Reverse-engineering some avionics (Vibro-Meter Central Maintenance Computer)

[D Straney]

I'd run across some boards from the Swiss manufacturer Vibro-Meter (now part of Meggitt) before, and they looked interesting, with many channels of switched-capacitor filters, FPGAs, all kinds of mixed-signal stuff, special likely-thin-film resistors, etc.  (For example: https://i.ebayimg.com/images/g/9wkAAOSw~llgO8I9/s-l1600.jpg)  So not long ago, when I was browsing eBay and saw a Vibro-Meter avionics box that was being sold for a "why not?" low price because it had some kind of unresolved fault, I decided it would be worth spending the $40 to see if it had anything interesting inside.  Turns out there wasn't any special analog goodness in this one, but worked out well despite that.

This is a Central Maintenance Computer, almost 20 years old.  I have no idea what it actually does, and wasn't able to find any kind of description, but I would guess that it consolidates inputs(?) from a variety of different sources, so that it can provide timed alerts ("programmed number of hours have elapsed, time to change the brake pads"), logging, maybe also providing data for display in the cockpit through a serial link from some kind of main computer.




The connectors on the back, as would be expected, are very nice.  There's a higher-pin-count one, and a lower-pin-count one that I would guess is for power.



Anyways, once I was able to take out every screw to slide the cover off, you can see what looks like a main board on one side, and a power supply board on the other side, both attached to a central sheet metal frame.



(Sorry about all the flash-heavy photos, not good enough light in my place for good photography.)
The high-pin-count connector at the back is soldered to another board, which connects to both main board and power board through large headers.  The low-pin-count connector is mounted only to the frame, and has flying leads soldered to the connector board.



I was a little surprised at the lack of Serious Filtering here.  I've never worked with avionics, but the photos I've seen usually show some pretty beefy TVS devices and EMC filters.
(These are from fccid.io and Liebherr)

My understanding is that in anything as safety-critical as aircraft electronics, it has to keep working no matter what happens on the external pins, even in some harsh environments: lightning might strike the plane, or the cabling starts picking up the high-power radio transmissions, for example.  The lower standards for industrial electronics can already be difficult with Electrical Fast Transients (EFT), ESD, and EMI-tolerance.  However...making an only-semi-educated guess, I'd assume this Central Maintenance Computer isn't an immediately safety-critical system (if it's dealing with issues on the order of days rather than seconds) and so as long as it doesn't take out anything more important when it goes down, if it dies it's not a huge deal to just finish the flight without it and replace it later.

Let's look at the main board:
The little riser daughterboard attached to it mostly just has a couple Vibro-Meter branded ICs and misc. logic.

Not going to be able to get any info on these.  Those look like some really exquisitely expensive PGA-style connectors between the main board and riser board though, haven't seen those ever used for board-to-board connections before, only on old IC packages.

Anyways...



That sure is a ton of MELF resistors arranged in a nice grid.  I tried reading the color bands for a few of the resistors in the following schematics but wasn't able to make them come out to sensible values in either direction.  Any help appreciated here.  Also we can already see some repeating patterns.  There's a ton of 74ACT16244 buffers down the middle, a lot of repeated 2901 quad comparators, some repeated 2903 dual comparators, a processor section with a 68000-series µP surrounded by various types of memory, and then a little bit of other stuff.

As a quick aside, there's actually a little board on the inside of the faceplate, which plugs directly into the main board when assembled:

It contains the same exact parts and types of memory as the main board (SRAM, EEPROM, and "boot sector flash" which seems to be lockable), so I'm guessing this is some sort of expansion or upgrade-flexibility.  Being able to upgrade in the field by pulling off the faceplate and changing one board in that vs. disassembling/re-stickering the whole thing would be a pretty convenient way to go.  One of the non-volatile memories has to be for program code and the other likely contains logging date or long-term storage.
The digital section of the main board, for comparison:


