Inside the brains of a Boeing 777

What follows is a post about the “brains” of the 777.   They seem to be at the heart of how someone could possibly make a 777 disappear and this post will serve as background for such speculations.

The Cortex

The 777 is a marvel of engineering, being the world’s largest twinjet and Boeing’s first fly-by-wire airliner, and the first commercial airliner designed completely on computers.  All flight controls are computer-mediated in the brains or “neural network” of the 777.   A panoramic tour of the Main Equipment Center (MEC) where the “brains” are kept can be had by clicking the picture below (courtesy of the font of knowledge):

The brains of a 777 (click for a panoramic tour).

Photo tours are here and here.  The black boxes on the upper right of the photo above are essentially the computer brains known as AIMS.   These boxes and many other units in the plane are as known as Line Replaceable Units (LRUs).    They communicate with each other and the rest of the plane using standard  protocols and interfaces, so each one can be designed individually, swapped out and replaced at will and each does a portion of the work necessary to fly the plane.  Units can be added to provide extra functionality, and upgrades, for example retrofitting from AIMS-1 to AIMS-2 as mentioned in the previous post.  See also here (PDF).

The various systems, particularly communications that have been talked about as part of the MH370 disappearance are controlled by LRUs:  ACARS, navigation and SATCOM are all associated with one or more LRUs.

The avionics bay (MEC) is located in the belly of the plane to the rear of the flight deck.  There are three ways to access this avionics bay via:

1. the passenger cabin near the galley as shown in the video in the last post,
2. an exterior hatch in the belly of the plane, and
3. via a door connected to the forward cargo bay.  On MH370, passenger luggage was kept in this cargo bay per the Factual Information Report.

The nervous system

There is a rat’s nest of communication protocols used.   ARINC 629 (technical PDF) was new for the 777 and patented by Boeing.The older ARINC 429 is also used, presumably to be compatible with older available equipment.  An optical fiber ethernet-like (10BaseT) network similar to the familiar Local Area Network (LAN) you may have in your home is also used for high speed communications between LRUs.  There are a host of other buses, but those are the major ones.

The ARINC 629 is the main mission critical nervous system of the plane, however, and for good reason as it is quite ingenious.  A single twisted pair of wires up to 100 meters long can connect up to 120 LRUs.   This simplifies plane wiring by using a single communications bus or wire.   If you’re familiar with a typical office wired LAN, there is a cable going to each computer or device on the LAN from a router – lots of wires.  The bus is two-way, and any LRU could talk to any other if they know the language, and every LRU can listen to all of the conversations.   Connected LRUs politely wait their turn to talk following a set timing protocol.  There is no central point of failure as there can be with a router.  If one LRU goes down, the others can still talk.  Except for redundant control timers to allow each LRU to decide when it’s time to talk, there is no control, and it is robust to failure.

Connection of a device (LRU) to the bus is the ultimate in simplicity.   Only a Current Mode Coupler is needed, which is a simple enclosure around the twisted pair of wires.   No splicing is needed (or allowed):

Connecting an LRU to the ARINC 629 ( Y. C. Yeh. Design considerations in Boeing 777 fly-bywire computers. In Proceedings Third IEEE International High-Assurance Systems Engineering Symposium, pages 64–72, Washington, DC, USA, 1998)

If you are into electronics, you can order a desktop B777 ARINC 629 simulator.

ARINC 629 B777 simulator.

Triple-triple redundancy

There are different ARINC 629 buses for different purposes,  because while ARINC 629 is fast, many units talking could overwhelm capacity. The bus needs to be underutilized most of the time so a given LRU can squawk away if need be in critical situations.  The simplicity of a single twisted wire bus means you can easily break the communications bus into several pieces to provide this and isolate communications by topic, and there are 11 ARINC 629s altogether.  The 777 uses a separate bus for flight controls, for example.

Necessary complexity is added for redundancy and fault-tolerance.  There are three buses with triplicate LRUs.   If lightning or birds strike the plane, and one bus is knocked out, there is backup, since LRUs are connected to multiple buses.   If one LRU fails, there are two backups in some cases.

The B777 flies on 99% ADA, a computer language developed by the US Department of Defense. Even potential software and hardware bugs are dealt with ingeniously:  Triple-redundant key LRUs such as the flight computer are “dissimilar” on each of the three ARINC 629 buses on purpose.   Each LRU has a different processor from a different manufacturer (Motorola, AMD and Intel) and thus different compilers, so a bug in one compiler or processor does not bring down the plane.

