Design Considerations in Boeing 777 Fly-By-Wire Computers Y. C. (Bob) Yeh Boeing Commercial Airplane Group Flight Systems P. O. Box 3707, M/S 02-KA Seattle, WA 98124-2207 [email protected] Abstract critical avionics systems are defined to illustrate the The new technologies in flight control avionics necessary building blocks for the forward path, from systems selected for the Boeing 777 airplane program pilot inputs to control surface, flight controls electronics. consist of the following: Fly-By-Wire (FBW), ARINC 629 2.0 Outline of New Technologies for 777 Flight Data Bus, and Deferred Maintenance. Controls The FBW must meet extremely high levels of Traditionally, new technologies are introduced for a functional integrity and availability. The heart of the new airplane program, and the 777 is no exception. The FBW concept is the use of triple redundancy for all challenge is the selection of the new technologies which hardware resources: computing system, airplane can best meet the desire for more functionality with electrical power, hydraulic power and communication higher reliability and easier maintainability. That is to paths. say, the incorporation of new technologies is to add value The multiple redundant hardware are required to for our customers. The new technologies selected meet the numerical safety requirements. Hardware directly or indirectly for the flight controls were: redundancy can be relied upon only if hardware faults 1) FBW, 2) ARINC 629, and 3) deferred maintenance. can be contained; fail-passive electronics are necessary 2.1 Outline of the Primary Flight Control Function building blocks for the FBW systems. In addition, FBW computer architecture must consider other fault The outline of the 777 FBW system has been tolerance issues: generic errors, common mode faults, described [6],[13],[14],[15]. The primary flight control near-coincidence faults and dissimilarity. surfaces are illustrated in Figure 1, and an overview of the FBW system is shown in Figure 2. Figure 3 shows 1.0 Introduction the hydraulic power distribution for the Power Control The NASA FBW projects [1],[2] provide the Units (PCUs) to which Actuation Control Electronics numerical integrity and functional availability (ACEs) provide electrical control. requirements for FBW computers. A finding from the research, Byzantine General problem [3], also serves as a 2.2 ARINC 629 Digital Data Bus design consideration to assess robustness of FBW computer architectures. Past Boeing and other industry The ARINC 629 data bus [16] is a time division experiences in dealing with generic faults [4], near- multiplex system. It includes multiple transmitters with coincidence faults [5] provide ground rules for the broadcast-type, autonomous terminal access. Up to 120 Boeing 7J7 FBW program. The experiences on the 7J7 users may be connected together. The users program [6],[7],[8],[9] and the academic research on communicate to the bus using a coupler and terminal as design diversity [10],[11], design paradigm [12] are shown in Figure 3. Terminal access is autonomous. carried over to the 777 FBW program [13],[14],[15]. Terminals listen to the bus and wait for a quiet period before transmitting. Only one terminal is allowed to Furthermore, to certify the 777 FBW program, the transmit at a time. After a terminal has transmitted, three flight controls design and development process considers different protocol timers are used to ensure that it does all requirements from: airplane functional groups, not transmit again until all of the other terminals have certification agencies, customers, in-service experiences, had a chance to transmit. technology trends and design paradigm. The Boeing 777 FBW requirements were then derived and developed. The purpose of this article is to describe the new technologies employed directly and indirectly for the 777 primary flight control system, with an emphasis on the design considerations for the FBW computer architecture. The fail-passive electronics for flight Single Rudder Partial Span Tab Spoilers Elevator (7 Per Side) (Single Span) Slats S tabilizer Double Slotted Flap F laperon Flap Aileron FIGURE 1 777 FLIGHT CONTROL SURFACES SYSTEM SUPPORTING SYSTEMS CARDFILES ARINC HYDIM, WOW 629 (4) EICAS ELMS & MFD AFDCS PSEU ADM S ADMS R/A WES EDIU AIM S ADIRUSAARU PSAS FSEU TAC AU TO SWITCH OFF FLIGHT PFC CONTROL DISCONNECT SPEEDBRAKE DATA BUSES SWITCH (3 ) LEVER SPEEDBRAKE ACTUATOR PFCS TRANSDUCERS SPRING 6 COLUMN POSITION COLUMN 2 COLUMN FORCE ( EACH BREAKOUT WITH 2 OUTPUT SIGNALS) 6 WHEEL POSITION 2 WHEEL FORCE 4 RUDDER P EDAL POSI TION PCUS 4 SPEEDBRAKE POS ITION ACES 2 RUDDER TRIM POSI TION (31) DYNAMIC LOAD A/P BACKDRIVE DAMPER ACTUATORS AFDC AUTOPILOT FLIGHT DIRECTOR COMPUTER ADM AIR DATA MODULE (STATIC AND TOTAL PRESSURES) TRIM ACTUATORS FEEL UNITS 2-COLUMN 2-W HE EL EICAS ENGINE INDICATION AND CREW ALERTING SYSTEM 