Professional Documents
Culture Documents
e-mail: :frank.doerenberg@alliedsignal.com
Personal introduction
Education:
MSEE Delft Univ. of Technology (1984) MBA Nova Southeastern Univ. (1996)
Miscellaneous:
Private pilot
e-mail: frank.doerenberg@usa.net
Personal introduction
Education:
MSEE Delft Univ. of Technology (1984) MBA Nova Southeastern Univ. (1996) Enrolled in PhD/EE program at University of Washington
Miscellaneous:
Private pilot
2
1995-1997 F.M.G. Drenberg
3
1995-1997 F.M.G. Drenberg
Airlines & Operators Airspace Sys., ATC/ATM Integrated Aviation System Ground & Space Infrastructure Environment Govt & Industry Agencies
4
1995-1997 F.M.G. Drenberg
Aircraft sub-systems
Flight Control Fuel Mgt Engine thrust Structure & Gear Computer/ Data links Cabin air press/temp Phone & fax Cabin call/PA Games & video Audio video
5
1995-1997 F.M.G. Drenberg
Electrical power Air Data Comm/Nav Surveillance Cabin lighting Cargo/bag handling Galleys & water/waste
= reqd for ops in air transport system = reqd for cargo and pax comfort/well-being
ROI, LCC, affordability, payback seat-mile economics serviceable and flyable with minimal maint. and flight crew training (inc. fleet commonality) payload, range, route structures, fuel burn (weight &
volume of equipment/wiring/installation/structure) contd
to have systems that are mature at entry into service instead of years later (esp. for early ETOPS) to reduce the cost of future software mods
8
1995-1997 F.M.G. Drenberg
Avionics technologies
1900
1950
- avionics is (growing) part of the equation -
2000
10
1995-1997 F.M.G. Drenberg
(contd)
Authorities:
ATC & ATM ground- & space-based infrastructure fed & intl (de-)regulations safety (e.g., TCAS, smoke det.) environment
Avionics suppliers:
customer satisfaction, one-stop-shopping cost reduction / profitability margins technological leadership strategic shift from BFE (commodity) SFE integrate competitors traditional products integrate or die
ref.: P. Parry: Wholl survive in the aerospace supply sector?, Interavia, March 94, pp. 22-24 ref.: R. Ropelewski, M. Taverna: What drives development of new avionics?, Interavia, Dec. 94, pp. 14-18 & Jan. 95, pp. 17-18
11
1995-1997 F.M.G. Drenberg
(contd)
Airframe manufacturer:
customer satisfaction, product performance, passenger appeal significant cost reduction over previous generation (esp. for smaller a/c, due to seat-cost considerations; e.g. 100 pax
target: $35M $20M)
contd
12
1995-1997 F.M.G. Drenberg
(contd)
fault-tolerance transparent to application s/w brick-wall partitioned applications all Aps & Ops software: on-board loadable/upgradeable 100% fault detection and complete self-test (w/o test equipment) 95% reliability over a/c life (60k-100k hrs)
- more, better, cheaper, faster ref.: P. Parry: Wholl survive in the aerospace supply sector?, Interavia, March 94, pp. 22-24 ref.: R. Ropelewski, M. Taverna: What drives development of new avionics?, Interavia, Dec. 94, pp. 14-18 & Jan. 95, pp. 17-18
13
1995-1997 F.M.G. Drenberg
(contd)
Avionics business
airline mergers, alliances, bankruptcies airlines seek revenue enhancement and cost reductions increasing airtraffic volume, delays FANS/free flight: increased capacity, reduced separation, same or better safety airlines & airframers want RC, forcing suppliers NRC no real competition yet from video/teleconf. (biz travel)
- airplanes are a commodity in rising cost environment 16
1995-1997 F.M.G. Drenberg
Productivity
+5-6% p.a.
DOC
Index
10
1960
65
70
75
80
85
90
17
1995-1997 F.M.G. Drenberg
- airline performance trends ref.: Airline Business, January 1996, p. 29 ref.: A. Smith: Cost and benefits of implementing the new CNS/ATM systems, ICAO Journal, Jan/Feb 96, pp. 12-15, 24
- world fleet is forecast to double over 20 years (by 2015: 20,000 * > 50 seats )
1000
D ti me s o c
=1.7 B
800
+ 6%/year
600
+7%/year + 5%/year
400
n ati In ter
o n al
1995
1996
1997
1998
1999
2000
1990
1991
1992
1993
ref.: Flight International, 3-9 January 1996, p. 27,28 ref.: Boeing CAG Current Market Outlook 1995 ref.: K. OToole: Cycles in the sky, Flight Intl, 3-9 July 1996, p. 24 ref.: IATA raises five-year passenger forecast, Flight Intl, 6-12 Nov 1996, p. 8
1994
2005
200
18
1995-1997 F.M.G. Drenberg
500
Tonne-km (billions, log-scale)
Passengers
Most likely (7% p.a.)
1000
100
Freight
ACTUAL ICAO FORECAST
300
30
1995 2005
19
1995-1997 F.M.G. Drenberg
1985
RPMs, billions
200 400 600 800 1,000
20
1995-1997 F.M.G. Drenberg
100
Retirement of aircraft
40
50
20
25
0
900 800 700 600 500 400 300 200 100
0
71-75 76-80 81-85 86-90 91-95 96-00 01-05 06-10 11-15
20
25
Age in years 30
35
1,000
Other
McDonnell Douglas
500
250
0 195860626466687072747678808284868890929496980002
ref.: A.L. Velocci: Restraint, Airline health key to stable rebound, AW&ST, Nov. 25 1996, pp. 36-38 ref.: P. Sparaco: Airbus plans increased production rate, AW&ST, Nov. 15 1996, pp. 48-50
0 1988 1989 1990 1991 1992 1993 1994 1995 1996 1997
21
1995-1997 F.M.G. Drenberg
crew fuel
10-15%
maint.
ownership
1/3
systems
Euro-regionals: 50% of DOC is beyond control of owner/operator (fees for landing /ATC/ground-handling + fuel)
ref.: P. Condom: Is outsourcing the winning solution?, Interavia Aerospace World, Aug. 93, pp. 3436 ref.: 1992 ATA study of U.S. airlines
22
1995-1997 F.M.G. Drenberg
30% 8%
737-300
($1834/hr)
737-500
($1607/hr)
crew
16%
31%
20% 34%
25% 25%
27% 27%
15%
ownership (insurance, possession, etc.)
31% 747-400
($6673/hr)
DC-10-30
($4306/hr)
MD-80
($1825/hr)
4 12 7 % 11% 27%
12 27% %
U.S. major carriers all items in U.S.$ per block hour year ending Sept. 31,'94
ref.: Air Transport World, Jan-May 1995 ref.: The guide to airline costs, Aircraft Technology Engineering & Maintenance, Oct/Nov 1995, pp. 50-58
Big $ numbers
life-time maintenance cost (ROM), example: maintenance $1200/block hour airplane life-time 60+ k hours maintenance-over-life $75 million
- Boeing 747-400 25
reduction in DOC New systems & technology can only be justified if they:
inflation corrected price-tag of airplanes has increased over the years** not completely offset by simultaneous take cost out of the airplane reduce DOC increase revenue
ref.: C.T. Leonard: How mechanical engineering issues affect avionics design, Proc. IEEE NAECON, Dayton, OH, 89, pp. 2043-2049
departure delays (up to $10k / hour) flight cancellation (up to $50k) in-flight diversion (up to $45k) in terms of pax perception: incalculable
- 50% of delays/cancellations caused by improper maintenance (other causes: equipment, crew, ATC*, WX, procedures, etc.)
ref.: Commercial Airline Revenue Study by GE Aircraft Engines (Jan. 88 - Jan. 92) ref.: B. Rankin, J. Allen: Maintenance Error Decision Aid, Boeing Airliner, April-June 96, pp. 20-27
28
1995-1997 F.M.G. Drenberg
B767 B747-400 $ 6k3 $ 9k3 $ 18k9 $ 37k2 $ 13k8 $ 22k6 $ 16k1 $ 28k7
29
Software 70%
Dependability Taxonomy
Dependability
Attributes
Means
Impairments
Faults Fault avoidance Safety Errors Fault tolerance Reliability Failures Fault removal Dispatchability Fault forecasting Maintainability Integrity - dependability: degree of justifyable reliance that can placed
on a systems delivery of correct and timely service ref.: Intl Federation of Information Processing Working Group on Dependable Computing & Fault Tolerance (IFIP WG 10.4) ref.: Prasad, D., McDermid, J., Wand, I.: Dependability terminology: similarities and differences, IEEE AES Systems Magazine, Jan. 96, pp. 14-20 ref.: F.J. Redmill (ed.): Dependability of critical computer systems - 1, 1988, 292 pp., Elsevier Publ., ISBN 1-85166-203-0 ref.: A. Avizienis, J.-C. Laprie: Dependable computing: from concepts to design diversity, Proc. of the IEEE, Vol. 74, No. 5, May 86, pp. 629-638
32
1995-1997 F.M.G. Drenberg
Fault Avoidance
- prevent (by construction) faults from entering into, developing in, or propagating through the system -
controlled, disciplined, consistent Sys. Eng. process simplicity, testability, etc. reduced parts count, interconnects & interfaces (integrate!) standards, analyses, simulations, lessons-learned, V&V partitioning (for fault containment & isolation, cert., etc.) shielding, grounding, bonding, filtering controlled operating environment (cooling, heatsinks, etc.) properly select, handle, screen, and de-rate parts test human factors zero-tolerance for patch work in reqs & design etc., etc.