Ok, so back in the analog realm, tackling the quad comparators first, as these take up most of the board area: we'd suspect that these are sensing inputs from the outside world to provide a digital status input to the processor.  There's 40 of these comparators total, and if using one comparator per input, that makes for 160 separate inputs.  With the 74ACT16244 buffers, each chip has 16 bits and there's 20 of these, so this is 320 bits total.  Now the only reason to have so many of those 74ACT16244 buffers in the middle of all the comparators is for their 3-state outputs (for those unfamiliar, the outputs can be disabled and made to "float" like a mostly-open circuit): if each buffer takes its inputs from a different set of 16 comparator outputs, and the buffer outputs are all tied together, then the processor could enable only one buffer at a time, to read a set of 16 comparator outputs at a time.  There's also more than 160 pins on the connector to the outside world, so this makes sense.

I'm not sure where the 160 vs. 320 discrepancy comes from though.  I guess it's possible that the layout was tight enough that it made more sense to use only 8 bits of each buffer based on pinout and trace routing, or something similar.  I haven't traced out the continuity for any of the digital parts yet.

It turns out though that the initial hunch was correct: looking at one "unit cell" of the 2901 quad comparators, each one has 4 identical copies of a circuit that receives a single-ended input from the connector and compares it against a threshold, with some decent over-voltage protection.


These must be single-ended digital signals from other equipment on the plane, as the thresholds used by these comparators aren't dynamically generated by the processor or anything like that but are shared between all channels, from a fixed voltage reference generator:


It took me a minute to figure out what exactly was going on here, but it's an interesting scheme for making a zener diode voltage reference insensitive to the power supply voltage.  When you put a reverse current through a zener diode, as in a classic zener regulator circuit...

...the zener diode doesn't behave like a perfect voltage source.  Besides varying with temperature, the zener voltage also varies with the amount of reverse current put through it; you can think of this as a resistor in series with the zener diode (the "zener resistance").  So if the power supply voltage varies, this changes the voltage across the resistor, which changes the current through the zener diode, which changes the output voltage.
In the scheme used here, a resistor from the power supply "bootstraps" the reference at startup, providing some current through the zener diode, but then the top op-amp takes over and creates a fixed voltage to set the voltage across a resistor and therefore the zener diode's current.  This bias voltage is based on the zener voltage itself, and so if the zener voltage remains stable the bias voltage will also remain stable, and as a result the current through the zener diode will also remain stable.  Being a self-driving type of loop though which uses its own output as an input, it needs the bootstrap resistor I mentioned earlier to get things going reliably at first until it can settle into its intended mode.

Since I'd bet money that the analog supplies here are regulated, and the reference voltage doesn't seem to be used for anything particularly demanding from the precision point of view, this is probably massive overkill here.

The next-largest section is all those 2903 dual comparators in the corner, which turn out to receive differential digital inputs:


The use of two comparators for each differential input provides some extra fault-tolerance/"introspection" abilities.  One comparator & one digital output would only give you a "high" vs. "everything else" indication, whereas here if both comparator outputs are low, the input voltages are too similar (within the hysteresis window set by the feedback resistors) and something's wrong - maybe some wires are broken or a cable is disconnected.  This is exactly the kind of thing that would be good to know.
These comparator outputs feed not to the processor, but to the riser board and the mystery Vibro-Meter ICs.

Next up is the miscellaneous circuitry in the corner below the processor section.  This turns out to contain output circuitry, in the form of two "power" open-collector outputs, and a differential analog signal.



Each analog output uses the unity-gain LM6221 buffer (the DIP packages visible in the photo), presumably for its 300 mA output current capabilities and tolerance of capacitive loads, wrapped inside the feedback loop of an op-amp to precisely control the output.  The large ceramic caps in the photo are what provides the filtering for the LM6221's power rails.  The differential input signal for these op-amps comes from the riser board and the Vibro-Meter IC(s).  I have no idea what this output could be for, except maybe driving a gauge somewhere?