1-AILERON 2-ELEVATOR, 2-RUDDER PEDAL 1-RUDDER ELMS ELECTRICAL LOAD M ANAGEM ENT SYSTEM VARIABLE MFD MULTIPLE FUNCTIO N DISPLAY 1-AILERON, FIXED AILERON ELEVATOR FEEL PSA POWER SUPPLY ASSEMBLY TRIM 1-RUDDER, FIXED ACTUATORS FSEU FLAP SLAT ELECTRONICS UNIT CMDS AIM S AIRP LANE INF O RM ATIO N M ANAG EM ENT SY STE M TRIM SWITCHES PFC PRIMARY FLIG HT CO MPUTER PITCH & RUDDER TRIM CMDS PSEU PRO XIMITY SW ITCH ELECTRO NICS UNIT GUST SUPPRESSION XDUCRS R/A RADIO ALTIMETER ADIRU AIR DATA INERTIAL REFERENCE UNIT SAARU SECONDARY ATTITUDE AND AIR DATA REFERENCE UNIT ACE ACTUATOR CONTROL ELECTRONICS PCU POW ER CO NTROL UNITS, ACTUATO RS HYDIM HYDRAULIC INTERFACE MODULE WOW WEIGHT ON WHEELS WES WARNING ELECTRONICS SY STEM FIGURE 2 777 PRIMARY FLIGHT CONTROL SYSTEM OVERVIEW R C C R R C C R CBL R L2 CBL L2 L1 C L2 L2 C L R 6 7 8 R C C L2 R 9 L L R L1 L1 R 5 IB S P O IL E R S IB S P O IL E R S 10 R C C L 4 11 L C 3 FLAPERON FLAPERON 12 C 2 13 C 1 R OB SPOILERS OB SPOILERS 14 L2 C C L1 L CBL CBL L L1,C R,L2 C R OB AIL OB AIL L1, L2, C, R DENOTES ACE S0URCE C R CBL L1 C R L2 CABLE C C L2 L L ACE SOURCE L L1 L RUDDER HYDRAULIC LEFT ELEVATOR RIGHT ELEVATOR SOURCE R R NOTE: SPOILERS 4 AND 11 ARE COMMANDED VIA CABLES FROM THE CONTROL WHEEL AND VIA THE ACES FROM THE SPEED BRAKE LEVER. THE STABILIZER IS COMMANDED VIA THE CABLES THROUGH THE AISLE STAND LEVERS ONLY AND OTHERWISE IS COMMANDED THROUGH THE ACES. Figure 3 Primary Flight Controls Hydraulic/ ACE Distribution redundancy beyond that required to achieve the functional integrity for airplane dispatch. Consequently, Figure 4 shows the interconnection of two systems repair of random hardware failures can be deferred to a using an ARINC 629 terminal controller and Serial convenient time and place, resulting in reduction of Interface Module (SIM) which are installed on a circuit dispatch delays or cancellations. board within each Line Replaceable Unit (LRU). The SIM interfaces with the stub cable via a connector on The triple-triple redundant PFC architecture, triple the LRU. The stub cable is then connected to the global channels with triple dissimilar lanes in each channel, data bus via a current mode coupler. has been described [14]. The PFC can be dispatched with one failed lane: maintenance alert is generated for A representation of the main internal logic and data maintenance attention. The PFC can also be dispatched flows within an ARINC 629 terminal controller is with one failed channel: flight deck status message is shown in Figure 5. Data enters through the demodulator generated requiring replacement of a PFC channel and is checked for faults. The receiver circuitry within three flights. monitors all incoming labels and determines which wordstrings are needed. The data needed by the The ADIRS and AIMS architectures can be attached users is sent to the subsystem interface and to summarized as follows. the users. 2.3 Deferred Maintenance The deferred maintenance has been a desirable attribute for customer airlines to enhance airplane dispatch reliability. The deferred maintenance concept mandates the need for the fault tolerant design for the major digital avionics systems such as PFC, ADIRS (Air Data Inertial Reference System) and AIMS (Airplane Information Management System.) Based on Life Cycle Cost study for an optimum redundancy level for airlines, these computer architectures contain one level of 2.3.1 Air Data Inertial Reference System - impact of objects - electrical faults This system evolved from the Air Data Computers - electrical power failure and Inertial Reference Systems on previous airplanes. - electromagnetic environment The system consists of traditional triple-redundant pitot - lightning strike and static ports, whose signals are converted to - hydraulic failure electrical signals by Air Data Modules mounted near the - structural damage probes. Digital signals are sent via Flight Control - radiation environment in the atmosphere ARINC 629 buses to the ADIRU and SAARU for - ash cloud environment in the atmosphere processing, as shown in Figure 6. The ADIRU and - fire SAARU are fault tolerant computers with angular rate - rough or unsafe installation and maintenance sensors and accelerometers mounted in a skewed-axis arrangement [17]. The ADIRU can be dispatched with These common mode concerns led to the FBW one failure of each of the following assemblies: angular requirements for separation of FBW components and rate sensor, accelerometer, processor, and I/O module. FBW functional separation. 2.3.2 Airplane Information Management System 3.1.1 Separation of FBW Components The AIMS is the data cruncher for the following The separation is required for redundant flight functions: 1) flight management, 2) thrust management, control elements including LRUs, associated wiring and 3) display, 4) data communication, 5) central hydraulic lines to the greatest extent possible.