- must address entire product life-cycle: from inception through disposal 33
Fault Tolerance
- the ability of a system to sustain one or more specified faults in a way that is transparent to the operating environment -
more alternate means to perform a particular function or flight operation goal: only independent, multiple faults and design errors remain as reasonably possible causes of catastrophic failure conditions fail-passive, fail-safe, fail-active are fail-intolerant fault free, ignorance tolerant, or full/fool proof
Static (Fault Masking) No fault reaction: no fault detection no reconfiguration Examples of techniques: interwoven logic hardwired multiple hardware redundancy error correcting code majority voting (N-modular redundancy)
Dynamic
Hybrid
Fault detection
Examples of techniques: comparison (cross, voter, wrap-around) reasonableness check (rate, range, cross) task execution monitor (a.k.a. Watch Dog) checksum, parity, error detection code diagnostic and built-in tests
Active
Standby
Examples of techniques: Examples of techniques: adaptive voting & signal select switch-in backup spare(s) operating (hot, shadow) dynamic task reallocation non-operating (cold, flexed) graceful degradation n-parallel, k-out-of-n s/w recovery (retry, rollback) operational-mode switching
35
Fault Classifications
- fault tolerance approach is driven by the number & classes of faults to protect against, as well as by criticality and risk-exposure -
Criteria Activity Duration Perception Cause Intent Count Time (multiple faults) Cause (multiple faults)
Fault type Latent vs. active Transient vs. permanent Symmetric vs. asymmetric Random vs. generic Benign vs. malicious Single vs. multiple (Near-) Coincident vs. Distinct Independent vs. common-mode
Nothing in nature is random ... A thing appears random only through the incompleteness of our knowledge -- Spinoza, Dutch philosopher 1632-1677
36
ref.: N. Suri, C.J. Walter, M.M. Hugue (eds.): Advances in ultra-reliable distributed systems, IEEE Comp. Society Press, 95, 476 pp., ISBN 0-8186-6287
1995-1997 F.M.G. Drenberg
Redundancy
Attributes:
form (physical, temporal, performance, data, analytical) similarity/diversity* level of replication physical distribution within a/c allocation along end-to-end path configuration (grouping & interconnects) redundancy management concept (static, dynamic)
- more resources that required for fault-free single-thread operation * Notes:
- dissimilaritys power is based on assumption that it makes simultaneous common-mode (generic) faults extremely improbable - dissimilarity does not reduce the probability of simultaneous random faults - dissimilarity provides little advantage against common-mode environmental faults (EMI, temp/vibe, power) - dissimilarity allows shift away from proving absence of generic faults, to demonstrating ability to survive them (cert. level!) - dissimilarity of design drives source of faults back to (common) requirements and system architecture - dissimilarity is fault avoidance tool, as long as independence is not compromised when fixing ambiguities or divergence
37
1995-1997 F.M.G. Drenberg
Higher reliability
- will it make a difference in airline maintenance? frequent cause of maintenance today is not avionics LRUs, but interconnects, sensors and actuators (as much as 60%) improving MTBUR* more important than increasing MTBF (goal:
MTBUR/MTBF ratio 1)
complete system forms a chain: high-rel is required at system level, not just at box level MTBF & MTBUR may lead to Avionics By The Hour:
concept: operator leases equipment, only pays for actual hours flown avionics mfr needs this too: sells fewer spares (much) less profit
* unit pulls on maintenance alert only, not
- keep the good part on the plane ref.: P. Seidenman, D. Spanovich: Building a Better Black Box, Aviation Equipment Maintenance, Feb. 95, pp. 34-36 ref.: D. Galler, G. Slenski: "Causes of Electrical Failures," IEEE AES Systems Magazine, August 1991, pp. 3-8 ref.: M. Pecht (ed.): Product reliability, maintainability. and supportability handbook, CRC Press, 95, 413 pp., ISBN 0-8493-9457-0 ref.: M. Doring: Measuring the cost of dependability, Boeing Airliner Magazine, Jul-Sep 94, pp. 21-25
38
1995-1997 F.M.G. Drenberg
integration:
reduce on-board & off-board interconnects: weakest link in the reliability chain share resources (reduce duplication)
* redundancy may increase availability, but at
same time increases prob. that redundant copies are inconsistent/diverge
N-Parallel Redundancy
1 System Reliability 1 0.5
0 20k
(=MTBF)
0.5
40k 3 5
dun f re 10 er o umb N tu dan nits
100k 15
37 40
N-Parallel Redundancy
1 System Reliability 0.5
60k
Desired region
100k
1 0.9 - 0.95
0 20k
(=MTBF)
0.5
40k 3 5
dun f re 10 er o umb N tu dan nits
100k 15
- goals: low cost & low redundancy but high rel. & safety -
38 41
1995-1997 F.M.G. Drenberg
from n=1
0.5
2
MTTF n = MTTF 1
(curves do not account for rel. penalty of complexity)
1
practical limit
= MTTF
10
15
- diminishing returns -
42
1995-1997 F.M.G. Drenberg
F2-out-of-2 F2-out-of-2
=1
F2-out-of-N(t) F2-out-of-2(t)
10 10 10 10 10 10
-1 -2 -3
N=4
-4 -5
N=3
-6 -7
10 0.001
0.01
0.1
1.0
t MTTFunit
10
43
1995-1997 F.M.G. Drenberg
Redundancy
Note: curves are for fail-passive configs, except those shown for simplex, cube, and n-parallel
1.0 Rconfig(t)
dual-triplex
0.5 1/e
quad dual
dual-dual
triplex
0
t =MTTFunit
t MTTFunit
3
44
1995-1997 F.M.G. Drenberg
45
1995-1997 F.M.G. Drenberg
Redundancy
- redundancy for fault-tolerance and extended system reliability -
1.0 Rconfig(t)
dual-triplex
0.5 1/e
quad dual
dual-dual
triplex
0
t =MTTFunit
t MTTFunit
3
46
1995-1997 F.M.G. Drenberg
Redundancy
1.0 Rconfig(t) 0.9
3-p triplex cube
2-p
4-p
0.8
0.5
t MTTFunit
1.0
note: MTTFs solely based on time-integration of reliability funct., and do not reflect system complexity; Markov analysis may give different result.
Time-to-R= 0.997
Time-to-R= 0.95
a 1 1 1 b c 3-parallel
a b c cube
a b c b c
a b c
a b c
optimized cube
if no single-thread ops., then dont need 3 output modules
- use resources more efficiently: do not discard entire lane if only part fails 50
ref.: M. Lambert: Maintenance-free avionics offered to airlines, Interavia, Oct. 88, pp. 1088-
Unit-reliability is more powerful than redundancy level in achieving high system reliability
- Fit-and-forget system reliability (based on conventional redundancy) implies units with reliability of todays components ( 10-7/h)
51
1995-1997 F.M.G. Drenberg
Integration of what?
hardware, software, mechanical elements data buses, RF apertures related, interacting, closely associated, similar functions & controls (reduce duplication) distributed information
e.g., fusion for more meaningful pilot info (smart alerting, EMACS) e.g., improve performance (flight + thrust control, ECS)
displays, controls, LRUs (esp. single-thread) BIT organizations, people entire aviation system
ref.: P. Gartz: Trends in Avionics Systems Architecture, presented at the 9th DASC, Virginia Beach/VA, Oct. 90, 23 pp. ref.: Avionics Systems Eng. & Maint. Committee (ASEMC) of the Air Transport Assn (ATA) ref.: Avionics Magazine, Feb. 1996, p. 12
increase fault isolation accuracy reduce NFF/CND/RETOK* from 50% to < 10%
* ATA est. NFF cost to US airline
industry $100M p.a., avg $800 per removal (labor, shipping, sparing)
52
1995-1997 F.M.G. Drenberg
Integration trend: Multi-Mode Receiver (MMR) ICAO philosophy change (Comm/Ops meeting, Montreal 95):
from: single-system (e.g., VOR/DME) standard, ensuring intl uniformity & compatibility to: standardizing on 3 quite different approach aids (ILS, MLS, GNSS*) so: CAAs, airports, operators free to choose one or more and: world aviation authorities should promote the use of Multi-Mode Receivers (MMRs) or equivalent avionics *
ICAO: GNSS > GPS (e.g., GNS+GLONASS, to ensure complete redundancy, esp. in landing ops.)
ref.: W. Reynish: Three systems, One standard?, Avionics Magazine, Sept. 95, pp. 26-28 ref.: D. Hughes: USAF, GEC-Marconi test ILS/MLS/GPS receiver, AW&ST, Dec. 4 95, pp. 96 53 ref.: R.S. Prill, R. Minarik: Programmable digital radio common module prototypr, Proc. 13th DASC, Phoenix/AZ, Nov. 94, pp. 563-567 1995-1997 F.M.G. Drenberg ref.: ARINC-754/755 (analog/digital MMR), ARINC-756 (GNLU)
Integration trend
LRUs System On Chip
FMGD
1970s
~ total ~ 10
-2
1980s
~ total ~ 10
-4
1990s
~ total~ 2x10
-5
2000-2010
~ total ~ 10
-7
ARINC-629 digital data bus between LRUs ARINC-659 backplane bus between LRMs fault tolerant LRUs card level redundancy
high-speed fiber optic comm. between systems fault tolerant cards chip level redundancy
54
1995-1997 F.M.G. Drenberg
Integration issues
integrated system is not a package deal airline:
no more option to pick favorite supplier for each federated LRU but gets improved availability, reduced sparing & LCC
as levels of (functional) integration increase more stringent availability & integrity reqs than for more distributed implementation if integration requires fault-tolerance (= redundancy), some of the gains from reduced duplication are lost compared to conventional LRUs, cabinet/LRM solutions pose challenge to effective shielding/bonding for EMI/Lightning protection partitioning provides change/growth flexibility: only re-certify changed areas
55
1995-1997 F.M.G. Drenberg
Integration issues
(contd)
loss of a shared resource affects multiple functions potential for single-point/common-mode failure due to contaminated data flow, control flow, resource:
fault tolerance required to meet availability & integrity reqs partitioning must be part of architecture and independent of application software increased importance of FMEA, FHA, etc.
mixed levels of criticality: certify at highest level, or certify the partitioning protection. criticality of the whole may be higher than that of stand-alone parts due to effects of loss (3x essential critical ?) technology readiness (risk): development of fault-tolerant integrated architectures drives a/c level schedules (be mature at a/c program go-ahead)
56
1995-1997 F.M.G. Drenberg
Larson
NO unpleasant surprises!
57
1995-1997 F.M.G. Drenberg
Large reduction in safety margins or functional capabilities Hazardous / Difficult for crew to cope with adverse operating conditions, and Severe-Major cannot be relied upon to perform tasks accurately & completely Some passengers seriously injured (potentially fatal) Major Significant reduction in safety margins or functional capabilities Significant increase in crew workload or conditions impairing crew efficiency Some passengers injured Slight reduction of safety margins or functional capabilities Slight increase in crew workload, well within capabilities Operational limitations, diversions, flight plan changes Inconvenience to passengers No effect on operational capability of aircraft No increase in crew workload Concern, nuisance
Minor
Qualitative Probability several times during operational life of each airplane occasionally during total operational life of all airplanes of particular type not expected to occur in entire fleet operational life
Critical (A)
failure contributes to, or causes a failure condition which would prevent continued safe flight and landing
Essential (B)
failure contributes to, or failure would not contribute causes a failure condition to, or causes a failure which would significantly condition which would impact airplane safety or significantly impact airplane crew ability to cope with safety or crew ability to adverse operating condit. cope with adverse condit.
- hazard: potential/existing unplanned condition that can result in death, injury, illness, damage, loss 61
1995-1997 F.M.G. Drenberg
ref.: H.E. Roland, B. Moriarty: System safety engineering and management, 2nd ed., Wiley & Sons, 90, 367 pp., ISBN 0-471-61816-0
POWER DISTURBANCE
- average EMI incident occurrence rate 5x10-3 per flight ref.: Clarke, C.A., Larsen, W.A.: Aircraft Electromagnetic Compatibility, DOT/FAA/CT-86/40, June 1987 ref.: Shooman, L.M.: A study of occurrence rates of EMI to aircraft with a focus on HIRF, Proc. DASC-93, pp. 191-194 ref.: RTCA Document DO-233 Portable Electronic Devices Carried On Board Aircraft, Aug. 96 Graphics adapted from: J.A. Schofield: European standards shine spotlight on EMI, Design News, 9-25-1995, pp. 58-60 63
1995-1997 F.M.G. Drenberg
increased reliance on digital computers (for flight-critical functions) that contain EMI-susceptible devices higher clock speeds:
reduced susceptibility: PCB tracks become transmission lines but absolute bandwidth for decent signal shapes goes up (10xfc) though bandwidth pushed into range with fewer x-mitters (civil)
continued proliferation of EM transmitters (incl. PEDs), and increase in EM power reduced inherent Faraday-cage protection: increasing amounts of non-metallic airframe sections
ref.: C.A. Clarke, W.E. Larsen: Aircraft Electromagnetic Compatibility, Feb. 89, 155 pp., DOT/FAA/CT-88/10; same as Chapt. 11 of Dig. Systems Validation Handbook Vol. II 64 ref.:G.L. Fuller: Understanding HIRF - High Intensity Radiated Fields, Avionics Comm. Publ., Leesburg/VA, 95, 123 pp., ISBN 1-885544-05-7 ref.: M.L. Shooman: A study of occurrence rates of EMI to aircraft with a focus on HIRF, Proc. 12th DASC, Seattle/WA, Oct. 93, pp. 191-194 1995-1997 F.M.G. Drenberg
Requirements Taxonomy
Requirements Mission Safety Reliability Dispatchability Availability Functionality Performance Operational Maintenance Cost Certificability etc.
