CA2928844A1 - Engine failure management process and device for an aircraft turbine engine - Google Patents

Abstract

This invention concerns an engine failure process with a management system controlling an aircraft engine. During a preparatory step (STPA), at least two failures of the management system apt to occur are identified and saved in the aircraft (1), each failure associated to a failure level to be selected between a first level, for a failure having no impact on piloting the aircraft (1) and a second level. Each first level failure is associated to an authorized flight time. If at least one of the said failures occurs, the failure level of each failure is detected during a detection step (STP4). During a display step (STP6) it is reported that at least a first level failure has occurred, if no second level failure is detected, the flight may thus continue for at least a predetermined amount of time.

Description

Method and device for fault management with a system of management of a turbine engine of an aircraft The present invention relates to a method and a device for management of failures with a management system of a turbine engine of a aircraft. Such an aircraft can notably be a rotorcraft The invention is therefore in the technical field of turboshaft management systems, in particular of a rotorcraft.
A rotorcraft has at least one main rotor participating in the lift, or even the propulsion of this aircraft. This main rotor is rotated by a power plant comprising at least least one engine. Such an engine can be a heat engine, and in particular a turbine engine for example.
For example, a rotorcraft has at least one engine thermally connected mechanically to a gearbox of Power called the main power transmission box.
This power transmission box rotates a rotor mast of the main rotor.
Therefore, an engine can be controlled by a system of management. For example, a turbine engine management system includes a calculator and a fuel dispenser. Such management system can then be a system known by the acronym FADEC corresponding to the English expression Full Authority Digital Engine Control. In addition, the calculator can be known under the acronym EECU corresponding to the English expression Engine Electronic Control Unit, or simply under

2 the acronym ECU corresponding to the English expression Engine Control Unit.
The calculator communicates with various equipment, and including various measuring systems to control the doser of fuel.
In particular, the calculator can communicate with measuring systems determining the value of parameters of thermal engine monitoring. To control a turbine engine, the measuring system can for example measure a rotational speed of a gas turbine engine, a temperature prevailing at the within the turbine engine, a couple developed by an organ of the turbine engine.
The calculator can also communicate with a system avionics of the aircraft to obtain data likely to influence the performance of the controlled thermal engine. By example, the calculator is connected to an anemobarometric system determining the pressure and temperature of the air outside the rotorcraft.
For safety, some organs can be redundant.
For example, the calculator can have two sets of separate calculation each able to control the fuel dispenser. Of such sets are called channels or channels, the calculator being qualified as a two-channel or dual-channel calculator.
Similarly, measurement systems can be redundant, each measuring system communicating with each set of

3 calculation. In addition, each measuring system can communicate through the redundant links with each channel of the computer.
In addition, the management system is monitored in flight for to limit the risk of accidents in case of breakdown.
Thus, a management system is able to detect a plurality of failures by analyzing the data circulating within various organs of the management system.
For example, a calculator can detect a failure of a temperature sensor if this sensor transmits a temperature aberrant to the calculator or a malfunction of the motor.
The various failures of a power plant obviously have distinct impacts on the aircraft and the safety of the flight.
For example, a classification provides, for example, three levels of failures.
The first level of failures identifies failures that have not an impact on the piloting of the aircraft. For example, the loss of a redundant temperature sensor does not have an impact on the steering of the aircraft.
The second and third echelons reference to failures having an impact on the control of the rotorcraft.
If a failure is detected by a management system, this failure can be reported to a pilot. For example, a rotorcraft can include a multifunction display capable of displaying a page listing the

4 faults identified. Such a list is sometimes called Master list in English language.
In addition, a builder can establish a master list minimal equipment. Such a list is also known as the acronym MMEL corresponding to the English expression Master Minimum Equipment List.
For a failure of the first step, the manufacturer may allow the flight for a limited number of hours before repair if such a particular failure occurs. This function is known as the acronym TLD which corresponds to the English term Time Limit Dispatch. Therefore, the manufacturer can associate at least one failure at a flight time allowed in the main list minimal equipment.
As a result, the manufacturer establishes ground faults likely to occur and assign them to a failure level. For some failures of the first rung, the constructor establishes a number authorized flying hours from the moment the failure occurs.
When a single minor failure of first step is signaled by the management system, either theft is prohibited or theft remains possible for the duration specified by the manufacturer.
When the management system detects multiple failures first-level miners or at least one failure of the second step or failure of the third rung, the flight is not allowed.
According to this state of the art, the manufacturer thus establishes the breakdowns can be envisaged and classifies these failures according to a system of classification at three levels. In addition, some breakdowns of the first step may be associated with an authorized flight duration. If a single failure of first step intervenes, the flight can be authorized within the limit of the flight time specified for this failure. In the in other cases, theft is prohibited.

