■Wf.

THE AMERICAN SOCIETY OF MECHANICAL ENGINEERS

345 E. 47th St., New York, N.Y. 10017 98-GT-457

The Society shall not be responsible for statements or opinions advanced In papers or discussion at meetings of the Society or of its DMslorts or
Sections, or printed in Its publications. Discussion is printed only if the paper is published in an ASME Journal. Authorization to photocopy
for internal or personal use is granted to libraries and other users registered with the Copyright aearance Center (CCC) provided
53/article or $4/page is paid to CCC, 222 Rosewood Dr., Danvers, MA 01923. Requests for special permission or bulk reproduction
should be addressed to the ASME Technical Publishing Department.

Copyright 0 1998 by ASME AU Rights Rewired Printed in U.S.A.

Downloaded from http://asmedigitalcollection.asme.org/GT/proceedings-pdf/GT1998/78668/V005T15A033/4219122/v005t15a033-98-gt-457.pdf by guest on 11 January 2023

PROPULSION ASPECTS OF THE 111111111111Ra1111111111
THRUST ASYMMETRY COMPENSATION SYSTEM (TAC)
ON THE BOEING 777 AIRPLANE

Grace Balut Ostrom

Propulsion Engineering
The Boeing Company. PO Box 3707
Seattle. WA 98124-2207

ABSTRACT is not required for aircraft dispatch. Thus airline pilots will be
The Boeing 777 airplane has been designed with a Thrust required to train for both TAC on and TAC off.
Asymmetry Compensation System (TAC). This system reduces The system configuration is shown in figure I. The Engine
flight crew workload during single-engine flight operation by Data Interface Unit (EDIU) is the system thrust "sensor". The
automatically commanding rudder deflection to compensate for EDIU computes thrust from analog signals, from digital signals
different levels of thrust between the left and right engines. The transmitted by the Electronic Engine Control (EEC) and from
airplane is equipped with two Engine Data Interface Units aircraft digital ambient signals provided by the Air Data Inertial
(EDIU) which compute thrust based on engine parameters. Reference Unit (ADIRU). The EDIU also determines the thrust
This paper will describe the thrust calculation, the fault validity. Both the thrust and thrust validity are transmitted to
detection requirements and the resultant fault monitors, and the the Airplane Information Management System (AIMS). AIMS
processes used to validate the EDIU logic. transmits the thrust information to the Primary Flight
Computer (PFC). When the PFC is in NORMAL mode and
thrust difference between engines exceeds the activation
TAC SYSTEM DESCRIPTION threshold, TAC becomes active. The PFC determines rudder
The twin engine Boeing 777 airplane is controlled by a fly- and rudder trim commands based on the validated thrust
by-wire Primary Flight Control System which has three control difference. Pilot awareness of TAC system activity is provided
modes - Normal. Secondary, and Direct Modes. Normal Mode by moving the rudder pedals through the rudder trim actuators.
contains many augmentation and compensation features The pilot always maintains full override authority through
intended to improve the handling characteristics of the airplane. rudder pedal displacement.
One of these features, referred to as Thrust Asymmetry The TAC system also includes a dedicated switch in the
Compensation (TAC). is a system that provides automatic cockpit. This switch allows the pilot to disarm the function. If
rudder compensation for yawing moments caused by different the system detects a fault which disables the compensating
levels of engine thrust. The TAC system is basic to the 777 function, the switch will illuminate, and the message "THRUST
aircraft. ASYM COMP" will be displayed to the pilot on the Engine
The system was designed to reduce pilot work load during Indicating and Crew Alerting (EICAS) display unit. The switch
conditions of thrust asymmetry. The compensation assists the also allows for the reactivation of the system. If the conditions
pilot during engine failure, and also provides compensation which disarmed the function are no longer present, cycling of
throughout the remainder of the flight (where one engine is the switch will re-enable the function to operate.
windmilling or at idle, and the thrust on the other engine is
being modulated). However, no specific certification credit
was taken for the TAC function and availability of the function
•

