Avionics reverse-engineering: Honeywell/Sperry NZ-920 Navigation Computer

[D Straney]

I've been sitting on this one for a while due to difficulty of reverse-engineering: it's a complex one, an aircraft navigation computer from the early 90's.  It looks like it was specifically made for small jets, rather than commercial airliners.


I was able to find a manual that covered the entire set of avionics that includes the NZ-920: https://www.manualslib.com/manual/828981/Honeywell-Spz-8000.html
The specific role of the navigation computer is to combine location info from multiple sources at different levels of resolution and reliability, and then distribute that "single source of truth" location to other systems which need it.  It also keeps a database of radio beacons, airports, and other useful aviation-related location features, which besides being needed to select the correct listening frequencies for the radio beacon receivers, might enable some sort of graphical map display?  Finally, it has some auto-navigation features where you can program a flight path, and it will send banking and ascend/descend control signals to the fly-by-wire system to steer and follow the programmed path.

Potential sources of location data are:

• VOR: short-range radio beacons at known coordinates which indicate position by sending a signal whose phase varies with compass direction; two beacons are then enough to calculate an unambiguous location
• DME: short-range radio beacons at known coordinates which indicate height (indirectly) using a query-and-response bidirectional exchange, and measuring propagation delay
• Omega: global navigation using a few VLF radio beacons at fixed reference locations
• GPS: global navigation using satellites, everyone knows this one
• Inertial Reference System: onboard gyroscope, gets used for "dead reckoning" when there's no beacons nearby and no global navigation sources

Most of these report to the navigation computer over ARINC-429, which is a unidirectional-broadcast serial bus standard with set formats for frames and standard message types.  Some of the other action happens though over ASCB (Aircraft Standard Comms Bus), a different peer-to-peer serial standard based on 10 Mbps Ethernet.

The upshot is that the hardware it needs to do its job involves math capabilities, a lot of (rewritable) storage, and a LOT of external interfaces to other equipment.  The helpful block diagram from the manual shows 24 separate serial interfaces:


Now that we know what's involved, let's pull off the cover:

(power supply already removed in this shot)

There's a backplane, with a power supply and 6 other boards plugged into it.  The backplane has some capacitors and a transformer for some unknown purpose:


Starting with the easiest board....
Board 6 (Navigation Database)

This mostly has just a lot of EEPROMs.  SEEQ was known for their memory chips, and the DM28C256A is a 32K x 8 EEPROM, which when multiplied by the 40 copies on this board comes out to 1.31 MB.  This matches the size of the navigation database storage from the manual.  Being rewritable is important, as the manual also mentions a typical update schedule of twice a year, and shipping & swapping boards on this schedule would be a lot.  Instead, the CPU handles the updates through a dedicated RS-422 interface, as shown in the block diagram above.

There's also some misc. logic, probably for bus interfacing and address decoding to determine which EEPROM to select.  That's what these 54HC138 3:8 decoders are almost definitely for:


Let's also take a second to admire the nice regular layout of all those paralleled address and data lines:


Board 2 (Main CPU)

The manual mentions a math coprocessor for all the coordinate combining and filtering calculations (plus doing the trigonometry required to get an absolute position from beacon distances/angles).  We can see it here in the top right: the 8086 main CPU with its 8087 coprocessor.

There's also a lot of RAM (middle) and UV EPROM program memory (left), with more misc. logic and 74xx138 decoders to generate those memory chip's #CS signals.  The 82C59 in the bottom left is a military-spec version of the classic Intel interrupt priority decoder, which (simplified version:) accepts a variety of interrupt requests from external devices and passes on the highest-priority one to the CPU first.

There's also two serial interfaces on this board, driven by the MD8251 USART and the Zilog Z0853006 serial comms controller, which seems a little more flexible but overall very similar.  The physical layer is handled by 2x AM26LS34 (8 total differential receivers) and 2x DS26LS31 (8x total differential transmitters).

