777 AUTOPILOT FLIGHT DIRECTOR SYSTEM
Ronald R. Hornksh -Technical Director
Collins Air Transport Division - Rockwell, Cedar Rapids IA
ABSTRACT
This paper overviews the design architecture and
operation of the 777 Autopilot Flight Director System
(AFDS). The AFDS pnwides the functions necessary for
automatic control a d o r fight director guidance of the
777 airplane selected fSght paoh. The system consists of a
Mode Control Panel (MCP),which provides the primary
interface between the flight crew and the AFDS; three
Autopilot Flight D i q t o r Computers (AFDCs), which
provide triplexcomputationsfor the flight director (F/D),
autopilot (A/P), maintenance, and backdrive functions;
and six backdrive control actuators (BCA), which
provide visual and tactile feedback indications to the
flight crew through dual redundant control of wheel,
column, and pedal positions commanded by the autopilat
function.
AFDS CONTROL OF THE AIRCRAFT
The 777 aircraft represents a departure from traditional flight
control systems through the introduction of electrohydraulic
power control units @“s) to regulate the position of the
primary aircraft conml surfaces. Consequently, the
functions and architecture of the flight control system have
also departed from the approach utilized on previous
airplanes. Unlike its predecessors, the 777 AFDS does not
have direct control of the primary flight control surfaces.
Autopilot control functions are accomplished through the
provisioning of electronic control commands to the Primary
Flight Control System (PFCS), and associated Actuator
Control Electronics (ACE), to move the aircraft flight control
surfaces (figure 1). This forward control path is hereafter
151
0-7803-2425-0/94 $4.00
referexi to as ”Frontdrive”, which also serves to distinguish
this traditional autopilot control path from the new
”Backdrive”function provided by the 777 AFDS. Since the
pilot controls are electronically signaled to the flightcontrol
surfaces, the AFDS also provides the critical function of
communicating PFCS commanded surface positions to
backdrive the respective column, wheel, and pedal positions
in the cockpit when the autopilot is controlling the aircraft.
This is accomplished through commands from the AFDCs
lhrough a high integrity analog interface to dual servo
iictuators on each primary flight control axis input in the
cockpit. In autopilot mode, the backdrive function provides
cockpit control movements to reflect the automatic control.
Additionally, the backdrive function is utilized to increase
tactile force on the control wheel in manual mode, as
commanded by a Back Angle Protection (BAP) function
incorporated in the PFC computations.
AFDS SYSTEM ARCHITECTURE
‘The triplex autopilot flight director computer architecture
provides multi-channel automatic cruise control as well as
the system configuration for fail-operational automatic
approach and autoland (figure 2). Each AFDC receives
redundant sensor data, including MCP data, either directly
from the sensors or via cross-channel communication
between the AFDCs. Each AFDC computes the autopilot
and flight director commands utilizing the voted or selected
sensor data. The computed autopilot commands, including
engage requests, are sent to the Primary Flight Computers
~(PFCS).The PFCs vote the engage requests and computed
commands from the three AFDCs, and use these voted
outputs to determinemanual or autocontrol mode switching,
and to compute ACE/PCUflight control commands when in
automatic mode. Maximum available AFDS system
redundancy is deployed whether operating in cruise or
autoland.
1994 IEEE
 +I nU'urlLUI

I
CONIROL

REQUESTS QRANTS
ENGAGEMEN ENGAGEMEN
ISSUES ISSUES
COMMANDS BACKDRIVE
TO FLY COMMANDS

~~~~

Figure 1 - AFD$ Control of the Aircraft

COMMAND
INPUT SENSOR VOTING
AND SIQNAL VOTING
SENSORS
f SELECTION PLANE

C O M P x f
3
m
$
0
a MANUAL

ADlRU

I AFDCs D
SENSORS

Figure 2 - Frontdrive System Architecture

152
Failure protection for the autopilot function is basically
provided by system redundancy. For autoland operation,
redundant Sensors and computations are required. S e m r
failures and computation failures are protected by the
respective voting planes in the AFDC and the PFC. For
cruiseoperation,the system is allowed to degrade to a single
computation channel. In this condition, failureprotection is
provided by in-line monitoring in the AFDC and fdtering
and limiting in the PFC. The. PFC protection includes g
limiting and aileron exceedance cut-out, in addition to the
BAP protection feature noted above.
The backdrive function is also resident within the triplex
AFDC architecture,and provides control wheel, column-and
-
Figure 3 Backdrive System Architecture
Redundant BCAs are engaged in all three axes to provide
fail- autoland capability.
