Jet engine control and protection system and method

• US 6,922,625 B2
• Filed: 12/12/2002
• Issued: 07/26/2005
• Est. Priority Date: 12/12/2002
• Status: Active Grant

• Current Assignee: Honeywell International Inc.
• Original Assignee: Honeywell International Inc.
• Inventors: Horvath, Joseph M., Mahoney, Timothy D., Weir, Kenneth S.
• Primary Examiner(s): Black, Thomas G.
• Assistant Examiner(s): Tran, Dalena
• Application Number:
  US10/317,476
• Publication Number:
  US 20040117102A1
• Time in Patent Office: 957 Days
• Field of Search: 701/3, 701/7, 701/8, 701/14, 701/100, 244/75.R, 244/194, 244/76.R, 318/560, 318/562, 318/564, 318/565, 318/567, 318/568.23
• US Class Current: 701/100
• CPC Class Codes: F02C 9/263 by means of fuel metering valves
• CPC Class Codes: F02C 9/28 Regulating systems responsive to plant or ambient parameters, e.g. temperature, pressure, rotor speed F02C9/30 - F02C9/38, F02C9/44 take precedence
• CPC Class Codes: F05D 2270/021 to prevent overspeed
• CPC Class Codes: F05D 2270/094 by using back-up controls
• CPC Class Codes: F05D 2270/304 Spool rotational speed
• CPC Class Codes: G05B 9/03 with multiple-channel loop, i.e. redundant control systems

Abstract

A highly reliable, multi-channel control, monitoring, and protection system includes at least three processors in each of the redundant channels, a main processor, and first and second monitor processors. The main processor performs the main control functions, and the monitor processors mirror one or more of the functions performed by the main processor. The processing performed in the main processor and the monitor processors is continuously compared to determine whether control needs to be shifted to one of the other redundant channels.

Claims

1. A jet engine control and protection system, comprising:

a main processor coupled to receive at least one or more command signals and operable, in response thereto, to determine an appropriate control signal for controlling a jet engine parameter;

a first monitor processor coupled to receive at least one or more command signals and operable, in response thereto, to determine the appropriate control signal, each command signal supplied to the first monitor processor being independent of each command signal supplied to the main processor; and

a second monitor processor coupled to receive at least one or more command signals and operable, in response thereto, to determine the appropriate control signal, each command signal supplied to the second monitor processor being independent of each command signal supplied to the main and first monitor processors.

2. The system of claim 1, wherein:

the system includes N-number of redundant channels, each redundant channel including a main processor, a first monitor processor, and a second monitor processor; and

at least one of the main, first monitor, and second monitor processors in one of the redundant channels is active and implementing one or more functions, while the main, first monitor, and second monitor processors in the other redundant channels are inactive.

3. The system of claim 2, wherein one or more functions in at least one of the active redundant processors is inactivated and the same one or more functions in one of the inactive redundant processors is activated when at least the active first and second monitor processors disagree with the active main processor as to the appropriate control signal.

4. The system of claim 2, wherein at least a portion of each of the active redundant channels is inactivated and at least a portion of one of the inactive redundant channels is activated when at least the active first and second monitor processors disagree with the active channel main processor as to the appropriate control signal.

5. The system of claim 4, wherein, one of the active first and second monitor processors supplies the appropriate control signal if, a predetermined time period after the activation of at least a portion of one of the inactive redundant channels, the disagreement between the active processors persists.

6. The system of claim 1, further comprising:

an input/output (I/O) module coupled to receive at least the control signal from the main processor and operable to supply a conditioned control signal.

7. The system of claim 6, wherein the first and second monitor processors are further operable to issue an overspeed shutdown command.

8. The system of claim 7, further comprising:

logical AND circuitry having an input coupled to each of the first and second monitor processors and operable to supply a shutdown command signal when the first and second monitor processors issue an overspeed shutdown command.

9. The system of claim 1, further comprising:

a main fuel control valve coupled to receive the conditioned control signal from the I/O module.

10. The system of claim 1, wherein the main, first monitor, and second monitor processors are each further coupled to receive one or more monitor signals related to jet engine operability.

11. The system of claim 1, wherein the main processor is further operable to conduct self-check fault detection.

12. A jet engine control and monitoring system, comprising:

a main processor coupled to receive at least one or more command signals and at least one or more monitor signals related to jet engine operability and operable, in response thereto, to determine whether or not a jet engine failure mode is present;

a first monitor processor coupled to receive at least one or more command signals and at least one or more monitor signals related to jet engine operability and operable, in response thereto, to determine whether or not a jet engine failure mode is present, each command signal and each monitor signal supplied to the first monitor processor being independent of each command signal and each monitor signal supplied to the main processor; and

a second monitor processor coupled to receive at least one or more command signals and at least one or more monitor signals related to jet engine operability and operable, in response thereto, to determine whether or not a jet engine failure mode is present, each command signal and each monitor signal supplied to the second monitor processor being independent of each command signal and each monitor signal supplied to the main and first monitor processors.

13. The system of claim 12, wherein:

the system includes N-number of redundant channels, each redundant channel including a main processor, a first monitor processor, and a second monitor processor; and

at least one of the redundant channels is active and implementing one or more functions, while the other redundant channels are inactive.

14. The system of claim 12, wherein one or more functions in at least one of the active processors is inactivated and the same one or more functions in one of the inactive redundant processors is activated when at least the active first and second monitor processors disagree with the active main processor as to whether or not a jet engine failure mode is present.