Which of the many, many serial interfaces are these?  The block diagram shows only 3 sets of serial interfaces that are connected directly to the main CPU instead of one of the two I/O co-processors, and one of those interfaces is RS-232, which rules it out because of the differential signaling here.  These are likely some combo of the RS-422 data loader interface, and the RS-422 interface to the CDU.  Both of these are synchronous, but the CDU interface seems to use one clock for two separate control and data channels.  The only reason I could see to use the two different USART chips is to fully take advantage of the extra features of the Zilog part, maybe to sync its bit clock and frame timing to the 8251 or the other way around, if the two USARTs together form the CDU interface, with one for the control channel and one for the data channel.

Board 4 (I/O Processor B & Discrete Outputs)

Looking back at the block diagram above, there's actually so many different serial interfaces to the navigation computer that it has two I/O co-processors: "I/O Processor B" and "I/O Processor C".  This seems to be I/O Processor B, which manages a lot of ARINC transceivers, a few RS-422 transceivers (on a different board, as we'll see later) and the discrete output signals that either indicate alerts or help control external equipment.
You can see the processor itself, another 80C86, near the right side in a socket.  There's also some RAM at the top-left, some EPROM for program code around the middle of the board, and a crystal & MD82C84 clock generator at the right side.  There's also misc. digital logic scattered around, likely for the address decoding required to interface to the memory and peripherals.


Over at the left side of the board are the discrete output drivers: there's 2x 74x259 8-bit addressable latches, 4x LM148 quad op-amps, and 16x 2N6661 MOSFETs (the metal cans) as well as some resistor arrays and 16x diodes.  This strongly suggests (confirmed by continuity check on the backplane) that these match the 16x discrete outputs on the block diagram.

You can see the upper half of these too in the photo above with the IDT memory chips.

Board 5 (Interfaces for I/O Processor B & Discrete Inputs)

This board, as far as I can tell, holds the many, many serial interfaces required for I/O processor B: 8x ARINC-429 receivers, 2x ARINC-429 transmitters, 3x RS-422 receivers, and 1x RS-422 transmitter.  Let's see how that matches up with what we can see here.  There's 7x identical Honeywell ASICs, and 5x MD8251A USARTs.  This doesn't match up nicely at all to the number of interfaces present!  ARINC-429 has a "self-clocking" Bipolar Return-to-Zero (BPRZ) physical layer which uses 0V as a separate level from positive or negative levels (see more info here), and a specific packet format as well, so I'm guessing that the Honeywell ASICs are ARINC-429 transceivers that also handle packet decoding and buffering.  I'd really like to trace out one block of circuitry here, but the combination of densely-packed components (with traces running underneath them), a multi-layer board, and conformal coating, all adds up to make any circuit-tracing impossibly frustrating here.
There's also 8x identical circuit sections, each with two metal-can transistors (a complementary pair of 2N2222 NPN and 2N2907 PNP) and one metal-can op-amp (LF156H, JFET-input 5 Mhz, tolerant of cap. loads up to 5 nF).  Their proximity to the ASICs and the number suggests that there's one of these analog blocks for each ASIC - my best guess is that they're doing common-mode-tolerant level-shifting/decoding of the differential three-level ARINC-429 inputs, and that there's an extra channel present.


There's also a set of two more LF156 op-amps in metal cans near the top-left corner of the board all by themselves, which if I had to guess may drive the 2x ARINC-429 transmit channels.

At the bottom-right corner of the board are 2x 26LS34 quad differential receivers, and 1x 26LS31 quad differential transmitter.  These seem to be used for the 3x RS-422 receive channels and the 1x RS-422 transmit channel on I/O Processor B, and probably connect to some of the MD8251 USARTs above.  The "AFIS/ACRS Rx Bus", which is actually on I/O Processor C, actually has continuity on the backplane to this board too, so that must be what some of the extra receivers are used for.

