Reverse-engineering misc. avionics (ongoing)

[D Straney]

(First two parts are here and here)

Index:

• Diehl Fire Extinguisher Controller
• EAS Windshield Temperature Regulator
• Honeywell/Sperry DS-125A TAS/Temperature Indicator
• Voice Warning Generator from F-4 fighter jet
• BAE Systems MD-1219/A Audio Signal Discriminator
• Smiths Remote Interface Unit
• Raytheon boards from submarine communications terminal

Here's some random commercial-aircraft electronics boxes that showed up for cheap as extremely-used or "for parts" on eBay and seemed worth a teardown, but didn't have enough reverse-engineering value or interesting signal-processing stuff inside for an entire post on their own...

Raytheon audio distribution bus boxes: full photos for Analog Interface Unit and Cabin Distribution Bus Repeater
These seem to be part of some kind of aircraft-wide audio distribution system, which is digital (!): the repeater has an FPGA and some LVDS transceivers (DS26C31, DS26C32) inside...

...while the "audio interface unit" has the same:



I'm guessing that the Analog Interface Unit takes voice or other audio signals and adds them to the bus, along with some kind of muxing/control.  Besides a buck converter in the lower-left for its built-in power supply (MAX758), the same signal passes through 2 separate DC-blocking caps to 2 separate ICs, the MT8870DS and MC14L5480.

The MT8870DS is a DTMF decoder, which suggests that there's some kind of telephone-dialing-style control which goes on through the audio input.  I'm guessing this has something to do with routing, where the cockpit of an airliner could do general broadcast audio vs. calling only staff at a specific location, for example.  I don't know enough about the context to make a better guess at this.
The MC14L5480 is an audio-specific ADC/DAC, which seems to be made specifically for voice as it has BPFs built in as well as companding, for telephone-style applications where bit-rate is at a premium.

The rest of the circuitry in the analog interface unit is centered around a bunch of op-amps and analog switches.  There's also a trimmer accessible through the top cover, which has a testpoint on the outside, and which seems to set a voltage directly on one of the connector pins.  I'm not sure exactly what's happening there, and the 4-layer layout makes it much harder to figure out the connections here (which is why this post doesn't have a full schematic yet), but would like to see what's going on with that trim - will have to take a couple sewing needles and poke around for continuity tests at some point when I have the time and patience.

I was pretty surprised that all the communications here was digital, even for the late-90's date codes on both these boards: seems like analog audio distribution would've been comparatively simple enough to have persisted up until the last 10 years or so.  Maybe there's enough sources of interference though with all the various electronic systems on a typical aircraft that it made sense far earlier to distribute voice in a more noise-tolerant way; at least the telecom industry has experience with doing that at an absolute minimum bit-rate.

[D Straney]

Diehl Fire Extinguisher Control Unit: full photos here

I was a bit disappointed by this one - had expected that something with such a critical-sounding function would have lots of redundancy and special reliability features: but no, it's pretty much just a processor with external inputs that controls some relays and external loads (probably solenoid valves).



The CPU board has a 68000-series processor, along with some TDE1373 and TDE1767 "lamp & relay drivers" - these have the normal set of protection features against over-temperature, short-circuit, etc. along with fault outputs so the CPU can watch for problems.  There's also a TS27M2 dual op-amp, which probably has something to do with temperature sensor inputs.

Haven't gotten around to tracing out the contents of these boards yet, but compared to the last ones they'll be much easier due to being only 2 layers and having no internal planes to get in the way:


The "power board" has a LOT of diodes: most of these, from my limited circuit-tracing so far, seem to be there to clamp the I/O pins to Vcc and ground.

There's also a few relays, two of which have their own drivers right next to them, which I'm guessing are for driving external valves to release water or foam.
Power comes in through the brown inductor, one of the spherical diodes, and into the big-ass capacitor (voltage hold-up during transients, especially those created by the load switching, is pretty important here I guess): the control supply then comes from the pre-regulator transistor (left side of the heatsink) which feeds only the 7805 +5V regulator (right side of the heatsink).

Figuring out if there's anything interesting going on with the op-amps on the CPU board is on my to-do list...

[D Straney]

Electronique Aerospatiale/St. Chamond-Granat Windshield Temperature Regulator: full photos here

Here's a nice easily-traceable all-analog old one from the 70's:






The limiting factor here is not lack of circuitry or multi-layer boards, but just my own lack of time.

I'm curious to find out why what I'd expect to be a simple temperature controller needs 9 separate trims, or so many parts.  It does seem to have a good deal of self-test functionality built in...

...but it still seems like a lot.

