Onboard Loadable Software
Many newer airplanes, such as the Boeing 737-600/-700/-800/-900, 747-400, 767, and 777, feature loadable systems whose functionality may be changed or updated using onboard loadable software. Modifying system functionality with new software instead of with modified or new hardware can help operators reduce the total number of hardware line replaceable units (LRU) in inventory, increase hardware commonality, and reduce airplane modification time. Airplane systems that can be modified with loadable software are standard on several later-model Boeing airplanes (see table 1). This feature allows operators to change the configuration of loadable systems without physically modifying or replacing hardware components. Benefits include the ability to meet new requirements, incorporate design improvements, and correct errors. In addition, software often can be loaded just in the time required to turn an airplane around for the next flight. A major advantage of changing system functionality without changing hardware is the reduced number of line replaceable unit (LRU) spares both operators and Boeing must keep in stock.
(See sidebar for related information on Douglas-designed commercial airplanes.)
However, both Boeing and operators have found it cost effective to preload the LRUs for some systems before installation on the airplane. The total time required to configure a complete system can be significant. For example, loading the 747-400 integrated display units (IDU) requires 15 min each, for a total of 90 min, if each IDU is loaded successfully on the first attempt.
Many systems comprise hardware and software components. A loadable system is different because it consists of loadable software parts and loadable (hardware) LRUs that are independently configured at the airplane level.
Software can be transferred into a software-loadable LRU using various equipment. Software can be loaded using a permanently installed onboard loader, a portable onboard loader, industry-available shop loaders, supplier-unique shop loaders, or supplier automated test equipment.
A few systems can be onboard-loaded by inserting the medium into the LRU itself. The appropriate equipment used to load an LRU depends on the system. For all loadable systems, the software parts installed as part of the system are identified electronically; a placard is not required on an LRU to identify what software parts are loaded in that LRU.
Spare copies of the loadable software parts are supplied on digital storage media (typically 3.5-in disks) when an airplane is delivered. These media parts are located in a binder stored on board the airplane. The 777 maintenance access terminal (MAT) includes a mass storage device as standard equipment. This mass storage device also stores spare copies of the loadable software parts for systems that can be loaded from the MAT. Mass storage devices are also used by some optional systems on the 777 but are not yet available on other models.
To operate and maintain an airplane that contains software loadable systems, operators first must implement several procedures to accomplish the following:
- Procure loadable software parts and loadable LRUs.
- Manage software libraries.
- Preload loadable software parts into loadable LRUs off the airplane.
- Verify conformity of loadable software part configurations to airplane certification documentation.
Procure Loadable Software Parts And Loadable LRUs
A loadable software part is identified by a unique part number, distinct from the part number of the hardware component (the LRU) or components in which the software is loaded. Hardware part numbers listed in the illustrated parts catalog (IPC) refer to the physical component only, with no software loaded.
To order a loadable LRU with the software preloaded, the operator must order both the software and hardware part numbers and stipulate that the software is to be loaded into the LRU.
The part number of a software program or file is distinct both from the part number for the media set and the part number for the hardware LRU.
The media set part number may represent one media part or a set of two or more media parts. The media parts are labeled to indicate how many parts are in the set, and to identify the designation of each member in a set (for example, 1 of 2, 2 of 2). The standard media parts are 3.5-in disks, but software for some systems is supplied on other media, such as on CD-ROM. As a result of operator requests, beginning in 1999 loadable software will be listed in the IPC according to the loadable software part number and will be called out in the chapter corresponding to each loadable system. The disk part number associated with a loadable software part number will be referenced in the nomenclature field of each software part number. Loadable software will be shown in the IPC according to the loadable software part number, because this is the part number that the mechanic must verify is installed in an LRU. However, operators must order loadable software parts by specifying the disk set part number.
Loadable software falls into several categories according to function:
- Operational program software (OPS).
- Operational program configuration (OPC).
- Airline modifiable information (AMI).
Operational program software (OPS).
The operating system of an LRU, the OPS acts on data contained in the operation program configuration (OPC) files to define the function of the LRU. The OPS is typically the largest, most complex software associated with an LRU, both in the amount of information it contains and the time required to load the software. Obtaining certification for new versions of an OPS requires commensurate time and effort.
Operational program configuration (OPC).
This software is a specialized database that determines the LRU configuration and function by enabling or disabling optional features contained in the OPS. Configuration information is also supplied to many LRUs through hard-wired discretes (program pins). The large number of possible combinations of software and program-pin configurations complicates configuration management. Though an OPC will probably never completely replace program pins, Boeing has placed as much configuration information as possible in the OPC. The OPC is small compared to the OPS and typically requires less than one minute to load.
A database is a collection of data arranged for easy access and retrieval by the operating system of an LRU. Some of the databases used by software loadable LRUs are
Flight management computer (FMC) navigation database (NDB). FMC model/engine database. FMC performance defaults database. FMC quick reference handbook takeoff-speeds database. Airborne communications addressing and reporting system database. Common display system display-unit database. Digital flight data acquisition unit (DFDAU) mandatory database. DFDAU ARINC 429 broadcast database. The NDB, which is quite familiar to operators, is a database of navigation and route information used by the FMC to carry out navigation tasks. NDB software is typically revised every 28 days and becomes available approximately one week before it becomes effective. Unlike other loadable software, the NDB is date controlled as opposed to part number controlled.
