Why did the Boeing 787 switch back to separate IRS systems?

Question

The Boeing 737 uses two independent IRS systems (see also Why are there two IRS switches on the 737NG?):

^{(source: 737 NG FCOMv2 (11.10.21 - Flight Management, Navigation - Controls and Indicators))}

and the Boeing 747 uses three independent IRS systems:

^{(source: 747-400 FCOMv2 (11.10.9 - Flight Management, Navigation - Controls and Indicators))}

For the Boeing 777, they switched to a single ADIRU:

^{(source: 777 FCOMv2 (11.10.10 - Flight Management, Navigation - Controls and Indicators))}

The reasons are explained in this answer to the question How many Inertial Reference Systems are on a commercial aircraft?:

Fast forward to the Boeing 777, the pilots only have one such unit: the ADIRU, or Air Data Inertial Reference Unit. The ADIRU by itself is a fault tolerance unit - within this unit, there are multiple gyroscopes and accelerometers. In the past, when multiple redundant units are provided to the pilots, there were instances where the pilots had trouble identifying the malfunctioning unit or switched to the wrong unit, and the plane crashed. Now there is only one unit, and the redundancy mechanism is auto-managed.

This makes perfect sense to me and should have improved safety. But I was surprised to find that the Boeing 787, which is in part based on the 777, switched back to two separate systems:

^{(cropped from source)}

Question: Why did they change back? Was there something wrong with the 777 ADIRU?

Answer 1

There were also other practical end use issues as well. Having worked in the manufacturing and repair of theses fault tolerant units, one of the benefits was supposed to be the ability to plan maintenance. You could have a gyro or acceleromter voted out and still be able to take off and fly, since the F-T ADIRU had six gyros/accels and the SAARU four gyros/accels. Problem was the airlines weren't really taking advantage of this. They'd wait until you'd have two gyros or accelerometers voted out before and then be unable to take off due to restrictions. Some of the sensors sat voted out for years, with no replacement occurring.

Of course the airlines pointed the blame back the design. The F-T ADIRU was the third most expensive part of the 777 behind each engine. Most of them also did not carry spares for their repair inventory due to the costs of spares. Spare F-T ADIRU a couple years ago were running north of 2 million a piece. They found that the aircraft had less down time with a split system then using the fault tolerant system. Largely because they had ample spares for the split systems due the spare parts costing 1/10th the cost of the fault tolerants.

Answer 2

A definitive answer for the change needs to come from Boeing/Honeywell. As far as I've looked, the rationale was not made public.

I can address two points you've raised:

This makes perfect sense to me and should have improved safety.
Was there something wrong with the 777 ADIRU?

The 777's fault-tolerant IRS presents different hazards. When the system was unveiled c. 1995, it was revolutionary. Something that comes around in the avionics industry once every 10 to 15 years as this Boeing paper (paywall) put it.

In the world of commercial avionics, major changes occur only every 10 to 15 years, usually on an all-new airplane. The Boeing 777's Fault Tolerant Air Data Inertial Reference System represents the third generation of its kind. The predominantly mechanical/analog systems of the early 747 gave way to solid-state, digital ones on the 767. These have now been supplanted on the 777 by the integrated fault-tolerant FT-ADIRS. Unlike the second generation, which replaced analog units one-for-one with digital, the 777 FT-ADIRS has a radically new architecture.

But then Malaysia Airlines Flight 124 (official report) happened in 2005.

The quick summary is that an accelerometer had failed in 2001 (4 years before the incident). And the system (being fault-tolerant) masked the fault and stopped using input from that accelerometer. That was as designed, and the cost-saving benefit of the system allowed the plane to continue to fly without needing to swap the unit or degrade its dispatch.

But when a second accelerometer failed in-flight in 2005, a software bug resulted in the unit using data from the first accelerometer that had failed back in 2001. The investigation could not dive into the specifics of the bug due to the commercial sensitivity of the software. It has been since fixed.

Disaster was averted in part because of some lines of code that were not required in service (only in testing) that Boeing had decided to leave them in. Namely a mid-value function that smoothed the erroneous output with the good output from the SAARU. (SAARU being the backup unit on the 777 that provides attitude data. It is similar in function to the ATT mode shown in the 737 and 747 panels in the question, but it doesn't have a manual selector. It requires the FT-ADIRS to correctly recognize it has failed.)

Side note: On the 777 pressing the on/off button in-flight does nothing.

In flight, system logic prevents the ADIRU from becoming unpowered if the ADIRU switch is inadvertently switched OFF (777 FCOM § 6.11).

Two researchers from NASA and University of Glasgow studied this incident in 2007, and part of their conclusion was:

(...) the benefits of fault masking in redundant systems also create new hazards. When service teams fail to identify underlying failures during major maintenance procedures, aircraft may continue to be operated without the additional assurance provided by redundancy. The potential consequences of this hazard are compounded by the effects of fault masking for operational staff. They will not be aware of the underlying faults that affect their application. When subsequent failures finally compromise the use of redundant systems, flight crews will be faced with unanticipated problems.

(Emphasis mine.)

A 2012 FAA report on Flight-Critical Systems Design Assurance looked into that incident (among others):

[Research] data showed more than a tenfold increase in overall failure probability after a first instrument failure [a reference to the aforementioned accelerometer], which was hardly a basis for permitting a nonorthogonal array with one failed accelerometer to be flown for 4 years without repair.

And from the report's conclusion:

(...) the tendency toward higher complexity in both operating modes and redundancy management (RM) raises concerns about the ability to completely test the system under all conditions as well as to assess pilot proficiency in mastering all the available resources under emergency conditions.

(Emphasis mine.)

That already hints at a certification nightmare for any new such equipment.

---

The official incident recreation was uploaded to YouTube unofficially, with added sound, which can be viewed here. Note the pitching up and the simultaneous and contradictory stick shaker/overspeed warnings.