Looking at the backs of the boards, you can see the big transistor with a heatsink that most likely drives a heater, as well as discolored PCB material/conformal coating around it to show the record of high temperature over time:

Interestingly, both boards seem to be 3 layers, not using the bottom layer for anything outside of pads for the through-holes.  Maybe this is some measure to keep solder from wicking away from the joints before soldermask was common, or before soldermask was trusted in higher-reliability applications.

Looking forward to getting a free weekend to report back with a schematic on this one, and see exactly what it's using this seemingly-excessive number of metal cans for.

Edit: better photos

[amyk]

The CPU board has a 68000-series processor

Small correction: That's a 68HC05, which is very different from 68k family. It's closer to the 8-bit 6800.

[moffy]

Very strange to see the PLCC 68HC805 socketed, that was generally a taboo for anything avionics. The protective coating seems to be mostly missing from the chip also, might have been a later repair.

[T3sl4co1l]

Diehl Fire Extinguisher Control Unit: full photos
The "power board" has a LOT of diodes: most of these, from my limited circuit-tracing so far, seem to be there to clamp the I/O pins to Vcc and ground.

https://flic.kr/p/2oUFRMe

There's also a few relays, two of which have their own drivers right next to them, which I'm guessing are for driving external valves to release water or foam.
Power comes in through the brown inductor, one of the spherical diodes, and into the big-ass capacitor (voltage hold-up during transients, especially those created by the load switching, is pretty important here I guess): the control supply then comes from the pre-regulator transistor (left side of the heatsink) which feeds only the 7805 +5V regulator (right side of the heatsink).

Big cap could also be for capacitive discharge into a solenoid or explosive-release type actuator.  Have worked with a system of such design for heavy automotive (mining equipment among others) application.

I don't know about these systems from the design-specification or safety or regs angle, just circuits and hardware specs.  These weren't redundant either.  (Though a redundancy of sensors might've been used; partly to get better confidence, as some kinds of sensors can have intermittent outputs by nature, flame sensors for example.)

Tim

[D Straney]

Big cap could also be for capacitive discharge into a solenoid or explosive-release type actuator.  Have worked with a system of such design for heavy automotive (mining equipment among others) application.

Now that's an interesting thought!  I took a closer look at the power routing, and was surprised to see (after triple-checking) that the only thing connected to that big cap was the pre-regulator and the 5V regulator.  All the relays too have 5V coils.  I guess it really is probably just for holding up the control supply - easier to let the voltage before the regulator sag (where the changes won't be passed on to the regulated output), than to try and buffer the 5V rail enough that it doesn't sag (where the tolerance is much tighter).

The analog section on the CPU board, with the metal cans and the dual op-amp, turns out to be a 100 mA current source fed to one of two outputs, and a dual differential voltage measurement which each share one terminal with the current source outputs.  It looks like it does some sort of resistance measurement (temperature sensor?), with the ability to drive either of 2 identical sensors, maybe for redundancy or maybe just for sensing multiple zones.

...although I'd expect there to be more than 2 temperature sensors total in a plane: guessing there's either:
1. a lot of temperature-sensitive fusible links all wired in series in one giant loop, so that when one melts the circuit opens, or
2. there's a separate "combiner box" that does multi-zone temperature sensor then opens a relay to signal over-temp.

[T3sl4co1l]

Ah, that'd do then.

Yeah not sure what's going on there, seems like a current/voltage mode mux of some sort? Depends on wiring...

Tim

[SeanB]

Aircraft fire sensors are mechanical, using a bimetallic switch that is normally closed, and goes open when it gets hot enough. A few in series in the engine cowling, and then wired to the fire circuit, where you have the 100mA current to provide contact cleaning during test, where you place a heat source around it, and wait for it to open, or simply use a plastic probe to open it and have confirmation from cockpit the indicator and master caution actuates for each one. Then a cockpit display that shows fire, with the micro simply acting as a really simple debounce, as those switches do suffer from noise and can vibrate open circuit with some engine conditions, so the micro logs noisy switches for maintenance in a log, and will wait for around 5 seconds of open before setting the fire alarm, with some having a resistor across the sensors to allow detecting a switch activation (line resistance still correct for x number open) or an open loop. Yours seems to have sensor resistors, so will wait for 2 or more to be open, before definitely saying there is a fire, as a single one going open is not uncommon. That will simply set a fire system caution lamp on the master caution panel, saying there is a possible degradation, but 2 will set the big red warning light, and also the audio warning on the pilot headset feed, and also the cockpit chime.

Then you debate, look to see if there is actually a fire, or see from the instruments about oil pressure loss, and fuel flow exceeding the current throttle setting, or EGT starting to vary from the optimum level.  If all that, then pretty sure you have a fire, and then you shut down the engine, and break the locking wire on the fire handle, and, depending on the design, pull and turn one way, to discharge the one bottle of Halon, or break the mica window above the press button that triggers the Halon bottle. Normally you are right about then looking for the closest place to land, because there are way too many things that can fail to make a fire, and some are not going to comply to the halon and shutting down of the engine.

