Architecture of a brake system comprising two computers resistant to double failure, and associated method

The invention relates to a braking system architecture for an aircraft comprising two computers and resistant to a double failure, and a method for managing such an architecture.

BACKGROUND OF THE INVENTION

There are known braking system architectures for aircraft equipped with a plurality of brakes, the architecture comprising at least two braking computers each controlling all of the brakes.

Each computer is divided into two channels, a first channel being adapted to control the brakes while a second channel is adapted to monitor the first channel. If in the active computer, a discrepancy between the channels displayed, the other computer automatically takes over, making this architecture resistant to a single failure.

However, if another failure were to occur on the second computer, braking with all of the brakes can no longer be guaranteed by means of only two computers.

He should either give up work for braking or settle for a degraded braking or provide a third computer.

It is known from US 6,513,885 a braking architecture comprising three primary channels each controlling a part of the brake, and three secondary channels each controlling a part of the brake, so that each part of the brakes can be controlled by a primary channel, and, in case of loss thereof, by the corresponding secondary channel.

OBJECT OF THE INVENTION

The invention aims at providing a braking system architecture offering an enhanced level of security, without using additional computer.

BRIEF DESCRIPTION OF THE INVENTION

According to the invention there is provided a braking system architecture for an airplane fitted with a plurality of undercarriages carrying a plurality of wheels, at least some are equipped with brakes, the architecture comprising at least two braking computers each comprising two modules so that in each computer, one of the modules control a first portion of the brakes and the other module controls a second portion complementary to the first brake, characterized in that the architecture is configured to operate in one of the following operating modes:<ul><li>a first normal mode in which both modules of one of the braking computers are active for controlling all of the brakes;</li><li>a second normal mode in which both modules of the other of the braking computers are active for controlling all of the brakes;</li><li>an alternative mode in which a module of one of the braking computers and one module of the other of the braking computers are active for controlling all of the brakes.</li></ul>

Indeed, there are instances where a dual failures of each of the braking computers module fails, each of faulted modules control part of the brakes complementary to that controlled by the other failed module. The remaining two modules are therefore theoretically capable of ensuring a braking mobilizing all of the brakes of the aircraft.

According to the invention, braking is carried out using two valid modules, thus at full capacity since it is thus possible to control all of the brakes of the aircraft. The architecture of the invention thus obviates the physical cluster modules for simultaneous operation of two modules that do not belong to the same braking computer.

The braking system architecture of the invention is well resistant to at least a certain type of double failure, without resort to an additional computer.

According to a particular aspect of the invention, the modules include first monitoring means configured so that, in each of the operating modes, the two active modules monitor each other.

So that the active modules are in the same computer or in two separate computers, they monitor each other, to ensure the braking with all of the brakes with high security, whatever the mode of operation of the architecture.

Preferably then, each module includes a first card adapted to generate a braking setpoint, and a second card adapted to generate a braking order for each brake associated with the modulation module of the braking order to avoid a slip of said brake, the first monitoring means being associated with the first card modules and adapted to monitor the first card of the other active modules.

More preferably, the first card and the second card of the same module include second monitoring means configured so that when said module is active, the first map and the second map monitor each other.

To this end, the first card and the second card preferably comprise at least one identical input.

According to another aspect of the invention, the braking system architecture is configured to operate also in an emergency mode in which only one of one of the braking computers is active modules.

This arrangement further allows braking with only the brakes associated with the active module.

According to a preferred embodiment of the architecture of the invention, one of the modules of one of the computers is connected to a first power bus, one of the modules of the other ECUs is connected to a second power bus, the other two modules intended to be active together in the alternative mode are connected to a third supply bus.

According to a practical aspect of the invention, each module is configured to perform at least one function other than braking interesting at least one of the undercarriages of the aircraft, such as the orientation of the aircraft on the ground or downhill / tilt said undercarriages.

The invention also relates to an associated method for managing.

BRIEF DESCRIPTION OF DRAWINGS

The invention will be better understood in light of the following description with reference to the appended drawings, of which:<ul><li>Figure 1 which shows schematically a braking architecture of an aircraft according to the invention;</li><li>Figures 2 to 5 which represent the different modes of operation of a braking architecture according to a particular embodiment of the invention.</li></ul>

DETAILED DESCRIPTION OF THE INVENTION

Referring to Figure 1, a braking system architecture for an aircraft comprises two braking computers A, B, each comprising modules, respectively A1, A2 and B1, B2. In the application illustrated here, the aircraft has two main undercarriages each carrying four braked wheels, the brakes are referenced from 1 to 8. The modules A1 and B1 control wheel brakes respectively 1.5 the first undercarriage and brakes 4.8 the second undercarriage wheels, while A2 and B2 modules control the wheel brakes respectively 2,6 and the first undercarriage wheel brakes 3.7 the second undercarriage, as illustrated schematically in FIG.