There are two dissimilar backdrive computational lanes
within each AFDC. The PFC generates the backdrive
commands from the consolidated autopilot commands and
the Bank Angle Protection function. Each AFDC receives
backdrive commands and control positions from all three
PFCs. The PFC data is routed to the two independent lanes
within each AFDC where the commands are consolidated.
The resulting voted outputs control the actuator motor and
clutch drives.
153
pedal movement feedback to the flight crew during autopilot
operation. The backdrive function further serves to provide
the BAP tactile force feedback in manual mode, as well as
spoiler control via the wheel backdrive, and roll-out
nose-wheel steering via the pedal backdrive. A highly
monitored dual backdrive system architecture provides the
system configuration for fail-operational autoland integrity
as well as high cruise availability (figure 3). Two backdnve
control actuators (BCAs) are installed in each primary flight
control axis. The left AFDC drives the left actuator set and
the right AFDC drives the right actuator set. The center
AFDC does not interface with either the left or right
backdrive actuators. During cruise operation, only a single
actuator set is engaged
_ _ (either left or right wheel and column
actuators).
BACKDRIVE
ACTUATOR
Failure protection for the backdrive system is basically
provided by the dissimilar lane architecture,which provides
independent control of the high and low side of the actuator
drives and actuator engage clutches, resulting in a
fail-passive servo drive within each AFDC. Either lane can
disengagethe backdrive actuators. Cross Lane monitoring is
also provided for system fault isolation.
OPERATIONAL MODES
The 777 AFDS provides the traditionalpilot selectable flight
director and automatic control features found on previous
airplanes. Vertical modes include control to a selected
vertical speed, control to transition between flight levels,
control to hold altitude, and control to vertical steering
commands from the Flight Management Control Function
mw.
Lateral modes include control to a selected heading, control
to a selected ILS localiza beam,control to hold a wings level
heading, and control to lateral steering commands from the
FMCF. Additionally, the 777AFDS introduces new features
to control to a selected flight path angle, and to control to a
selectedor held lateralm k . Takeoff / Go-Around guidance
and/or control, 8s well as automatic Approach and Autoland
capability to Category III B landingcriteria are also provided
by the 777 AFDS. Pilot selection for all AFDS operational
modes is provided through the AFDS Mode Control Panel,
located centrally in the777cockpitglareshield(figure4). It
provides the means to engage the autopilot, and/or flight
director and enables the flight crew to select different
operating modes. The mode select pushbuttons are
momentary action switches, and selection is confirmed by
LED illumination of a bar appearing in the lower half of the
Figure 4 - AFDS Operational Modes
Desired target values for altitude, vertical speed, flight path
angle, heading, track, indicated airspeed (IAS), and Mach
can be selected via encoder control knobs on the MCP.
Selectionsare presented to the flight crew on four segmented
liquid crystal displays (LCDs), backlit by a common
flomcent tube for readability under all cockpit lighting
conditions. Common LCD display fields are provided far
vertical speed/flight path angle, heading/track, and
IAS/MACH, as the two modes within each of these pairs of
154
activated switch. The MCP pushbuuon legends are also
backlit with incandescent liglhring to aid button recognition.
The maprity of the AFDS modes require a single push to
immediately engage the Ap1)S s y m into the requested
mode of Operation. The localizer 0, A p c h (APP),
and the two FMCF navigath modes (LNAV & VNAV),
however, are armable modes which will only capme and
e n g a g e o n c e a l l e n ~ c r i ~ ~ ~ b y t h e m o dfully
eare
met. Th~Brmablemodescinbediscannedbyasecondpush
of the pushbunon while the m ed condition exists. In
addition to AFDS control and operation, the MCP also
provides for autothrottle (AD) arming, engagement, and
selectiodcaotrol of speed and thrust targets for the 777
Thrust Management Computing Function (TMCF). The
autothrottle arm switch is a split switch with the left half
controlling the TMCF for the left engine, and the right half
controlling the TMCF for the right engine. When the
autothmttle is armed, the autothrottle will automatically
become active when either the vertical navigation, flight
level change, or t a k e o f f / ~ u n d AFDS modes are
selected by the flight crew.
-
modes are mutually exclusive. Control selection between
mutually exclusive modes is accomplished via a
push-&toggle function lacaaed immediately above each
respective LCD window, with presentation of the active
mode repeated on the comsponding LCD displaying the
target information. All target panmeters except vertical
speed/flight path angle may be preselected by the flight crew
prior to autopilot and/or flight director engagement.