Yes I did change quite a few of those sensors, they get grumpy with time, and are classed as repairable items, so both have a serial number, and you have to return to stores as well. 3 screws, and 2 terminals that you undo the bolts, remove terminator resistor if there, and transfer to the new to you one. Then go fill in the paperwork, and get it signed off by another. Some really sucked to get to, right there where, with a little work, you can feel it, but not see it or easily get to it. Those were always replaced when engine was in the service bay, when they were easy to see and replace. Funny how easy it is, when it is not wrapped around with an entire airframe.

Edit: Also in the avionics bay, and nicely under the pilot in the battery and LOX compartment. SOP there was if that battery fire light came on you reached down, pulled legs in and pulled the yellow and black handle, and relied on Martin Baker. Except the one pilot, who had that, and shut down the engines, jumped out, opened that door, and pulled the battery out and tossed it. Note it is held down in the cage with a M5 bolt, he snapped it pulling that out, did not spend the 20 seconds unscrewing the knurled lock nut. Then complained of the torn muscles.

[harerod]

Nice story. Brings back memories of deciding on how to handle issues in flight.
What aircraft was that pilot with the big balls flying, if I may ask?

[TurboTom]

There's also another type of fire detector being used in aviation that works the other way round, mostly installed in engine nacelles and APU compartments, known as "FireWire" (has nothing to do with IEEE1394...). It can be considered a "rigid coax cable" with the dielectric replaced by a special salt formulation that shorts out the inner conductor to the tube by ion conduction once a certain temperature is exceeded. Connections at both ends of the "coax cable" permit continuity checking to verify the condition of this system. The advantage of this system that a larger area can be monitored for excessive temperatures while it's not necessary to have too many individual sensors or thermo-switches. This system is also self-resetting once the overtemperature situation is sorted.

I can contribute with some photos of an aviation smoke detector (ionizition type) that's been certified for use in civil transport aircraft to monitor the cabin and the freight compartments. The sensor contains a tiny amount of 241Americium to ionize the air flowing throught it. Smoke particles will eliminate the ions so the tiny current that flows through the air will drop if there's smoke present. The photos also show an alpha-sensitive DIY Geiger counter (less enclosure...been too lazy to make one yet) to indicate that a considerable radiation can only be detected if the ion chamber is open. With a closed ion chamber, only a slightly elevated background can be measured (due to the 59keV gammas that get emitted by the Americium), nothing to worry about -- especially in an aircraft... 

The little electronics present in there is once again conformally coated and looks at least a decade more "vintage" than the production date may suggest. But this is just the result of having gone through very expensive certification and being obliged to produce the item in the same configuration that it was certified in. Every modification would require a (partial) re-certification. The highly sensitive charge amplifier has to be located inside the resin-filled white plastic base of the ion chamber since on the PCB, there's no electrometer-like circuitry to be found.

[D Straney]

Great info about the fire detection, esp. with the continuous-sensing-coax.

Here's another one:
Honeywell/Sperry DS-125A TAS/Temperature Indicator
To be honest, I was hoping this one would be an older more complicated model like this one from the late 60's/early 70's(?), but the lack of a big stack of PCBs with special-purpose hybrids is a nice illustration of the commodification of electronics over the couple decades between that model and my model.




Once you remove a couple screws at the end, the case slides off and you can see the main board:



The circuitry is pretty straightforward.  A PCB-mounted transformer on the bottom, diodes on the top, and bulk capacitors on the bottom form the DC power supply from the 26 VAC input.  The large metal can is an LM126 dual tracking regulator, which likely generates bipolar power supplies for all the analog stuff.  An LM224 quad op-amp and a bunch of resistors probably take the analog sensor inputs and offset/scale them, before they go into the dual MC14433L ICs.  These are self-contained 3.5-digit BCD-output ADCs, the type you'd use to directly drive a display on a panel meter or something similar.




The BCD outputs of the MC14433Ls then go into a series of 4511 BCD-to-7-segment decoders...

...and from there, into the mess of wiring that connects the display board to the main board:


(I feel sorry for the tech who had to do these all day)
Haven't looked at the display board yet, but it's likely just plain 7-segment LEDs, since the 4511 can drive a good deal of current (25 mA or so) from its outputs, enough to get even the old inefficient LEDs pretty bright.

Might try and power up this indicator once I can cobble together some kind of janky 400 Hz AC source.  There's also a couple logic chips (4069 hex inverter, 4011 quad NAND gate) where I'm not quite sure yet what they're for: providing the "display update" clock, maybe missing signal detection along with a couple op-amps used as comparators?