In reality, the modules A1, A2, B1, B2 do not directly control the brakes. If the brakes are hydraulic technology, the modules send electrical signals to the servo (by a brake) that regulate the pressure in the brakes based on the received electrical signal. If the brakes are of electrical technology, modules send electrical signals to control units (by a brake) that regulate the intensity of current supplied to the electric motors of brakes based on the received electrical signal. In both cases, the electrical signals from the modules can be identical, so that the illustrated architecture may be used on aircraft equipped with hydraulic brakes or electric brakes.

Note that the allocation of brakes controlled by each of the same braking computer module is symmetrical, so that the sudden failure of a module does not cause the trajectory of the aircraft in rolling track deviation.

In normal operation, one of the braking computers A, B is active and thus controls all brakes. The choice of one of the braking computers is active can be done in several ways, known per se. can be permanently used, for example one of the braking computers and one being used only in the event of failure of one that is usually used. alternatively one can also choose to use one or other of the braking computers, changing braking computer on every flight.

All the modules A1, A2, B1, B2 receives, via one or more communication bus 10, electrical information from the cockpit of the aircraft, which are grouped by one or more hubs 9. Among these electrical information, there is in particular a signal from a brake switch by which the pilot indicates whether he wishes a normal braking controlled by the driver, an automatic braking programmed deceleration, or immobilization of the aircraft parking. There are also 11 electrical signals from P pedals operated by the pilot.

Suppose the braking computer A is active. If the module A1 should fail, then the architecture is configured in a known manner to pass over the braking computer B. The latter is able to control all of the brakes, thus ensuring full capacity braking. Braking then continues to be assured in a normal mode of braking.

If, in the first scenario, the module B1 should fail, then the B2 module continues to control half of the brakes (in this case the brakes 2,3,6,7). It is therefore still possible to achieve a braking, even after a double fault, even if braking is provided with half the brakes. It is there in an emergency braking mode.

If in a second scenario, the module B2 should fail, then the architecture is configured according to the invention, ensure the control of all the brakes using the A2 and B1 modules. Indeed, the A2 module controlling the brakes 2,3,6,7 and 1,4,5,8 B1 module controlling the brakes, it is possible to control all of the brakes using these two modules, although, physically, said modules are in two different computers. Thus, this new mode of operation is an intermediate alternative mode between normal and standby mode, allowing control of all brakes, although none of the computers is fully active.

To add an extra level of security, A2 and B1 modules directly receive the pedals 11 signals, which, in case of failure of the communication bus 10, to continue to provide braking of the aircraft according to the indications of pilot data using the pedals.

If, later in the second scenario, the module B1 should fail also, then it is still possible to achieve using the A2 module with a half brakes. We find a fashion emergency operation.

If, alternatively, the module A2 were to fail, then the B1 module remains active, so that braking can be performed with a half of the brakes.

The general principle of the invention having been explained, a preferred embodiment of the invention will now be described in connection with Figures 2 to 5.

As shown in Figure 2, the architecture comprises, as explained, the two computers A and B each separated into two modules, respectively A1, A2 and B1, B2. Here, only the computer A is active for controlling all of the brakes.

Each module here comprises a first electronic card, referred to herein as low speed BV card, adapted to generate a braking setpoint. To this end, the BV map comprises a number of inputs such as the pedal signal 11 of Figure 1, or an automatic braking signal (autobrake).

Each module also includes a second electronic card, known as high-speed card HV, adapted to generate control commands in the direction of the actuators (servo valves for hydraulic brakes or electric motors for electric brake) associated with the brakes controlled by said module . To this end, the unit HV map braking setpoint generated by the corresponding low speed card BV to avoid wheel slip during braking (this, of course, only for the braked wheels controlled by the module). To this end, the HV map comprises a number of inputs from various sensors (wheel rotation, pressure in the circuits) associated with the braked wheels and brakes, to establish this modulation.

The HV card processor is a processor adapted to operate at a faster speed than the processor of the card BV, since the braking setpoint modulation must be developed in real time based on information of instantaneous behavior of the wheels and brakes. This difference in processor speed of the card BV and the card HV is the origin of the name of these cards.

The A1 module is powered by a first supply bus PW1 associated with generators driven by the engines of the aircraft. B2 module is powered by a second supply bus PW2, independent of the first supply bus PW1, and associated with other generators driven by the engines of the aircraft. A2 and B1 modules are powered by a third supply bus PWEss independent of PW1 and PW2 to supply bus, and associated on the one hand to an auxiliary generator driven not by the engines of the aircraft, and other hand to a DC source, such as batteries. Note that a single failure of one of the current sources of power bus PWEss can lead to loss of PWEss power bus.