Presented at the International Gas Turbine & Aeroengine Congress & Exhibition
Stockholm, Sweden — June 2–June 5, 1998
 extremely improbable, shall cause unacceptable TAC rudder
rmodetrurn" Liddy TAC SYSTEM behavior or prevent continued safe flight and landing. The TAC
Pedals
li±
frac] , CONFIGURATIOS system relies on engine parameters (NI and EPR) to calculate
%YE
s‘ th

Rudder Actuator Leven thrust, There are failures of these parameters which, undetected,
Lornmaad 11 BA could violate this TAC requirement.
Another system requirement was to ensure that pilot
EDIU EDIU
recognition of an engine failure was retained. Excess rudder
compensation (overcompensation) has the potential of

Downloaded from http://asmedigitalcollection.asme.org/GT/proceedings-pdf/GT1998/78668/V005T15A033/4219122/v005t15a033-98-gt-457.pdf by guest on 11 January 2023

providing the pilot the wrong cue as to which engine has failed.
Computed thrust accuracy affects TAC compensation levels and
ADIRU A MS had to be accommodated in the design.
There were also timing requirements levied on the system.
lamed System response time had to be strictly defined to insure that
ireust
the desired compensation levels were provided during engine
PFCS transient conditions such as engine failure.

Propulsion System Reauirements

The top level TAC system requirements cascaded into
Figure numerous lower level EDIU requirements.
First, all engine failure modes and engine sensor failures
modes were identified, and their impact on the TAC system
evaluated. All failures which could violate the systems
TAC THRUST
requirements had to be detected by the EDIU fault monitors.
The TAC system was designed using computed thrust.
The list of all engine/sensor failure modes was reviewed by all
rather than measured thrust. The actual measurement of thrust
three engine manufacturers and the FAA. This list identified the
is difficult. Thrust measurements taken during a flight test
failure conditions in which EDIU thrust calculations would not
program use special flight test instrumentation, including highly
reflect actual engine thrust. The EDIU design had to include
calibrated multiple pressure sensors. This type of
fault detection logic able to detect these faults within the
instrumentation.is expensive and difficult to maintain, making it
requirements thresholds and disarm the system. The undetected
undesirable for power setting on a commercial airplane. The
faults had to meet the defined handling qualities requirements.
two traditional methods of thrust measurement on an engine are
Detected failures result in the loss of the TAC function and limit
low rotor fan speed (NI) and engine pressure ratio (EPR - the
erroneous rudder commands.
ratio of engine core exhaust pressure to inlet total pressure).
The differences between the computed thrust and actual
The "measurement" of thrust by these two methods include
thrust establish the thrust accuracy. The range of thrust
inaccuracies, such as the effects of bleed and power off-takes,
accuracy was evaluated and was a component in establishing the
engine-to-engine variations and engine deterioration. These
total range of thrust asymmetry compensation. This was
inaccuracies are accommodated in the airplane power setting
incorporated in the design of the rudder gains. The requirement
charts, insuring that the required thrust is obtained. The TAC
of thrust accuracy and other system variations had to meet the
system was designed using these traditional methods of thrust
compensation levels required.
measurement, using existing engine signals. This design met
the system requirements and resulted in a system that did not
require additional sensors. The use of existing sensors meant
EDIU DEVELOPMENT
that additional maintenance for the airlines was not incurred.
The EDIU development included establishing the system
architecture, determination of the thrust calculations and the
design of the thrust validity algorithms.
TAC SYSTEM DESIGN DEVELOPMENT
The process of designing the TAC system began with the
definition of the overall system requirements. These system
EDIU Description
requirements then drove the lower level propulsion
The EDIU was developed to provide an interface to
requirements and objectives.
exchange engine data with airplane systems, and to perform the
TAC thrust computation and validation function. Fault-
tolerance was a key design requirement, to meet the availability
TAC System Reauirements
and redundancy requirements for its functions and to minimize
The implementation of the TAC system had to result in
airplane schedule interruptions.
acceptable airplane handling qualities at all times, and had to
These requirements led to the use of two EDIUs on the 777
result in a system that was certifiable by the airplane regulatory
airplane, one for each engine. Each EDIU has three channels.
agencies. The basic top level requirement was: no single
Thrust for each engine is computed in each of the EDIU
failure, or any combinational failures not shown to be