Most of the 5x external discrete inputs connect to this board too.  There's two possible sections that could handle these...
At the left edge, 6x 74x251 8:1 muxes, and a shitton of diodes (for input protection) all at the left side of the board (6 * 8 = 48 channels max.):

At the right edge, 8x LF156 op-amps (metal cans), and 4x LM139 quad comparators, followed by 4x 74x14 hex Schmitt-trigger inverters:

My best guess is that some of the discrete inputs are 5V logic-compatible levels, and so go straight through some series protection resistors and clamping diodes straight into the 74x251 8:1 muxes, which the CPU uses to read out individual bits on command.  Other inputs (8 of them?) are likely at non-logic-compatible levels, and so likely go through the op-amps on the right-hand side, then the comparators, then the Schmitt-trigger inverters, to "clean them up" and make them proper logic levels before going to the 74x251 muxes.  The 2 comparators/channel for the op-amp-based input channels is, I'm guessing, to do some sort of "window comparator" function and indicate separately if some of these inputs are not within the expected voltage range.

Board 3 (I/O Processor C)

Let's finish up the serial-interface madness with the other I/O co-processor, "I/O Processor C".  You can see this co-processor right in the middle of the board, as expected yet another 80C86.  There's again some EPROM program memory, and some ceramic gold-cap chips which I'm assuming are RAM.  Just like on the other I/O co-processor board, there's also a scattering of digital logic in the form of bus buffers and decoders, for interfacing the address and data buses to these memory chips and other peripherals.
The 82C84 clock generator pops up again here - it's worth mentioning this time that the 82C84 does a surprising amount, besides generating the CPU clock from a crystal: it also can divide that down for a slower peripheral clock source, re-time and "sharpen" the external CPU reset signal to make it synchronous with the clock, re-time bus ready signals, and combine some of the bus control signals to work with multi-master buses.  Read the datasheet if you're curious.
There's also an 82C88 "bus controller", which tkaes in the 8086's small number of bus control signals (possibly they were limited by pin count?) and decodes them to a much larger variety of "latch enables" and other bus control signals that are useful for interfacing to other devices, without adding a ton of glue logic.


On to the serial interfaces: according to the block diagram, this board handles 2x bidirectional ASCB buses, and a single AFIS/ACRS receive channel.  The next most obvious feature on the board is the same Zilog USART chip as on the CPU board, so this probably handles the AFIS/ACRS reception (although its physical-layer differential receiver is on board 5, as discussed above).

The bidirectional ASCB buses seem to be similar to Ethernet, and have a fairly complex protocol, at least compared to a simple UART.  The external ASCB connections trace all the way to the pulse transformers at the lower-left of this board, which along with the 26LS31 and 26LS34 differential transceivers probably form the physical layer for this bus:

There's a large block of digital logic above this, with a lot of counters (74x193, 74x163, 74x192), flip-flops (74x74), a couple serial-in/parallel-out shift registers (74x164), some logic gates and muxes (74x157) here and there, and a couple PLDs at the left.  I'm guessing that this all forms a non-integrated data link layer for these ASCB buses: would be very interesting to trace out all the connections here, but as mentioned above the combo of dense hard-to-follow traces on internal layers and conformal coating to defeat easy continuity sweeps would make this take an unrealistic amount of time and effort.

Board 1 (RTC & Mysteries)

There's a lot going on here, and to be honest I'm not sure what most of it is doing.

The most obvious is the ICM7170 real-time-clock (RTC) for time-keeping and calendar functions, with a backup battery to keep it running even when the aircraft is powered down, and its oscillator crystal directly below it:


Next to it is also 2x 32Kx8 SRAM chips, with another backup battery: these could be the separate "memory" (fed from the aircraft battery) referenced in the upper-right corner of the block diagram.  I assume this memory would store some kind of permanent usage-or-error log/settings/maintenance data that you wouldn't want to lose every time the aircraft was powered off.  I don't know whether this has its own separate battery from the RTC, or they both share the two batteries so that one can be swapped out while the other remains active.

On the far right side of that photo though, is where it gets strange - this is an AD42529 DAC.  I wasn't able to find any real data on this part, except a reference on an obscure-parts-vendor website which described it as "SERIAL INPUT 16-BIT 4 MA-20 MA, 0 MA-20 MA DAC".  So it seems it has a current output, that does....something?  Note the 2x LM139 quad comparators underneath as well, in that photo: I could see needing two comparators total to check battery levels and warn when a backup battery is running low, but I'm not sure what 8x separate comparators get used for here.

