. Especially, the aircraft has a high-lift system with slats and flaps which are driven by the flight control surface drive apparatus. According to another aspect, the invention provides a computer program comprising instructions to cause the flight control system of any of the above-mentioned embodiments to execute the steps of the health monitoring method according to any of the above-mentioned embodiments.

Preferred embodiments of the invention propose an automatically performed torque sensor unit health monitoring. Preferred embodiments of the invention provide an automatically performed torque sensor monitoring which can be conducted during operation of an aircraft.

According to preferred embodiments, economy of operation is improved using an automated detection system. While embodiments of the invention are particularly suitable when used in connection with flight control surface driving apparatuses suitable for driving primary flight control surfaces such as ailerons, rudders, etc. or secondary flight control surfaces such as high-lift devices, examples disclosed herein are also applicable, albeit outside the scope of the appended claims, to other movable actuated surfaces in an aircraft such as cargo doors, landing gear doors, etc..

Preferred embodiments of the invention are explained below with reference to the drawings in which:.

Referring to <FIG>, an aircraft <NUM> has a flight control system <NUM> including control surfaces <NUM> and a flight control surface driving apparatus <NUM>. The flight control surface driving apparatus <NUM> comprises a control surface drive device <NUM> for generating mechanical power for the movement of at least one of the control surfaces <NUM>, a transmission device <NUM> for transmitting mechanical power from the control surface drive device <NUM> to the at least one of the control surfaces <NUM>, at least one load sensor <NUM> for sensing a load imposed on the control surface drive device <NUM>, and a control device <NUM> configured to receive a load sensor output signal from the at least one load sensor <NUM> and to control the control surface drive device <NUM> in response to the load sensor output signal. In the embodiment shown, the flight control system <NUM> includes a high lift system <NUM> with high-lift devices <NUM> as control surfaces <NUM>. Several flight control surface driving apparatuses <NUM>, <NUM>, 104f are configured to drive associated groups of such high-lift devices <NUM>. The flight control surface driving apparatus <NUM> further includes a brake device <NUM> for braking or blocking movement of the transmission device <NUM>.

As further shown in <FIG>, the aircraft <NUM> has a fuselage <NUM>. The aircraft <NUM> also has a pair of wings 14a, 14b that are attached to the fuselage <NUM>. The aircraft <NUM> further comprises engines <NUM> that are attached to the wings 14a, 14b.

The aircraft <NUM> has a plurality of said high-lift devices <NUM>, such as slats <NUM> and flaps <NUM> which are examples of the control surfaces <NUM>. The high-lift devices <NUM> are driven by a power control unit or PCU <NUM> which is an example of the control surface drive device <NUM>. The PCU <NUM> outputs torque to the transmission device <NUM> which includes drive shafts <NUM> that are connected to the high-lift devices <NUM> in a manner known per se. In order to arrest the high-lift devices <NUM> in a predetermined position, wing tip brakes (WTB) 26a, 26b (elements of the brake device <NUM>) are arranged near the end portions of the drive shafts <NUM>.

In more detail, the high-lift system <NUM> includes, as flight control surface driving apparatuses <NUM>, a slat driving apparatus <NUM> for driving the slats <NUM> and a flap driving apparatus 104f for driving the flaps. Each of these driving apparatuses <NUM>, 104f has a centralized PCU <NUM> mounted in the fuselage. Each PCU <NUM> is controlled by the control device <NUM> which includes a first and a second slat flap computer (SFCC) <NUM>-<NUM>, <NUM>-<NUM>. The first and second slat flap computers <NUM>-<NUM>, <NUM>-<NUM> are independent from each other and control and monitor the slat and flap driving apparatuses <NUM>, 104f in correspondence with the pilot's operation of an input device <NUM>.

The configurations of the slat and flap driving apparatuses <NUM>, 104f are similar and are explained in more detail with reference to the example of the slat driving apparatus <NUM> depicted schematically in <FIG>.

Referring now to <FIG>, first the PCU <NUM> as an example of the control surface drive device <NUM> for generating mechanical power for the movement of the slats <NUM> is described. The PCU24 has at least two independent motors <NUM>, <NUM> which are connected by an appropriate gear, for example a speed summing differential gear (DIFG) <NUM>.

The DIFG <NUM> has a left-hand output shaft 42a for driving first to seventh left-hand slats <NUM>. 1a to <NUM>. 7b and a right-hand output shaft 42b for driving first to seventh right-hand slats <NUM>. 1b to <NUM>. Of course, the number of slats <NUM> may differ in other embodiments.