[moffy]

Interesting construction, I assume the round largish black component is a 400Hz,3phase toroidal transformer ? Odd that they only applied a solder mask to one side of the board, and they used a 15 pin D type connector rather than a circular mil style, I guess cost and form factor. We used some D type connectors but only because the pins were fully sealed, embedded into a glass insulator.

[SeanB]

Nice story. Brings back memories of deciding on how to handle issues in flight.
What aircraft was that pilot with the big balls flying, if I may ask?

Aeromacchi Impala, which was a combination of wood and aluminium, so was interesting to maintain.

As to the use of the 15 pin DIN connector over the circular military one, simple, it was done to keep the enclosure height small, as the 19 pin round circular bayonet will not fit in the height, and the 9 pin has too few pins, so the 15 pin, 25 pin and 37 pin ones were very common there, as they are rugged, reliable, and actually were designed for this purpose. Very common to see in use, especially in board to board interconnects, and to mount plug in modules as well, as you get a lot of locking hardware for them, plus there are also a lot of variants, especially the 37 pin, which has backshells that have 6 circular fittings, so you can have a mix of coax 50R, 75R and 93R coax plug and sockets (and they can fit either plug or socket, and are also available in PCB mount and crimp style as well), or have power connectors that are rated to 400VAC and 10A, plus a few 2kV rated high voltage inserts as well. the computer industry used them, as they were both common, rugged and near idiot proof, and you got a good selection of them off the shelf easily, though most of the less common are now only on special order, as they sort of devolved to a 9pin, 15 pin (plus the 15 pin 3 row in the 9 pin shell), 25 pin and 37 pin as sort of the most common ones now, though there are others in the DIN range. Low profile, and with the right hardware not likely to vibrate loose, and you can easily have 5 in a row, all with different locking methods, and not worry about them being incorrectly connected.

[harerod]

Quote from: harerod on 2023-08-12, 20:35:26

Nice story. Brings back memories of deciding on how to handle issues in flight.
What aircraft was that pilot with the big balls flying, if I may ask?

Aeromacchi Impala, which was a combination of wood and aluminium, so was interesting to maintain.

...

Oh, what a beauty.
https://en.wikipedia.org/wiki/Aermacchi_MB-326

[D Straney]

Yeah I really came to appreciate D-sub connectors only when I was working with MRI systems, where minimum-size-possible wasn't a requirement. That combo of rugged (both for locking, and hard to insert in a way that bends pins) and cheap/easily available in many different varieties is hard to beat. Especially fond of using the panel mount ones that have IDC connections, so you can run a ribbon cable straight to a header on a board and not worry about physical alignment/stress on the solder joints, or have to hand cut/strip/solder a ton of wires individually.

[D Straney]

Voice Warning Generator from F-4 fighter jet
Given that this was made in 1982, I was curious before opening this up exactly what was going to be inside.  Was memory density high enough at the time that it would be feasible to store sampled audio? (assume roughly 6 ksps for voice * 3-second clip = 18K x 8 storage needed for one clip) Would there be special analog or digital techniques to reduce bit depth or sampling rate needed, similar to what the telephone system does with companding, sampling slower in some frequency ranges and faster in others, etc.?  Or is storage space not that much of an issue? (don't even know how many different warnings it has to generate)  Either way, any readout of digital data will probably be handled with discrete counters, digital comparators, etc. rather than a processor (size/power/complexity overkill for the time).  Would there be a miniaturized very-special-purpose extra-robust tape recorder in there instead?


Ok, no tape recorder, just electronics.


Woah, nice.  Take a look:

The two purple ceramic DIPs are from the Mostek MKB36000 series of mil-spec 8K x 8 PROMs (the last 4 digits in the individual part numbers likely reflect the custom programming).  These should hold the voice data in some form.  The white ceramic DIP should be a DAC to produce the audio output: I wasn't able to find any details on this "AD11/208" part specifically, but found many references to other Analog Devices "AD11/..." parts, all DACs.  The two McDonnell Douglas hybrids (esp. the large one) likely contain all the logic for sequencing and reading out the memory data to the DAC on command, handling sampling rate and control signals and other things.  The 16 kHz oscillator can nearby is probably what clocks the internal logic here and sets the sampling rate.  For all I know, there may be some kind of digital-companding going on inside the large hybrid, as the bit depth of the stored audio samples and the DAC resolution don't necessarily have to match.

I'm hoping to open one or both of these hybrids at some point in the future if I come across a cheap jeweler's saw; would be nice to take off the lids carefully and with minimal effect on the hybrids and the rest of the board (all the shiny gold and ceramic does look pretty great, can't compromise that too much) to see what exactly is inside.  The lids may be soldered and removable with hot air, but with all the conformal coating and labels, I really don't want to go the "heating" route and gas my own apartment with the fumes from that.