2
channels. The EDIU also provides a gateway function for Ni Sensor Failure. The most obvious failure for the
Electronic Engine Control (EEC) information by receiving EDIU is the failure of the NI signal. An erroneous NI signal
ARINC 429 information transmitted by the EEC on the engine, will result in an erroneous thrust value. Piloted cab sessions
and retransmitting icon the airplane system ARINC 629 busses. were conducted to establish the maximum erroneous rudder
In addition, the EDIU gateways airplane information from the acceptable. The resultant maximum erroneous rudder was
ARINC 629 busses to the EECs via the EECs ARINC 429 converted to a maximum thrust error signal. System conditions
databus. The EDIUs have access to all the EEC data and and dynamics had to be considered to define the maximum
airplane data required for thrust calculations: this made the thrust error. Given the maximum thrust error, the maximum
EDIU ideal for use as the TAC thrust sensor. . erroneous NI was determined. Thus a monitor had to be

Downloaded from http://asmedigitalcollection.asme.org/GT/proceedings-pdf/GT1998/78668/V005T15A033/4219122/v005t15a033-98-gt-457.pdf by guest on 11 January 2023

developed which would detect an erroneous shift in NI within
the defined threshold.
Thrust Calculation The engine NI sensor has multiple windings, one dedicated
The thrust calculation is quite basic. The EDIU uses to the EDIU and two dedicated to the EEC. The detection of a
corrected NI EPR and Mach Number to calculate thrust. single winding failure is accomplished through a comparison of
These sensors are basic to the airplane, and the EDIU has the analog and digital NI signals. However, there are common
multiple sources of each signal from which to complete its mode failures of the NI sensor which would affect both the
calculations. The data for the thrust tables is measured during analog and digital NI signals, such as a failure of the NI sensor
the flight test prOgram. housing. The basic EDIU NI monitor which detects a failure of
The core of the thrust calculation derives thrust from NI. the NI sensor relies on the use of other engine parameters. The
This thrust calculation is used during transients and at low ED1U includes models of NI derived from other engine
power conditions. However, some trims and limits are applied parameters. The synthesized (modeled) values of NI are
to meet the various requirements. compared with actual NI. When the NI shift exceeds the
At steady state high power condition the thrust may be monitor threshold, the system is disabled.
trimmed to adjust for EPR/NI variations. To compute the same The most challenging aspect of the thrust validation was to
thrust for both engines when being controlled to the same EPR, keep the system enabled during real, highly dynamic engine
the nominal EPRIN I relationship is used to provide an NI trim. failures, and to only disable the system when the thrust sensor
The thrust accuracy, for an undamaged engine, had to meet actually failed. During an engine failure, engine parameters will
the rudder compensation requirements. The difference between vary depending on the type of failure. The characteristics of
the actual engine thrust and the EDIU computed thrust is a the engine parameters during an engine failure will not follow
function of many factors, including: engine-to-engine variation. the same trends as during normal transient operation.
engine deterioration, bleed and power off-takes, compressor Additionally, the engine characteristics during a flameout will
stator vane positions, and engine and ambient sensor errors. differ front the characteristics of an engine failure caused by
These variations were analyzed and the thrust accuracy defined. mechanical damage. This variation results in the probability
that the fault monitor may detect a sensor failure, when in fact
the engine itself has failed.
Thrust Validation The EDIU models were initially developed using engine
The bulk of the EDIU logic provides fault detection, simulation predicted failure responses. Actual engine failure
accommodation and annunciation, The EDIU must detect data obtained from experimental engine development testing
failures of the thrust sensing system to meet the systems was used to improve the match of the engine parameters.
requirements. The types of failures that must be detected or All the pertinent high fidelity engine failure data was
accommodated include failures of the sensors used in the thrust acquired from both flight test and from the engine
calculation, and failures which result in fan damage such that manufacturers test stand data. Bear in mind, that this type of
the EDIU thrust computation is not applicable. data base is limited. Only data that had been recorded with at
Three engine / sensor failures which could violate the least 20 samples per second was useful, because of the
system requirements were identified. The first was the failure of sensitivity of the model dynamics. This data was processed and
the NI sensor itself, where the measured NI does not reflect the used with the EDIU simulation to fine tune the model dynamics.
low spool shaft speed. The second was a failure of the shaft
between the fan and the sensor, referred to as a forward shaft, Forward Shaft Failure. This failure, shown in figure 2,
failure, where the measured shaft speed does not reflect the is a failure of the shaft between the thrust producing fan, and the
speed of the thrust producing fan. The third failure was foreign- rotor speed sensor pickup. The loss of the fan results in the
object-damage (F0D). where the engine fan has been damaged rapid increase in speed of the remainder of the shaft, connected
and the thrust output of the fan does not match the calculated now only to the turbine. The result of this failure for TAC, if
thrust. For each of these failures appropriate detection and undetected, is the rapid decrease of actual thrust accompanied
accommodation logic was developed. The discussion of the by an increase of sensed thrust (by the increase in sensed NI).
design considerations for each of these failures and their fault The performance of the other engine parameters was
monitors follows. evaluated for trends that would separate this shaft failure from
other engine failures resulting in an increase of NI and front
normal acceleration characteristics. The parameters were the EEC adjusts fuel to bring EPR back to commanded EPR.
identified, and the fault monitor developed. As can be seen, FOD results is loss of actual thrust. However,
actual NI can increase above the levels of an undamaged
engine. Use of this NI to compute thrust would result in
adverse rudder. Thus the thrust calculation includes an NI limit
at high power.
FORWARD IP SHAFT FAIT [IRE
"I■miml="