The DAC's purpose is mystery #1.  It only continues from there...
Mystery #2: At the right-hand side of the board, there's also 3x LM139s (12x comparators), 4x LM148s (12x general-purpose op-amps), and a DG508 analog switch.
Mystery #3: There's more than the normal amount of CPU-bus-interfacing glue logic here too.  There's 4x 4040 12-bit counters, 3x 74x191 4-bit counters, and an EPROM.  Some kind of clock generator() involves a few op-amps and transistors with their own crystal at the top-left corner, too.  The only thing I can think of is that this is some kind of backup timebase / clock generator which works as a watchdog for the CPU(s), or something like that.  The "TAG SYNC" and "CDU SYNC" external inputs also connect to this board, but I don't know what those do so that doesn't help much either.
Mystery #4: Where's the RS-232 interface?  The block diagram shows 3x RS-232 interfaces to the main processor, but I haven't seen any dedicated RS-232 transceiver chips.  Are the RS-232 transceivers implemented with op-amps and transistors?  I checked continuity from each of the RS-232 channels on the external connector (using the pin numbers helpfully given on the block diagram), and found that one RS-232 channel goes to board 3, one goes to board 5, and one goes to board 2.  It would be plausible for the mystery analog circuitry (minus the DAC) on this board to be working as a set of RS-232 transceivers, but those signals just do not connect (directly) to this board.

It's ok though, we can take a nice relaxing look at traces winding their way across the bottom side of this board:


Power Supply
Finally, let's take a look at what powers all of this:

According to the block diagram, the navigation computer runs off 28VDC from the aircraft, so this must step it down to +5V for the digital logic and probably something like ±12V for the analog circuitry.

I can't tell the exact topology here without being able to easily trace the connections, because there's a lot of power devices and magnetics.  The light-colored toroidal inductors are probably EMI filters for the input and/or outputs, and you can see the bulk capacitors nicely stacked like cordwood.  With a lack of symmetrical arrangements of MOSFETs though, I'm guessing this doesn't have a half-bridge or full-bridge isolated converter, maybe just a flyback with some auxiliary outputs.  There's only a single regulated converter here, as there's a single controller: the SE5560, next to a set of op-amps (LM124) and comparators (LM139) that are probably for monitoring and protection.

Let's go through all the power switching devices...

• 2N3716 (TO-3 metal can) is a "medium-speed" NPN power BJT, rated for 80V 10A.  This is less likely to be the main switching transistor?
• IRF630 & IRF730 (TO-220) at bottom-right are 200V 0.3Ω and 400V 1Ω power MOSFETs.  The drain of the (lower-voltage) IRF630 connects to the positive side of the right-hand "firewood stack" of capacitors, but I'm not sure whether these are connected to the input or output.  The voltage rating suggests that these could be the switching transistor(s) for the power converter, but the mismatch in voltage ratings and resistances also suggests that the higher-voltage higher-resistance one operates some sort of auxiliary clamp circuit, rather than being an "equal player" in a half-bridge or push-pull converter.
• 3x mystery TO-220 packages in heatsinks at bottom-left have too much conformal coating for me to read the markings, but I'm guessing that these are linear regulators for cleaning up the switch-mode power supply's outputs, especially because the auxiliary outputs will be unregulated even if the "main" output from the supply (probably the +5V, with the most current draw) is regulated.

Unlike some of the military equipment I've taken apart, the NZ-920 is not conduction-cooled: there's a fan blowing air along all the cards, which explains why a lot of these parts are not more heavily heatsinked (and why everything's a little dusty in these photos).

There's also 2 sets of stud-mount diodes, mounted on heavy brackets that get screwed to the outside computer housing, for heatsinking:


Here's a closer look at the control circuitry...


...and at other miscellaneous pieces of the power supply:



Anyways, hope you enjoyed this look inside.  It's a bit disappointing to have a bunch of unresolved mysteries and not be able to do my normal circuit-tracing on this, but going to make up for that with the tank fire-control computer teardown coming next.