15. The system of claim 12, wherein at least a portion of the active redundant channel is inactivated and at least a portion of one of the inactive redundant channels is activated when at least the active channel first and second monitor processors disagree with the active channel main processor as to whether or not a jet engine failure mode is present.

16. The system of claim 12, where the main processor is further operable to conduct self-check fault detection.

17. The system of claim 12, wherein the monitor signals received by the main, first monitor, and second monitor processors include at least one of jet engine fan speed and shaft speed.

18. The system of claim 12, wherein the jet engine failure mode includes at least one of jet engine overthrust and jet engine oversped.

19. A jet engine control and protection system, comprising:

N-number of redundant control and protection channels, one of which is active while the others are inactive, each channel including,

a main processor coupled to receive one or more command signals and one or more engine monitor signals related to jet engine operability, and operable, in response thereto, to determine (i) an appropriate control signal for controlling a jet engine parameter and (ii) whether or not a jet engine failure mode is present,

a first monitor processor coupled to receive one or more command signals and one or more engine monitor signals related to et engine operability, and operable, in response thereto, to determine (i) an appropriate control signal for controlling a jet engine parameter and (ii) whether or not a jet engine failure mode is present, each command signal and each engine monitor signal supplied to the first monitor processor being independent of each command signal and each engine monitor signal supplied to the main processor, and

a second monitor processor coupled to receive one or more command signals and one or more engine monitor signals related to jet engine operability, and operable, in response thereto, to determine (i) an appropriate control signal for controlling a jet engine parameter and (ii) whether or not a jet engine failure mode is present, each command signal and each engine monitor signal supplied to the second monitor processor being independent of each command signal and each engine monitor signal supplied to the main and first monitor processors,

wherein at least a portion of the active redundant channel is inactivated and at least a portion of one of the inactive redundant channels is activated when at least the active channel first and second monitor processors disagree with the active channel main processor as to one of;

(i) the appropriate control signal, and

(ii) whether a jet engine failure mode is present.

20. A method of controlling and protecting a jet engine, comprising:

making a first determination of an appropriate control signal for controlling a jet parameter based on one or more first command signals;

making a second determination of the appropriate control signal based on one or more second command signals, each second command signal being independent of each first command signal; and

making a third determination of the appropriate control signal based on one or more third command signals, each third command signal being independent of each first and second command signal.

21. The method of claim 20, further comprising:

making the first, second, and third determinations of whether or not a jet engine failure mode is present using N-number of redundant channels; and

maintaining one of the redundant channels active, while the other redundant channels are inactive.

22. The method of claim 21, further comprising:

making a fourth determination as to whether the second and third determinations of the appropriate control signal disagree with the first determination of the appropriate control signal; and

if so, inactivating at least a portion of the active redundant channel and activating at least a portion one of the inactive redundant channels.

23. The method of claim 20, further comprising:

making a first determination as to whether or not a jet engine failure mode is present based on one or more first signals related to jet engine operability;

making a second determination as to whether or not a jet engine failure mode is present based on one or more second signals related to jet engine operability, each second signal being independent of each first signal; and

making a third determination as to whether or not a jet engine failure mode is present based on one or more third signals related to jet engine operability, each third signal being independent of each first and second signal.

24. The method of claim 23, further comprising:

making the first, second, and third determinations of whether or not a jet engine failure mode is present using N-number of redundant channels; and

maintaining one of the redundant channels active, while the other redundant channels are inactive.

25. The system of claim 24, further comprising:

making a fourth determination as to whether the second and third determinations as to whether or not a jet engine failure mode is present disagree with the first determination as to whether or not a jet engine failure mode is present; and

if so, inactivating at least a portion of the active redundant channel and activating at least a portion of one of the inactive redundant channels.

26. The method of claim 23, wherein the jet engine failure mode includes at least one of jet engine overthrust and jet engine overspeed.

27. The method of claim 26, further comprising:

issuing one or more overspeed shutdown commands if it is determined that the jet engine overspeed failure mode is present.

28. The method of claim 27, further comprising:

shutting down the jet engine when at least two overspeed shutdown commands are issued.

29. In a jet engine protection and control system having N-number of redundant channels, one of which is active and the others of which are inactive, a method of controlling and protecting the jet engine, comprising:

making a first determination in the active channel of an appropriate control signal for controlling a jet parameter based on one or more first command signals;

making a second determination in the active channel of the appropriate control signal based on one or more second command signals, each second command signal being independent of each first command signal;

making a third determination in the active channel of the appropriate control signal based on one or more third command signals, each third command signal being independent of each first and second command signal;

making a fourth determination in the active channel as to whether the second and third determinations disagree with the first determination of the appropriate control signal;

making a fifth determination in the active channel as to whether or not a jet engine failure mode is present based on one or more first signals related to jet engine operability;

making a sixth determination in the active channel as to whether or not a jet engine failure mode is present based on one or more second signals related to jet engine operability, each second signal being independent of each first signal;

making a seventh determination in the active channel as to whether or not a jet engine failure mode is present based on one or more third signals related to jet engine operability, each third signal being independent of each first and second signal;

making an eighth determination in the active channel as to whether the sixth and seventh determinations disagree with the fifth determination as to whether or not a jet engine failure mode is present; and

inactivating at least a portion of the active redundant channel and activating at least a portion of one of the inactive redundant channels if one of the fourth and eight determinations indicates one of a disagreement between the second and third determinations and the first determination, and a disagreement between the sixth and seventh determinations and the fifth determination, respectively.