Avionics teardown: engine controller boards - Page 1
Forum section: electronics / projects

author: D Straney
author_rank: Frequent Contributor
timestamp: July 06, 2025, 05:05:01 pm
content: I was lucky enough to find a couple interesting-looking scrapped boards a while back. There are two copies, sharing the same part number but different revisions: G & H. The older one has early-90's date codes ('90-'91), while the parts on the newer one are from a few years later.Older board:Newer board:Comparing them side-by-side, you can see the many reworks on the older one, and how the design changes were incorporated cleanly into the newer version. Notice how the extra diodes that were glued down and wired in by hand on the older board, are now surface-mount parts with footprints on the newer board.We'll get to analyzing what these boards do and how, but first, let's look at the...BackgroundThe boards have "89954" all over them, which is the CAGE code for BAE Systems Controls. That's a start.Looking up the part numbers from some of the chips on an aerospace supplier website gave me zero information, except listing the manufacturers as CFM International for one and FADEC International for the other:These are both the names of companies involved with commercial aircraft engines, and in the case of "FADEC International", specifically about engine control computers:Finally, there's a sticker on an IC which lists the manufacturer as "63760". This turns out to be the CAGE code for "BAE Systems Controls Inc. Commercial Aircraft".So, there we have it. This is most likely part of a commercial aircraft's jet engine controller. Even though it's not military or space electronics that have to be radiation-hardened to some degree, the copious ceramic-and-gold packages are there likely for reliability, when plastic packages were less proven (seeing as there's hundreds of lives depending on these working correctly!), especially in tough environmental conditions (heat & vibration) if the controllers were mounted directly on the jet engines.ConstructionEach of these consists of 2 PCBs, glued to both faces of a thick and very heavy steel plate for rigidity and/or conduction cooling. At one end is a high-pin-count connector, presumably for connecting to a backplane in the engine controller, and from there to other boards and external connectors.At the other end is a connector which is actually more of a testpoint array - it also spans both boards, but doesn't seem to connect them together, just presents contacts. These are recessed slightly so that they can't be accidentally shorted together easily, but can be probed with the right tool.Processing sideCPUThe main feature here is a68020 processor, part of Motorola's 68000 family. This was apparently the first of the 32-bit family to have fully 32-bit address and data buses.ASICThe unsearchable chip next door is a mystery, but we can make some guesses.Common support chips for the 68020 include floating-point co-processors (the 68881 & 68882), and a paged memory management unit (MMU, the 68851). This mystery chip could implement any combination of either or both of these, plus maybe some common processor peripherals: timers, reset generators, clock control, etc. The 40 Mhz clock nearby is presumably used as the CPU clock.MemorySpeaking of memory, that's the majority of what's on this side. There's 16K words of EEPROM (probably program memory), and 8K words of RAM. ThePAL/PLA(programmable logic) & individual logic chips are probably performing the address decoding for the different memories.The two smaller EEPROMs next to the CPU don't have stickers, which indicates they weren't programmed ahead of time. These are probably used for logging data during engine operation.Resistor arraysScattered around are some packages that were initially a mystery......until I opened one up and found it was a resistor array:There's a lot of identical resistors bussed to a common pin, so I'm guessing these are mass pull-ups or pull-downs, especiallly with all the 3-state buffers nearby: you need a LOT of resistors for 64 bits worth of combined address & data bus.I/O sideARINC 429 transceiversThis side seems to be dedicated to external I/O, and specifically to communications. There's a set of 3x dual receivers & transmitters forARINC 429, an aircraft serial-communications protocol, which adds up to 6 total ARINC 429 channels.I have to imagine that some of these 6 channels are for redundancy: an engine controller is not something you'd want to lose communications with, with a single point of failure.TheHA4-5002 buffersnearby are a bit of a mystery. The number of them (6) suspiciously matches the number of ARINC 429 transmit channels, and they sit right next to the transmitters - however, since ARINC 429 uses differential signaling, this is actually half the number of individual transmit signals (12 total).I think these buffers are used to drive the reference voltage supplies to the ARINC 429 transmitters, instead of directly driving external outputs. If you look at theHI-8382 datasheet for the ARINC 429 transmitters, you can see that it accepts a "Vref" power supply, which sets the output voltage swing of the drivers. The short-circuit output current for the HI-8382 is roughly 150 mA, which makes sense with the 100 mA DC capability of the HA4-5002 buffers.Notice the AD584 multi-output voltage reference, plus the OP11 quad op-amp next to it, below the ARINC 429 transceivers. The AD584 likely generates Vref for the ARINC 429 transmitters, the OP11 buffers it (with some amount of gain?), and then the reference is fed to the inputs of all the HI4-5002 buffers to drive the HI-8382 Vref inputs.ControllerWhat seems to be running the show on this side of the board is another ASIC:This probably contains the encoding/decoding logic plus UARTs for all the ARINC 429 serial interfaces, plus the bus interface logic to talk to the CPU.It has an EPROM nearby (microcode?), plus an IDT 7133 & 7143 dual-port RAM. The 7133 & 7143 are designed to be used together to create a 2K x 16-bit memory from two individual 2K x 8-bit memories. This 2K x 16 RAM block is almost certainly used by this communications controller to queue incoming and outgoing messages.MiscellaneousThe 26LS32 & 26LS31 in the corner provide 4 extra differential inputs & outputs: I don't know whether these are more serial interfaces, or "discrete" I/Os.There's also an LM139 quad comparator at the opposite end, which together with all the resistors nearby, suggests that it's reading discrete inputs from the outside world - maybe sensor inputs.Small ASICsThe biggest mystery is the small ASICs scattered all around - they're the ones marked "VLSI" here, on the older board:...and the ones with the Harris ("H") logo, marked 89954SOCN... here, on the newer board:I popped the lid on one of these to take a look inside:I still don't know what it does, exactly. There's 8 identical channels, with power transistors at the bottom that produce power outputs (notice the thicker output traces on the metal layers).Each of these channels is independent and has no common connections, except a couple horizontal wires near the bottom edge. Each channel has 2 inputs. If it was a digital buffer it would make sense, or a decoder-and-driver, but it's clearly neither of those. I have no idea what the columns of mystery logic are doing.You can see the output drivers in more detail here:The global logic block, and the details around the I/O pins are also interesting to look at:Overall, between the structure and the many (proection?) diodes nearby, my best guess is that this ASIC is something which drives external discrete outputs. The power transistors aren't large enough and there's not enough protection/monitoring for these to be driving heavy loads like valves/motors/actuators of any kind, but they could be turning on external relays or indicator lights.Let me know if you have any thoughts. The full set of photos is here:https://www.flickr.com/photos/147639706@N02/albums/72177720327365204

author: Simmed
author_rank: Frequent Contributor
timestamp: July 06, 2025, 05:50:11 pm
content: https://en.wikipedia.org/wiki/ARINC_429ARINC Protocol Tutorial (PDF). GE Intelligent Platforms. 2010interesting, the 16bit code can only process up to max altitude of 65536 feet

author: gerbay
author_rank: Regular Contributor
timestamp: July 06, 2025, 06:56:20 pm
content: Quoteif more data range is required 19-bit BNR will be sufficient