[SeanB]

Quote from: harerod on 2023-08-12, 20:35:26

Nice story. Brings back memories of deciding on how to handle issues in flight.
What aircraft was that pilot with the big balls flying, if I may ask?

Aeromacchi Impala, which was a combination of wood and aluminium, so was interesting to maintain.

...

Yes, too bad so many of them ended up as gate gargoyles, or were chopped up as scrap metal.

Oh, what a beauty.
https://en.wikipedia.org/wiki/Aermacchi_MB-326

[D Straney]

BAE Systems MD-1219/A Audio Signal Discriminator


This is a strange one.  The nameplate calls it a "Signal Discriminator", while looking up the part number at aerospace-stocking websites describes it as an "Audio Discriminator" and shows an NSN of 5821-01-248-4308, from 1987, with no specific end use outside of "avionics".  Ok, that's not very helpful, let's see what inside.

If you unscrew the back plate, you can see a piece of rubber that cushions the boards from the rear.  Unscrewing the front plate shows that the external D-sub connectors aren't directly soldered to the boards, but are intermediate adapters that plug into the boards' D-sub connectors.


There's two boards, labeled as "A1" and "A2", with no connections between them:



There's no active devices in the entire box: A1 has 5 channels of an all-passive circuit with transformers, caps, and diodes, and A2 has only relays and 8x-diode arrays in DIP packages:


A1 has 5 channels of a circuit which seems to mute signals under very roughly 100 mV amplitude, by stepping up the signal with an audio transformer, passing it through a diode, and then stepping it back down to its original level: I guess this could fit the definition of a discriminator if being generous?  Is this meant to mute the background noise from audio signals (from a radio for example) esp. if multiple audio sources are going to be mixed together?


A2 is harder to figure out.  It has a 5 x 4 matrix of relays, with 5x channels (columns) where a common signal is optionally connected to any of 4 other individual places.  Because the traces run underneath the relays on the top side of the board I can't be 100% sure (ended up returning this box due to a lack of electronics inside, so can't do a continuity check), but it looks like this is a normally-closed connection.

The diode arrays then select sets of relay coils to activate, from some kind of open-collector drive, by switching the negative side of the coils.  (I didn't show it here due to laziness, but each relay has an internal catch diode on the coil which confirms the polarity)

Each of these activation inputs spans across all 5 channels, disconnecting an input on every channel but one.  There are also the vertically-arranged diode sets in the schematic, which seem to be some kind of diode-OR monitor outputs that go low if at least one of a specific relay-combo is activated.
This is obviously some small part of a much larger system, rather than a self-contained piece that can be understood on its own like a radar altimeter or a navigation computer.  Not knowing how this is supposed to be connected to everything else makes this much, much harder - I keep going through cycles of thinking that I might understand what the diode-and-relay combinations are doing, and then realize that I don't after all.  Any insights here appreciated.

[peter-h]

Here are a load of pics of avionics internals, from General Aviation
https://www.euroga.org/forums/maintenance-avionics/6537-random-avionics-internals

You get a lot of funny stuff in that business, due to

- long time spans in production (literally 30-40 years in some cases, with some Z80 based stuff still made today)
- most designers being inexperienced and choosing huge quantities of discrete parts, plus crazy numbers of different E96 resistor values where 10k would do
- national/cultural effects e.g. French designers not speaking English and using common US parts relabelled and with French data sheets

[D Straney]

Nice!  That looks familiar, think I've looked through that before - it's definitely striking, the difference between general aviation stuff (where half could very well have been put together by one person in a garage) and commercial aviation stuff.

Smiths Remote Interface Unit
Here's a more modern one, from 2004, made by Smiths Aerospace.

My impression was that a "remote interface unit" was kind of like an I/O expander for an aircraft, and that seems to be born out by the internals.  Let's take a look:


There's a smaller control daughterboard, stuck on top of the main board.  Here's what the main board looks like, with the control board removed:



Off in one corner is the local power supply, with a UC2843 PWM controller, and a couple transformers and/or coupled inductors, which probably provide the low-voltage power for the onboard digital logic and analog:

The large black box towards the upper left is a capacitor (probably for buffering the input power rail).  The transistor (SOT-223 package) at the very bottom edge, below one of the magnetics, is probably the switching transistor.  The many diodes above the magnetics are probably the rectifiers for multiple low-voltage outputs.

Near one connector is what looks like a lot of switched-power outputs, with power transistors and 0.27Ω resistors for current sensing.  Not sure what the chips with the white labels on them are...maybe isolators of some kind? (if the "power-output ground" is different from the "control ground")  Or over-current protection / current-sense amps / gate drivers (if fast switching is needed for PWMing any of the power outputs) / all of the above?