Airline modifiable information (AMI).
This is another small data file that supplies information to the OPS of some LRUs. The operator generates the AMI data file to specify preferences for functions such as cabin management data recording, report generation and formatting, and services provided to the various passenger seating zones.
AMI data files are used by some LRUs to provide information used by the OPS. On some airplanes, for example, when data needs to be recorded or formatted, reports generated, or seating zone services specified, the appropriate OPS refers to the AMI data file for the necessary information to accomplish the task.
An AMI data file is typically data rather than programs or executable code. However, AMI data files for some systems include logic units, which are high-level program code. To what extent AMI data files can be modified is controlled by the certified OPS of the LRU, which prevents operator modifications from affecting safety, regardless of whether the modifications are correct. It is only on this basis that such modification is permitted without certification authority review.
Manage Software Libraries
Boeing recommends that operators establish and maintain a software control library (or libraries) for storing backup copies of loadable software, associated documentation, and any media binders that are not kept on an airplane. Using a software control library can help operators ensure the availability and integrity of loadable software parts to support their airplanes. Operators must obtain necessary permission from the supplier before duplicating software, storage media, or documentation.
Boeing provides each airplane with media parts which are packaged in a binder or set of binders. The standard media type is a 3.5-in disk, but the generic term is media set. Each media set has its own part number, which is different from the software part number or part numbers of its components. In addition to the media sets delivered with the airplane, a supplier for a loadable system will provide up to 10 additional media sets (per part number) upon operator request.
If a service bulletin requires a software update or change, LRU suppliers will provide one media set per affected airplane and 10 additional sets upon operator request. The 10 extra copies are available per the product support agreement between the supplier and Boeing.
The binder containing the loadable software is considered part of the certified configuration of the airplane and so is intended to be stored on the airplane. However, Boeing has issued service letters (737-SL-00-014, 747-SL-00-014, 757-SL-00-010, 767-SL-00-011, 777-SL-00-003) stating no technical objection if an operator wants to remove the disk binders from the airplane. The binders, binder pages, and media sets have unique part numbers and can be ordered using the same process as for any other spare.
Preload Loadable Software Parts Into Loadable LRUs off the Airplane
Whenever a loadable LRU is replaced, the loadable software configuration certified for the airplane on which it is installed must be loaded into the replacement LRU. The operator may request that the supplier load specific software parts when an LRU is ordered or repaired. To save time, the appropriate software can also be loaded in the operator’s maintenance shop using shop-loading equipment.
If an LRU is loaded with software in the operator’s maintenance shop and returned to stores, it may be desirable to document the software configuration with a tie-on tag to assist with inventory control. However, the tie-on tag must be removed after the LRU is installed, and the software configuration must be electronically verified as specified in the Aircraft Maintenance Manual removal and installation procedure for each software-loadable LRU.
Verify Conformity of Loadable Software Part Configurations to Airplane Certification Documentation
The operator must implement procedures to control updates and modifications to loadable systems that occur after the airplane is delivered. The part numbers of the software loaded into a loadable system are part of the type certificate of the airplane. The operator must ensure that the configuration control documentation for each airplane reflects the current configuration of loadable software parts, and that the loadable software parts are certified for the airplane on which they are installed.
Loadable software requires the same configuration control as airplane hardware components. The software part numbers that are part of the delivered configuration of an airplane are documented in the engineering drawings provided with the airplane at delivery. In addition, a report listing the software part numbers delivered with a particular airplane is provided as an attachment to the airplane readiness log. However, this report, as well as the IPC, will not reflect any rapid revisions (RR) incorporated on a particular airplane that affected loadable software parts. The operator should review all RRs incorporated on a particular airplane for an accurate understanding of the certified configuration.
The software loaded on a loadable LRU is reported electronically, so a marking on the LRU is not necessary. To verify that the appropriate software parts are installed, it must be possible to confirm that the appropriate software is loaded while the component is installed in the airplane. Relying on placards or other markings to determine the part number of the software loaded in a component is not recommended.
To confirm that the proper part number is loaded in a component, the operator should verify component status electronically by reading the part number from a front panel display, MAT, control display unit, or other device designed for that purpose.
The operator’s configuration control processes should ensure that the configuration of software part numbers installed on each airplane is documented. This documentation should be updated when service bulletins or other changes are incorporated and should be available when needed. Personnel should be trained and aware of the airline’s configuration control processes and the importance of maintaining the certified configuration of loadable software parts.
Loadable software can be a useful tool for Boeing operators by providing them with the ability to quickly change or update functionality on their commercial airplanes. If operators take the necessary steps to prepare for the maintenance of loadable software systems, they can keep fewer hardware LRUs in stock, increase hardware commonality, and reduce airplane modification time. The maintenance activity to use loadable software includes procuring the necessary loadable software parts and loadable LRUs, managing software libraries, preloading loadable software parts into loadable LRUs off the airplane, and verifying that loadable software part configurations conform to airplane certification documentation.