11
$\begingroup$

The Boeing 737 uses two independent IRS systems (see also Why are there two IRS switches on the 737NG?):

737 IRS selectors
(source: 737 NG FCOMv2 (11.10.21 - Flight Management, Navigation - Controls and Indicators))

and the Boeing 747 uses three independent IRS systems:

747 IRS selectors
(source: 747-400 FCOMv2 (11.10.9 - Flight Management, Navigation - Controls and Indicators))

For the Boeing 777, they switched to a single ADIRU:

777 ADIRU switch
(source: 777 FCOMv2 (11.10.10 - Flight Management, Navigation - Controls and Indicators))

The reasons are explained in this answer to the question How many Inertial Reference Systems are on a commercial aircraft?:

Fast forward to the Boeing 777, the pilots only have one such unit: the ADIRU, or Air Data Inertial Reference Unit. The ADIRU by itself is a fault tolerance unit - within this unit, there are multiple gyroscopes and accelerometers. In the past, when multiple redundant units are provided to the pilots, there were instances where the pilots had trouble identifying the malfunctioning unit or switched to the wrong unit, and the plane crashed. Now there is only one unit, and the redundancy mechanism is auto-managed.

This makes perfect sense to me and should have improved safety. But I was surprised to find that the Boeing 787, which is in part based on the 777, switched back to two separate systems:

787 IRS selectors
(cropped from source)

Question: Why did they change back? Was there something wrong with the 777 ADIRU?

$\endgroup$
  • 6
    $\begingroup$ I don't know, but what an exceptionally well presented and demonstrated question! Love the pictures, they really helped me follow $\endgroup$ – Dan Nov 14 '19 at 18:28
  • $\begingroup$ See Gerry's comment to my answer (which I hope he turns into an answer). $\endgroup$ – ymb1 Nov 15 '19 at 18:15
5
$\begingroup$

A definitive answer for the change needs to come from Boeing/Honeywell. As far as I've looked, the rationale was not made public.

I can address two points you've raised:

This makes perfect sense to me and should have improved safety.
Was there something wrong with the 777 ADIRU?

The 777's fault-tolerant IRS presents different hazards. When the system was unveiled c. 1995, it was revolutionary. Something that comes around in the avionics industry once every 10 to 15 years as this Boeing paper (paywall) put it.

In the world of commercial avionics, major changes occur only every 10 to 15 years, usually on an all-new airplane. The Boeing 777's Fault Tolerant Air Data Inertial Reference System represents the third generation of its kind. The predominantly mechanical/analog systems of the early 747 gave way to solid-state, digital ones on the 767. These have now been supplanted on the 777 by the integrated fault-tolerant FT-ADIRS. Unlike the second generation, which replaced analog units one-for-one with digital, the 777 FT-ADIRS has a radically new architecture.

But then Malaysia Airlines Flight 124 (official report) happened in 2005.

The quick summary is that an accelerometer had failed in 2001 (4 years before the incident). And the system (being fault-tolerant) masked the fault and stopped using input from that accelerometer. That was as designed, and the cost-saving benefit of the system allowed the plane to continue to fly without needing to swap the unit or degrade its dispatch.

But when a second accelerometer failed in-flight in 2005, a software bug resulted in the unit using data from the first accelerometer that had failed back in 2001. The investigation could not dive into the specifics of the bug due to the commercial sensitivity of the software. It has been since fixed.

Disaster was averted in part because of some lines of code that were not required in service (only in testing) that Boeing had decided to leave them in. Namely a mid-value function that smoothed the erroneous output with the good output from the SAARU. (SAARU being the backup unit on the 777 that provides attitude data. It is similar in function to the ATT mode shown in the 737 and 747 panels in the question, but it doesn't have a manual selector. It requires the FT-ADIRS to correctly recognize it has failed.)

Side note: On the 777 pressing the on/off button in-flight does nothing.

In flight, system logic prevents the ADIRU from becoming unpowered if the ADIRU switch is inadvertently switched OFF (777 FCOM § 6.11).

Two researchers from NASA and University of Glasgow studied this incident in 2007, and part of their conclusion was:

(...) the benefits of fault masking in redundant systems also create new hazards. When service teams fail to identify underlying failures during major maintenance procedures, aircraft may continue to be operated without the additional assurance provided by redundancy. The potential consequences of this hazard are compounded by the effects of fault masking for operational staff. They will not be aware of the underlying faults that affect their application. When subsequent failures finally compromise the use of redundant systems, flight crews will be faced with unanticipated problems.

(Emphasis mine.)

A 2012 FAA report on Flight-Critical Systems Design Assurance looked into that incident (among others):

[Research] data showed more than a tenfold increase in overall failure probability after a first instrument failure [a reference to the aforementioned accelerometer], which was hardly a basis for permitting a nonorthogonal array with one failed accelerometer to be flown for 4 years without repair.

And from the report's conclusion:

(...) the tendency toward higher complexity in both operating modes and redundancy management (RM) raises concerns about the ability to completely test the system under all conditions as well as to assess pilot proficiency in mastering all the available resources under emergency conditions.

(Emphasis mine.)

That already hints at a certification nightmare for any new such equipment.


The official incident recreation was uploaded to YouTube unofficially, with added sound, which can be viewed here. Note the pitching up and the simultaneous and contradictory stick shaker/overspeed warnings.

|improve this answer|||||
$\endgroup$
  • 3
    $\begingroup$ Good analysis but most of these events were after the B787 design was set. I worked for a competing avionics supplier at the time and the IRS architecture was set by Boeing by 2003. I think the initial impetus was fallout from the Intel Pentium bug in 1994. The FAA became concerned over the potential for latent common mode faults. As a result, DO-254 was written and additional guidance published that mandated both hardware and software diversity in critical systems. The ADIRU wasn't compliant. Each B787 'earth reference system' has a dissimilar IRS and AHRS to provide fault detection. $\endgroup$ – Gerry Nov 15 '19 at 17:28
  • $\begingroup$ Thanks @Gerry for the insight. So in a sense the event confirmed the FAA's concerns. $\endgroup$ – ymb1 Nov 15 '19 at 17:36

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.