Each motor <NUM>, <NUM> is provided with a Power Off Brake <NUM> to arrest the motor <NUM>, <NUM> in the commanded position. Depending on the aircraft power supply system and the availability requirements the PCU <NUM> is either purely hydraulically or electrically driven or includes an electric motor <NUM> and a hydraulic motor <NUM> (hybrid PCU) as shown in the present embodiment. For the electric motor <NUM>, a digitally controlled brushless DC motor may be used and for the hydraulic motor <NUM> a digitally controlled variable displacement motor may be used and may be controlled by a hydraulic valve block <NUM>. For the electric drive embodying the electric motor <NUM>, a Motor Control Electronic (MCE) <NUM> is interfacing with the SFCC <NUM>-<NUM>, <NUM>-<NUM> and an aircraft electrical busbar <NUM>-<NUM>, <NUM>-<NUM>. The MCE <NUM> converts the electric power as required for the brushless DC motor. A motor control for the hydraulic and electric drive is established by a closed loop layout to maintain speed and torque command inputs. The control algorithms are implemented, e.g. by software as computer programs, in the control device <NUM> (e.g. in each SFCC <NUM>-<NUM>, <NUM>-<NUM>) which is provided with all required data to control the motors <NUM>, <NUM>. The SFCCs <NUM>-<NUM>, <NUM>-<NUM> of the control device <NUM> control this operation of the flight control surface driving apparatus <NUM> also in response to output signals of load sensors <NUM> and position pick-up units <NUM>, <NUM>. The SFCC <NUM> has a slat control portion <NUM> controlling the operation of the slat driving apparatus <NUM>, and a flap control portion 32f controlling the operation of the flap driving apparatus 104f which is not shown in <FIG>. In one embodiment, the MCE <NUM> comprises a closed-loop controller <NUM> for controlling speed and torque of the electric motor <NUM>. According to another embodiment, the closed loop controller <NUM> is implemented as software within the control device <NUM>, e.g. in any of the SFCCs <NUM>-<NUM>, <NUM>-<NUM>.

The transmission device <NUM> includes a left-hand torque shaft system 56a connected to the left-hand output shaft 42a and a right-hand torque shaft system 56b connected to the right-hand output shaft 42b. Each torque shaft system 56a, 56b comprises a series of the drive shafts <NUM>, connected to each other for a common rotation. A left-hand WTB 26a acts on the last drive shaft <NUM> of the left-hand torque shaft system 56a near the wing tip of the left-hand wing 14a, and a right-hand WTB 26b acts on the last drive shaft <NUM> of the right-hand torque system 56b near the wing tip of the right-hand wing 14b. Further, a position pick-up unit <NUM> picks up the position (e.g. an absolute rotation angle position) of the corresponding last drive shaft <NUM>.

The load in the transmission of each wing 14a, 14b is limited by electronic load limiter (ETL) functionality using the at least one load sensor <NUM>. In the embodiment shown, where the mechanical power is transmitted via rotation, the torque in the transmission of each wing <NUM> is limited by electronic torque limiter functionality. The torque in the torque shaft systems 56a, 56b of the transmission device <NUM> is limited by electronic torque sensing units (TSU) <NUM> including a first torque sensor <NUM>-1a, <NUM>-1b and a second torque sensor <NUM>-2a, <NUM>-2b sensing the torque imposed on the corresponding output shaft 42a, 42b of the POB <NUM>. For example, the TSUs <NUM> are integrated on the PCU outputs to the left-hand and right-hand wing 14a, 14b. The left-hand and right-hand first torque sensors <NUM>-1a, <NUM>-1b are connected to the first SFCC <NUM>-<NUM>, and the left-hand and right-hand second torque sensors <NUM>-2a, <NUM>-2b are connected to the second SFCC <NUM>-<NUM>.

If the TSU <NUM> detects that the torque in one of the PCU output shafts 42a, 42b exceeds a predetermined over torque threshold, the electrical output signal provided by the TSU <NUM> triggers a monitor (implemented as computer program in the control device <NUM>) which initiates a rapid speed reversal and torque control sequence subsequently controlling the torque to a lower level. This ensures that the prescribed loads in the transmission device <NUM> are not exceeded even in case of a jam. Finally, the slat driving apparatus <NUM> is arrested by engaging the POB <NUM> of the corresponding motor <NUM>, <NUM>.

In the default High Lift operating mode the WTBs 26a, 26b are released and the PCU <NUM> is providing the power to operate the high-lift system <NUM> with the commanded speed into any gated position.

For implementing the load sensor <NUM>, any appropriate load sensing principle is possible. For example, the TSU <NUM> which replaces mechanical system torque limiters of conventional flight control surface driving apparatuses comprises appropriate mechanical and electrical components to measure the PCU output torque and to translate it into an electrical output signal (e.g. by Linear Variable Transducer (LVDT)).

In the following a health monitoring procedure for checking proper functionality of the transmission device <NUM> and of the load sensors <NUM> is described with reference to <FIG>. The control device <NUM> contains a corresponding computer program and is configured to command an automatic performance of this functionality check. The functionality check leads to early detection of wear or other possible reasons for beginning deteriorations, improves long-term reliability and helps to avoid unnecessary maintenance work.