5 This procedure is interesting but necessarily leads to the prohibition of a flight if two minor breakdowns occur. This situation may be harmful for example when the aircraft is found at sea on a platform. This aircraft is then stuck on the platform while the aircraft may eventually join its base.
The document ARP5107 index B of November 2001 makes reference to the aforementioned Time Limit Dispatch function. Acronym ARP corresponds to the English expression Aerospace Recommended Practice.
According to this document ARP5107, if a failure is associated with a failure occurrence rate greater than 100 * 10-6 failure per hour, the breakdown can not be associated with an authorized flight time before repair.
If a failure is associated with a failure occurrence rate between 75 * 10-6 and 100 * 10-6 failure per hour, the fault can be associated with a short flight time authorized before repair.
If a failure is associated with a failure occurrence rate less than 75 * 10-6 failure per hour, the failure may be associated with a long flight time allowed before repair.
This paper suggests that a failure may be associated with a number of hours of flight authorized before repair, this number hours are established based on the occurrence rate of the failure.

6 The document EP1444658 aims to determine in real time, at to know in flight, the probabilities of success of a mission of a time given for example two hours. An algorithm also establishes the authorized flight time following said failure.
According to the method described, a failure rate is assigned to each two-way component of a calculator of a management system.
For each component of a first channel, a constructor determines which components of the second channel are needed to cover normal operation in case of component failure examined from the first way.
Therefore, aircraft systems detect whether a component particular of the first lane is down. If so, a total failure rate is calculated based on failure rates individual components of the second channel required for the normal operation of the management system in case of failure of the particular component concerned.
A predicted flight time remaining before repairing the fault is then established based on this total failure rate.
The predicted flight time is compared to a mission objective, the achievement of the mission being dependent on the comparison performed.
The document DARREN PRESCOTT ET AL: Monte Carlo simulation of aircraft with known faults reliability, maintainability and safety, 2009, ICRm 2009, 8th International Conference on IEE, PISTACAVVAY, NJ, USA, July 20

7 2009, XP031532994 pages 532-535 is known. This document presents the implementation of four categories of breakdowns.
Document US 2012/078463 is also known.
The object of the present invention is therefore to propose a method alternative fault analysis on an engine management system an aircraft to determine whether the aircraft can fly following at least failure.
The invention therefore relates to a fault management method with a management system controlling an aircraft engine for determine whether the aircraft can fly following at least one failure, the management system comprising at least one computer provided with two calculation channels as well as a fuel dispenser and a system of measurement, at least one control channel connecting each channel of calculation to a fuel dispenser. The measuring system has a plurality of measuring members, each measuring member being connected to each calculation channel of the calculator for transmitting at least one information relating to the operation of the aircraft at each calculation. Each measuring device is to be chosen from a list including at least one measuring device of an avionics system of the aircraft and a measuring device measuring at least one piece of information relating to a engine monitoring parameter.
During a preparation step at least two failures of management system likely to occur are memorized in the aircraft.
Each failure is associated with a level of failure to choose between a first level for a failure having no impact on the

8 piloting of the aircraft and a second level for a breakdown having a impact on the piloting of the aircraft.
The term failure cited in isolation refers on the one hand to a failure of a single component called elementary breakdown, and on the other hand to a combination of basic breakdowns called breakdown multiple that occur during a flight of the aircraft.
A combination of elementary breakdowns of the first level can lead to a multiple failure of first level or second level. For example, an aircraft may have two torque meters for security purposes. The malfunction of a single torque meter is a elementary failure of first level. On the other hand, the joint breakdown of the two torque meters is a second level multiple failure.
A builder therefore establishes a list of faults including basic failures and / or multiple failures, each failure being associated with a level of failure.
In addition, at least each breakdown of the first level is associated at a flight time authorized following the occurrence of the failure and before repair of this failure, each authorized flight time being stored in the aircraft.
During a fault detection step, it is determined whether at at least one of these failures occurs.
During an evaluation step, the level of failure is determined each failure detected during the detection step, using the data established during the preparation stage.
During a display stage, a pilot is informed that less a failure of first level occurred if no failure