Req's for Redundancy Management Fault masking Fault detection Fault isolation Fault recovery etc.
65
1995-1997 F.M.G. Drenberg
Modularity issues
modularization decreases the size of the Line Removable Item from LRU box to LRM module flexibility: add or remove functions and hardware flexibility: change architecture (configure & reconfigure) permits management of obsolescence: piece-meal update on modular basis, as technology & economics justify reconfigurability, expansion to meet future needs by adding modules facilitates fault tolerance (N+1 redundancy)
- module = building block 66
1995-1997 F.M.G. Drenberg
Standardization issues
generic, can be used across variety of functions economies of scale (production volume, recurring cost) fewer unique designs and parts, re-use m fewer part numbers: NS N 1/k . smaller number of spares: PLk i t = exp(-N)m=0 m!
spares acquisition (may be higher) & holding cost logistics, supportability documentation, configuration management training, test equipment overkill penalty for being universal (must support highest system reqs higher design assurance level)
- standardization ~ commonality 67
1995-1997 F.M.G. Drenberg
Software Resources Operating System I/O processing and monitoring BIT and Maint. functions Application Unique BIT
Common Unique
ref.: M.J. Morgan: Integrated Modular Avionics for Next-Generation Commercial Aircraft, IEEE AES Systems Magazine, Aug. 91, pp. 9-12 ref.: D. Hart: Integrated Modular Avionics - Part I - V, Avionics, May-Nov. 1991
68
1995-1997 F.M.G. Drenberg
Software Resources
Operating System I/O processing & monitoring BIT and Maint. functions Application-1
INTEGRATION
Shared I/O * BIT hardware Power Supply Chassis Unique I/O * Unique I/O * Unique I/O *
LRU-3
Unique functions Unique functions
LRU-2 LRU-1
69
1995-1997 F.M.G. Drenberg
Software Resources
Operating System I/O processing & monitoring BIT and Maint. functions Application-1
INTEGRATION
Shared I/O * BIT hardware Power Supply Chassis Unique I/O * Unique I/O * Unique I/O *
LRU-3
Unique functions Unique functions
LRU-2 LRU-1
70
1995-1997 F.M.G. Drenberg
LRUs interact interconnects Integration of LRUs fewer interconnects: connectors (failure prone and very expensive if high pin-count) wiring (weight) communication h/w at both ends communication s/w at both ends
71
1995-1997 F.M.G. Drenberg
5% O/S 20% I/O Maint. 10% 20% BIT Appl. 45% Total 100%
CPU I/O Power Bus Chass. Total 15% 20% 10% 30% 25% 100%
-- - + ++
5% O/S 20% I/O Maint. 10% 20% BIT Appl. 45% Total 100%
CPU I/O Power Bus Chass. Total
15% 20% 10% 30% 25% 100%
-- - + ++
-- - + ++
-- - + ++
Integrated
Rel. software complexity
same +30% same same
Federated 5% O/S 20% I/O Maint. 10% 20% BIT Appl. 45% Total 100% 15% CPU 20% I/O Power 10% 30% Bus Chass. 25% Total 100%
half half same
Integrated
Rel. software complexity Rel. hardware cost
74
5% O/S 20% I/O Maint. 10% 20% BIT Appl. 45% Total 100% 15% CPU 20% I/O Power 10% 30% Bus Chass. 25% Total 100%
15% 5% 5% 25%
155% 100%
assumes integration of related functions of equal size & complexity; 25% error margin
100%
25% Federated
Rel. software complexity
Integrated 110%
Rel. software complexity
Federated
Integrated
100%
Federated
Integrated
10
10
Federated
6
25% error bar
Federated
6
25% error bar
Integrated
Integrated
2 1 2 1
10
10
Well..
assumes integration of related functions with equal size/complexity
10
10
Federated
6
Integrated
Integrated
2 1 2 1
10
10
- ??????????? -
78
1995-1997 F.M.G. Drenberg
A historical note
Modular electronics dates back to several German military radios of the late 1930s!
German WW II radios
Modules:
die-cast Alu-Mg alloy module* for each stage completely enclosed & shielded, with internally shielded compartments generously applied decoupling (fault avoidance) mechanically & electrically very stable easily installed/removed w. 90 lock-screws (maint.) simple (manufacturability: strategically distributed, no high skills)
* Army/Navy got on, alloy Goerings Luftwaffe got Alu; from mid-1943 only Zn
81
ref.: Telefunken GmbH: Luftboden-Empf-Programm 2-7500 m fr die Bodenausrstung der deutschen Luftwaffe, Berlin, May
German WW II radios
82
1995-1997 F.M.G. Drenberg
German WW II radios
Receiver standardization:
40 kHz - 150 MHz covered with 4 radios with identical form, fit, operation
Parts standardization:
1 or 2 standard types of tubes per radio
Lorenz Lo 6 K 39a: 6x RV12P2000 Telefunken Kw E a: 11x RV2P800 FuSprech. f.: 6x RV12P2000 + 1x RL12P10 (RX),
and 1x RV12P2000 + 2x RL12P10 (TX)
tricky circuitry
83
1995-1997 F.M.G. Drenberg
German WW II radios
BIT:
switchable meter for Vanode & Ianode of each radio stage, and for filament voltage noise generator to measure RX sensitivity pass/fail, minimum servicability markings
Modular construction
85
photo: courtesy Foundation Centre for German Communication & Related Technology 1920-1945, Amsterdam/NL, A.O. Bauer
photo: courtesy Foundation Centre for German Communication & Related Technology 1920-1945, Amsterdam/NL, A.O. Bauer
photo: courtesy Foundation Centre for German Communication & Related Technology 1920-1945, Amsterdam/NL, A.O. Bauer
88
ref.: Telefunken GmbH: Luftboden-Empf-Programm 2-7500 m fr die Bodenausrstung der deutschen Luftwaffe, Berlin, May
89
1995-1997 F.M.G. Drenberg
Level-1: LRUs re-packaged into LRMs Level-2: databus integration and partitioning Level-3: all digital, global databuses Level-4: functional integration at LRM level Level-5: dynamic task allocation & reconfig.
- a range of concepts and configurations (no hard distinction between levels)
90
ref.: R.J. Stafford: IMA cost and design issues, Proc. 6th ERA Avionics Conf., London/UK, Dec. 92, pp. 1.4.1-1.4.10
IMA Level-1
LRUs re-packaged as LRMs in cabinet(s):
several types of standardized I/O modules (mix
of analog/discrete/digital)
external input data-concentrators standard computational module integration only of power-supplies (shared) no functional integration (LRUs mapped 1:1) no new interactions (certification!) ARINC-429 links between LRMs retained ARINC-429 links between cabinets
91
1995-1997 F.M.G. Drenberg
92
Utility Systems
*Entertainment,
Info, Telecom, Sales, Banking, etc.
Functional Integration
AT
FADEC
SERVOS
ATC/ATM
96
1995-1997 F.M.G. Drenberg
Functional Integration
AT
FADEC
SERVOS
ATC/ATM
97
Functional Integration
AT
FADEC
SERVOS
ATC/ATM
98
Functional Integration
AT
FADEC
SERVOS
ATC/ATM
99
ref.: Is new technology a friend or foe?, editorial in Aerospace World, April 1992, pp. 33-35
Examples:
Modular Flight Control & Guidance Computer
(EFCS by BGT/Germany)
ref.: E.T. Raymond, C.C. Chenoweth: Aircraft flight control actuation system design, SAE, 93, 270 pp., ISBN 1-56091-376-2 ref.: Hughes, D., Dornheim, M.A.: United DC-10 Crashes in Sioux City, Iowa, Aviation Week & Space Technology, July 24, 1989, pp. 96-97 ref.: Dornheim, M.A.: "Throttles land "disabled" jet," Aviation Week & Space Technology, September 4, 1995, pp. 26-27 ref.: Devlin, B.T., Girts, R.D.: "MD-11 Automatic Flight System," Proc. 11th DASC, Oct. 1992, pp. 174-177 & IEEE AES Systems Magazine, March 1993, pp. 53-56 ref.: Kolano, E.: Fly by fire, Flight International, 20 Dec. 95, pp. 26-29 ref.: Norris, G.: Boeing may use propulsion control on 747-500/600X, Flight Intl, 2-8 Oct. 1996, p. 4 ref.: Engine nozzle design - a variable feast?, editorial in Aircraft Technology Engineering & Maintenance, Oct./Nov. 1995, pp. 10-11
101
1995-1997 F.M.G. Drenberg
ELAC
SEC
"50-100 Pax", high-end BizAv
FMGC FM C
FGC
FAC
SFCC
FM C
Flight Mgt
FCGC
FC/FG
FCDC
All Airbus LRUs: dual internal, dissimilar s/w A330/340: 3x FCPC, 2x FCSP, replacing ELACs & SECs
102
ref.: D. Brire, P. Traverse: Airbus A320/330/340 electrical flight controls - a family of fault tolerant systems, Proc. 23rd FTCS, Toulouse/F, June 93, pp. 616-623
FM C
Flight Mgt: 12 MCU
FCGC
FC/FG total: 2 cabinets = 12 LRMs, 4 PSMs = 18 MCU volume
FCDC
11 LRUs = 24 lanes, incl. 20 PSUs = 50 MCU volume
modular integration
103
1995-1997 F.M.G. Drenberg
primary flight control (FBW), incl. backup secondary flight control (FBW) high-lift flight control (slat/flap FBW) flight envelope protection auto pilot w. CatIIIb auto-land flight director auto throttle
ref.: D.T. McRuer, D.E. Johnson: Flight control systems: properties and problems - Vol. 1 & 2, Feb. 75, 165 pp. & 145 pp., NASA CR-2500/2501 ref.: D. McRuer, I. Ashkenas, D. Graham: Aircraft dynamics and automatic control, Princeton Univ. Press, 73, 784 pp., ISBN 0-691-08083-6 ref.: J. Roskam: Airplane flight dynamic and automatic flight controls - Part 1 & 2, Roskam A&E Corp., 1388 pp., LoC Card no. 78-31382 ref.: R.J. Bleeg: Commercial jet transport fly-by-wire architecture consideration, Proc. 8th DASC, San Jose/CA, Oct. 88, pp. 399-406
104
1995-1997 F.M.G. Drenberg
demonstrator program in cooperation with DASA simulator and A340-rig tests: ongoing since 1Q91 flight test scheduled for 1Q98 on VFW614 test bed certification: primary flight control only (incl. dynamic task-reconfig concept) development & test program: full-function FCGC
BGT
Bodenseewerk Gertetechnik GmbH
105
1995-1997 F.M.G. Drenberg
VFW-614
106
low cost no reduction in safety & performance vs. conventional architectures safely dispatchable with any single module failed safely dispatchable with any two modules failed (reduced performance) significantly reduced weight/size/power
BGT
Bodenseewerk Gertetechnik GmbH
107
1995-1997 F.M.G. Drenberg
integration of functions, enabled by computing performance (mixed criticality levels!) reduced amount of interfacing (computer computer, lane lane)
lower cost hardware: no ARINC-65X backplane databus, connectors, module lever strict separation of I/O from computational functions dissimilarity
BGT
Bodenseewerk Gertetechnik GmbH
more paths through system: move away from rigid lane structure resource sharing, multi-use I/O hardware no single-thread operation reduced output h/w redundancy graceful degradation (shedding of lower criticality functions (FG) to retain higher (FC))
108
1995-1997 F.M.G. Drenberg
per FCGC:
2 dual Computing Modules (CPMs) 2 dual I/O Modules (IOM type A):
one mainly for PFC, the other mainly for FG
2 or 3 Power Supply Modules (dep. on dispatch reqs) A429 inter-FCGC, 10 Mbs serial inter-module A650 cabinet form factor, shorter LRMs
BGT
Bodenseewerk Gertetechnik GmbH
109
1995-1997 F.M.G. Drenberg
FC
FG (FC)
X-puter + PowerPC
4x IOM PowerPC + GP P
FG (FC)
FC
FG (FC)
BGT
- CPM failure -
111
1995-1997 F.M.G. Drenberg
BGT
112
1995-1997 F.M.G. Drenberg
BGT
113
1995-1997 F.M.G. Drenberg
AlliedSignal programs
Future .....