Triple-triple redundancy (Yeh, 1998)

To conceptualize:  imagine having home computers that are 3-in-1: an Apple Mac, Windows PC, and Linux system.   As you are working a spreadsheet, the spreadsheet is updating on all three, and a lockup, failure or software glitch in one will allow you to continue your work unaffected.  When you finish (land), you can fix the broken one.   Further imagine the computers each have their own separate power source and are each triplicated (9 total) and physically separated in groups of three, so if part of your house collapses, it does not destroy all of them.  This is analogous to the design of the 777 brain.

There is constant monitoring of each system through BITE (Built-In Testing Equipment).   Faults can occur, but due to the redundancy, the plane stays flying.   Faults are recorded and downloaded, and the system can be repaired on the ground.   Presumably Boeing receives some of this information, and periodically provides upgrades to the software via the MAT/PMAT system described in the previous post.

Boeing went so far as to try to physically separate the teams programming each device for “design diversity,” but it didn’t work out quite as they hoped (Yeh, 1998):

The development of the PFC software during the 7J7 program confirmed that the three separate teams, in order to code their logic from the requirements, were having to ask Boeing so many questions for clarification of the requirements that the independence of the three teams was irreparable compromised. This is the reason why Boeing elected to revert to the usual and customary method of creating and certifying flight critical source code.

In the end, all critical systems on the plane are triply redundant, from the brains to the electrical to the hydraulic controls.  The 777 is designed very robustly against faults, but was designed in a pre-9/11 era.  In future posts, I’ll discuss the implications of all this.

Advertisements

Would the waypoint SCCI (Punta Arenas) even be in the plane’s navigation system?

Good question.

The Flight MH370 Boeing 777-200ER was originally delivered to Malaysia Airlines on May 31, 2002.  It was the 404th 777 built.  It most likely came installed with a first generation AIMS-1 Airplane Information Management System.   Second generation AIMS-2 did not arrive until 2003.  Although the B777 can be upgraded, there is no public record of this and the Malaysian Factual Information Report simply refers to the system as “AIMS,” which can be taken as a generic name for AIMS-1/2 or what AIMS-1 was referred to as before AIMS-2 came along.

This is important, because the AIMS-1 avionics system has very limited memory (PDF document from MITRE Corporation) for navigation and airport databases.  In fact, with databases continually growing, it not possible for an AIMS-1 system to hold the entire world catalog.   Databases are provided by suppliers (Boeing’s Jeppesen, Lufthansa’s LIDO, or Navtech/ EAG) in ARINC 424 format.   It is not clear which supplier Malaysian Airlines used for their 777s, but Lufthansa’s LIDO system was selected for Malaysian Boeing 737s and Airbus A380s.  Airlines practice database capacity management by restricting what is loaded to grid squares or use other techniques such as restricting airports, which consume a lot of space.  Another strategy could be to restrict airports by runway length.  World databases for runways of 5000 feet or more are around 8MB in size, whereas the AIMS-1 stores 2 MB, but by restricting to only 777-capable runways, the size would be less. It’s not clear if restricting to longer 777-capable runways, the world would fit in AIMS-1.  Airlines actually have limited capability to modify these databases, but would coordinate with the vendor.  GIven the popularity of the 777 as a “worldliner,” they have no doubt come up with solutions.

Accuracy is very important and navigation databases are generally regulated to be refreshed every 28 days, so every 28 days, 9M-MRO (MH370) should have received an upload of the latest database on a floppy disc (yes, typically a 3.5-inch floppy disc unless they had AIMS-2 and something better like Alaska Airlines).  The pilot and copilot can display the current database version and expiry dates on their respective displays (Control Display Unit or CDU).  According to Boeing, the diskettes are intended to be kept in a binder on the airplane. The uploads would have been done with something like a Maintenance Access Terminal (MAT) or Teledyne Controls Portable Maintenance Access Terminal (PMAT) (PDF).  PMATS can be kept in the aircraft’s E/E Bay (Main Equipment Center (MEC)), but there is a MAT terminal and PMAT port on the flight deck, and PMAT ports in the nose and right wheel wells and the Jack Screw area.  Here is an incredible video tour of a 777 E/E bay in-flight, with a shot of a PMAT device and the AIMS system (courtesy LGHamiltonUSA).

Newer versions of dataloaders are wireless, for example Teledyne’s eADL Wireless Ground Link.  These airborne data loaders can save airlines money, not to mention the hassle of floppy discs.  Such system are available for 777s but It is not clear what kind of system Malaysian Airlines would have used.

