Patent Description:
The current practice in the aerospace industry with regards to engine oil verification is to manually check the level of lubricating fluid in the tank using a dipstick prior to every flight. The manual check is a time consuming task for the maintenance team, especially when then engines are not easily accessible.

While some automated engine lubricating fluid verification systems are suitable for their purposes, improvements are needed in the aerospace industry.

<CIT> discloses bearing-sensor integration for a lubrication analysis system and method for an aircraft engine, however D1 does not disclose the use of different levels of reliability for sensing, detecting, indicating and annunciating a fluid level.

According to an aspect of the present invention, there is provided an aerospace engine lubricating fluid level annunciating system in accordance with claim <NUM>.

This aspect may extend to an aircraft comprising the aerospace engine lubricating fluid level annunciating system of any of claims <NUM> to <NUM>, and the first engine (and optionally the second engine).

According to another aspect of the present invention, there is provided a method for annunciating a level of lubricating fluid of at least one aerospace engine in accordance with claim <NUM>.

Any of the features described herein may be used together, in any combination.

The present disclosure is directed to methods and systems for annunciating the lubricating fluid level of an engine, such as a gas turbine engine. <FIG> illustrates a gas turbine engine <NUM> of a type provided for use in subsonic flight, generally comprising in serial flow communication a fan <NUM> through which ambient air is propelled, a compressor section <NUM> for pressurizing the air, a combustor <NUM> in which the compressed air is mixed with fuel and ignited for generating an annular stream of hot combustion gases, and a turbine section <NUM> for extracting energy from the combustion gases. Although illustrated as a turbofan engine, the gas turbine engine <NUM> may alternatively be another type of engine, for example a turboshaft engine, also generally comprising in serial flow communication a compressor section, a combustor, and a turbine section, and a fan through which ambient air is propelled. A turboprop engine may also apply.

An engine lubricating system <NUM> is coupled to the engine <NUM> for providing lubricating fluid thereto. The lubricating fluid provides a fluid barrier between moving parts of the engine <NUM>, to prevent friction and wear. The lubricating fluid also contributes to the cooling of the engine <NUM> and provides sealing and cleaning functions as well. In some embodiments, the lubricating fluid is oil, such as single grade or multi-grade oil. Other lubricating fluids, such as synthetic compositions, may also be used. The lubricating system <NUM> may comprise a fluid pan/sump/tank, one or more pumps, one or more filters, and any other accessory or component used in circulating the lubricating fluid into and out of the engine <NUM>.

Referring to <FIG>, there is illustrated an example embodiment of a system <NUM> for annunciating the level of lubricating fluid of an engine, such as engine <NUM>. The current practice in the aerospace industry is to manually check the fluid level in the tank using a dipstick prior to every flight. While there exists automated systems for annunciating a lubricating fluid level, any such system used in the aerospace industry must comply with applicable safety requirements. This also applies for applications other than aerospace where a failure of the system could lead to catastrophic results. For an aircraft, engine lubricating fluid level falling below a minimum operating level may present a severe failure case as it can lead to engine power loss or damage. For certain types of aircraft, a potential engine power loss warrants a highest reliability level for related functions. The complexity of software-based systems, particularly those forming part of an aircraft fault annunciation system, make it difficult for such systems to have the highest reliability level. The system <NUM>, as illustrated in <FIG>, allows the low lubricating fluid level to be annunciated automatically while respecting industry standards and guidelines for airborne electronic hardware.

For example, the current industry standard for the development of aircraft systems taking into account the overall aircraft operating environment and functions may be found in ARP4754A. This document describes the design assurance concept for application at the aircraft and system level and standardizes the term "development assurance". Another document, RTCA DO-<NUM> provides guidance for the development of airborne electronic hardware and has been recognized by the Federal Aviation Administration (FAA) as a means of compliance for the development assurance of electronic hardware in airborne systems. There are five levels of compliance, A through E, which depend on the effect a failure of the hardware will have on the operation of the aircraft. Development Assurance Level (DAL) A is the most stringent, defined as a "catastrophic" effect, while a DAL E will not affect the safety of the aircraft. Meeting DAL A compliance for complex electronic hardware requires a much higher level of verification and validation than a DAL E compliance. Most avionic platforms are DAL B or DAL C and therefore cannot be used to annunciate a level of lubricating fluid lower than a minimum operating level, as this function must meet DAL A.