9 detected is a second level fault, the theft can then be continued for at least a predetermined period of time by the constructor regardless of the first level failure detected.
The aircraft is thus equipped with at least one engine, such as an engine thermal. The operation of each motor is controlled by a Management system.
This management system is provided with a calculator comprising at least two calculation channels per security. Each calculation channel communicates with conventional measuring devices measuring controlled engine parameters. In addition, each calculation channel can communicate with an avionics system, and for example with a power supply system, a measuring device measuring information useful for the operation of the engine and a unit of the avionics system.
According to the invention, a constructor therefore lists beforehand the use of the aircraft from aircraft breakdowns likely to occur produce. This preparation step is carried out by applying the known techniques.
In addition, the manufacturer determines a failure level for each breakdown. Any faults that can be detected by the aircraft are classified according to at least two levels.
The first level is assigned to each minor failure not an impact on the flyability of the aircraft. A failure having no impact on the flyability of the aircraft may be particularly breakdown having no impact on the operation of at least one thermal engine being for example automatically processed.

Conversely, the second level is assigned to each failure having an impact on the flyability of the aircraft. This second level can be decomposed into at least two sub-levels for example.
So, the second level can be broken down into a first 5 sub-level and a second sub-level of failure. The classification then presents three levels of failure, namely the first level of breakdown corresponding to the first step mentioned above, the first sub-level of failure that represents a corresponding second level at the second step above, and the second sub-level of failure

10 which represents a third level corresponding to the third aforementioned step Therefore, the first sub-level is conferred on major malfunctions affecting the control of the engine, this engine operating with minimal degradation as a result of treatment of the breakdown. The second sub-level groups the failures leading to the loss of control of the fuel dispenser and therefore to the loss of the power developed by the engine.
In addition, first-level failures have no impact on the flyability of the aircraft, the flight is likely to be authorized for a while before being repaired.
Therefore, the manufacturer assigns an authorized flight time before repair at least at each first level failure.
Optionally, at least one second level failure is also associated with an authorized flight time.
As a result and prior to the use of the aircraft, at least two lists of failures are for example established during the step of preparation, namely a list of failures of the first level associating

11 each first-level failure at a permitted flight time and a list of failures of the second level possibly associating at least a second level fault at an authorized flight time. These lists faults are stored and embarked in the aircraft.
When using the aircraft, the equipment of the aircraft examine the operation of the power plant during the step fault detection.
If at least one failure occurs, the equipment of the aircraft determine the nature of the failure ie the level of the breakdown in using the lists of failures stored and embedded in the aircraft.
Finally, if no fault detected is a failure of second level, a display indicates the occurrence of at least one failure of first level. The flight can then be continued for at least one predetermined time by the manufacturer before the failure of the aircraft is not repaired.
For example, the calculator channels of a calculator can be connected to an outdoor temperature sensor of the avionics system.
A first level failure can then correspond to the loss of the information transmitted by the temperature sensor. If such breakdown occurs, the flight may be continued for at least predetermined duration.
A first degree of reporting therefore consists of signaling the presence of first level failures.
When a message is displayed to indicate the presence of less a first-level breakdown, the equipment of the aircraft

12 announce the presence of one or more failures of first level.
The pilot does not know at this point what are the first failures level and their number. All first level failures can be present at the same time.
Nevertheless, the pilot knows that in this case the flight remains possible for at least the predetermined duration.
On the other hand, a second level breakdown may lead to the ban on theft, at least in the presence of passengers.
A second level of reporting consists of examining the individual nature of failures to determine if the failures allow a flight time greater than the predetermined duration.
Document ARP5107 proposes to determine a flight time allowed if a failure occurs based on an occurrence rate breakdowns. EP 1444658 proposes to establish in flight a predicted flight time.
The invention follows another strategy. This invention proposes categorize failures to determine if a failure is a failure minor that does not impact the flyability of the aircraft. The the presence of minor breakdowns of this type does not entail the direct immobilization of the aircraft, the aircraft still being able to fly at least for the predetermined duration.
In the framework of a so-called Offshore mission in language English, this function allows a pilot to return the aircraft to its original base in case of minor breakdowns, and does not oblige the aircraft to stay at sea for example.