lliedSignal
A E R O S P A C E
AlliedSignal Programs
Integrated Cockpit Avionics Integrated Hazard Avoidance System Integrated Utilities System
lliedSignal
A E R O S P A C E
lliedSignal
A E R O S P A C E
4 major OEMs real industry several active programs good design capability some CIS govt funding
Production Plants
Airlines
Aeroflot remains
national carrier over 200 new airlines
high demand for capacity large fleet under-utilized over 200 new airlines in need of updating lack of support facilities customer image problems growing market OEMs addressing the
neeed
Private Operators
lliedSignal
A E R O S P A C E
ref.: K.R. Dilks: Modernization of the Russian Air Traffic Control/ Air Traffic Management System, Journal of Air Traffic Control, Jan/Mar 94, pp. 8-15 ref.: V.G. Afanasiev: The business opportunities in Russia: the new Aeroflot - Russian international airlines, presented at 2nd Annual Aerospace-Aviation Executive Symp., Arlington/VA, Nov. 94, 5 pp.
Moscow Kiev
AN
Taganrog
BE
Kazan Saratov
YAK mfg TU mfg
Novosibirsk
AN mfg
Irkutsk
BE mfg Beta Air
lliedSignal
A E R O S P A C E
Europe
8 9 7 10 10 9 10 10 10 11 10 10 10 mo. A-300 A-310 A-320 A-330 A-340 Average BAe-41 BAe-125 BAe-146 Average 17 11 12 17 11 14 mo. 14 12 20 15 mo.
CIS
IL-86 IL-96 IL-114 TU-154 TU-204 Yak-42 Average 48 51 57-69 40 60 66 55 mo.
cp
source sel.
EFIS cp
EICAS cp
FC cp
source sel.
to IOM-1/3
WX-RDR
brightness
Display System
6"x8" AM-LCD's
PFD
ND
EICAS
EICAS
ND
PFD
AlliedSignal h/w
to CNS-1
Stdby Instr.
to CNS-2
RMU-1
RMU-2
Sensors
ADC-1 AHRS-1
FMS/GPS-1 FMS/GPS-2
Sensors
AHRS-2 ADC-2
AlliedSignal OTS
to I/O-3 to/from Engine Ctl to I/O-2
AP PS FW DC I/O I/O OM + PS 1 2 AT
PS
to Flt Ctl
AP I/O I/O DC FW PS + VS 3 4 AT
Cabinet nr. 1
from A/C Systems
Cabinet nr. 2
to Audio System from A/C Systems
to IOM-1/2/3/4 to FSM-1/2
ADF MLS RA
VOR
opt.
cp cp cp cp
DATA LOADER
(portable)
ACARS XPDR
VOR RA
ADF DME
VHF
from RMU-1
opt.
ILS
to Displays
DME TACAN
opt.
XPDR HF
cp
ILS
TCAS
opt.
opt.
HF
lliedSignal
A E R O S P A C E
ref.: F. Drenberg, L. LaForge: An Overview of AlliedSignals Avionics Development in the CIS, IEEE AES Systems Magazine, Feb. 95, pp. 8-12
lliedSignal
A E R O S P A C E
Module-module communication: high speed A429 backplane Power consumption: < 400W total (115 Vac & 27 Vdc ) Cooled by integral fans
lliedSignal
A E R O S P A C E
I/O consolidation
simplifies DU and FMS/MCDU
lliedSignal
A E R O S P A C E
discrete in
lliedSignal
A E R O S P A C E
CM-Processor Board
CM-Interface Board
lliedSignal
A E R O S P A C E
module = computer board + interface board SMT (exc. connectors & hold-up capacitors) processor: 486 DX 33 @ 25 MHz inputs/outputs: out:16+5 ARINC429 in &
memory: 512 kBRAM
discrete in & out: 48+12 RS-232: 1 (shop maint.) 256 KB Boot RAM Flash (program mem & database) 32kB NVM
* 1 AMU-width
IOM-Interface Board
lliedSignal
A E R O S P A C E
IOM-Interface Board
- technical data -
module = 2x {computer board + interface board} SMT (exc. connectors & hold-up capacitors) processors: 486 DX 33 @ 25 MHz inputs/outputs: out: 2x (36+9) ARINC429 in &
memory: RAM
discrete in & out: 2x (22+8) RS-232: 1+1 (shop maint.) Boot Flash (program mem & database) NVM
software loadable via ARINC-615 3 AMU width application: FCMs, FWMs, OMM, IOMs to DUs, FDR,
from a/c systems, CNS, EIS control panels
lliedSignal
A E R O S P A C E
Russian Trivia
they know and love their culture 80% of Muscovites have a weekend datcha near Moscow Nothing ever gets finished in Russia From the provinces it can take 3 hours to get a phone call to Moscow Russians love dogs Vodka plays a significant role in the Russian way of life Life expectancy for a Russian male is 63 years Somebody in Moscow collects manhole covers The women are not short and stout in black head scarves, they are surprisingly attractive
lliedSignal
A E R O S P A C E
AlliedSignal Programs
Integrated Cockpit Avionics Integrated Hazard Avoidance System Integrated Utilities System
lliedSignal
A E R O S P A C E
Percentage of accidents Load, Takeoff taxi, unload 4.8% 12.8% Initial climb 7.4% Climb 6.4% Cruise 5.7% Descent 6.2%
Flaps retracted
Nav Fix 1% 1% 14% 57% Exposure, percentage of flight time 11% 12%
Outer Marker 3% 1%
- worldwide commercial jet fleet, all acidents 1965-1994 ref.: Boeing Commercial Airplane Group Statistical Summary of Commericial Jet Aircraft Accidents - Worldwide operations 19592
lliedSignal
A E R O S P A C E
lliedSignal
A E R O S P A C E
Terrain:
Controlled Flight Into Terrain (CFIT):
worldwide, a leading cause of fatal accidents involving commercial air transports usually during approach phase of flight (3% departure), usually while decending at normal flight-path angle 25% VFR (esp. night time) 65% IFR (esp. non-precision with step-down fixes)
ref.: D. Carbaugh, S. Cooper: Avoiding Controlled Flight Into Terrain, Boeing Airliner, April-June 96, pp. 1-11 ref.: D. Hughes: CFIT task force to develop simulator training aid, AV&ST, July 10, 95, pp. 22, 35, 38
lliedSignal
A E R O S P A C E
environmental:
volcanic ash
traffic:
other aircraft (all classes) birds
ref.: J. Townsend: Low-altitude wind shear, and its hazard to aviation, Natl Academy, Washington/DC, 1983 ref.: L.S. Buurma: Long-range surveillance radars as indicators of bird numbers aloft, Israeli J. of Zoology, Vol. 41, 95, pp. 21-236 5
lliedSignal
A E R O S P A C E
Hazards to aircraft
On-Ground:
runway incursions other aircraft vehicles animals other obstacles
(contd)
On-Aircraft:
fire, smoke wing ice
6
lliedSignal
A E R O S P A C E
12,000 10,000 8,000 Aircraft 6,000 4,000 2,000 0 66 14 12 10 Annual departures 8 (Millions) 6 4 2 0 66 68 70 72 74 76 78 80 82 84 86 88 90 92 68 70 72 74 76 78 80 82 84 86 88 90 92
94
14.6
94
Accident rates of US scheduled airlines (Part 121): 1 per 2,500 M miles (95); 1 per 1,250 M miles (94) 1 per 4.2 M departures (95); 1 per 2M (94)
Accident rates of US scheduled airlines (Part 125): 1 per 333 M miles (95); 1 per 200 M miles (94) 1 per 1.75 M departures (95); 1per 1.2M (94)
- worldwide operations 1965-1994 ref.: Boeing Commercial Airplane Group Statistical Summary of Commericial Jet Aircraft Accidents - Worldwide operations 19597
lliedSignal
A E R O S P A C E
Projection
more accidents
lliedSignal
A E R O S P A C E
Flight recorders
(SS)CVR, (SS)FDR
Smoke detection
ref.: D. Esler: Trend monitoring comes of age, Business & Commercial Aviation, July 95, pp. 7075 ref.: P. Rickey: VCRs and FDRs, Avionics Magazine, March 96, pp. 34-38 9
lliedSignal
A E R O S P A C E
Terrain Avoidance
GPWS Functionality
Modes 1- 4 Mode 5 (Glide Slope) Mode 6 (Altitude Callouts and Bank Angle)
lliedSignal
A E R O S P A C E
17 16
15
7
5
5 4 3 2 1 1
Midair collision Landing Ice/ Windshear Fuel Runway Other snow exhaustion incursion
300
CFIT
Fire
- CFIT accounts for majority of fatal commercial airplane accidents ref.: D. Carbaugh, S. Cooper: Avoiding Controlled Flight Into Terrain, Boeing Airliner Magazine, April-June 1996, pp. 1-11 11
lliedSignal
A E R O S P A C E
35 30
Accidents
55
60
65
70
75
80
85
90
Year
- introduction of GPWS has reduced CFIT risk ref.: D. Carbaugh, S. Cooper: Avoiding Controlled Flight Into Terrain, Boeing Airliner Magazine, April-June 1996, pp. 1-11 12
lliedSignal
A E R O S P A C E
12 11 16
Late warning, or improper pilot response
13
lliedSignal
A E R O S P A C E
+2000
+1000
Aircraft Elevation
-500
(variable)
-1000
-2000
14
lliedSignal
A E R O S P A C E
15
lliedSignal
A E R O S P A C E
16
lliedSignal
A E R O S P A C E
ref.: freeflight (moving map software for laptop PC), FreeFlight Inc, Pasadena, CA
17
lliedSignal
A E R O S P A C E
End of Cold War helped provide 30 arc second data for 65% of the world Coverage has grown to 85 % of land mass Includes 90% of worlds airports Validation by Flight and Simulation Terrain info: compressed into 20 MB flash memory
Purchased from Jeppesen All runways 3500 feet in length Currently 4,750 airports and 6,408 runways Runway info: Lat/Long of center, length, bearing, elevation
18
lliedSignal
A E R O S P A C E
Orange: 60 arcsec Green: 5 arcmin (enroute) Brown: Dig. Chart of the World Yellow: 120 arcsec Blue: missing data
19
lliedSignal
A E R O S P A C E
50.00
0.00
lliedSignal
A E R O S P A C E
nm
f(dx to airport)
look-ahead distance
Look-ahead alert and warning (60 sec, instead of 10-30 sec) Terrain-clearance independent of a/c landing configuration Situational display of threatening terrain
21
lliedSignal
A E R O S P A C E
lliedSignal
A E R O S P A C E
GPWS TCAS II
lliedSignal
A E R O S P A C E
Waveguide
Ant. Ctlr
RADAR
Sw RADAR
GND PROX
OVRD
TCAS/ATC CP
GPWS CP
GPWS
A453
WARNING CAUTION
TCAS Processor
lliedSignal
A E R O S P A C E
Dir. Ant.