If you look back at the power supply photo above, there's an analog mux ("HI9P548-9") between these power outputs and the power supply, which is probably used for selecting between the different output-current-sense signals, to measure one at a time.
There's possibly one more output channel just around the corner, plus some filtering (series inductor, white box) and protection (TVS diode(s) for over-voltage) for the power input:

...and possibly a couple more output channels in between the two connectors, although the current sense resistor looks different and one channel doesn't have a current sense resistor visible at all:


The other connector looks like it's all inputs.  There's a lot of series 56KΩ resistors, leading into dual diodes in SOT-23 packages, to clamp the input signal between the rails - see here for how this is probably arranged (I'm not 100% sure about these being dual diodes, but would bet a lot of money that's the case).  Between the large series resistance for current-limiting, and the clamping diodes, this serves to protect any input circuitry from the "wild west" situation that's happening on the aircraft wiring: lightning strikes, accidental shorts to high-voltage power, long wiring picking up high-power radar transmissions, etc.

The rows of many ceramic caps at the bottom of this photo are probably providing some basic filtering on these inputs.  The inputs seem to feed into a large group of analog muxes nearby (DG4xx series), which probably are cascaded in a tree-like configuration to select only one of these inputs at a time.

From counting the SOT-23 packages, I think there's roughly 43 external inputs, which requires a whole lot of muxing over a few hierarchical layers.  The 3x AD620 instrumentation amplifiers near the middle of the board (visible in some earlier photos) are probably providing some differential inputs, as a complement to all the single-ended analog inputs here.

There's also a bit of mystery analog circuitry around the side: maybe an output?  There's a DG413 (4x SPST analog switch), LM2903 (dual comparator), and 2x ST TS512AI dual precision op-amps.  There's also some colorful resistors which look similar to precision types from Vishay and KOA Speer I've used before.

This section might be scaling down a few higher voltages, buffering them, muxing between them with the analog switches, and then doing some kind of window-comparator function to check that they're within normal range (monitoring power supplies, for example).  Or who knows really, there's a thick layer of conformal coating over everything and most of the traces are on inner layers.

Ok, now that we've seen the switched (open-drain?) power outputs and muxed analog inputs on the main board, let's take a look at the control board.  What stands out most here is the pair of microcontrollers:

The large one is an ST10F269Z2Q3, a reasonably-powerful 16-bit part with some multiply-accumulate accelerators for signal processing(!!!) and a whole bunch of peripherals (PWM, ADC, timers, serial interfaces, an RTC, etc.).  The small one is a much smaller 8-bit PIC16F627.  I have no idea what the division of labor is between these two.

To one side are some local linear regulators, and two HI-8583s, which are dual ARINC 429 transceivers.  ARINC 429 is a commonly-used 2-wire serial bus on commercial aircraft, with similar use cases to MIL-STD-1553.  These transceivers include not just the level-shifting circuitry, but the serial encoding/decoding and FIFOs for storing received messages (or holding onto messages to transmit): they're meant to interface through a 16-bit processor bus, which is where the "external bus interface" of the ST10F269 probably comes in handy.


Covering the rest of the control board is an analog section (with many probable-op-amps and precision resistors, for proper scaling and offsets) leading into an AD977A 16-bit 200 ksps ADC.  This is probably what's reading all those external inputs one at a time, through the tree of analog muxes.  Even though the ST10F269 has an onboard ADC, the integrated ones are (intentionally) never going to be as good as a dedicated-purpose separate ADC, whether because of on-chip noise, IC process optimized for high-density digital instead of for high-performance analog, limited die area, lack of trimming, not wanting to sink money into an expensive high-quality ADC that many customers may never use on the general-purpose MCU, etc. etc.  I'm guessing the high sampling rate (impressive to maintain 16 bit resolution at 200 ksps!) is useful here when scanning between so many different inputs, if it needs to sample each individual input frequently.



So overall, this really does seem like the aircraft version of an I/O expander.  It's got serial interfaces to talk to higher-level computers on the plane, which can then tell it to turn on or off some outputs, and read back input values; probably offload some I/O processing as well.  The main MCU being so over-qualified for doing only basic communications and I/O suggests that it's also using its math capabilities to do some filtering or feedback loops or something similar.  This particular unit, being sold as surplus, supposedly came from a British Lynx helicopter.  Anyways, hope you enjoyed the photos.

[T3sl4co1l]

I wonder if a lot of those inputs might be LVDTs and resolvers; they're common/traditional in aircraft, 16-bit would be needed for positional accuracy, and spread across so many inputs, 200kSps is probably fine for sampling 400Hz or so signals.  Some DSP functionality, or relatively powerful CPU, would be desirable to handle the "complex" (read: AC phase) calculations.

I'm not offhand familiar with what input structures are used with this; it's plausible that a simple resistor divider, clamp diode and RC filter would do.  It could be various other level or signal inputs, of course.

Tim

[D Straney]

Good point, that would make a lot of sense.