13 This process can then increase the availability of the aircraft in the case of minor breakdowns.
In addition, this method is easily usable for a pilot because the pilot does not have to perform an analysis of the faults present. The simple display of first-level breakdowns allows the pilot to know that the aircraft is at least capable of flying for the duration predetermined.
This method may further comprise one or more of additional features that follow.
For example, each failure is to be chosen from a list comprising:
- a failure causing the absence of transmission of a said information by the measuring system to at least one calculation way, - a failure causing the transmission to the computer of a information by the measuring system having a value identified as abnormal, - a failure causing transmission by the system of measuring a first value to a calculation channel does not not a second value passed to the other calculation path for the same information.
We therefore mean by failure, a real incident preventing by example the transmission of information to the system calculator management, or the transmission of erroneous information or inconsistent with other information.

14 The constructor then memorizes during the preparation stage all failures meeting at least one of the above criteria.
In addition, a failure of the first level without impact on the pilot is a failure which does not alter the functioning of the engine.
Conversely, a second level failure having an impact on the steering is a failure that causes the system to malfunction.
management requiring the implementation of at least one procedure described in a flight manual.
In another aspect, the predetermined duration is less than or equal to each authorized flight time.
In addition, the predetermined duration corresponds to the duration necessary to complete a mission and return to a point of departure.
As an illustration, when an aircraft is heading towards a platform at sea from an original ground base, the pilot knows that the aircraft can reach the platform and return to the base original.
Therefore, the predetermined duration can be equal to 5 hours.
In addition, a list of values that can be assigned to a authorized flight time is established, each value of the said list of values being associated with a degree of criticality of a failure, during the preparation step, the degree of criticality of the each breakdown that is associated with an authorized flight time and assigns to the flight time allowed for a fault examined the value corresponding to the degree of criticality of this failure examined.

According to this variant, the constructor establishes a list of values likely to constitute an authorized flight time.
For example, an authorized flight time may be equal to one of the following values: 100 hours, 50 hours, 15 hours and duration 5 predetermined.
Each value is associated with a degree of criticality. according to the previous example, the first degree of criticality is then associated with authorized flight time equal to the predetermined duration, the second degree of criticality being associated with an authorized flight time of 15 10 hours, the third degree of criticality being associated with flight time 50 hours, the fourth degree of criticality being associated with an authorized flight time equal to 100 hours.
For each failure to be associated with an authorized flight time, the constructor determines a degree of criticality to determine the time

15 of flight authorized to associate with this failure.
The degree of criticality can be defined in relation to the operational consequences of the failure examined and to probability of loss of motor function following breakdown examined. This degree of criticality is determined during an analysis said AMDEC analysis well known to those skilled in the art.
AMDEC stands for Analysis of Modes Failure, Effects and Criticality.
The invention can then provide not one but two degrees of reporting of faults.

16 When carrying out the process, the first degree of signaling consists, for example, in signaling the presence of breakdowns first level.
The second level of reporting consists in presenting to less information to determine if flight times allowed faults that have occurred allow you to fly for a total duration greater than the predetermined duration. This total duration is then equal to the lowest allowed flight time for all failures occurred.
For example, if two failures are associated respectively at two authorized flight times of 50 hours and 100 hours, the aircraft can fly 50 hours before being repaired.
Eventually, a message indicates the presence of first level and the lowest allowed flight time.
Reporting levels can also be implemented successively.
For example, during a step of refining flight time authorized before repair, a detailed list of breakdowns occurred, the remaining flight time before repair being equal to the lowest flight time for failures.
The detailed list of faults present must be analyzed by an operator.
According to a first degree of reporting, the presence of breakdowns first level is reported.

