Jim McWha
The Boeing Company – Retired
13511 SE 50th Place,
Bellevue, WA 98006
Phone: 425 746 9006
e-mail: jmcwha@aol
Development of the 777 Flight Control
System
This paper provides an overview of the 777 Flight Control System, the Boeing Company’s first full Fly-By-Wire (FBW) system on a commercial transport. Included will be brief discussions of the basic design philosophy, system architecture, primary functions, validation tools, test program highlights, supplier and customer relationships, and several key decisions made during the development which w
ere pivotal to the success of the program. Success is measured in terms of the personal satisfaction felt by all who were involved in the program and the widespread acceptance of the performance of the airplane since entering service in June 1995, especially its excellent safety record to date.
The 777 program was formally initiated in October 1990 with a target delivery date of May 1995. However, some advantage was taken of work done in developing new systems, including FBW, for the 7J7 program a few years earlier. This program was terminated following reevaluation of the market needs. Other systems which also originated on the 7J7 were the Airplane Integrated Management System (AIMS), the ARINC 629 High Speed Databuses, and the Air Data Inertial Reference System (ADIRS). These systems were necessary for better integration of functions, for higher availability and for improved maintainability of the airplane. With the increased use of digital technology there is much more built-in self-test providing better overall coverage and identification of faults to the specific Line Replaceable Units (LRUs).
Much has been made, and rightly so, of the “Working Together” theme which characterized the 777 throughout its development; this was the most significant cultural change that most of us had experienced. Close working relationships were established between Engineering and Manufacturing through Design-Build teams, Airlines provided Pilots and Maintenance personnel on site at Boeing to
ensure that Boeing understood their needs, cross functional engineering teams worked to ensure that interface requirements were clearly documented and Suppliers were much more involved in decision making. The benefit of including the airlines throughout the development is evident in the degree of commonality between customers' airplanes. Most variability is accommodated by selectable options, which were designed into the basic airplane and its systems, thus minimizing the amount of design work as each new customer's airplane is configured to their needs.
Since the 777 was the first to use FBW on all control surfaces, a lot of consideration went into development of a system design philosophy which established the basis for the Flight Control System:
•Operation and response of the airplane shall be familiar to the pilots, based on
their past experience and training.
•Control functions shall assist the pilot in avoiding or recovering from
exceedances of operational boundaries.
•The pilot shall retain ultimate control authority of the airplane.
•Traditional tactile and visual cues shall be provided to assist the flight crew in
monitoring the operation of the
autopilot and autothrottle systems •Simple reliable alternate control paths shall be provided.
This philosophy enabled Boeing to make the following significant design decisions:
•Conventional Pilot controls
•Flight Envelope protection, rather than limiting
•Backdriven Controls for autopilot and autothrottle
•Dissimilar alternate control for additional failure protection
Flight Control System Overview
The 777 flight control system evolved from many discussions with potential customers, combined with known FAA and JAA requirements, Boeing objectives and a review of lessons learned from other commercial and military programs. Fly–by–Wire technology offered potential weight savings by
enabling use of a relaxed static stability aerodynamic configuration, and the flexibility to
AIAA Guidance, Navigation, and Control Conference and Exhibit
11-14 August 2003, Austin, Texas
AIAA 2003-5767 Copyright © 2003 by James McWha, The Boeing Company (Retired). Published by the American Institute of Aeronautics and Astronautics, Inc., with permission.
accommodate several derivative models with a minimum of change.
The 777 primary flight control system is depicted in figure 1. The primary flight computers (PFCs) are highly redundant digital computers providing most of the system management functions (control laws, failure detection, redundancy management, maintenance, etc.) The Actuator Control Electronics (ACEs) provide the interfaces with all the analog sensors and analog/digital conversion of signals to and from the PFCs. ACEs, actuators, hydraulics, and electrical signaling are distributed such that the airplane is safely controllable with loss of any two channels. The system may also downgrade from a “full-up” configuration (Normal) to Secondary after loss of some sensors and even to a purely analog mode (Direct Mode) in the unlikely event of loss of digital signals from the PFCs (F
ig. 2). This satisfied the need for a simple reliable back-up. The FBW system was recognized as one of the most critical in the airplane so it was decided early on to protect it from all the other systems by segregating it as much as possible from the rest of the equipment. Dedicated electrical power was provided; permanent magnet generators were mounted on each engine shaft and DC power supply assemblies (PSAs) fed each channel of the FBW system. Alternate sources of power are provided to the PSAs from the 28 volt DC airplane buses, Hot Battery bus and the Ram Air Turbine, which also supplies emergency hydraulic power. (Fig. 3) A dedicated set of ARINC 629 buses limited access to only those signals required by the FBW system. A lot of attention was paid to separation of redundant elements (computers, wiring and hydraulic lines) to protect against collateral damage from engine and landing gear failures. Additional protection of the system against birdstrikes was necessary for pilot controls and sensors.
