In the Boeing 777’s first major avionics upgrade since its introduction in 1995, the distinctive twin-engine widebody jet will sport a leaner, yet more capable integrated avionics system and optional cockpit-mounted electronic flight bags (EFBs). Italian flag carrier Alitalia will be the first to receive the integrated avionics. Starting with the 777-200ER, new production aircraft also will receive new primary flight computers, electrical load management systems, air supply and cabin pressure controllers, cabin pressure outflow valves and proximity sensing electronics units.
At the heart of the upgrade is Honeywell’s Airplane Information Management System (AIMS), which integrates processing for the following avionics functions:
Flight management computing,
Navigation,
Flight deck communications,
Primary displays computing,
Digital flight data acquisition,
Quick access recorder,
Aircraft condition monitoring
Thrust management computing,
Central maintenance computing and
Data conversion gateway.
The basic AIMS architecture includes two cabinets, each populated with line replaceable modules. The original system greatly reduced avionics cost and weight by decreasing the number of standalone black boxes, each with its own power supply, processing and input/output (I/O). A special function–qualified to the DO-178B, Level A, software specification–is the data conversion gateway (DCG), which transfers bus signals between the various types of links, reducing the number of bus wires and interface cards. Signals from the various digital buses, analog lines and discrete connections enter the system once (apart from deliberate redundancies) and are distributed to the different AIMS-hosted avionics functions over the SAFEBus (ARINC 659) deterministic backplane. Additional copies of the data are transmitted to other airplane line replaceable units over various transmission mediums, including discrete, ARINC 429 and ARINC 629 formats. The new AIMS-2 system actually packs 10, rather than eight, modules into each cabinet, but thanks to packaging improvements, weighs 32 pounds (14.5 kg) less than its predecessor. AIMS-2 also dissipates 39 percent less power than AIMS-1.
AIMS-1
The original AIMS system was the first integrated modular avionics system for the air transport sector and is still the most highly integrated one, consolidating the processing for 10 different aircraft systems. Inside the cabinets, the units are broadly differentiated by module type–such as core processing and I/O. The new design also adds a power conditioning module. Ironically this addition helped to shrink the overall design.
AIMS-1 core processing modules (CPMs) come in four basic flavors. Each type has a common set of processing resources–processor, instruction memory, bus interfaces and power–and some unique circuit card assemblies (CCAs), or plug-in modules. The CPMs include:
CPM/Basic, which does not have a special-function CCA.
CPM/Comm, with interfaces to the airplane fiber optic LAN (local area network), the A717 interface to the flight data recorder, and an RS-422 interface to the quick access recorder.
CPM/GG (graphic generator), with the core processor and a graphic generation CCA, which connects to the flight deck display units.
And CPM/ACMF (aircraft condition monitoring function), with an additional memory CCA that stores ACMF data.
Because the AIMS architecture uses generic building blocks, a need existed for multiple software applications to be able to share common hardware resources, without corrupting each other’s data. This led to the development of Honeywell’s Apex operating system–with its time and space partitioning–which became the foundation for the ARINC 653 operating system spec. Under Apex, for example, the central maintenance function (Level D of DO-178B), flight deck communications (Level C) and DCG (Level A) can share the same processing hardware yet still be developed and verified independently.
Another achievement was deferred maintenance through fault tolerance. Boeing required a continued, 10-day dispatch rate of up to 99.9 percent in the face of any failure, assuming a full-up system at the beginning of that period, recalls Gust Tsikalas, Honeywell product line director. With AIMS this was performed largely in software, by carrying extra copies of the applications, rather than many different processor modules. Honeywell’s deterministic SAFEBus backplane technology allowed the company to prove that "another copy of a software application could be running and ready to go, so that, [if needed, it] could come on line without a hiccup," Tsikalas says. A backup software function can transition into a primary function within two backplane clock cycles, a matter of nanoseconds.
"The core processor design is architected to provide cycle-by-cycle, self-checking pairs, using a feature called ‘lockstep processing,’" Tsikalas explains. Lockstep processing means that dual, self-checking processor pairs constantly check the accuracy of operating functions and are able to detect and instantaneously create "containment zones" around a faulty processor module, so that a fault is not propagated throughout the system.