Mechanical alterations in the TSU <NUM> (e.g. wear or other alterations of mechanical components which transfer a torsional deflection of the output shaft 42a, 42b into a linear motion sensed by electrical sensors) will have influence on the TSU torque value readings.

An example for a TSU condition check is explained in the following with reference to <FIG>.

<FIG> shows the following signals over the time t:.

The functionality check of the health monitoring method comprises the following steps:.

Referring to <FIG>, the WTB engages at time t1. Further, the control surface drive devise <NUM> receives a command to drive with low speed. After t1, the drive speed signal <NUM> starts to drop. The closed-loop controller <NUM> responds by sending a load command signal <NUM> (MCE torque signal) which rises linearly. Further, since the transmission device <NUM> is blocked, the load sensor <NUM> outputs the load sensor output signal <NUM> which rises linearly. The control device <NUM> determines whether the load sensor output signal <NUM> remains in the predetermined range <NUM>. Further, the control device <NUM> determines whether the load command signal <NUM> remains in the predetermined range <NUM>. If any of the signals <NUM>, <NUM> leaves the predetermined range, a failure message is issued. Otherwise, the test is continued until the load sensor output signal reaches the predetermined ETL over torque threshold <NUM> as mentioned above. According to another embodiment (not shown), the test ends when the load command signal <NUM> reaches a predetermined load limit, for example a threshold which corresponds to the ETL over torque threshold <NUM>.

<FIG> shows for example a TSU integrity check as part of a WTB and/or POB performance test. A preferred embodiment is described in the following in more detail.

As part of the WTB / POB performance test, which is carried out regularly, the following sequence can be used to check the correct function of the TSU <NUM>. The SFCC <NUM>-<NUM>, <NUM>-<NUM> commands the electric drive of the PCU <NUM> with low speed against the engaged WTB 26a, 26b causing stall of the electric drive. The speed control of the PCU electric drive implemented in the SFCC <NUM>-<NUM>, <NUM>-<NUM> is established by a closed speed control loop with an integral part. The output of this speed loop is the MCE torque command signal <NUM> which correspond to a commanded motor torque. Because of the integral part of the controller <NUM>, the MCE torque command signal <NUM> steadily increases during the stall condition. As a consequence, with increasing electric motor torque, the torque at the PCU <NUM> output which is measured by the TSU <NUM> also increases. The TSU Torque reading - load sensor output signal <NUM> - is compared by the SFCC <NUM>-<NUM>, <NUM>-<NUM> to a reference torque value (e.g. MCE torque command signal <NUM> from the speed loop). When the deviation of these two signals <NUM>, <NUM> exceeds a defined threshold, the test is aborted and failed. As long as during motor stall both signals following within an acceptable range the motor drive command remains active until a defined threshold <NUM> is achieved. The test is successfully passed when a defined threshold is achieved (e.g. the ETL trip threshold). The correct function of the TSU <NUM> is proven when the TSU Torque reading is following the rise of the commanded motor torque signal within an acceptable range until the abort condition is achieved.

In case that the speed loop is implemented in the MCE <NUM> the corresponding evaluation will be performed in the MCE <NUM> and the results are sent to the SFCC <NUM>-<NUM>, <NUM>-<NUM>.

In order to reduce maintenance work and to improve long-time reliability, a health monitoring method has been described for checking a functionality of a flight control surface driving apparatus <NUM> using at least one load sensor <NUM> for sensing a load imposed on a control surface drive device <NUM>, the method comprising at least one of the steps:.

Further, a flight control surface drive apparatus <NUM>, a flight control system <NUM> and an aircraft <NUM> comprising a control device <NUM> configured to automatic command conduct of such health monitoring method have been described.

Claim 1:
Health monitoring method for checking a functionality of a flight control surface driving apparatus (<NUM>) comprising a control surface drive device (<NUM>) for generating mechanical power for moving at least one control surface (<NUM>), a transmission device (<NUM>) for transmitting mechanical power from the control surface drive device (<NUM>) to the at least one control surface (<NUM>), at least one brake device (<NUM>) for braking movement of the transmission device, at least one load sensor (<NUM>) for sensing a load imposed on the control surface drive device (<NUM>), and a control device (<NUM>) configured to receive a load sensor output signal (<NUM>) from the at least one load sensor (<NUM>) and to control the control surface drive device (<NUM>) in response to the load sensor output signal (<NUM>), wherein the health monitoring method comprises automatically checking proper functionality of at least one of the at least one load sensor (<NUM>) and the transmission device (<NUM>) by
a) blocking movement of the transmission device (<NUM>) by means of the brake device (<NUM>),
b) commanding the control surface drive device (<NUM>) to apply a load on the transmission device blocked by the brake device (<NUM>), while
c) determining whether at least one load sensor output signal (<NUM>) of the at least one load sensor (<NUM>) remains within a predetermined range (<NUM>).