Downloaded from http://asmedigitalcollection.asme.org/GT/proceedings-pdf/GT1998/78668/V005T15A033/4219122/v005t15a033-98-gt-457.pdf by guest on 11 January 2023

VALIDATION OF THE TAC SYSTEM
The verification and validation of the TAC system, as for
all 777 systems, was extensive and thorough (Buus et al, 1997).
Numerous facilities and personnel tested various aspects of the
system to provide complete coverage. The validation of the
Ni TURBINE thrust aspects of the TAC system ranged from EDIU stand-alone
SENSOR
testing, to testing of the complete system in flight test airplanes.
The PFC and EDIU problem reporting systems documented
inconsistencies found during testing, and insured that these

FAN
c
a a issues were addressed. Validation test results were documented
as formal reports.
SHAFT BEARING
FAILURE

Figure 2 EDIU Verification and Validation

The EDIU vendor verified that the EDIU logic was
implemented in accordance with the design specifications. The
validation of the EMU thrust system, insuring compliance with
Foreign Object Damage (F0D). Figure 3 shows the the airplane system requirements, was conducted by Boeing.
characteristics of various engine parameters as a result of FOD This included insuring that the logic met the thrust accuracy and
damage severe enough to reduce available thrust, but not severe the thrust validation requirements, and extensive testing to
enough to cause the engine to shutdown. In this case, the "weed out" nuisance faults that would cause nuisance disarms of
engine is operating in EPR mode. and after the initial transient the system.

Engine Characteristics
as a Result of FOD

EPR COMMAND

,
EPR ACTUAL

NI ACTUAL

THRUST DERIVED FROM NI

THRUST LIMIT

ACTUAL THRUST

Figure 3

4
 Downloaded from http://asmedigitalcollection.asme.org/GT/proceedings-pdf/GT1998/78668/V005T15A033/4219122/v005t15a033-98-gt-457.pdf by guest on 11 January 2023
Figure 4 - Propulsion Integration Lab