4
Bottom
IHAS
IHAS - L
IHAS
Coax
WX Radar Antenna
IHAS - R
A453
Top
Bottom
Omni Ant.
25
lliedSignal
A E R O S P A C E
lliedSignal
A E R O S P A C E
(contd)
lliedSignal
A E R O S P A C E
Open architecture Support software Level A (RTCA/DO-178B) Simultaneously support lower software levels Minimize complexity at A level Provide for incremental system evolution Hold down cost of changes
28
lliedSignal
A E R O S P A C E
$$
K_EXEC
processor time allocation partition window positioning connection of channels to partitions
$$$
BIC Tables
channel bandwidth allocations node transmit permissions
lliedSignal 6
A E R O S P A C E
TCAS-II
Mode-S Transponder
Warning Computer
W X R a d a r
T C A S A T C
D u a l C P M
D u a l C P M
I O M
I O M
D u a l P S M
s p a r e
s p a r e
RF + DSP Modules
IHAS
30
lliedSignal
A E R O S P A C E
E-GPWS
a/c data & power
TCAS
Mode-S
Radar
Ant. drive Power Bus OASYS + special modules for Radar and TCAS/Mode-S processing integrated TCAS/Mode-S IOMs shared by all functions CPM shared by all functions
E-GPWS Fault Warning Computer general processing for TCAS, Mode-S, Radar
a/c power
PSM
CPM
IOM
IOM
TCAS + Mode-S
special I/O & processing
Radar
special I/O & processing
a/c data
31
lliedSignal
A E R O S P A C E
IHAS characteristics
digital: ARINC-429 and 629 analog: as required for specific aircraft inter-modular backplane bus: modified ARINC-659 RF: 2 TCAS/Mode-S antennas (shared aperture, directional) power: multiple 115 Vac and 28 Vdc
Interfaces:
Mechanical:
LRM form-factor: ARINC-600 connectors: RF and modified ARINC-600
- conceptual -
32
lliedSignal
A E R O S P A C E
lliedSignal
A E R O S P A C E
fault-tolerant
lliedSignal
A E R O S P A C E
Partition Execs
Thread schedulers, driven by event/priority/deadline; executes strictly within a partition created by K-Exec
Lib. 1 Lib. 2
Kernel-Mode software
K-Exec
Hardware
- modified scheduler activation type exec ref.: A.S. Tanenbaum: Distributed Operating Systems, Prentice Hall, 1995, 614 pp., ISBN 0-13-219908-29 35
lliedSignal
A E R O S P A C E
Node architecture
External I/O External I/O External I/O
IPU
IPU
Generic IOM
Generic IOM
P1
P2
P3
P4
P5
P3
P6
P7
P8
P9
P10
K-Exec
Bus I/F
K-Exec
Bus I/F
K-Exec
Bus I/F
K-Exec
Bus I/F
K-Exec
Bus I/F
36
lliedSignal
A E R O S P A C E
processing throughput
VAX-MIPs, Whet/Drystones, SPEC95, etc. dont start with top-of-line (you may out-grow it before next gen is available = EOL)
embeddedness
desired: minimum number of external components, i.e., component integration counters, timers (incl. watchdog) cache DRAM refresh floating point unit memory management unit serial port UART JTAG port for debug, BIT, shop test, software load
operating voltage
5, 3.3, 2.5, 2.2, 1.8, etc. Vdc
37
lliedSignal
A E R O S P A C E
Processor selection criteria power consumption temperature range cache (instruction & data) size and level
L2/L3 may not be desired
contd
desired: < 0.5 W (no 35 W Pentium Pro if using 4-10 Ps per cabinet or LRU)
memory management
virtual addresssing (page based)
error checking capability (e.g., bus parity) exception & interrupt handling
at Kernel & Application Exec level at application level
lliedSignal
A E R O S P A C E
contd
cost
recurring cost of complete processor core development/maintenance
lliedSignal
A E R O S P A C E
lliedSignal
A E R O S P A C E
connects all processing nodes in the system integration of numerous conventional point-to-point and broadcast databuses between LRUs (time-)shared resource:
bus must provide fault tolerance (redundancy, distributed control, etc.) bus interfaces must provide a high-integrity front-end bus & bus protocol must ensure robust partitioning, while supporting cost-effective development, upgrade & addition of applications
41
lliedSignal
A E R O S P A C E
Clock
Clock
DPRAM
Clock
DPRAM
Clock
Table Mem
Table Mem
42
lliedSignal
A E R O S P A C E
Clock
I/F FIFO
I/F
DPRAM
Clock Clock
Table Mem
Table Mem
lliedSignal
A E R O S P A C E
Space partitioning: guarantees integrity of allocated program & data memory space, registers, dedicated I/O Time partitioning: guarantees timely access to allocated (shared) processing & communication bandwidth determinstic execution
- at functional level, an integrated system with a robust chain of partitioning looks like a virtual federated system 44
lliedSignal
A E R O S P A C E
Growth Potential
Wake-vortex prediction Wing-ice detection Clear Air Turbulence detection Volcanic ash detection Enhanced Vision System (EVS)
lliedSignal
A E R O S P A C E
IHAS: stepping stone towards an integrated Enhanced Situational Awareness System (ESAS) ....
Enh. TCAS Volc. Ash Dry-Hail Wake Vortex CAT
IHAS
Warn & Caution WX/Windshear Radar Cond. & Perf. Monitoring Radar Terrain & Obst. Sensing Radar Posn. Correlation HUD Imaging Sensors EVS
ESAS
lliedSignal
A E R O S P A C E
Accidents are not frequent enough to measure safety through accident rates Absence of accidents does not necessarily imply safety IHAS can monitor safety parameters for statistically meaningful measurement of Merit of Safety Quality
relative safety how close to hazardous condition how often statistical only: not traceable to particular flights can be used to indentify unsafe SIDs/STARs, ATC procedures, etc.
47
lliedSignal
A E R O S P A C E
Terrain Clearance
3o G
lides
lope
Runway
Probability of CFIT
Probability
Nominal
Terrain Clearance
lliedSignal
A E R O S P A C E
re-use of backplane, modules, circuit design, O/S, BIT, V&V, etc. fewer specific test equipment sharing / pooling of resources from various SBUs/SBEs economies of scale for generic modules and backplane fewer partnumbers (documentation, spares, test equipm., etc.) interchangeability of modules across applications
Reduced RE:
lliedSignal
A E R O S P A C E
common
IOM IHAS CPM
(dual)
PSM
(dual)
tbd
Bus + Mech
O/S Maint S/W BIT S/W
AlliedSignal Programs
Integrated Cockpit Avionics Integrated Hazard Avoidance System Integrated Utilities System
lliedSignal
A E R O S P A C E
Bleed Air Bleed Leak Det Avionics Cooling Cargo Fire Prot Eng. Fire Prot Smoke Detect Anti-Ice Cabin Air
- pressure - conditioning
Elec Pwr Gen Elec Pwr Distr Load Mgt Windshld Heat DC sensors Lighting
- external - flight deck - cabin
Engine Control Thermal Mgt Thrust Reverse Fuel Control APU Control
Electrical
Propulsion
Environmental Control
Cargo Handling Potable Water Lavs & Waste Galley Escape System Oxygen
Payload
Avionics
Hydro-Mechanical
lliedSignal
A E R O S P A C E
ref.: D. Parry: Electrical Load Management for the 777, Avionics Magazine, Feb. 95, pp. 36-38 ref.: Avionics on the Boeing 777, Part 1-11, Airline Avionics, May 94 - June 95 ref.: M.D.W. McIntyre, C.A. Gosset: The Boeing 777 fault tolerant air data inertial reference system , Proc. 14th DASC, Boston/MA, Nov. 95, pp. 178-183 ref.: G. Bartley: Model 777 primary flight control system, Boeing Airliner Magazine, Oct/Dec 94, pp. 7-17 ref.: R.R. Hornish: 777 autopilot flight director system, Proc. 13th DASC, Phoenix/AZ, Nov. 94, pp. 151-156
lliedSignal
A E R O S P A C E
Internal Actuators:
valves motor solenoid compressors motor, turbine air-fan fluid pump other EM devices
Physical Outputs:
air flow at suitable temp & press coolant flow at suitable temp & press O2, N2 flow APU air
lliedSignal
A E R O S P A C E
future engines:
electrical start instead of air (requires > 100 kW!) bleed-air system will be deleted through mech. integration (civil only)
lliedSignal
A E R O S P A C E
Integrated Utilities
Integrated Systems
ICECS
Microprocessor/ Software
B757/767
F-18 C/D
1960
lliedSignal
A E R O S P A C E
1970
1980
1990
2000
ref.: Janes Avionics, 1992-1993, Janes Information Group Inc., 664 pp., ISBN 0-7106-0990-6 ref.: Janes All the Worlds Aircraft, 1993-1994, Janes Information Group Inc., 733 pp., ISBN 0-7106-1066-1
lliedSignal
A E R O S P A C E
lliedSignal
A E R O S P A C E
Bleed Air Bleed Leak Det Avionics Cooling Cargo Fire Prot Eng. Fire Prot Smoke Detect Anti-Ice Cabin Air
- pressure - conditioning
Elec Pwr Gen Elec Pwr Distr Load Mgt Windshld Heat DC sensors Lighting
- external - flight deck - cabin
Engine Control Thermal Mgt Thrust Reverse Fuel Control APU Control
Electrical
Propulsion
Environmental Control
Cargo Handling Potable Water Lavs & Waste Galley Escape System Oxygen
Payload
Avionics
Hydro-Mechanical
Windows
Cabin Temp
Cabin Pressure
avionics radar hydraulics electr. power
Flight Deck
lliedSignal
A E R O S P A C E
Selector Displays
10
Starter/Generator
FADEC
Bleed-Air
Fuel
A/C Loads
T/EMM Controller
APU
Engine Oil
lliedSignal
A E R O S P A C E
ECS Cabin Pressure Vapor Cycle Sys. Bleed Air APU Electric Power Hydraulic Sys.