Lockstep processing works along the following lines. CPMs contain two Advanced Micro Devices 29050 microprocessors (AIMS-1) or two HI-29KII chips (AIMS-2) connected in a way that allows all processor inputs and outputs–address, data, instructions–to be immediately compared. If these comparisons yield different results, the processing is flawed. If they yield identical answers–the normal case–the processing result is valid. If an error is detected, "all processing results are halted, an error is logged, and recovery is attempted," says Tsikalas. "Outputs, or results, are not allowed to escape from the containment zone until such time that the processor environment can be verified–by power-up or runtime BITE [built-in test equipment]–to be good." These approaches, combined with the redundant system architecture, help to explain Boeing’s approximately 99.3 percent schedule reliability rate in 2002 for the 777.
AIMS-2
Anticipated growth in avionics features and parts obsolescence issues drove the need for an AIMS upgrade, says Dan Murray, Boeing’s 777 systems and equipment manager. It has gotten difficult and expensive to obtain parts for the original 100-megabit/sec (Mbit/sec) Fiber Distributed Data Interface (FDDI) local area network. Called Planenet, the fiber optic LAN–used on the ground–carries traffic between AIMS and both the maintenance access terminal (MAT) and the portable MAT, and is used in software data loading. With AIMS-2, Boeing replaced the FDDI LAN with 10-Mbit/sec Ethernet 10BaseT. (AIMS-1 actually used less than 10Mbits/sec of FDDI’s bandwidth, so the Ethernet link will allow for future growth.)
Data loading is far faster with AIMS-2. It now takes only 17 minutes to load the AIMS operating software, compared with five hours before. The navigation database, which has to be updated every 28 days, can be loaded in less than five minutes, as opposed to an hour. One of the reasons for this is improved components, such as electrically erasable flash memories that can be more rapidly loaded. Another factor is that AIMS now handles the loading protocol.
Boeing also has replaced the 2-Mbit/sec ARINC 629 AIMS intercabinet bus with a point-to-point Ethernet 10BaseT line, enabling a five-fold increase in throughput. (ARINC 629 is still used for the airplane flight control buses and systems buses.) According to Honeywell, the AIMS-2 design also is more reliable, lighter-weight, lower in cost of ownership, less power-hungry and higher in I/O count. Throughput and memory capacity have been more than doubled, for example, compared with AIMS-1.
Low-level component packaging improvements helped to reduce the plug-in card count for the basic processor module from five to one, Tsikalas says. Honeywell, for example, purchased the intellectual property rights to the AMD 29050 processor used in the AIMS-1 system and integrated this function into an application-specific integrated circuit (ASIC). The AIMS bus interface unit to SAFEBus and several other components also were combined into a small package.
The new design also makes hardware and software upgrades easier, according to Tsikalas. A key enabler is the more than 10-fold reduction in the amount of low-level, board-specific software, i.e. firmware. The functions that this board-resident software provided–such as built-in test and hardware initialization–are now performed by "non-resident boot software" that is loadable in the field. Firmware was one of the bottlenecks of the earlier data loading system, he says. But to have swapped existing components for speedier versions would have required airlines to return the modules to Honeywell, which would have been "fairly unpalatable." Honeywell also has converted the AIMS automatic test equipment interface to support the more standard EADS ATEC test equipment rather than the Honeywell STS test station.
Electronic Flight Bags
A second high-profile upgrade–and the most obvious change in the cockpit–is the addition of two 10.4-inch, color displays mounted in side areas to the far left and right of the flight deck. Space was left for this purpose when the airplane was originally designed in the early 1990s. The EFBs, including the displays and their computing units, are provided by Astronautics Corp. of America. Jeppesen will integrate the software applications that will be operationally approved, and Boeing will integrate the system into the airplane. Certification is expected in October. The equipment will be offered first on the 777-200ER, but will be made available on all Boeing aircraft models–new and existing platforms–including all 777s, the 747-400, 737, 757 and 767, according to Dave Allen, chief engineer for Boeing Crew Information Services (CIS). Units will share the same part number, easing airline logistics.