17 According to the second degree of reporting, detected failures are displayed, for example by being classified according to their degree of criticality.
Moreover, during the display stage, it is possible to report to a pilot that at least one first-level failure occurred in displaying a single generic formulation.
Expression generic formulation refers to a wording announcing the presence of at least one failure of the first level without detailing failures.
All first level failures are grouped under one generic name and presented to the pilot.
The displayed message can then include the flight time authorized minimum.
In addition, during the display stage, it is possible to signal to a pilot that at least a second level failure has occurred if at least a fault detected is a second level fault.
If the displayed message corresponds to major breakdowns of second level, the pilot knows that the aircraft can not fly again until the maintenance actions have been performed.
Moreover, during the preparation stage, at least one second level failure can be associated with a flight time authorized, the flight being authorized only in the absence of a passenger.
According to this variant, certain major breakdowns can also give rise to a limited-time flight authorization. Nevertheless and in this case, the flight is limited to a technical flight performed without passengers.

18 In addition to a method, the invention relates to a management device equipped with at least one engine management system of one aircraft to determine whether the aircraft can fly following at least one breakdown.
The management system includes at least one computer provided with two calculation channels as well as a fuel dispenser and a measuring system, at least one control channel connecting each calculation channel to a fuel metering device, said measuring system comprising a plurality of measuring members, each measurement being connected to each calculation channel to transmit at least information relating to the operation of the aircraft at each lane calculation method, each measuring element being chosen from a list including at least one member of an avionics system of the aircraft and a measuring device measuring at least one piece of information relating to a engine monitoring parameter.
The fault management device then applies the method described above, said fault management device comprising:
a memory unit storing each identified fault during the preparation stage, as well as the level of each breakdown and the authorized flight time for at least the breakdowns of the first level, a processing unit implementing the step of fault detection and evaluation step, a display unit implementing the display step

19 The avionics system comprising a calculation unit, said processing unit may comprise at least one of the equipment following: said computing unit, said computer of the system of management.
The implementation of the method can be carried out in the management system calculator or in a calculation unit of the avionics system or any other calculator that has all information and has a security level sufficient.
In addition to a management device, the invention relates to an aircraft.
The aircraft is provided with at least one engine.
This aircraft includes a fault management device of the type previously described.
The invention and its advantages will appear in more detail as part of the following description with examples given in illustrative title with reference to the appended figures which represent:
FIG. 1, a diagram illustrating an aircraft according to the invention, and FIG. 2, a diagram illustrating the method according to the invention.
The elements present in several distinct figures are assigned a single reference.
Figure 1 shows an aircraft 1 according to the invention.

In particular, this aircraft can comprise at least one rotor 2 participating in the lift and / or propulsion of the aircraft.
The aircraft can then be a rotorcraft for example.
In addition, the aircraft 1 may comprise a box of 5 power transmission 3 rotating the rotor 2.
To set the transmission gearbox in motion Power 3, the aircraft includes a power plant 4.
This power plant 4 is provided with at least one motor 5.
For convenience, Figure 1 shows a single motor 5.
Each engine 5 may be a heat engine, such as a turbine engine for example.
Conventionally, each motor 5 can be controlled by a management system 10, such as a FADEC type system.
The term management system then refers to a system 15 controlling the operation of an engine.
Each management system 10 comprises a calculator of management says more simply calculator 15. This calculator is from ECU type for example.
Therefore, the calculator can be provided with two calculation channels

20 16, 17 distinct for security. The calculation channels 16, 17 communicate with each other.
Each calculation channel 16, 17 can then be respectively equipped with a processor 16 ', 17' or equivalent, and a unit of storage 18, 18 'able to store information and instructions.

21 The storage unit can store code segments of software and values of variables.
Each calculation channel can communicate with a system avionics 50 of the aircraft. The term avionics system makes reference to all electronic, electrical and computers that assist in the piloting of aircraft, with the exception of management systems.
In particular, each calculation channel can be connected to a power supply system 55.
In addition, each calculation channel can communicate with equipment 51, 52 of the avionics system through a system interfaces 19.
In addition, each management system 10 has a metering device fuel 20. The fuel dispenser 20 controls the flow of fuel passed to the engine 5 controlled by this management system 10.
Therefore, each calculation channel 16, 17 communicates with the fuel dispenser by a control channel 21, 22 for position the fuel dispenser in the proper position.
In particular, to determine this appropriate position, each management system includes a measurement system.
measuring system refers to a system determining the value of parameters used to control the motor 5. These parameters include at least one information relating to the operation of the aircraft, and in particular the operation of the controlled engine.