 MCP ARCHITECTURE
The 777 Mode Control Panel contains dual 8OC186
pmssing lanes which provide redundant U0 interface
capability to the three Autopilot Flight Director Computem
-
m 5 MCP Arehitechup
F
Communication between the dual processing lanes and the
pilot selectable front panel controls is also via multiple
interface paths, where practical, to provide optimm
availability and/or failure detection and isolation. The
hghted pushbuttons utilize four-pole snap action s w k b
withthreesigurlsfedtocachproc~lane.Toggleswitch
functkns and C o n d hob mode selection pushbuttons are
single pole mmetuary map action with dual contacts. and
each control knob inaoaporateS dual encoders and decode
functions to p v i d e indepemdent selection inputs to each
processing lase.
Singularor common elements on the MCP, such as the LCD
target displays, are switchable between the two M 8
processing luKs 41s a function of failure status ar
side-in-control switching logic within the AFDS. The
f l m s e n t kklighting of the LCD displays also contains
single elements in W sensing, power, and drive circuitry
portions of the control loop. Sensors employed include
cockpit ambbt, reqte lighting, manual dimming, optical
and t e m p t u r e inputs. Brightnessis controlled by varying
frequency and duty cycle to the arc and filamentdrivesof the
florescent tube - and while the hardware drive circuitry is a
singular implementation, the control algorithms are
duplicated in softwafe to allow either procesSing lane to
control overail LCD backlight loop stability.
155
via ARlNC 429 low speed (12.5 kilobits/sec)
communication buses (figure 5). Redundant Operational
Program Software in each lane maximizes MCP availability
by providing full MCP functionality in the event of a single
processor lane failure.
- LAFDC
-( L AFDC
"OT
CONNECTED
-c m
" E m
-FE&
- RAFDC
AFDC ARCHITECTURE
The 777 Autopilot Flight Director Computers each contain
three independentprocessors.
procesSar C is a custom FB-2ooo l6-bit stack oriented
processor. designed specifically f a flight control
applicationsin tenns of both operationalcharacteristicsand
compu"l integrity. It fea- a sveamlinedinmction
set rhat provides efficient execution of compiled Ada code.
Included are several insauctions that directly implement
frequently used flight Control related functions. The
FCP-2OOO also includes numerousprovisions for testing and
monitoring tofacilitate rapid and thorough failure detection.
Included are intwoal moPjtMs which provide immediate
detectionofalargepercenPgeofthepossibledevicefailures.
These monitors are complemented by provisions for
thmugh testing of the device by a background in-flight
self-test program,executed underobservation of monitoring
hardware. Extensive pcnver-up test provisions are also
included. The C processor executes the logic and control
laws for the autopilot and flight director "frontdrive"
functions, as well as the majority of the computations
associated with the maintenance, self-test, and onboard
data-load functions.

28V DC
(COMP) *
DISCBAR *
28VDC -
(BK DR)
28 V BA'ITERY-
WARN)
w I
T I I
-
Figure 6 AFDC Architecture
The A and B processors provide independent high and low
side control of the engage clutch and motor drive interfaces
to the "backdrive" servos. Processor A is a custom AAMP2
16-bit stack oriented processor, and Processor B is an Intel
80386SX 32-bit machine with a 16-bit external interface.
The backdrive functionsand the autopilot engagddisengage
function are implemented within the A and B computational
lanes which are cross-compared to provide a fail-passive
channel within each AFDC.
All three processing elements contain independent
programmable read only memory (PROM),electrically
erasable programmable read only memory (EEPROM),and
random access memory (RAM) - accessible by the
respective CPUs via dedicated local buses. Each of the three
processors contain a small kemel of operational software,
resident in their respectivePROM memories, which provides
Acknowlegements and excerpts from Boeing Aircraft Company and Rockwell Intemational - Collins Commercial Avionics proprietary design
documents (Autopilot Flight Director System Description Document & System Requirements and Implementation Description, respectively).
I
- WHL, COL,
PED TACH A
*WHL, COL,
PED-MOTOR A
*CLUTCH A
*CLUTCH B
I I
* WHL, COL,
PED-MOTOR B
I - WHL,COL,
PED TACH B
processor initialization, self test, dataload handling
functions, and validity checking on the loadable portions of
theoperational program software(OB).Control is passed to
theOPS software,resident in EEPROM,tocomplete self test
and begin normal AFDC operational computations.
All of the AFDC processors share common ARINC 629,
ARINC 429, and discrete inputloutput (YO)resources.
Communications between U0 functions and individual
processors, as well as inter-processor communication,
occurs via a Global Bus intemal to the AFDC.
Key operational interfaces from the AFDC, such as the
backdrive engage/disengage circuitry and the autopilot
disconnect warning circuitry, are implemented via
redundant, segregated circuitry within the AFDC to maintain
high levels of integrity and safety.
156