Pilots will control the EFB with their fingertips, using touch screens, as well as bezel keys and a QWERTY keypad. Customers asked for the touch screen technology because of its ease of use, Allen says. "We’ll have a MTBF [mean time between failure] commensurate with the other avionics equipment." On the B777, the cursor control device also will be integrated into the EFB system.
The first EFB customers are receiving Class 3 equipment, as defined in the Federal Aviation Administration’s (FAA’s) new advisory circular, AC 120-76A. Class 3, the most integrated of the three categories discussed in the document, involves electronic flight bags that are built into the cockpit and can be operated in all phases of flight. Class 3 devices require FAA certification except for "user modifiable software," which will be operationally approved. Boeing’s project will be the first Class 3 certification.
Boeing and its Jeppesen unit plan to offer Class 2 EFBs, as well. While no B777 operators have requested this equipment yet, many other operators are requesting Class 2 devices, Allen says. Class 2 envisions portable, off-the-shelf computers that are connected to the aircraft during flight but can be removed by the pilot. Class 2 mounting mechanisms and airplane interfaces will be Part 25-approved. While Class 2 EFB software doesn’t have to meet DO-178B requirements, AC120-76A requires a risk assessment and mitigation process. Class 2 EFBs have no phase-of-flight restrictions, but installations will need to avoid interference with pilot egress, flight controls, oxygen masks and other equipment.
The connection between the electronic processing units driving the EFBs and the respective displays is 1000Base-SX, a 1-gigabit/sec fiber optic link accommodating digital video. Each electronics unit comprises a pair of computers–partitioned off from each other–one running a Part 25-certifiable version of the Linux operating system and the other running Windows 2000. Each of the four computers contains a 40-gigabyte, sealed hard drive pressurized to 1 atmosphere to prevent a disc crash during rapid decompression. The Linux operating system, where the Level D applications reside, controls the display and allows reset of the Windows partition in flight.
Airline customers will obtain operational approval of the Windows software and applications from FAA under AC 120-76A after Boeing has obtained Part 25 approval of the airplane. The Windows side of the EFB electronics unit is built on an open architecture, meaning that airline customers can–with the assistance of a Boeing/Jeppesen software development kit–write their own programs, contract with third-party developers, and adapt legacy software to run on the display.
Boeing is qualifying the Linux operating system and applications to Level C of DO-178B, even though only Level D is required by FAA, in order to pave the way for Level C applications in the future. A Level D application would be taxi position awareness, which would use GPS data to overlay an aircraft icon (ownship position) on an airport map. The EFB will be interfaced (via ARINC 429 buses) to the navigation system for position, to the inertial reference system for heading, and to the flight management function for origin and destination airport information. Applications to be operationally approved will include aircraft performance calculations and documentation (minimum equipment list, operating manual, airplane flight manual, and en route, approach and departure charts).
Systems will be delivered with an "application manager," or menu structure, Allen says. Airlines will handle applications through separate contracts with Jeppesen. "All applications will have the opportunity to send messages [such as performance calculations] via ACARS [aircraft communications addressing and reporting system]," he says. And with the implementation of CoreNet–a file server that will allow the use of other network devices on the airplane–and Connexion by Boeing–a secure broadband connectivity service–the software programs will be able to use Boeing’s wideband antenna. The CoreNet file server, for example, will allow the EFB to be connected to the aircraft LAN, using 100BaseT. This move–which accommodates the installation of graphics printers, access to cabin wireless LAN units, and other network-based systems–is a key component of the "e-enabled airline," Allen says.
Baseline EFB data loading will use an ARINC 615A data loader. A terminal wireless LAN unit also can be used to load data via an IEEE 802.11b link to an airport access point. (Other applications also could use the link.) The wireless link is part of a data distribution and management (DDM) system, allowing airlines to move data to the EFB every time the aircraft is on the ground and the airplane is in contact with a compatible airport access point. Software in the DDM ground system and the EFB manages loads so that they can occur incrementally. "The airline can manage its own data loads with CD distributions, or can use DDM to control the EFB software configuration from its home offices, manage the data loads, and schedule the installation," Allen says.