Ok, here's one that's not strictly avionics, but let's make an exception and call it "high-reliability vehicle electronics":
Raytheon boards from submarine communications terminal
These are two boards which, based on the National Stock Number info, seemed to come from the AN/USC-38 satellite-comms terminal, used on submarines (the Trident in particular is called out in the description) and date back to roughly the late 80's.  There's more info on the overall system here: https://www.globalsecurity.org/space/library/report/1999/nssrm/initiatives/anusc38.htm
It used EHF-range (> 30 Ghz typically) frequencies, so I assume this could only be done when a sub had surfaced, as opposed to the amazingly low frequencies & massive antennas used in other cases to reach submarines underwater.  Data rate was still low, at 2.4 kbps max.

HV Monitoring board


Transmission of any real power at 30 Ghz+, especially at the time, would be very much non-solid-state: something along the lines of a Klystron or Traveling Wave Tube.  These use high voltages to accelerate a beam of electrons in a vacuum, and so this board (based on the label) seems to be about monitoring these high voltages for the control system.



Analog section
At the left, there's a bunch of quad op-amps.  These probably take the different voltages from the various HV monitoring points (pre-scaled down to something reasonable by external voltage dividers) and buffer/scale/offset them to feed to the ADCs on this board.

That 2nd connector isn't for external connections: the various I/O all happens through the backplane.  This is a debug/testing connector so that you can look at internal signals, and narrow down a fault to a particular card while still installed and working, without having to power down the whole system and use an extender card, as is common with test equipment from the same era.  You can see the same thing on some other avionics PCBs I've looked at:
(Right side, between the release levers)

(Gold fingers along the top edge, again between the release levers)

(Row of discrete testpoints)

This is the kind of equipment where you need to be able to swap in replacement boards, and can't just write off the entire extremely-expensive comms terminal with a "we'll fix it later" when you're in the field (at sea).

Anyways...the analog input channels go through the two MUX08 analog muxes, and into the two ADCs:

This is marked "AD9040A", but the AD9040A is actually a newer Analog Devices part with many more pins, and an unnecessarily-high sample rate (40 Msps) for this application.  This seems to be a case of accidental part number re-use, because looking up the military part number "5962-8680202VA" shows that the equivalent Analog Devices part is actually the 10-bit AD571, which has the correct number of pins and a more reasonable sampling rate (25 ksps) for this application.

The 54LS221 dual one-shot ("monostable") timers nearby are probably used to generate some of the "start conversion" pulse timing.

ADC input sources
The two MUX08 analog muxes, which select the ADC input channels, seem to have their control inputs ganged together.  These control inputs can be selected from one of two "channel selection modes" by the 54LS157 4x 2:1 digital muxes near the top-left corner.  One of these channel selection modes comes from the two 54LS148 8-input priority encoders closer to the middle of the board.  I'd originally assumed that these priority encoders were used to generate interrupts based on input-out-of-range signals from analog comparators, but the selection inputs actually go to the backplane connector: so I think these priority encoder chips might be used for some kind of "one-hot" channel selection scheme, for the software to pick which channel to read.

(Disclaimer: I wasn't able to figure out a full schematic for this board due to multiple layers, traces running underneath top-side ICs, heavy conformal coating, limited time, etc. so these are just my best guesses based on a limited amount of connection tracing)

ADC output data
The bottom ADC has its output data go directly to the data bus pins on the connector, which connect back to the CPU.  The top ADC, however, is a little different.  Its 10-bit output instead gets latched by the '377 8x D-FF and '74 2x D-FF chips nearby, and then fed into the address pins of the two PROMs at the top-right of the board (82S131 & 82S181).  The PROMs' output data then gets fed to the backplane connector, to be used somewhere else.

So what this looks like, is that the bottom ADC's data is getting used directly, but the top ADC's data is being fed through some kind of programmed lookup table.  These two PROMs take in the 10-bit ADC data and produce a 12-bit output, with the top 4 bits coming from the 82S131 (which has access to all the ADC data except the least-significant bit, hence the 512 instead of 1024 addresses) and the bottom 8 bits coming from the 82S181.

I doubt this lookup table is used for calibration alone: a simple pair of gain and offset trimmers would correct for everything except step-to-step non-linearities of the ADC (DNL), and a lookup table + precision calibration procedure seems like overkill vs. just getting a slightly more expensive ADC with a couple more bits.  Instead, it might be used to implement some kind of digital transfer function, either to avoid complicated math in software, or maybe to correct for a non-linear transfer function in the measurement circuits themselves used to meter the high voltages?