Power Supply
CPU Module
Digital Interface
Power Electronics
Other Functions
Conventional Controls
12
Integration of controls
* MAFT is not limited to 4 nodes
Integrated control system has higher criticality So, (more) fault tolerance required T/EMM Controller is based on MAFT: Multi-computer
Architecture for Fault Tolerance: a platform of 4* semi-autonomous computer nodes (lanes) connected by a serial-link broadcast bus network each of the 4 nodes (lanes) is partitioned into a Computing Module and an I/O Module the computing module is partitioned into an Applications Processor and an RTEM (Real-Time Executive Module) co-processor
ref.: C.J. Walter, R.M. Kieckhafer, A.M. Finn: MAFT: a Multicomputer Architecture for Fault-Tolerance in Real-Time Control Systems, Proc. IEEE Real Time Systems Symp., San Diego/CA, Dec. 85, 8 pp. ref.: C.J. Walter: MAFT: an architecture for reliable fly-by-wire flight control, proc. 8th DASC, San Jose/CA, Oct. 88, pp. 415-421 ref.: L. Lamport, R. Shostak, M. Pease: The Byzantine Generals Problem, ACM Trans. on Programming Languages & Systems, Vol. 4, No. 3, July 82, pp. 382-401 ref.: M. Barborak, M. Malek, A. Dahbura: The Consensus Problem in Fault-Tolerant Computing, ACM Computing Surveys, Vol. 25, No. 2, June 93, pp. 171-220 13
lliedSignal
A E R O S P A C E
RTEM-based system
fully connected broadcast network
(repeated for all nodes)
RTEM
RTEM
RTEM
RTEM
AP
AP
AP
AP
IOP
IOP
IOP
IOP
lliedSignal
A E R O S P A C E
system busses
14
MAFT/RTEM
MAFT: original theory & concepts developed and patented by Bendix Aerospace Technology Center, Columbia/MD (1970s) Concept: fault tolerant co-processor which provides RedMan functions for real-time mission-critical systems dedicated h/w, makes overhead functions transparent to APs: looks like peripheral (memory mapped or I/O port) deterministic, design-for-validation (certification) to reduce system development, validation cost supports dissimilar AP Ps & N-Version s/w to protect against generic faults makes no assumptions regarding types of faults/errors to be tolerated: any fault/error is possible, no matter how malicious
lliedSignal
A E R O S P A C E
15
16
Global consistency
Basis for reliability in a distributed fault-tolerant system Must be established on all critical system parameters Two forms of agreement:
Byzantine Agreement (exact agreement) on boolean data
Agreement: all healthy lanes agree on contents of every message sent. Validity: all healthy lanes agree on contents of messages sent by any other healthy lane, as originally sent.
- the ability of non-faulty lanes to reach agreement despite presence of (some) faulty lanes -
17
RTEM-based node
fully connected broadcast network
RTEM
Applications Processor
Analog I/O
Input/Output Processor
Discrete I/O
system bus(es)
lliedSignal
A E R O S P A C E
18
RTEM block-diagram
from all other nodes + wrap from own node to all other nodes
Message Checker
Transmitter
19
Voter:
Approximate (with deviance limit), or Boolean
Task Scheduler:
event driven, priority based, globally verified (inc. WDT) allows wide variety of execution times & iteration rates
Synchronizer:
loose-sync (frame based), periodic resync (exchange, vote, correct local clocks = distr. FT global clock)
Fault Tolerator:
collects inputs from all error detection mechanisms ( 25), and generates error reports (voted)
lliedSignal
A E R O S P A C E
20
lliedSignal
A E R O S P A C E
21
RX/TX Conn.
Task Sched
Voter
Sync
lliedSignal
A E R O S P A C E
22
23
31 32 33 34 35 36 38 45 49
Indicating/Recording Systems Landing Gear Lights Navigation Oxygen Pneumatic System Water/Waste Central Maintenance System Airborne Auxiliary Power
indicates candidate system
lliedSignal
A E R O S P A C E
24
Future .....
deletion of avionics
GPS sole means of nav by 2010 in USA demise of NDB, VOR, DME, ILS
contd
1997 F.M.G. Drenberg
Future ........
(contd)
device density and performance system complexity and size remote electronics:
end-to-end digitalization interfacing & computing closer to data source or to point of application smart sensors, actuators, skins, etc.
contd
1997 F.M.G. Drenberg
time
"now-ish"
ref.: G. Stix: "Toward 'point One' - Trends in Semiconductor Manufacturing," Scientific American, February 1995, pp. 90-95 ref.: G.D. Hutcheson, J.D. Hutcheson: "Technology and Economics in the Semiconductor Industry," Scientific American, January 1996, pp. 54-62 1997 F.M.G. Drenberg
10
PROXIMITY ALIGNERS PROJECTION ALIGNERS FIRST G-LINE STEPPERS 16M ADVANCED G-LINE STEPPERS 80786 POWER PC 620 FIRST I-LINE STEPPERS 4M ADVANCED I-LINE STEPPERS FIRST DEEP-UV STEPPERS POWER PC 601 68040 1M 80486 256K 68030 68020 80386 PENTIUM PRO POWER PC 604 PENTIUM
80786
10
64M
N U M B E R O F T R A N S I S T O R S P E R C H IP
107
10
10
64K 68000
80286
16K
8086
10
4K 8080 6800 INTEL MICROPROCESSOR MOTOROLA MICROPROCESSOR SIZE OF MEMORY (DRAM) IN BITS
1K 4004
increase performance (PC Ps) and/or integrate more functions with P and evolve towards complete system-on-chip
(embedded applications)
10
3 1970 '72 '74 '76 '78 '80 '82 '84 '86 '88 '90 '92 '94 '96 '98 2000 YEAR OF AVAILABILITY
ref.: G.D. Hutcheson, J.D. Hutcheson: "Technology and Economics in the Semiconductor Industry," Scientific American, January 1996, pp. 54-62
ref.: M. Slater: The microprocessor today, IEEE Micro, Dec. 1996, pp. 32-44
- further price/performance improvements to be expected ref.: EE Times, May 22, 95, p. 16 1997 F.M.G. Drenberg
Future ........
(contd)
Future ........
improved human factors (safety)
(contd)
open standard LRMs, LRM BFE? electrical power: 270 Vdc, Vac, battery backup? HOL source code ownership? more electric aircraft ? (e.g., development of powerful rare-earth PM motors) full-time APUs (much higher APU rel., APU bleed-air more efficient engines) new processor architectures (e.g., wormhole computer?) ??
1997 F.M.G. Drenberg
10
Future ........
FMS AP/AT Perf Mgt CNS Radios Comm Mgt Displays Data Concentr. Air Data & Inertial Ref On-Board Maint Pax Comm. Pax Entertain. Condition Mon. Flight Warning Flight Safety
- FDR, CVR - TCAS - GPWS - WX
(contd)
Bleed Air Bleed Leak Det Avionics Cooling Cargo Fire Prot Eng. Fire Prot Smoke Detect Anti-Ice Cabin Air
- pressure - conditioning
Elec Pwr Gen Elec Pwr Distr Load Mgt Windshld Heat DC sensors Lighting
- external - flight deck - cabin
Engine Control Thermal Mgt Thrust Reverse Fuel Control APU Control
Electrical
Propulsion
Environmental Control
Cargo Handling Potable Water Lavs & Waste Galley Escape System Oxygen
Payload
Avionics
Flight Control
Hydro-Mechanical Hydro-
11
System Complexity and Size - trends partially driven by Ada req't 150 k 777-200
80 MB
100 k
20 MB
A330/340
747-400
2x every 2 years
10 MB A320 747-400 A310
50 k
Apollo
1970
1975
Year
ref.: P. Gartz: Systems Engineering, tutorial at 13th & 14th DASC, Boston/MA, Nov. 1995; ref.: Airbus Industries (pers. conv.) ref.: P. Gartz: Trends in avionics systems architecture, presented at 9th DASC, Virginia Beach/VA, Oct. 90, 23 pp. ref.: P. Pelton, K. Scarborough.: Systems Engineering Experiences from the 777 AIMS program, proc. 14th AIAA/IEEE DASC, Boston/MA, Nov. 1995
> 2M SLOCs
System Complexity
installed software
100 MB
777-200
System Size
12
150k
777-200
100k
747-400
50k
747-200
757/767-200
ref.: P. Gartz: Systems Engineering, tutorial at 13th & 14th DASC, Boston/MA, Nov. 1995; ref.: Airbus Industries (pers. conv.) ref.: P. Gartz: Trends in avionics systems architecture, presented at 9th DASC, Virginia Beach/VA, Oct. 90, 23 pp. ref.: P. Pelton, K. Scarborough.: Systems Engineering Experiences from the 777 AIMS program, proc. 14th AIAA/IEEE DASC, Boston/MA, Nov. 1995
13
80 MB
2x every 2 years
A330/340
20 MB
A320 747-400
1970
1980
1990
ref.: P. Gartz: Systems Engineering, tutorial at 13th & 14th DASC, Boston/MA, Nov. 1995; ref.: Airbus Industries (pers. conv.) ref.: P. Gartz: Trends in avionics systems architecture, presented at 9th DASC, Virginia Beach/VA, Oct. 90, 23 pp. ref.: P. Pelton, K. Scarborough.: Systems Engineering Experiences from the 777 AIMS program, proc. 14th AIAA/IEEE DASC, Boston/MA, Nov. 1995
14
600
Source Lines of Code (kSLOCs)
- mech/elec systems SLOC combined is larger than AIMS source: BCAG 1997 F.M.G. Drenberg
15
16
some 1,500 circuit breakers 200,000 individually marked lengths of cable total 225 km (140 miles) 400,000 connections 14,000 connectors 3,000 splices 35,000 ring terminals over 1,000,000 individual parts system accounts for 10% of a/c price tag
ref.: A. Emmings: Wire power, British Airways World Engineering, Iss. 8, July/Aug. 95, pp. 401997 F.M.G. Drenberg
17
Extrapolation ......
Given:
777 processing power equivalent to 1,000 x 486
Assuming:
Moores Law (2x every 18 months)
Hence:
single-processor 777 within 15 years....
Computers in the future may weigh no more than 1.5 tons
Popular Mechanics magazine, 1949
ref.: Gordon Moore, 1966, on performance, complexity, and number of transistors per
18
Enabling technologies
19
Enabling technologies
- components integration (incl. RF) miniaturization, high-density packaging, improved chip-to-package size efficiency
(Multi Chip Module, Chip-On-Board, Flip-Chip, Chip-Scale- Package, 3-D stacking, etc.)
high temperature electronics (THE, e.g. SiC) fault-tolerant electronics (FTE), chip-level redundancy chip & inter-chip BIT
ref.: G. Derman: Interconnects & Packaging - Part 1: Chip-Scale Packages, EE Times, 26 Feb. 96, pp. 41,70-72 ref.: T. DiStefano, R. Marrs: Building on the surface-mount infrastructure, EE Times, 26 Feb. 96, pp. 49 ref.: HITEN (High Temp. Electronics Network)Aerospace applications of High Temperature Electronics, 13 May 96, http://www.hiten.com/hiten/categories/aero ref.: S. Birch: The hot issue of aerospace electronics, SAE Aerospace Engineering, July 95, pp. 4-6 ref.: J.A. Sparks: High temperature electronics for aerospace applications, proc. ERA Avionics Conf., London,Nov./Dec. 94, pp. 8.2.1-8.2.5
20
Enabling technologies
MCMs:
- components -
reduced size, increased performance low inductive/capacitive parasitics lower supply noise & ground bounce very expensive (mfg & test) 3-D stacking (e.g., memory) poses thermal problems military niche market for time being
thru-hole device
MCM substrate
PCB
SMT device
PCB
thru-hole device
MCM
SMT device
ref.: J.H. Mayer: Pieces fall into place for MCMs, Military & Aerospace Electronics, 20 March 96, pp. 20-
Enabling technologies
- drivers for high-volume = low-cost components -
Automotive industry:
high temperature electronics coming: ruggedized laptop LCDs *
(temp/vibe/sunlight environment similar to aviation application)
22
Electronics evolution
23
Enabling technologies
- design / development -
24
25
(frmr PCMCIA)
26
3.8 cm (1 in.)