Validation of the EDIU began with the development and

testing of the EDIU simulation. All of the EDIU logic was TAC System Validation
developed in a simulation, where the logic was tested with TAC System validation took place in many stages and
respect to the failure modes. The simulation development through many different facilities. Test vehicles included
occurred before the requirements were released to the vendor. complete airplane simulations, the flight controls test rig
However, the final validation of the EDIU took place in the (FCTR), the airplane system integration lab (SIL). the simulator
Propulsion Integration Laboratory (I'LL), shown in figure 4. cab, and the real airplane. As can be seen, the validation testing
This laboratory includes hardware EECs, hardware EDIU, and a of the TAC system was extensive.
hardware AIMS. The engine, airplane and PFC are simulated. The performance of the system falls into three categories:
The lab provided the capability to induce system faults, to upset system integration (LRU to LRU timing, resets, single channel
(reset) any of the LRUs, and to depower LRU channels. The failures, etc.), system performance during an engine failure
PIL lab was essential to evaluate timing issues between the (appropriate compensation), and system performance during
asynchronous EEC and EDIU. Detailed test plans were written TAC system, failures (erroneous rudder). Each category will be
and testing conducted to validate the EDIU thrust logic. discussed separately.
Thrust validation included insuring that the EDIU detected
a thrust sensor failure, but it also included insuring the EDIU TAC System Integration. TAC system hardware
remained active in the absence of true thrust sensor failure, The integration was validated piece wise in the propulsion lab and
integration of the hardware EEC and EDIU in the laboratory the flight controls lab, and then fully in the System Integration
was instrumental in reducing the number of nuisance faults. Lab (SIL). The propulsion lab was able to verify the system
Testing of the hardware EEC and EDIU in the PIL lab integration of the hardware EEC, EDIU and AIMS (the engine.
uncovered numerous EEC/EDIU integration issues that were PFC and airplane are simulated). The flight controls lab was
resolved long before the first flight test of TAC. able to verify the system integration of the hardware AIMS and
The flight test airplane was a vital supplement to this type PFC and rudder (the engine, EEC, EDIU and airplane are
of testing. The flight test data was scrutinized after each flight simulated). The SIL was able to do an end-to-end hardware test
to determine characteristics that could result in undesirable from the EEC. EDIU, AIMS to the PFC. All timing
results. Evaluation of flight conditions which had potential of requirements and channel failures were validated here.
causing nuisance problems provided information for system
improvements. TAC System Performance During Thrust
Some system faults/characteristics were not anticipated, Asymmetry. The performance of the system during
thus they weren't tested in the lab. One example of this was a conditions of thrust asymmetry were initially developed using a
noisy NI signal during start. There were certain NI sensors complete airplane simulation. The performance of the system
which exhibited noisy characteristics during low speed / can be divided into two components: the transient performance
voltages. This characteristics caused the EDIU to flag an NI and the steady state performance. The steady state performance
sensor failure and disarm the system. The EDILI logic was relies on the accuracy of the EDIU calculated thrust and rudder
subsequently modified to include a start and windmill mode, effectiveness. The transient performance of the system is most
which allowed filtering of the NI signal at low speeds only. sensitive during failures such as a engine flameout from high
The loss of accuracy due to the filtering did not affect system power, and is a function of timing and system dynamics. The
performance since the NI/thrust gain is so low at low power. simulation was used to define the characteristics of the system
dynamics, and to define the initial gains and time constants.

5
 The validation of the system continued in the simulator SYSTEM DIAGNOSTICS
cab. The cab provided the visual aspects that the simulation In normal TAC system operation, the pilot is aware of TAC
could not, and also was configured with hardware PFC and system rudder commands through changes in the rudder pedal
AIMS, The effect of pilot visual cues and the effect of hardware forces. If the system becomes disabled, the pilot is made aware
timing on system performance was evaluated here. The gains through an annunciation in the cockpit. Loss of the function
and time constants were adjusted as a result of the testing results in an Engine Indicating and Crew Alerting System
conducted in the simulator cab. (EICAS) message 'THRUST ASYM COMP" and the
The final validation phase of the system performance was illumination of the TAC switch. The EICAS message is shown