The system <NUM> for annunciating the level of lubricating fluid of an engine is provided with an architecture that has its critical and non-critical lubricant-related functions segregated, so as to meet industry regulations such as RTCA DO-<NUM>. It will be understood that the applicability of the system <NUM> goes beyond the guidelines defined by RTCA DO-<NUM> and may be generalized to any requirements associated with the reliability level of the components performing a given function. Critical lubricant-related functions are performed by components having a critical, or highest, level of reliability and non-critical lubricant-related functions are performed by components having a non-critical level of reliability. For the purposes of the present disclosure, a component is deemed to have a critical level of reliability if a comprehensive combination of deterministic tests and analyses can ensure correct functional performance under all foreseeable operating conditions with no anomalous behavior. Conversely, a component that cannot have a correct functional performance ensured by tests and analyses alone cannot be assigned a critical level of reliability and is therefore deemed to have a non-critical level of reliability. There may be multiple levels of non-criticality.

The critical functions are provided in a first section <NUM> and the non-critical functions are provided in a second section <NUM>. The critical lubricant-related functions comprise determining that the lubricant is below a minimum operating level and annunciating this information, and are performed with components having a critical level of reliability, which is equivalent to DAL A for RTCA DO-<NUM>. The expression "annunciate" is used herein to refer to an announcement of the low fluid level, such as through a flashing light, an audio alarm, a text message, or any other type of display of information capable of being produced with components having a critical level of reliability. Non-critical related functions, such as but not limited to maintenance planning, health diagnostics, and other data tracking features, are performed with components having a non-critical level of reliability, and for example may be DAL B or DAL C in accordance with RTCA DO-<NUM>.

In some embodiments, components having a critical level of reliability are non-complex electronic hardware components. This includes deterministic (or binary) logic components, such as Boolean gates, non-complex hardware switches, commercial off-the-shelf (COTS) components, and the like. Firmware, which is understood as a specific class of software that provides low-level control for a device's specific hardware, also falls into the category of non-complex electronic hardware components. All components that measure, process, and display the lubricant level when the lubricant level is below the minimum operating level have a critical level of reliability.

In one example embodiment, the system <NUM> comprises a fluid-level sensor <NUM> coupled to the lubricating system <NUM> of the engine <NUM>. For example, the fluid-level sensor may be of a floating mechanism-type inside a fluid tank of the lubricating system <NUM>, and provide an analog or discrete measurement signal using a network of resistive elements and reed switches. Other types of fluid sensors may also be used, such as load cells, magnetic level gauges, capacitance transmitters and other hydrostatic devices. The fluid-level sensor <NUM> may be any type of fluid sensor that is composed only of non-complex electronic hardware or other components having a critical level of reliability, due to its role in measuring the lubricant level below the minimum operating level.

The measurement signal representative of the fluid level is sent from the fluid sensor <NUM> to a low-level detector <NUM> which processes the measured signal from the fluid sensor <NUM> using components having a critical level of reliability, such as non-complex electronic hardware. The low-level detector <NUM> may comprise one or more Boolean gates or switches that will trigger a low-level indicator <NUM> when the lubricant level is below the minimum operating level. The low-level indicator may be a light, such as a Light Emitting Diode (LED) or other simple mechanical or electronic component having a critical level of reliability. The low-level indicator <NUM> may be part of an aircraft indications system that receives and displays the fluid level, for example in a cockpit of an aircraft. The aircraft indications system may include switches and lights outside of an avionics display. For a non-aerospace application, the low-level indicator <NUM> may be part of equipment operated by an operator.

The low-level detector <NUM> is also coupled to an annunciation and display system <NUM> for performing one or more of the non-critical functions related to the lubricating fluid. All other lubricant-related functions (i.e. other than annunciating a fluid level below a minimum operating level), such as those related to planning the lubricating fluid services where adding fluid is not required or essential for a coming flight, are performed by the annunciation and display system <NUM>. As these functions do not relate to measuring, processing, and displaying the fluid level when the fluid level is below the minimum operating level, the components used for the annunciation and display system <NUM> can have a non-critical level of reliability.

In some embodiments, the annunciation and display system <NUM> is configured to detect faults and/or potential dormancies in the components found in section <NUM>, i.e. the components having a critical level of reliability.

<FIG> illustrates an example embodiment of the system <NUM> as applied to a dual engine aircraft. In this example, a left hand (LH) engine 212A and right hand (RH) engine 212B each have dedicated fluid sensors 214A, 214B, low level detectors 216A, 216B, and low-level indicators 218A, 218B, respectively, all of which have a critical level of reliability. In some embodiments, the fluid sensors 214A, 214B are dual-channel sensors, for added redundancy. Similarly, the low-level detectors 216A, 216B may also be dual-channel. This configuration can achieve higher numerical probability requirements, such as less than <NUM> x <NUM>-<NUM> chances of an inflight shutdown of the engines 212A, 212B.