7 cm (2 3/4 in.)
1997 F.M.G. Drenberg
ref.: D. Maliniak: Modular dc-dc converter sends power density soaring, Electronic Design, Aug. 21 95, pp. 59-
27
ref.: J. Sweder et al.: Compact, reliable 70-watt X-band power module with greater than 30-percent PAE, proc. MTT symposium, June 1996
28
29
Red phosphor
Green phosphor
Cathode
Cathode conductor
Glass
Column line
Microtips
- CRT performance & image quality in low-power flat-panel display (emerging challenge to AM-LCDs?)
ref.: FED up with LCDs?, Portable Design, March 96, pp. 20-25 1997 F.M.G. Drenberg
30
31
Enabling technologies
- component integration issues more components become complex* (not 100% analyzable or 100% testable)
* not necessarily high gate count
hardware-near-software must apply design assurance to devices & tools, as already reqd for software (DO178); but who will do this for COTS?
ref.: RTCA DO-180 ref.: BCAG: "777 Application Specific Integrated Circuits (ASIC) Certification Guideline," Boeing Doc. 18W001; also: RTCA Paper No. 535-93/SC180-11, December 1993 ref.: Honeywell Commercial Flight Systems: "ASIC Development and Verification Guidelines," Honeywell Spec. DS61232-01 Rev A, January 1993; also: RTCA Paper No. 536-93/SC180-12 ref.: Harrison, L.H., Saraceni, P.J.: "Certification Issues for Complex Digital Hardware," Proc. 13th AIAA/IEEE DASC, Phoenix/AZ, Nov. 1994, pp. 216-220 1997 F.M.G. Drenberg
32
Enabling technologies
- architectures dynamic resource allocation move away from brute force redundancy scalable redundancy (GenAv AT) partitioning
33
Resource Partitioning
- part of system architecture and safety strategy Physical and logical organization of a system such that:
a partition does not contaminate an others data & code storage areas, or I/O failure of a resource that is shared by multiple partitions does not affect flight safety failure of a dedicated partition-resource does not cause adverse effects in any other partition failure of a partition does not reduce the timely access to shared resources by other partitions
- architectural means for providing isolation of functionally independent resources, for fault containment & isolation, and potential reduction of verification effort ref.: RTCA DO-178, DO-180 1997 F.M.G. Drenberg
34
Resource Partitioning
Partitions cannot be trusted:
(contd)
an independent protection mechanism must be provided against breaches of partitioning all failures of the protection mechanism must be detectable
Advantages of partitioning:
provides an effective means to meet safety reqs maximizes ability to detect & contain errors/faults allows partitions to be updated & certified separately allows re-V&V to be limited to changed partition allows incremental & parallel design, test, integration supports cost-effective development, cert., maint., updates allows mixed-criticality (not within same partition!) provides flexibility in responding to evolving system reqs
ref.: M.J. Morgan: Integrated modular avionics for next-generation commercial airplanes, IEEE AES Magazine, Vol. 6, No. 9, Aug. 91, pp. 9-12 1997 F.M.G. Drenberg
35
Enabling technologies
- communication -
fiber-optic communication (incl. on-chip) low(er) cost multi-directional databus air-ground, air-air
ref.: M. Paydar: Air-ground data links offer operational benefits as well as new possibilities, ICAO Journal, May 1997, pp.13-15
36
Enabling technologies
- design / development capturing complete set of validated reqs software auto-code software V&V hardware V&V (DO-180: hardware-nearsoftware, complex hardware) EMI/Lightning certification re-use
ref.: NATO AGARD Advisory Report 274: Validation of flight critical control systems, Dec. 91, 91 pp., ISBN 92-835-0650-2 1997 F.M.G. Drenberg
37
Enabling technologies
- design / development -
High
10,000 1,000
Medium
100 10
Low
Requirements
1
Production & Deployment
* but plan for inevitable need
to correct/change reqs, as insight into the need and the best solution grows during development (and customer changes its mind)
1997 F.M.G. Drenberg
- it clearly pays to do the right thing up front* ref.:Port, O., Schiller, Z., King, R.W.: A smarter way to manufacture, Business Week, April 30, 1990, pp. 110-117
38
Enabling technologies
- design & development Equivalent Maturity Level World Class - 3 Structured - 2 Defined - 1 Undefined - 0 36 (141 companies total) Percentage of Surveyed firms 17 36 52 0.5% Sample Average 4% 6.7% 4.7% Return-on-Sales p.a. 1987-1991 9.3% 8.1% 7.3% 5.1% Sample Average 8% Sales Growth p.a. 1987-1991 16 %
- business performance is linked to engineering maturity level ref.: Excellence in quality management, McKinsey & Co., Inc., 1992 ref.: Dion, R.: Process improvement and the corporate balance sheet, IEEE Software, Vol. 10, No. 4, July 1993, pp. 28-35
39
Enabling technologies
s/w 2/3 of system development cost: prime area for improvement systems engineering to provide reqs set:
F3I, performance (inc. timing), technology, etc. complete, validated, traceable, consistent, unambiguous
eliminate errors via (V&V-ed) autocode standard libraries of software modules (re-use) automated V&V tools
- certified software is too expensive ref.: EIA Interim Std 632 Systems Engineering, Dec. 1994 ref.: IEEE 1220 Std for Appl. and Mgt of the Systems Engineering Process, Dec. 1994 1997 F.M.G. Drenberg
40
Programming today is a race between software engineers striving to build bigger and better idiot-proof programs, and the universe trying to produce bigger and better idiots. So far, the universe is winning.
Rich Cook, comedian
1997 F.M.G. Drenberg
BIBLIOGRAPHY
BOOKS F.J. Redmill (ed.): Dependability of critical computer systems - 1, 1988, 292 pp., ITP Publ., ISBN 1-85166-203-0 D.P. Siewiorek, R.S. Swarz (eds.): Reliable computer systems, 2nd ed., Digital Press, 92, 908 pp., ISBN 1-55558-075-0 M.R. Lyu (ed.): Software fault tolerance, Wiley & Sons, 95, 337 pp., ISBN 0-471-95068-8 B.W. Johnson: Design and analysis of fault tolerant systems, Addision-Wesley, 89, 584 pp., ISBN 0-201-07570-9 25th Anniversary Compendium of Papers from Symposium on Fault Tolerant Computing, IEEE Comp. Society Press, 96, 300 pp., ISBN 0-8186-7150-5 N. Suri, C.J. Walter, M.M. Hugue (eds.): Advances in ultra-reliable distributed systems, IEEE Comp. Society Press, 95, 476 pp., ISBN 0-8186-6287 M. Pecht (ed.): Product reliability, maintainability, and supportability handbook, CRC Press, 95, 413 pp., ISBN 0-8493-9457-0 H.E Roland, B. Moriarty: System safety engineering and management, 2nd ed., Wiley & Sons, 90, 367 pp., ISBN 0-471-61816-0 G.L. Fuller: "Understanding HIRF - High Intensity Radiated Fields," publ. by Avionics Communications, Inc., Leesburg, VA, 1995, 123 pp., ISBN 1-885544-05-7 J. Curran: Trends in advanced avionics, Iowa State Univ. Press, 92, 189 pp., ISBN 0-8138-0749-2 J.R. Newport: Avionic system design, CRC Press, 94, 332 pp., ISBN 0-8493-2465-3 C.R. Spitzer: Digital Avionics Systems - Principles and Practices, 2nd ed., McGraw-Hill, 93, 277 pp., ISBN 0-07-060333-2 I.C. Pyle: Developing safety systems - a guide using Ada, Prentice Hall, 91, 254 pp., ISBN 0-13-204298-3 E.T. Raymond, C.C. Chenoweth: Aircraft flight control actuation system design, SAE, 93, 270 pp., ISBN 1-56091-376-2 D.T. McRuer, D.E. Johnson: Flight control systems: properties and problems - Vol. 1 & 2, 165 pp. & 145 pp., NASA CR-2500 & -2501 D. McRuer, I. Ashkenas, D. Graham: Aircraft dynamics and automatic control, Princeton Univ. Press, 73, 784 pp., ISBN 0-691-08083-6 J. Roskam: Airplane flight dynamics and automatic flight controls - Part 1 & 2, Roskam A&E Corp., 1388 pp., Library of Congress Card No. 78-31382 NATO Advisory Group for Aerospace R&D : AGARD Advisory Report 274 - Validation of Flight Critical Control Systems, dec. 91, 126 pp., ISBN 92-835-0650-2 C.A. Clarke, W.E. Larsen: Aircraft Electromagnetic Compatibility, feb. 85, 155 pp., DOT/FAA/CT-88/10; same as Chapter 11 of Digital Systems Validation Handbook Vol. II R.A. Sahner, K.S. Trivedi, A. Puliafito: Performance and reliability analysis of computer systems, Kluwer Academic Publ., 1995, ISBN 0-7923-9650-2 E.L. Wiener, D.C. Nagel (eds.): Human factors in aviation, Academic Press, 1988, 684 pp., ISBN 0-12-750031-6 Reliability Analysis Center (RAC) of the DoD Information Analysis Center (1-800-526-4802):
The Reliability Sourcebook 'How and Where to Obtain R&M Data and Information, RAC Order Code: RDSC-2, periodic updates Practical Statistical Analysis for the Reliability Engineer, RAC Order Code: SOAR-2 RAC Thermal Management Guidebook, RAC Order Code: RTMG Developing Reliability Goals/Requirements, October 1996, 34 pp., RAC Order Code: RBPR-2 Designing for Reliability, October 1996, 74 pp., RAC Order Code: RBPR-3 Measuring Product Reliability, September 1996, 47 pp., RAC Order Code: RBPR-5 Reliability Toolkit: Commercial Practices, RAC Order Code: CPE Fault Tree Analysis Application Guide", RAC Order Code: FTA Failure Mode, Effects and Criticality Analysis", RAC Order Code: FMECA
