« Previous Next »

Interlock Failure Monitor

Technical Information

Catalogue No: C1071
Category: Unknown
Object Type: Signal/Data Processor
Object Name: Interlock Failure Monitor
Part No: 8383-A-1
Serial No: 048/70
Manufacturer: Elliott Automation
Division: Unknown
Platform(s): BAC 1-11  Concorde  VC10 
Year of Manufacture: circa 1970
Width (mm):
Height (mm):
Depth (mm):
Weight (g):
Location: Archive Object Store

Interlock Failure Monitor
Type No. 8383-A-1
Ref No.
Ser No. 048/70
BAC 1-11 Aircraft Only
Beware Static Damage
MA Service & Repair Division
Date 26-5-88
GAv(R) A.S.&R.D. 86


The Interlock Failure Monitor does not appear on the system description of the BAC 1-11 2000 AFCS although the box is ‘BAC 1-11 AIRCRAFT ONLY’. The unit is described in the literature for the VC10 AFCS so was used in both systems.
In 1964 Elliott Bros designed an ‘Interlock Monitor’ system to locate which element of the automatic landing system had failed in the event of an interlock opening and causing autopilot disconnect. In those days, autopilot engagement was permitted when a discrete number of series relay contacts had been closed by the discrete monitor circuits the nature of the design was that, if one relay opened, there would be subsequent operation of the other relays due to the fail-safe method of combining the fault detecting relay contacts.
The equipment added to the automatic landing system was basically an on-aircraft fault diagnosis. It comprised a small digital computer and a simple multi-lamp display panel and reset switch. The Interlock Monitor Computer scanned the series of relay interlocks and detected which one opened first. This therefore located the failure to the particular comparator, identified by a corresponding lamp number on the display panel.
The equipment was first used in 1965 and became standard equipment for BOAC. Considerable problems were encountered due to the large number of interlocks which were in use over long periods in flight. The Monitor was eventually able to discriminate faults to an acceptable level of non-ambiguity only after considerable refinement of the in-line monitoring design.
There are two patch-boards under hinged covers either side of the unit’s handle. The left-hand panel has sockets 1-18 and the right-hand panel 19-36. Both sides have a shorting-pins stowed inside the cover. Presumably these pins short two layers of contacts beneath each of the numbered holes; possibly the hidden layer is common to them all, allowing point A to be connected to point B just by putting pins in A & B holes. At present we have not discovered how these pins were used.
This system was applied to the VC10, the super BAC 1-11 and Concorde.

From the early days of the company it had been hoped to enter the civil aircraft flight control field, in order to reduce dependence on military projects. The late 1950s was a time of significant change in the automatic flight control field. Elliott made a major contribution to this evolution by the design and development of actuation systems which integrated the electronic control input with the hydraulics of the main flying control power actuator.

The opportunity to take this step came in the late 1950’s with the planning of the Vickers 'VC 10' for which Elliott Brothers secured an order to provide a complete automatic flight control system. This led to considerable shared responsibility with the airframe designs of the Vickers VC 10, where the main control surfaces were split into several separate units. From the outset, the 'VC 10' system was planned to make provision for fully automatic landing of the aircraft. For certification ever to be possible an extremely high standard of reliability was essential, and even in the case of failure of the equipment it was a requirement that the aircraft must not be subjected to violent manoeuvres. After a detailed study of possible alternatives, the solution chosen was to duplicate the whole of the major system, one half to be operative while the other was to be 'standing by', with a changeover mechanism of the utmost reliability to permit instant switching from one to another. By 1960 the basic development was substantially complete and the requirements for automatic landing were being explored in detail with full 'autoland' capability available from January 1963. Successful development of the 'VC 10' system resulted in the opportunity to supply broadly similar equipment for the British Aircraft Corporation 'BAC 111', which has been produced in substantial numbers. The automatic flight control system of the Standard and Super VC10 was designed to be capable of development to full blind landing. To meet this requirement the system had to be capable of failure survival and this includes associated services such as power supplies and flying controls. The method of autopilot failure survival chosen was to provide two monitored systems which are fail soft, i.e. there is negligible aircraft disturbance after a failure. Only one autopilot is used to fly the aircraft, and the two systems, including power supplies, are completely independent. Each autopilot has a comparison monitor which detects faults and, in flight, will disconnect the system if these faults are likely to lead to dangerous conditions. For autoflare the system provides for automatic changeover to the second monitored autopilot system, in the event of fault in the first. Under these conditions the second autopilot is primed and ready to take over. If for any reason the monitoring system fails to prevent an autopilot runaway, the control movement is limited to a safe amount by the yielding of a torque-limiting spring. Many of the needed components were already present in the autopilot fit on the Standard VC10s, to achieve the autoland capacity the system on the Super received some additional items. The system, supplied by Elliott Brothers (London) Ltd, was based largely on components of the well-proved Bendix PB-20 autopilot, made under licence by Elliott, and interchangeable with American built components as installed in Boeing 707s. However, the system as a whole i.e., the dual autopilot concept was novel, and designed entirely by Elliott.           

A comprehensive description of the VC10 systems will be found at this VC10 website.

The BAC 1-11 AFCS, like that in the VC10, was based on the well proven Bendix PB-20 Autopilot and was designated the Series 2000AFCS. New features over the PB-20 system include separate pitch and azimuth control computers, a modular Air Data Sensor and a range of units specifically designed for autoflare and autolanding.

Each unit in the BAC 1-11 AFCS is built to a common configuration with circuit modules arranged in stacks either side of the chassis. The stacks are connected by plugs to a mother board and are physically separated into ‘command’ and ‘monitor’ functions to preclude common failures. The computers are entirely solid state and there is a high degree of built-in-test. Self-monitoring techniques and multiple channel redundancy are used to give automatic failure survival in approach and cruise flight.

Click to enlarge Click to enlarge