22 This measuring system 30 is provided with a plurality of members conventional measurement 31, 52 connected to each calculation channel. Each measuring unit is connected to each calculation channel 16, 17 by a link route 33.
Therefore, the measuring system may include at least one measuring member 31 measuring at least one piece of information relating to a engine monitoring parameter 5.
For example, at least one measuring member 31 is to be chosen in a catalog comprising: a speed measuring device measuring a rotational speed of an engine gas generator, a temperature measuring device measuring a temperature at inside the engine, a torque meter measuring a developed torque by the engine.
In addition, each calculation channel can receive information from measuring devices 52 of the avionics system, through of the interface system 19 for example.
In particular, measuring devices 52 can measure a external pressure PO and an outside temperature TO of the air ambient outside the aircraft.
In addition, the aircraft includes a device for managing the failures 40 to manage failures of the power plant.
This fault management device 40 includes each system of management 10, and possibly at least one system equipment avionics.

23 Therefore, the fault management device 40 includes a processing unit 60 cooperating with a memory unit 65 and a display unit 70.
Each computer can be part of the processing unit 60, the memory unit 65 comprising the storage units 18 of this computer.
Similarly, the processing unit 60 may comprise a unit of calculation 51 of the avionics system. Such a calculation unit can include a processor 53 or equivalent, and a storage unit 54. The memory unit 65 may comprise the storage unit 54 of the unit of calculation.
In addition, the management device includes a display unit 70 connected to the processing unit. The display unit 70 is particularly provided with a screen 71. Such a display unit may comprise a multifunction display, such as the known multifunction display that displays a list called MASTER LIST in English language. Such a MASTER LIST usually displays fault information reported by the aircraft systems.
The fault management device 40 applies the method according to the invention illustrated in FIG.
During a preparation step, a list of failures in the aircraft before use of the aircraft. This list of failures classifies failures of the management system that may occur, each failure being associated with a level of failure and possibly at a permitted flight time before a repair must be undertaken.

24 For example, the STPA preparation step can be decomposed into an STP1 analysis step, a step of STP2 classification, and a step of assigning a flight time authorized STP3.
During the STP1 analysis step, at least two failures of the management system likely to occur are identified.
Therefore, the builder studies the various equipment of the management system to perform a fault analysis.
In particular, all failures that cause the absence of transmission of information by the measuring system 30 to least one calculation channel 16, 17 can be identified.
In addition, faults that cause transmission to each calculator 15 of information by the measuring system 30 having a value identified as abnormal, can be identified.
A value is abnormal for example if this value is not within a range of theoretical values. For example, if the temperature determined by a sensor is not included in a predetermined range, the calculator receiving this information in deduce the presence of a failure.
In addition, breakdowns that cause transmission by the measuring system 30 from a first value to a calculation channel 16 not corresponding to a second value transmitted to the other channel 17 for the same information, can be identified.
For example, the value of the temperature measured by a temperature sensor received by the first calculation channel 16 is different from the value of that same temperature received by the second way of calculation. The calculating voices 16, 17 communicating between them to check the consistency of the information received, the calculator deduces the presence of a failure.26 In addition, during the STP2 classification stage carried out for 5 each of these failures, each failure is associated with a level of breakdown.
This method suggests establishing a first level of failure and a second level of failure having different impacts on the aircraft.
Second level failures are more severe than 10 first level.
In fact, the failures of the first level correspond to failures having no impact on the aircraft's controllability. By example, a failure without impact on the piloting is a failure not altering the operation of the motors 5.
Conversely, a failure having an impact on the piloting is a failure causing a malfunction of the management system.
such failure requires the implementation of at least one procedure described in a flight manual.
Optionally, the breakdowns of the second level can be 20 broken down into a plurality of sub-levels according to their impact on the operation of the engine and the aircraft.
The constructor then lists all the faults identified and assigns each failure to a level of failure.
During a step of assigning an authorized flight time STP3,

25 the manufacturer assigns, at least each failure of the first level at a permitted flight time. This authorized flight time