In some embodiments, the annunciation and display system <NUM> is shared by the LH engine 212A and RH engine 212B. Alternatively, a separate annunciation and display system <NUM> may be provided for each engine. While the example of <FIG> illustrates two engines, there may be more than two engines.

In some embodiments, the signals coming from the low level detectors 216A, 216B are routed to the annunciation and display system <NUM> through one or more engine controller <NUM>. The engine controller <NUM> can be implemented as part of a full-authority digital engine controls (FADEC) or other similar device, including electronic engine control (EEC), engine control unit (ECU), electronic propeller control, propeller control unit, and the like.

The segregation of the critical and non-critical lubricant-related functions as illustrated in <FIG> and <FIG> allow the annunciation and display system <NUM> to have software, including complex software and custom micro-coded components. The system <NUM> may therefore be retrofit to existing avionic platforms having a non-critical level of reliability.

With reference to <FIG>, there is illustrated an example method <NUM> for verifying a level of lubricating fluid of at least one engine. Critical and non-critical lubricant-related functions are segregated, such that critical functions <NUM> are performed independently from non-critical functions <NUM>. The critical functions <NUM> comprise sensing the fluid level at step <NUM>, detecting a fluid level below a minimum operating level at step <NUM>, and annunciating the fluid level below the minimum operating level at step <NUM>. The non-critical functions <NUM> comprise one or more lubricant-related functions at step <NUM>, such as diagnostics, prognostics, and health management excluding annunciating a lubricating fluid level below a minimum operating level.

With reference to <FIG>, an example of a computing device <NUM> is illustrated, which may be used to form part of all of the annunciation and display system <NUM> and/or the engine controller <NUM>. For simplicity only one computing device <NUM> is shown but more computing devices <NUM> may be operable to exchange data. The computing devices <NUM> may be the same or different types of devices. The processing unit <NUM> may comprise any suitable devices configured to implement the non-critical functions <NUM> such that instructions <NUM>, when executed by the computing device <NUM> or other programmable apparatus, may cause the functions/acts/steps performed as part of step <NUM> to be executed. In some embodiments, the annunciation and display system <NUM> is an off-the-shelf component, used in combination with components having a critical level of reliability.

The non-critical functions <NUM> described herein may be implemented in a high level procedural or object oriented programming or scripting language, or a combination thereof, to communicate with or assist in the operation of a computer system, for example the computing device <NUM>. Alternatively, the non-critical functions <NUM> may be implemented in assembly or machine language. The language may be a compiled or interpreted language. Program code for implementing the non-critical functions <NUM> may be stored on a storage media or a device, for example a ROM, a magnetic disk, an optical disc, a flash drive, or any other suitable storage media or device. The program code may be readable by a general or special-purpose programmable computer for configuring and operating the computer when the storage media or device is read by the computer to perform the procedures described herein. Embodiments of the non-critical functions <NUM> may also be considered to be implemented by way of a non-transitory computer-readable storage medium having a computer program stored thereon. The computer program may comprise computer-readable instructions which cause a computer, or more specifically the processing unit <NUM> of the computing device <NUM>, to operate in a specific and predefined manner to perform the functions described herein.

Claim 1:
An aerospace engine lubricating fluid level annunciation system (<NUM>) comprising:
a first fluid level sensor (<NUM>; 214A) for a first engine (<NUM>; 212A), the first fluid level sensor (<NUM>; 214A) having a critical level of reliability where deterministic tests and analyses can ensure correct functional performance under all foreseeable operating conditions with no anomalous behaviour;
a first low-level detector (<NUM>; 216A) coupled to the first fluid level sensor (<NUM>; 214A), the first low-level detector (<NUM>; 216A) having the critical level of reliability;
a first low-level indicator (<NUM>) coupled to the first low-level detector (<NUM>; 216A) for annunciating a fluid level of the first engine (<NUM>; 212A) below a minimum operating level, the first low-level indicator (<NUM>) having the critical level of reliability; and
an annunciation and display system (<NUM>) coupled to the first low-level detector (<NUM>; 216A) and configured for performing lubricant-related functions (<NUM>) other than annunciating the fluid level of the first engine (<NUM>; 212A) below the minimum operating level, the annunciation and display system (<NUM>) having a non-critical level of reliability.