Registers
There's also 4x 54LS670 4x4 register file ICs near the bottom-middle; from tracing the connections, these use the 2x 54LS244 buffers to their left to either read or write from the common CPU data bus.  These are arranged as 8 registers of 8 bits each.  I wasn't able to follow the address inputs, so I don't know for sure, but it doesn't make sense to just randomly drop some extra registers onto this board unrelated to the rest of the circuitry: my best guess is that the addressing for these is the same 3 bits that set the ADC channel, and so that these work as per-channel configuration registers for some ADC settings (such as the bipolar-vs-unipolar input setting).

Bottom-right PROMs
The two PROMs in the bottom-right corner of the board (82S115 & 82S131) are more of a mystery.  At first I assumed these were implementing an ADC data lookup table like the ones in the top-right, but the connections didn't support this.  Instead, these share address bits and so create a 512 x 12 memory, where the data outputs are latched by nearby D-FFs and then go to the backplane connector to be used somewhere else.  The top bit of the address is latched from a backplane input in a nearby 5474, and so is probably set either by software or by a system on a different card.  The lower 8 bits of the addresses come from the adjacent 54LS293 dual 4-bit counter, which is wired to work as a single 8-bit counter.  Its clock comes from another mystery external signal on the backplane connector.

So overall, these create 2 separate 256 x 12 lookup tables.  External inputs select which of the two tables to use (through the MSB), and external inputs also control the counting through the 256 table entries.  This could be some kind of digital waveform generation, but I really have no idea.  It's presumably somehow related to the high-voltage monitoring functions of the rest of the card, but also doesn't seem to interconnect with the other circuitry in any way.

Mystery PROM
I was struck by the sheer number of PROMs on what should mostly be an analog/data-conversion board, and tried to figure out what the 82S123 32x8 PROM in the top-left corner of the board is doing.  In the end the traces were too hard to follow, though: some of its data outputs at least go to the backplane connector, some of its address inputs also go to the backplane connector (and elsewhere on the board I wasn't able to follow), and one if its address inputs comes from the '157 ganged mux that seems to control ADC channel-selection modes.

[D Straney]

Logic Interface board



This board is simpler, and seems to be an interface from external control signals (maybe status/fault signals from the RF & power sections, or maybe from other interconnected equipment) to the control system's CPU.



The most noticeable part is the repeated sections of quad optoisolators (equivalent to 6N140, among many others).  These are used to provide 24 separate isolated digital inputs: the block of resistors and capacitors at the right side of the board filters the inputs, and then the adjacent resistors, resistor arrays, and diodes are used to set the optoisolators' LED current and protect the LEDs against reverse voltages.  The '244 buffers to the left of the optoisolators seem to buffer the optoisolator outputs and/or mux them on the CPU data bus, with their 3-state outputs.



There's also a row of relays along the top edge of the board, presumably used as isolated digital outputs to control the power or RF sections.  If you look closely at the markings on top, you can see that they conveniently have an integrated coil-driver transistor:


A 26LS33 and 26LS31 near the bottom of the board provide 4 differential inputs, and 4 differential outputs.  It's possible these are used for synchronous serial interfaces, and use the counter and 2x 8-bit shift registers nearby....or maybe those are unrelated.

There's a whole lot more misc. mystery logic, including 20x R-S latches, which suggests that there's external "set" and "reset" pulses coming in for this card to keep track of the state, or the software generates "set" and "reset" pulses to control a digital output (which seems less likely; there's instructions for that).  I don't know what all of this does, as most of this is going to be extremely dependent on whatever mystery devices connect to the I/O, and this board is even denser and harder to follow than the "HV monitoring" board.


Other boards
I got these from BMI Surplus, and if you search "Raytheon" you can see some other boards that are almost definitely from the same submarine-satcom system, with adjacent part numbers, matching dates, and/or the same end-use info in the official records:

• "PROCESSOR": CPU board, has a bipolar version of the TMS9900 processor just like this tank fire control computer.
• "DRIVER", looks like it drives some kind of external load (antenna tuner/positioner? modulation transformer?)
• "HV MONITOR", unsure how that's different from this "HV MTRG" card above
• "LOGIC CONTROL"
• (no info)

I didn't buy any of these others, because they're a lot more expensive (especially than I'm willing to pay just for "completion-ism") and don't seem to show any more interesting inside info about the system, except the CPU board (which again, expensive).  Hope you enjoyed this look inside an unusual computer application though.

[D Straney]

This is marked "AD9040A", but the AD9040A is actually a newer Analog Devices part with many more pins, and an unnecessarily-high sample rate (40 Msps) for this application.  This seems to be a case of accidental part number re-use...

Realized I'm dumb, they didn't accidentally re-use a custom part number later on: the "AD9040A" here is the combo of "AD" for Analog Devices, "9040" as a date code (40th week of 1990), and "A" is...who knows what, maybe a manufacturing location or something like that.  Just bad luck that this secondary marking also happens to make a valid part number too.