26 corresponds to the duration during which the aircraft can fly if the examined failure occurs.
Optionally, an authorized flight time is also assigned to failures of the second level.
In addition, the authorized flight time is greater than or equal to a predetermined duration. Thus, each breakdown associated with a time authorized flight is likely not to impede the flight during the minus the predetermined duration.
This predetermined duration may correspond to the duration necessary to complete a mission and return to a point of starting, being for example substantially equal to 5 hours.
In addition, the authorized flight time assigned to a breakdown may be chosen from a list pre-established by the manufacturer.
For example, the method suggests establishing a list of values can be assigned to an authorized flight time. Each value of this list of values corresponds to a degree of criticality of a failure.
This degree of criticality is defined in relation to the consequences the failure examined and the probability of the loss motor function following the failure examined.
Therefore, during the step of assigning a permitted flight time STP3, the method proposes to determine the degree of criticality of each breakdown.
The builder studies the failure examined, and assigns it a degree of criticality depending on the consequences of this failure. from then, the manufacturer assigns to the fault examined the flight time authorized to the degree of criticality of this failure examined.

27 At the end of the preparation stage, system failures likely to occur are listed, each failure being associated with a level of breakdown or even a permitted flight time.
These failures as well as their breakdown level and flight time corresponding allowed are stored in the memory unit. By For example, at least one database identifies failures and related information.
At the end of the preparation stage, the aircraft can be used during an STPB functional step. The STPB functional step performs the following steps iteratively and successively.
During an STP4 detection step, the processing unit 60 monitors the operation of management systems to detect possible breakdowns.
If a failure is detected, during an evaluation step STP5, the processing unit 60 solicits the memory unit 65 for determine the level of failure of each fault detected.
Therefore during a STP6 display step, the unit of processing 60 solicits the display unit 70 to signal that at least a first level failure occurred if no fault was detected is a second level failure. For example, a message is displayed in the list called MASTER LIST.
For example, the screen 71 displays a single formulation generic such as first-level failure to report the presence of at least one first level failure, if only first level breakdowns appeared.

28 If only first-level failures have occurred, the predetermined time of each first level failure being less than the predetermined duration, the pilot knows that the flight may be continued for at least the predetermined duration.
Therefore, the pilot can devote himself to piloting the aircraft without seeking to know the nature of the breakdowns.
However, during a STP7 flight time refinement step authorized before repair, the processing unit can display a list detailed breakdowns occurred at the request of a pilot for determine if the allowed flight time may be greater than the duration predetermined.
In addition, the processing unit can display a refined duration of which can be achieved, this refined duration being equal to the time of the lowest flight of failures.
According to one variant, the message signaling the presence of least a first-level failure contains this refined duration.
If necessary, the processing unit requests the display unit to signal to a pilot that at least one second level failure is occurred if at least one fault detected is a failure of second level.
If the second level fault is associated with a flight time authorized, the flight may be authorized in the absence of a passenger only during this flight time authorized before a repair be business.
Naturally, the present invention is subject to many variations as to its implementation. Although several

29 embodiments have been described, it is clear that it is not not conceivable to exhaustively identify all the modes possible. It is of course conceivable to replace a means described by equivalent means without departing from the scope of this invention.

Claims (16)