One of the decisions made early was that the cockpit controls would look and feel familiar to pilots, most of whom would be transitioning from other Boeing airplanes. It was also considered important that automatic controls functions (autopilot and autothrottle) should still be easy to monitor so the control column and throttle were back-driven. Some of the more mundane tasks were eliminated by "smarts'' in the control laws; e.g., compensation for loss of lift in a turn, automatic pitch trim for conf
iguration changes. A few safety features were included to prevent inadvertent exceedance of operational boundaries; overspeed and underspeed protection, bank angle, and engine thrust asymmetry from takeoff taxi through landing rollout. The latter ensures that an engine failure during takeoff is much safer; most pilots never experience one in all their years of service so they are dependent on recurrent training. The term protection was chosen deliberately, reflecting the need to provide final authority to the pilots. If the pilot wanted to go beyond the value which the protection function applied, he/she could apply considerable extra force to effect further change. This was considered important because it is difficult to foresee all eventualities that may occur, so all options should remain open for the pilots. While some of these features added complexity, both in hardware and software, they have proven popular in-service. These and other Common Cause Events are listed in Fig.4
System Integration
Systems have become much more interdependent and to some extent more complex so it became necessary to adopt a very structured approach to ensure “all bases were covered.” A Multi-Functional System Requirements Team(s) assembled all the requirements for the Flight Control System (functionality, performance, reliability, safety, crew operation and maintenance) early in the pr
ogram and this document formed the basis for all subsequent design and later, the testing in the integration facilities. One of the most useful integration tools proved to be an Issue Tracking and Compliance System which allowed all problems and issues to be recorded and progress toward resolution was tracked and available to management and to all team members for information and comment. Many of the processes utilized in the 777 program have since been formally documented in SAE ARPs 4754 and 4761 which provide Guidelines for the Development of Complex Systems. Airplane-Pilot Coupling
Recognizing that almost all FBW airplanes (military and commercial) had experienced Airplane-Pilot Coupling (APC) problems, either during development or later, special attention was paid to identifying and eliminating them.
Analyses were conducted and special tests were devised to “ferret out” potential APCs. Several were discovered and corrected and none have been reported since first delivery. A report of this work was issued and became a significant reference for a subsequent NRC Study report. It is important to note that the problems were found when pilots were first asked to fly the airplane with almost no prior familiarization training. This is often the case in simulator evaluations when the comments from pilots after first exposure to new functions may be the most valuable, before they ha
ve learned to adjust, either consciously or unconsciously.
Key Decisions
During the course of development several changes of direction were made which, in retrospect, were probably critical to the ultimate success of the program. These included:
1. A prototype flying test bed program
was scaled down considerably. The
original plan was to modify a 757 and
install as much prototype equipment as
possible on one pilot’s side. However,
this would have diverted too much
attention from the mainstream effort
with only limited real benefit to the 777
program. It was impractical to modify
the 757 hydraulic, electrical, and other
systems interfaces to emulate the
proposed 777 systems. Without those
interfaces much of the reason for
prototype testing is diluted since
problems are likely to involve those
interfaces. The focus was changed to
evaluation of several functions like the
new control laws and envelope
protection features which could be
incorporated relatively easily. This was
less ambitious but significant benefits
were realized without unduly diverting
attention from the mainstream program.