Thus a single failure affecting the power bus (bus loss of PW1, PW2 loss of the bus, or loss of one of the current sources of PWEss bus) does not lead to the loss of up to one of the four modules .

For clarity, the power supplies shown in Figure 2 are not reproduced in the following figures.

To improve braking safety, the monitoring functions are organized among the cards of the modules of the same computer as follows:<ul><li>BV cards A1 and A2 modules are adapted to monitor each other, for example by implementing the processor of one of BV card verification routines of the proper functioning of any of the cards BV, and vice versa, and by comparing (by software, or by means of logic gates) regularly the braking reference signal generated by a FS cards to the braking reference signal generated by the other of BV cards. This monitoring is symbolized by an arrow between the cards BV of the modules A1 and A2;</li><li>in each module, the cards HV and BV monitor each other, ensuring that the one card processor verifies the operation of the other card processor. This monitoring is symbolized by an arrow between the card BV and the card HV in each module.</li></ul>

Suppose then that module A1 comes to fail, either because PW1 power bus fails, or because one of the maps A1 module detects a failure of the other card.

Then, as explained above, the computer A is disabled, and the relay is transmitted to the second computer B, as shown in Figure 3, where the failing module A1 has been crossed.

Computer B has the same structure as the computer A and operates in the same way as the latter. The arrows symbolize the monitoring carried between a parte BV cards B1 and B2 modules, and secondly between BV and the card HV map of each of B1 and B2 modules.

Now suppose that the module B2 should fail, either because the power PW2 bus fails, or because a discrepancy between the cards BV and HV is detected.

While the architecture is organized to operate using the calculator module A2 and B1 A computer module B, as illustrated in Figure 4 where the failed module B2 was barred. In each of A2 and B1 modules, cards and BV HV monitor each other. According to the invention, the cards BV A2 and B1 modules are also suitable for monitoring each other, although these modulated not part of the same computer.

Finally, in case of failure of the module B1, only the A2 module remains active for only control one half of the brake, as illustrated in Figure 5 where the failed module B1 was barred.

In this respect, and to ensure a level of supervision between BV and the card HV card that goes beyond the control of the performance of the processors, at least one of the dice entries BV map that are necessary to calculate the setpoint braking is duplicated at the HV map. For example here symbolically there is illustrated the electric signal 11 from the P pedals which forms one of the inputs of the BV card, but also an input HV card, so that the HV map may itself proceed on the based on this signal to verify the calculations made by the BV map. This arrangement increases braking safety in this degraded mode of operation where only one of the modules is active. Preferably, this replication is performed on each of the modules.

The architecture of the invention thus allows, in the case of a single failure (a change from normal operation of the computer A to a normal operation of the computer B), or a double failure (passage alternative A2 / B1), to continue to ensure braking with all of the brakes while ensuring a high level of security.

Compared with a conventional architecture in which each computer comprises a first channel commanding all the braked wheels and a second channel monitoring the first channel should be to obtain the same level of security, implement three computers, it which is penalizing both mass in cost, maintenance and operational complexity.

In case of triple fault (switch to emergency mode only A2), the architecture of the invention also ensures braking in emergency mode, with a single module, on half the wheels.

There remains an ultimate fashion emergency brake consisting of the aircraft by means of the parking brake.

In a particular aspect of the invention, the cards BV of the modules are configured to perform other functions as braking itself, such as lowering landing gear, or the orientation of the aircraft on the ground. These functions are generally considered less critical than the braking function. It will be acceptable not to organize surveillance between A2 and B1 modules (during the operation shown in Figure 4) for these functions. Since this monitoring is not organized, these functions will preferably be provided through other means, to ensure sufficient operating safety. For example, lowering landing gear will be provided by gravity, while the orientation of the aircraft on the ground may be provided by differential braking.

The invention is not limited to the particular embodiment described above, but on the contrary covers any variant coming within the scope of the invention as defined by the claims.

In particular, although it was here chosen to focus on the common operation of modules A2 and B1, it is possible, symmetrically, to provide a common operation of A1 and B2 modules. Similarly, it is possible to provide for operations in emergency mode with the A2 and B1 modules.

Finally, although there has been illustrated application of the invention to an aircraft braking architecture has two main undercarriages with four braked wheels, one can of course apply this architecture to other configurations, such as eg an aircraft with two main wing undercarriages and one or two main fuselage undercarriages. We can then consider various brake control schemes by modules. For example, it is conceivable that A1 and B1 modules control the brakes of the wing undercarriages, while A2 and B2 modules control the brakes of the fuselage undercarriages.