Downloaded from http://asmedigitalcollection.asme.org/GT/proceedings-pdf/GT1998/78668/V005T15A033/4219122/v005t15a033-98-gt-457.pdf by guest on 11 January 2023

on the airplane. Testing was completed on three 777 flight test in figure 5.
airplanes, one for each engine type (PW4084, 0E90, and the In addition, if the EDIU disarmed the system because of a
TRENT 890). Testing included throttle transients (small step detected fault, the EDIU will transmit a maintenance message to
and large step) and engine failures (fuel cuts (flameouts)) at the Central Maintenance Computer System (CMCS). This
various flight conditions. The final system adjustments were maintenance message will be correlated to the EICAS status and
made as a result of this testing. advisory messages, allowing determination of the source of the
fault. The proper fault annunciation and correlation was tested
TAC System Performance During Thrust Sensor in the propulsion lab. An example of the correlation is shown in
Failures. The performance of the system during TAC system figure 6.
sensor failures could not be conducted in the actual airplane.
However, This type of testing was required to validate the
system, and in addition these types of failures had to be EXPERIENCE IN REVENUE SERVICE
demonstrated to the FAA. Thus the simulator cab had to be Fortunately, engine failures are a rare occurrence. In the
configured to simulate the sensor failures. few occurrences of engine shutdowns during revenue service of
The design process used the simulator cab to define the the 777, the TAC system has performed its intended function,
requirement thresholds and to refine the design. The simulator reducing pilot work load during the engine shutdown and for
cab was then also used to validate the system. The various the remainder of the flight.
failure conditions were identified, the conditions which resulted
in the worst upset specified and the system response refined
through extensive testing. The final system response was then
validated by both the Boeing flight test pilots and by the FAA.

• Citrti
1254
1115-61

-7, 77;

3 7 M
tr

+48 464
855 £9.1
145 r: 149
253 1:17/2s; 258
77 rt. 1,:1. 29
22 S: 22
•105 c7 Wiz

dv- —neon:as,-

Figure 5 - TAC EICAS Advisory Figure 6 - CIVICS / EICAS Correlation

6
SUMMARY AND CONCLUSION
The Thrust Asymmetry Compensation System is a basic
feature of the Boeing 777 airplane. The TAC system provides
automatic rudder compensation in the event of engine thrust
differences. The TAC system relies on the thrust derivation and
validation provided by the EDIU. Each of the three EDIU
channels calculates thrust based on engine sensors and verifies

Downloaded from http://asmedigitalcollection.asme.org/GT/proceedings-pdf/GT1998/78668/V005T15A033/4219122/v005t15a033-98-gt-457.pdf by guest on 11 January 2023

the validity through numerous fault monitors.
The TAC system relies on the accurate calculation of
thrust. The EDIU computes thrust based on fan speed (NI) and
engine pressure ratio (EPR). In addition, the system relies on
the correct eValuation of the thrust validity. An undetected
failure of the signals used in computing thrust could have a
detrimental effect on airplane handling qualities.
Validation of the TAC system included the development
and evaluation of the EDIU logic in a real time simulation.
Validation testing included a stand-alone bench, where the
hardware EDIU and software were operated with an engine and
airplane simulation. Testing validated that the thrust accuracy
and failure accommodation requirements were met. Pilot
evaluation in a fixed base flight simulator cab and during
airplane flight test verified that the system response to failures
met the handling quality requirements of the aircraft.
The extensive design, analysis, testing and validation of the
EDIU has contributed to a system which provides the
performance desired by the pilot, and meets all the system
safety requirements.
The simplicity of the basic system is a desirable feature.
The implementation from the propulsion aspect did not require
any new sensors, thus minimizing the maintenance aspects for
the airlines.
The TAC system has been successful in revenue service,
providing the desired compensation for numerous engine
shutdown events.

REFERENCES
Henning Butts, Robert McLees, Munir Orgun, Elizabeth
Pasztor and Larry Schultz "777 Flight Controls Validation
Process", IEEE Aerospace and Electronic Systems Conference,
April 1997

ACKNOWLEDGMENTS
The author would like to thank the following persons for
their contribution to the propulsion aspects of the TAC system:
Hals N. Larsen, Bruce Groenewegen, John Morton, Karl
Walczak and Dennis Kammers