Minor adjustments were made to flare
control laws and gust suppression. We
psas
also gained the confidence of the pilot
community; over 30 pilots from many
airlines augmented the Boeing pilot
team in a program of 565 landings and
243 flight hours. 2.The original architecture of the Primary
Flight Computers proposed by the equipment supplier included 3 dissimilar hardware and software designs. After some time, it became apparent that it was unduly cumbersome to maintain three separate software design teams with their individual interpretations of requirements. The problem with using Two or more independent software teams to implement the same requirements is that the systems folks who developed those requirements are precluded from working freely with the software teams to ensure they clearly understand the requirements, since it would erode the dissimilarity if they offered the same solution to each team. The complexity is illustrated in Fig. 5. It has also been found by Levenson and Knight that software engineers tend to make similar mistakes, or use similar design solutions. This makes it difficult to conduct effective reviews of software design against the requirements------in fact; dissimilarity discourages effective communication. The system also required very close tracking between the outputs of all lanes in order to detect failures which could produce unacceptable oscillatory outputs; it was extremely difficult to do so with three different software designs. We decided that the optimum approach would use 3 dissimilar hardware and 3 similar lanes in each computer. This allowed much freer exchange of information among all the teams without concern about compromising of dissimilar software designs. Essentially 3 times as many engineers were then available for the design and verification of a single software implementation, using different compilers for each of the dissimilar processors.
The use of dissimilar hardware does provide significant protection against the occasional manufacturing flaw or compiler error. None of the suppliers of commercial processors or compilers will accept the level of controls that might be imposed by aircraft system developers since that market segment is miniscule. Dissimilar hardware does not preclude similar software source code
and the object code is essentially
dissimilar due to the use of different
compilers. Unlike software, it is not
necessary to use different hardware
teams. The PFC architecture is shown
in Fig. 6.
3.The test integration facility included an
Iron Bird, Systems Integration Lab, and
a high fidelity Cockpit Simulator. The
original plan called for these to be
coupled; on the surface this may appear
attractive, but it means that a glitch in
any of the 3 facilities could impede the
progress of the other two. A decision
was made to decouple them allowing
teams in each to focus on their own
specialties and thus conduct many more
total tests, often running 18 hours per
day at least 6 days per week. The Iron
Bird was the facility of choice for flight
controls, both primary and secondary.
The System integration facility was
operated like an extra “ground-based”
airplane, with pilots scheduled for 4
hour shifts. The integration effort was
supported by a large number of “standalone” test benches both at
Boeing and at suppliers who were
scattered through Europe, Asia and the
US.
4.Prior to First Flight which had been
scheduled several years earlier for early
June, 1994, we decided that if the Flight
Control System required more time to
resolve problems, the flight would be
delayed, regardless of the impact. It
became apparent in early May that
making June 1st would be overly
optimistic; this posed quite a problem
due to the arrangements which were
already in place relative to media,
invited VIP guests, etc. However,
Boeing management followed through
on the commitment and, with heroic
efforts, we achieved readiness for what
turned out to be a very successful first
flight of almost four hours on June 12th.
This was only one more example of the
“working together” attitude which
prevailed throughout the
program.During Flight Test, no changes
could be made to Avionics or Flight
Control Systems in the test airplanes
before evaluation in the System
Integration Lab. As a result, less time
was wasted in flight, chasing problems
that could have been found in the labs,
and unprecedented flight rates of over
70 hours per month were achieved for
several months.
5.The decision to seek ETOPS approval
(180 minutes overwater) resulted in a
program that ensured the airplane was
indeed “Ready–for–Service” when
delivered to United Airlines on May
15th1995. One airplane was flown to
many different sites with a range of
environmental conditions, airplane
configurations and maintained by
airline mechanics using the airplane,
maintenance manual. Over 1000 flight
cycles of varying duration were
completed prior to certification by this
one airplane. Changes to systems were
minimal, and carefully documented
during this program.
The airplane has now been in service for over 8 years with an excellent record of reliability and essentially very few incidents of note. Pilots and Maintenance crews have been very complimentary about its “user-friendliness”. I still look back with gratitude for the opportunity to have been a part of such a program.
Fig. 1
Fig. 2
Fig. 3
Fig. 4
Fig. 5
Fig. 6
豫公网安备41160202000603
站长QQ:729038198
关于我们
投诉建议