30 1. Failure management method with a management system (10) controlling an engine (5) of an aircraft (1) to determine whether the aircraft (1) can fly following at least one failure, said management (10) comprising at least one calculator (15) provided with two calculation channels (16, 17) as well as a fuel dispenser (20) and a measuring system (30), at least one control channel (21, 22) connecting each calculation channel (16, 17) to a fuel dispenser (20), said measuring system (30) having a plurality of measurement (31, 52), each measuring element being connected to each channel calculation method (16, 17) for transmitting at least one relative information the operation of the aircraft at each calculation channel (16, 17), each measuring device being chosen from a list including at least one least one measuring member (52) of an avionics system (50) of the aircraft (1) and a measuring member (31) measuring at least one information relating to an engine monitoring parameter (5), characterized in that.
during a preparation step (STPA), it is stored in the aircraft at least two breakdowns of the management system likely to occur, each failure being associated with a level of failure to choose between a first level for a breakdown having no impact on the piloting of the aircraft (1) and a second level for a failure having an impact on the piloting the aircraft (1), at least each failure of the first level being associated with a memorized flight time memorized following the occurrence of the breakdown and before repairing this breakdown, during a detection step (STP4) of the breakdowns, determines if at least one of said failures occurs, - during an evaluation step (STP5), the level of failure of each failure detected during the step of detection (STP4), - during a display step (STP6), a pilot is signaled that at least a first level failure occurred if no fault detected is a second level failure, the the flight can then be continued for at least one predetermined by the manufacturer regardless of the failure of first level detected. 2. Method according to claim 1, characterized in that each failure is to be selected from a list comprising:
- a failure causing the absence of transmission of a said information by the measuring system (30) to at least one calculation channel (16, 17), - failure causing transmission to the computer (15) information by the measuring system (30) having a value identified as abnormal, - a failure causing transmission by the system of measuring (30) a first value to a calculation channel (16) does not correspond to a second value transmitted to the other calculation channel (17) for the same information. 3. Method according to any one of claims 1 to 2, characterized in that a failure without impact on the steering is a failure that does not alter the operation of said engine (5). 4. Method according to any one of claims 1 to 3, characterized in that a failure having an impact on the steering is a failure that causes a malfunction of the management system (10) requiring the implementation of at least one described procedure in a flight manual. 5. Method according to any one of claims 1 to 4, characterized in that said predetermined duration is less than or equal to each authorized flight time. 6. Process according to any one of claims 1 to 5, characterized in that said predetermined duration corresponds to the time required to complete a mission and return to a point departure. 7. Method according to any one of claims 1 to 6, characterized in that said predetermined duration is equal to 5 hours. 8. Process according to any one of claims 1 to 7, characterized in that a list of values assignable to a authorized flight time is established, each value of the said list of values being associated with a degree of criticality, during the step of preparation (STPA), the degree of criticality of each failure associated with an authorized flight time and is assigned to the time of flight authorized for a failure examined the value corresponding to the degree of criticality of this failure examined. 9. Process according to claim 8, characterized in that the degree of criticality is defined with respect to the operational consequences of the failure examined and to probability of loss of motor function following breakdown examined. 10. Process according to any one of claims 1 to 9, characterized in that during a refining step (STP7) of time authorized before repair, a detailed list of failures occurred, the remaining flight time before repair being equal the lowest flight time for failures. 11. Process according to any one of claims 1 to characterized in that during the display step (STP6), it is signaled to a driver that at least a first-level failure occurred in displaying a single generic formulation. 12. Process according to any one of claims 1 to characterized in that during said display step (STP6), signals to a pilot that at least one second-level failure is occurred if at least one fault detected is a failure of second level. 13. Process according to any one of claims 1 to characterized in that during the preparation step (STPA), at least a second level fault is associated with an authorized flight time, the flight being authorized in the absence of a passenger only. 14. Fault management device (40) having at least one management system (10) of an engine (5) of an aircraft (1) for determining whether the aircraft (1) can fly following at least one failure, said management system (10) comprising at least one calculator (15) provided with two calculation channels (16, 17) and a metering device fuel (20) and a measuring system (30), at least one control (21, 22) connecting each calculation channel (16, 17) to a metering device of fuel (20), said measuring system (30) having a plurality of measuring members (31, 52), each measuring member (31, 52) being connected to each calculation channel (16, 17) for transmitting at least one information relating to the operation of the aircraft (1) each calculation channel (16, 17), each measuring element being choose from a list including at least one measuring device (52) an avionics system of the aircraft and a measuring member (31) measuring at least one information relating to a parameter of engine monitoring (5), characterized in that said fault management device (40) applies the method according to any one of claims 1 to 13, said fault management device (40) comprising:
a memory unit (65) configured to memorize each failure identified during the preparation stage (STPA), as well as the level of each breakdown and the authorized flight time for at least the breakdowns of the first level, a processing unit (60) configured to implement the detection step (STP4) of the breakdowns and the step (STP5), a display unit (70) configured to implement the display step (STP6). 15.
Fault management device according to claim 14, characterized in that said avionic system (50) comprising a computing unit (51), said processing unit (60) comprises at least one of the following equipment: said computing unit (51), said calculator (15). 16. Aircraft (1) with at least one engine (5), characterized in that said aircraft (1) comprises a device for fault management (40) according to any one of claims 14 at 15.