M.L. Shooman: "A study of occurrence rates of EMI to aircraft with a focus on HIRF," Proc. 12th DASC, Seattle/WA, October 1993, pp. 191-194 W. Reynish: Three systems, One standard?, Avionics Magazine, Sept. 95, pp. 26-28 D. Hughes: USAF, GEC-Marconi test ILS/MLS/GPS receiver, AW&ST, Dec. 4 95, pp. 96 R.S. Prill, R. Minarik: Programmable digital radio common module prototypr, Proc. 13th DASC, Phoenix/AZ, Nov. 94, pp. 563-567 B.D. Nordwall: HIRF threat to digital avionics less than expected, AW&ST, Feb. 14, 94, pp. 52-54 M.J. Morgan: Integrated modular avionics for next-generation commercial aircraft, IEEE AES Systems Magazine, Aug. 91, pp. 9-12 D.C. Hart: A Primer on IMA, Avionics, April 1994, pp. 30-41 D.C. Hart: Integrated Modular Avionics - Part I - V Avionics, May 1991, pp. 28-40, November 1991, pp. 25-29 D. Rollema: German WW II Communications Receivers - Technical Perfection from a Nearby Past, Part 1-3, CQ, Aug/Oct 1980, May 1981 A.O. Bauer: Receiver and transmitter development in Germany 1920-1945, presented at IEE Intl Conf. on 100 Years Radio, London/UK, Sept. 95. H.-J. Ellissen: Funk- u. Bordsprechanlagen in Pantzerfahrzeugen, Die deutschen Funknachrichtenanlagen bis 1945, Band 3, Molitor Verlag, 91, ISBN-3-928388-01-0 R.J. Stafford: IMA cost and design issues, Proc. ERA Avionics Conf., London/UK, Dec. 92, pp. 1.4.1-1.4.9 P.J. Prisaznuk: Integrated Modular Avionics, proc. IEEE NAECON-92, Dayton/OH, May 1992, pp. 39-45 J.R. Todd: Integrating controls and avionics on commercial aircraft, proc. IEEE NAECON-92, Dayton/OH, May 1992, pp. 46-62 R. Little: Advanced avionics for military needs, Computing & Control Engineering Journal, January 1991, pp. 29-34 R.D. Trowern: Designing an Inflight Entertainment System, Avionics Magazine, Oct. 94, pp. 46-49 D. Hughes, M.A. Dornheim: United DC-10 crash in Sioux City, Iowa, AW&ST, July 24, 89, pp. 96-97 M.A. Dornheim: Throttles land disabled jet, AW&ST, Sept. 4, 95, pp. 26-27 B.T. Devlin, R.D. Girts: MD-11 Automatic Flight System, Proc. 11th DASC, Oct. 92, pp. 174-177; also: IEEE AES Magazine, March 93, pp. 53-56 E. Kolano: Fly by fire, Flight International, Dec. 20, 95, pp. 26-29 G. Norris: Boeing may use propulsion control on 747-500/600X, Flight Intl, 2-8 Oct 96, p. 4 Anon.: Engine nozzle design - a variable feast?, Aircraft Technology Engineering & Maintenance, Oct/Nov 95, pp. 10-11 B. Gal-Or: Civilizing military thrust vectoring flight control, Aerospace America, April 96, pp. 20-21 D. Brire, P. Traverse: Airbus A320/330/340 electrical flight controls - a familiy of fault tolerant systems, Proc. 23rd FTCS, Toulouse/F, June 93, pp. 616-23 R.J. Bleeg: "Commercial JetTransport Fly-By-Wire Architecture Considerations," Proc. AIAA/IEEE 8th DASC, San Jose/CA, October 1988, pp. 309-406 R. Reichel: Modular flight control and guidance computer, Proc. 6th ERA Avionics Conf., London/UK, Dec. 92, 9 pp. K.R. Dilks: Modernization of the Russian Air Traffic Control/ Air Traffic Management System, Journal of Air Traffic Control, Jan/Mar 94, pp. 8-15 V.G. Afanasiev: The business opportunities in Russia: the new Aeroflot - Russian international airlines, presented at 2nd Annual Aerospace-Aviation Executive Symp., Arlington/VA, Nov. 94, 5 pp F. Drenberg, L. LaForge: An Overview of AlliedSignals Avionics Development in the CIS, IEEE AES Systems Magazine, Feb. 95, pp. 8-12. S.L. Pelton, K.D. Scarbrough: Boeing systems engineering experiences from the 777 AIMS program, presented at 14th AIAA/IEEE DASC, Boston/MA, Nov. 1995, 10 pp. D. Parry: Electrical Load Management for the 777, Avionics Magazine, Feb. 95, pp. 36-38 Anon.: Avionics on the Boeing 777, Part 1-11, Airline Avionics, May 94 - June 95 M.D.W. McIntyre, C.A. Gosset: The Boeing 777 fault tolerant air data inertial reference system , Proc. 14th DASC, Boston/MA, Nov. 95, pp. 178-183 G. Bartley: Model 777 primary flight control system, Boeing Airliner Magazine, Oct/Dec 94, pp. 7-17 R.R. Hornish: 777 autopilot flight director system, Proc. 13th DASC, Phoenix/AZ, Nov. 94, pp. 151-156 C.J. Walter, R.M. Kieckhafer, A.M. Finn: MAFT: a Multicomputer Architecture for Fault-Tolerance in Real-Time Control Systems, Proc. IEEE Real Time Systems Symp., San Diego/CA, Dec. 85, 8 pp. C.J. Walter: MAFT: an architecture for reliable fly-by-wire flight control, proc. 8th DASC, San Jose/CA, Oct. 88, pp. 415-421 L. Lamport, R. Shostak, M. Pease: The Byzantine Generals Problem, ACM Trans. on Programming Languages & Systems, Vol. 4, No. 3, July 82, pp. 382-401 M. Barborak, M. Malek, A. Dahbura: The Consensus Problem in Fault-Tolerant Computing, ACM Computing Surveys, Vol. 25, No. 2, June 93, pp. 171-220 J.A. Donoghue: Toward integrating safety, Air Transport World, Nov. 95, pp. 98-99 D. Carbaugh, S. Cooper: Avoiding Controlled Flight Into Terrain, Boeing Airliner, April-June 96, pp. 1-11 M. Slater: The microprocessor today, IEEE Micro, Dec. 1996, pp. 32-44 D. Hildebrand: Memory protection in embedded systems, Embedded Systems Programming, Dec. 1996, pp. 72-76 D. Esler: Trend monitoring comes of age, Business & Commercial Aviation, July 95, pp. 70-75 C.A. Shifrin: Aviation safety takes center stage worldwide, AW & ST, 4 Nov 96, pp. 46-48 1997 F.M.G. Drenberg
M. Rodriguez, M. Stemig: Evolution of embedded avionics operating systems, presented at 14th AIAA/IEEE DASC, Boston/MA, Nov. 1995 M. Tippins: FMS Moving toward complete integration, Professional Pilot, June 1993, pp. 48-52 F.B. Murphy: A perspective on the Autonomous Airplane operating in the Global Air Transportation System, presented to ICCAIA, Everett/WA, March 1992, 13 slides J. Townsend: Low-altitude wind shear, and its hazard to aviation, Natl Academy, Washington/DC, 1983 F. M.G. Doerenberg, A. Darwiche: "Application of the Bendix/King Multicomputer Architecture for Fault Tolerance in a Digital Fly-By-Wire Flight Control System," Proc. MIDCON/IEEE Technical Conf., Dallas, TX, Aug.-Sept. 1988, pp. 267-272 L.H. Harrison, P.J. Saraceni: "Certification Issues for Complex Digital Hardware," Proc. 13th DASC, Phoenix/AZ, November 1994, pp. 216-220 V. Riley: "What avionics engineers should know about pilots and automation," Proc. AIAA/IEEE 14th DASC, Boston/MA, November 1995, pp. 252-257 R.W. Morris: "Increasing Avionic BIT Coverage Increases False Alarms," SAE Communications in Reliability, Maintainability, and Supportability, Vol. 1, No. 2, July 1994, pp. 3-8 A. Gerold: The Federal Radionavigation Plan, Avionics Magazine, May 96, pp. 34-35 Anon.: Enhanced situation awareness technology for retrofit and advanced cockpit design, Proc. Human Behavior Conf. at AEROTECH 92, SAE Publ, No. SP-933, 191 pp. Anon.: Industrial-strength formal specification techniques, Proc. IEEE Workshop, Boca Raton/FL, April 95, IEEE Computer Society Press, 172 pp., ISBN 0-8186-7005-3 Anon.: Automated cockpits special report Aviation Week & Space Technology, Part 1 (Jan. 30, 95, pp. 56-65), Part 2 (Feb. 6, 95, pp. 48-55) E.E. Rydell: Avionics backbone interconnection for busing in the backplane: advantages of serial busing, Proc. 13th DASC, Phoenix, AZ, Nov. 1994, pp. 17-22 M. Rodriguez, M. Stemig: Evolution of embedded avionics operating systems, presented at DASC-95, Boston/MA, Nov. 95, 5 pp. P. Parry, C. Vincenti-Brown: Window to the 21st century, World Aerospace Development 1995, 41st Paris Airshow, Cornhill Publ. , pp. 27-33 , ISBN 1-85938-0409 G. Stix: "Toward 'point One' - Trends in Semiconductor Manufacturing," Scientific American, February 1995, pp. 90-95 G.D. Hutcheson, J.D. Hutcheson: "Technology and Economics in the Semiconductor Industry," Scientific American, January 1996, pp. 54-62 C. Adams: Emerging Databus Standards, Avionics Magazine, March 96, pp. 18-25 K. Hoyme, K. Driscoll: SAFEbusTM, Proc. 11th DASC, pp. 68-72 A. Emmings: Wire power, British Airways World Engineering, Iss. 8, July/Aug. 95, pp. 40-43 G. Derman: Interconnects & Packaging - Part 1: Chip-Scale Packages, EE Times, 26 Feb. 96, pp. 41,70-72 T. DiStefano, R. Marrs: Building on the surface-mount infrastructure, EE Times, 26 Feb. 96, pp. 49 S. Birch: The hot issue of aerospace electronics, SAE Aerospace Engineering, July 95, pp. 4-6 J.A. Sparks: High temperature electronics for aerospace applications, proc. ERA Avionics Conf., London/UK, Nov./Dec. 94, pp. 8.2.1-8.2.5 J.H. Mayer: Pieces fall into place for MCMs, Military & Aerospace Electronics, 20 March 96, pp. 20-22 D. Maliniak: Modular dc-dc converter sends power density soaring, Electronic Design, Aug. 21 95, pp. 59-63 J. Sweder, et al.: Compact, reliable 70-Watt X-band power module with greater than 30-percent PAE Anon.: FED up with LCDs?, Portable Design, March 96, pp. 20-25 K. Sewel: FED technology threatens LCD in flat-panel race, Military & Aerospace Electronics, Dec. 1996, p. 19 BCAG: "777 Application Specific Integrated Circuits (ASIC) Certification Guideline," Boeing Doc. 18W001; also: RTCA Paper No. 535-93/SC180-11, December 1993 Honeywell Commercial Flight Systems: "ASIC Development and Verification Guidelines," Honeywell Spec. DS61232-01 Rev A, January 1993; also: RTCA Paper No. 536-93/SC180-12 O. Port, Z. Schiller, R.W. King: A smarter way to manufacture, Business Week, April 30, 1990, pp. 110-117 R. Dion: Process improvement and the corporate balance sheet, IEEE Software, Vol. 10, No. 4, July 1993, pp. 28-35
SAE 4761: Guidelines and methods for conducting the safety assessment process on civil airborne systems and equipment, Dec. 1996 ARINC 650: IMA Packaging and Interfaces ARINC 652: Guidance for Avionics Software Management ARINC 653: Standard Application Software Environment for IMA ARINC 659: Backplane Data Bus ARINC 629: Multi-Transmitter Data Bus ARINC-754/755: (analog/digital MMR), ARINC-756 (GNLU) 4 1997 F.M.G. Drenberg