Design Considerations in Boeing 777 Fly-By-Wire Computers

The new technologies in flight control avionics systems selected for the Boeing 777 airplane program consist of the following: Fly-By-Wire (FBW), ARINC 629 Data Bus, and Deferred Maintenance. The FBW must meet extremely high levels of functional integrity and availability. The heart of the FBW concept is the use of triple redundancy for all hardware resources: computing system, airplane electrical power, hydraulic power and communication paths. The multiple redundant hardware are required to meet the numerical safety requirements. Hardware redundancy can be relied upon only if hardware faults can be contained; fail-passive electronics are necessary building blocks for the FBW systems. In addition, FBW computer architecture must consider other fault tolerance issues: generic errors, common mode faults, near-coincidence faults and dissimilarity. 1.0 Introduction The NASA FBW projects [1],[2] provide the numerical integrity and functional availability requirements for FBW computers. A finding from the research, Byzantine General problem [3], also serves as a design consideration to assess robustness of FBW computer architectures. Past Boeing and other industry experiences in dealing with generic faults [4], nearcoincidence faults [5] provide ground rules for the Boeing 7J7 FBW program. The experiences on the 7J7 program [6],[7],[8],[9] and the academic research on design diversity [10],[11], design paradigm [12] are carried over to the 777 FBW program [13],[14],[15]. Furthermore, to certify the 777 FBW program, the flight controls design and development process considers all requirements from: airplane functional groups, certification agencies, customers, in-service experiences, technology trends and design paradigm. The Boeing 777 FBW requirements were then derived and developed. The purpose of this article is to describe the new technologies employed directly and indirectly for the 777 primary flight control system, with an emphasis on the design considerations for the FBW computer architecture. The fail-passive electronics for flight critical avionics systems are defined to illustrate the necessary building blocks for the forward path, from pilot inputs to control surface, flight controls electronics. 2.0 Outline of New Technologies for 777 Flight Controls Traditionally, new technologies are introduced for a new airplane program, and the 777 is no exception. The challenge is the selection of the new technologies which can best meet the desire for more functionality with higher reliability and easier maintainability. That is to say, the incorporation of new technologies is to add value for our customers. The new technologies selected directly or indirectly for the flight controls were: 1) FBW, 2) ARINC 629, and 3) deferred maintenance. 2.1 Outline of the Primary Flight Control Function The outline of the 777 FBW system has been described [6],[13],[14],[15]. The primary flight control surfaces are illustrated in Figure 1, and an overview of the FBW system is shown in Figure 2. Figure 3 shows the hydraulic power distribution for the Power Control Units (PCUs) to which Actuation Control Electronics (ACEs) provide electrical control. 2.2 ARINC 629 Digital Data Bus The ARINC 629 data bus [16] is a time division multiplex system. It includes multiple transmitters with broadcast-type, autonomous terminal access. Up to 120 users may be connected together. The users communicate to the bus using a coupler and terminal as shown in Figure 3. Terminal access is autonomous. Terminals listen to the bus and wait for a quiet period before transmitting. Only one terminal is allowed to transmit at a time. After a terminal has transmitted, three different protocol timers are used to ensure that it does not transmit again until all of the other terminals have had a chance to transmit.