Malaysian Airlines flew to Buenos Aires, Argentina as recently as 2012, so it’s conceivable they would have had ARINC 424 format South American region navigation data on hand, at least in old versions.   These filghts were by Boeing 747s, however, likely due to ETOPs restrictions (twin engine planes are limited to how long they can fly on one engine in case of engine failure) on 777s that only recently were revised.  Punta Arenas’ Carlos Ibanez del Campo International has a runway capable of landing a 777 and would easily be in such a regional database as an alternate airport, I would guess.  If not, it could simply be there as a waypoint.

ATSB, in their June Underwater search areas report examined the possibility that MH370 flew through the waypoint RUNUT as discussed in The Destination.  This could perhaps be included in a southeast asia regional database, but it’s not clear whether ATSB was guessing or actually knew what was installed on MH370.

It is unknown what Malaysian Airlines may have subscribed to for their regular navigation database (NDB) subscriptions, or what regions they specified to be installed on their 777s.  Different planes could easily have different regions installed.   9M-MRO flew all over the world in it’s history, so it’s unclear how MAS would have managed the limited AIMS-1 memory for this plane.

All that to say: I don’t know, but it’s unlikely if the aircraft was using AIMS-1, depending on Malaysian Airlines navigation database policies.  Unless someone intentionally installed it there, however, the path coincidentally fits.

Six independent degrees of support

The Endpoint

Over a year later, new information and analyses still constantly appear, and keeping up with it is a full time job.  The trail is far from cold.   The above Google Earth map depicts some of the very latest information.  Presented here are six independent degrees of support that all point at the same spot.  Coincidence?

1 – Reason for path

The Waypoint Hypothesis path is the white line cutting across the picture from top to bottom.  It is a simple path prediction based on my analysis of human factors.  In other words, there is a logical reason behind why MH370 may have flown the path. The green pins are early and more recent predictions of endpoints I have made along this path.  Last year, the 7th arc was not well understood and the early prediction was an educated guess.  I updated the prediction recently with the latest understanding of the 7th arc.  Subsequent to that, even newer information discussed below has come to light that may refine it further.

2 – Analysis of satellite data

The other green pins are various predictions by others.  Most of these are backed by thorough studies of satellite data that are linked at LGHamiltonUSA’s tumbler page along with a wealth of other information.  The influential Independent Group location is where the current search is focused and is based on a rigorous study of satellite data and fuel range.  The Hardy point is a prediction by a pilot that has reportedly received the attention of ATSB and is a partial satellite timing analysis.  Dr. Bobby Ulich’s prediction is a rigorous study of satellite data and fuel range.

The Waypoint Hypothesis has not received a thorough analysis (other than consistency with satellite timing)  for fit to satellite data yet.  However, being flanked on either side by pathways that have and have produced good fits (Ulich and Independent Group) means there is a good chance the Waypoint Hypothesis will produce a good fit as well.

3 – Performance Limit

The yellow line is the ATSB Performance Limit (maximum fuel range) shown in Figure 20 of their MH370 – Definition of Underwater Search Areas (PDF) report published June 2014 and updated August 2014.  I have projected this line by eye inside the 7th arc to the waypoint Hypothesis path.   There is an imaginary arc between the 6th and 7th arc passing through the “loss of second engine” point where MH370 is believed to have run out of fuel. As described in X marks the spot, where the Performance Limit intersects this imaginary arc would be the most likely place where the second engine on MH370 completely exhausted the fuel supply.    This correspondence with the satellite timing data only occurs at two places along the arcs: the northern and southern limits at either end of  nearly 2500 kilometers of 7th arc.  As the above figure shows, the Waypoint Hypothesis nearly exactly matches this point on the southern end – compare the ATSB Performance limit yellow line projection to the yellow “loss of second engine” pushpin. Although fuel range is crude and subject to assumption uncertainty, the Waypoint Hypothesis path is believed to be a best fit path for the ATSB fuel range. 

4 – End of Flight Simulations

Also shown superimposed on the Waypoint Hypothesis is a figure from Dr. Richard Cole’s recent simulation of end of flight possible paths.   Note that this figure could be superimposed anywhere along the 7th arc and does not predict where along the arc MH370 is – it simply analyzes the end of flight.  His analyses assume that MH370 ran out of fuel at the “loss of second engine” yellow pin.    MH370 would then bank and spiral or nose down, and the brown dots are possible endpoints from many simulations.