The digital load drive section is interesting because of its protection features.  The ones I can count are...

• Extreme shorted load current-limiting through the series drain resistor.
• Slower current limiting through the source resistor + BJT, which regulates the max. current to very roughly 120 mA.
• (Transient) over-voltage protection through the series drain resistor and the MOSFET's capacitance.  Might not be actually useful, or might be enough for short ESD spikes.
• Open-load or output transistor failure sensing through the Schmitt-trigger buffer that looks at the drain voltage and signals back to the processor.
• De-saturation detection/shutdown and re-try through the additional circuitry, so that in an over-current situation, the MOSFET doesn't just sit indefinitely in linear mode dissipating way more power than it's designed for.

The last one results in the most complicated circuitry.  Whenever the MOSFET's drain voltage goes above the threshold of the 74AC14 (somewhere in the 2-3V range) and the output command is high (meaning that the driver is supposed to be on), both of the diodes at the lower-right corner are reverse-biased and the capacitor next to them is allowed to charge from the high output of the left-facing inverter, through both of its "feedback" resistors.  When this voltage reaches the 74AC14's rising threshold, the inverter sees a high input, so sets its output low, which pulls down the MOSFET gate and turns it off.  Now the same process repeats, where the "MOSFET forced off" state lasts until the inverter's input capacitor has been discharged far enough for the inverter to see a low input, and set its output high again.  This essentially makes an oscillator, with a short fault-state delay followed by a long wait interval, followed by a short fault-state delay again.  The difference in timing is created by the additional resistor and diode across the inverter, which allows creating a fault-state timeout that's much shorter than the re-try/"cool-down" wait before trying to turn on the MOSFET again.

What stood out to me about this is not the protection logic itself, as this type of thing is very common.  But in the industrial controls world, this seems to normally be done with a singla integrated "load driver" IC which handles all the protection functions, current sense and open/shorted load detection for the main processor, time-outs and re-try delays, etc.  Go to https://s7detali.narod.ru and take a look at one of the Siemens PLC digital I/O modules.  But here, it's implemented all in not-particularly-complicated generic logic, maybe partly because only 2 channels were needed (which is very different than trying to fit 16 channels worth of I/O into a small form factor on a PLC rack) and maybe partly because of parts availability/design style - for an aircraft part with potentially a very long manufacturing or service life (esp. as getting these qualified is probably a pain), it's nice to not have to depend on one more single-source part that could go out of stock or stop production.

Let's take a look at the power board now:

I haven't mapped out the details yet of what's going on here, but in a general sense, there's...

Filtering on the input:


A switch-mode supply which might be a flyback producing the bipolar analog power supply, using a UCC2802 controller:


A bunch of linear regulators, including this seemingly discrete-transistor one:


Some kind of overall control or protection section:

Will probably take the time to figure out exactly what this part is doing sometime in the near future.

Any additional insights appreciated, I don't really know much about avionics so would be interested to hear more from people who do.

[Matsushima]

Just stumbled upon this year-old post looking for technical support from Meggitt... 

I have been working with avionics for the last 20+ years, but not in the low hardware level, more on the aircraft integration level. This box or a similar version is used on a few airplanes, the Embraer ERJ-145 being one of them. Central Maintenance Computers, although part of avionics, are lower-criticality pieces of equipment. It is basically used to log faults from all aircraft systems, to help troubleshoot and repair the airplane. It also captures data snapshots from a few systems of the aircraft for trend monitoring purposes. It does not interfere with what we call "continued safe flight and landing". Being a low criticality system translates into a lower level of scrutiny and activities for both programmable hardware (FPGAs, ASICs and the such) and software. It is a "Level D" system as per RTCA DO-178(B/C).

Vibro-Meter was very well known for their vibration monitoring systems (thus the name of the company) and Central Maintenance Computers were kind of a fish out of water in their lineup.