5 – Seismic Evidence

Seismic stations are designed to record earthquakes and are located all around the world.  By recording at several stations, the source of the event can be triangulated from differing arrival times. There are many recording stations located around the perimeter of the Indian Ocean and on islands within it.  They typically pick up other man-made events.  A Twitter user named Kirill Prostyakov is actively analyzing archived seismic data to try to detect the impact of MH370 on the surface of the sea.   The impact would have created a compression wave that could travel great distances in the SOFAR channel of the ocean, arrive at land and potentially be recorded by seismographs. Below is his latest reconstruction:

This is how a potential #MH370 impact signal looks across the IO. Works out to 40.165S 83.795E with <10sec residuals pic.twitter.com/UYILZHKdFa

— Kirill Prostyakov (@kprostyakov) March 16, 2015

The station seismographs shown above are shifted in time to the event time by adjusting for travel time delays in order to triangulate them.  The vertical line represents the triangulation event time of many stations to the red “Prostyakov” pushpin on the map above.   There is a clear visual amplitude difference before and after indicating that something happened at this location and time a couple of minutes after the last (7th arc) MH370 transmission. The event fits very closely in expected timing and location of impact of MH370 if it flew this route.

6 – Hydroacoustic Evidence

Hydrophones are underwater microphones designed to record the “sounds of the sea.”   They pick up the same waves as described above in the SOFAR channel as they arrive at shore.   They pick up various lower frequency wave events such as ice cracking in Antarctica.  They also can be used to triangulate, but unfortunately there are few stations. The US Los Alamos National Laboratory (LANL) has analyzed this data and has triangulated a location using timing and projected heading and this point is shown by the red pushpin in the map above.   They have discussed their findings in a couple of reports:

1. An initial analysis:  Seismic and hydroacoustic analysis relevant to MH370 (July, 2014)
2. A follow-on report looking at whether the event is unique along the 7th arc: (e.g. – could a hydroacoustic event be detected elsewhere along the arc?):  How Common are Noise Sources on the Crash Arc of Malaysian Flight 370 (October, 2014)

In the first report, they detected an event triangulated to the red pushpin but indicated the evidence is weak.  In the second report, they indicated that events are mostly not common along the arc.   Whether this event could be tied to MH370 is currently subject to debate, but the location and timing generally fit the other indicators described above.

Putting it all together

If you look at the above picture, you can see how all six independent pieces fit together like nearly perfectly cut puzzle pieces, each one connecting to one or two others and tying everything together:   from the initial human-selected pathway and destination to the second engine flameout, to the spiral down to the sea, to the potential seismo-acoustic pickup of the impact.

Each piece is fragile on it’s own, but together they begin to form a stronger case.

On the reasons for this site

Everything should be made as simple as possible, but no simpler

or perhaps more accurately:

It can scarcely be denied that the supreme goal of all theory is to make the irreducible basic elements as simple and as few as possible without having to surrender the adequate representation of a single datum of experience.  – Albert Einstein

The main reason for the creation of this site began a couple of weeks ago, when I decided to immerse myself in the latest developments in the search for MH370.   I became somewhat known for reverse-engineering the Inmarsat BTO data the authorities would not release about three weeks after the disappearance, and a week after formulating the Waypoint Hypothesis.  This allowed independent researchers a small breakthrough in cracking the code of the satellite data and examining possible locations.  Turns out my work was only as good as the poor diagram we had to work with, but it was a start.  Eventually the raw data was released.

From that core, the Independent Group (IG) eventually emerged and began trying to crack the other half of the code, the BFO (Burst Frequency Offset) or Doppler that allowed Inmarsat to say the plane went north or the plane went south.  Eventually, Inmarsat released the methodology (or the IG cracked it first, I’m not sure) and the IG and others came up with their own analyses to match and compare to the official investigation.  Legend has it the IG became influential in steering the official investigation towards a more reasonable search location indicated by the satellite data, though they (officials) won’t admit to it.

I strongly support the current search of the IG/ATSB combined swath.   It is arguably where the satellite data alone points as most likely, but other areas can be made to fit, including the Waypoint Hypothesis I believe, and that gets back to the quote at the top of the page.

It’s prudent to compute the most likely location holistically, taking into account human factors and any other relevant data.  Satellite data alone may be too simple, and subject to interpretation that leads to a wide swath, and limited search resources spread too thinly.   There are ways to further narrow the search if the current campaign that ends in May 2015 does not find MH370.  The search must continue if so.  I believe  “X” Marks the spot type analyses are warranted for the next phase.  A holistic view can lead to new insights and understanding as possibilities are ruled out.  It is prudent to set down the computers for a moment and ask “Why?”

Welcome

The Waypoint Hypothesis is a simple hypothesis of the unprecedented loss of MH370.  It’s a hypothesis based on simple assumptions. It provides a detailed location that MH370 may rest at that so far hasn’t been searched.

It’s compatible with all of the evidence, as far as I know.  To read more click the links/menu above or start with About.