The electrical power generation system for the 747-400 was a new design from previous 747 variants. Whereas the previous 747 Models were all designed to include a Flight Engineers station on the flight deck, the 747-400 was a two-crew flight deck. As such, the electrical power system control panel was designed into the pilots overhead panel instead of on the Flight Engineers side panel. By this time, Boeing had considerable experience in the designing an electrical power system for a two-crew flight deck. Previous two-crew designs were the 737, 757 and 767. The 747-400 had a number of features differing from the previous 747 variants, designed to simplify system operation and improve electrical power quality, reliability, and maintainability. These new features included:

With the engines running, electrical power is supplied by four Integrated Drive Generators, one on each engine and rated at 90 kVA each (Figure 1). The generators operate in electrical parallel, i. e. not isolated as in most two-engine airplane systems. A generator circuit breaker (GCB) connects the output of each generator to its respective bus. The main buses are connected to a tie bus (sometimes referred to as the synchronizing bus, or sync bus for short) through the bus tie breakers (BTB). The tie bus is split into two halves which are connected together by the split system breaker (SSB). With all IDG's operating, the four GCB's, four BTB's and the SSB are all closed, i.e. connected. For ground operations there are two direct drive APU generators and two external power receptacles for powering the airplane. Power from each APU generator is connected it its respective side of the sync bus through its APB contactor. Likewise, power from each external power receptacle is connected it its respective sync bus by its XP contactor (XPC). Each APU generator is rated at 90 kVA and each external power receptacle is rated at 90 kVA.

DC power is supplied by four Transformer Rectifier Units (TRU), one to each main DC bus (Figure 2). The four DC buses are operated in parallel by four DC Isolation Relays (DCIR). The DCIR's are normally closed, (conducting), but open for system isolation during autoland. The Captain's and First Officer's instrument buses are powered from the main AC buses through the Instrument Bus Voltage Sensing Units (IBVSU). These automatically transfer the instrument bus power to AC Bus-1 in the event that the normal source fails, which is AC Bus-3 for the Captain's instrument bus and AC Bus-2 for the First Officer's instrument bus.

The pilots control module for the electrical power generation system is in the pilots overhead panel (P5, Figure 3). There are four drive disconnect switches at the bottom of the module. These are guarded switches. Lifting the guard and pressing the switch will cause the IDG shaft to mechanically disconnect from the engine gearbox. This would only be done in the event of an overheated IDG or low IDG oil pressure. Once disconnected, the IDG cannot be reconnected in flight.

Above the disconnect switches are generator control switches. These are mechanically latching switches, latched in to keep the generator on and latched out for shutting a generator off. These switches remain in the ON (or in) position for all normal operations. Leaving these switches in the ON position permits the generators to automatically connect to the buses when the engines start.

Above the generator control switches are the bus tie control switches. These switches control the operation of the BTB's and have the same mechanical latching action as the generator control switches. With the switch latches in, the BTB operation is automatic. With the switch latched out, the respective BTB and DCIR is opened (isolated).

Above the bus tie control switches are the external power and APU generator control switches. These are spring back momentary action switches. Momentarily pressing the switch when the power source is available commands the source to connect to the sync bus. Conversely, if the switch is pressed when the source is already connected it commands the source to disconnect. There are two external power control switches and they operate in the same manner as the APU generator control switches. External power is obtained from two

receptacles on the lower forward fuselage. The aircraft electrical system does not parallel the two external power sources or the two APU generators. If only a single external power receptacle is connected, then selecting that external power source onto an unpowered airplane will power both sides of the sync bus by automatically closing the split system breaker (SSB). However, if both external power sources are selected, the SSB will open so that each external power source will only connect to its respective side of the sync bus. The same is true for the APU generators.

On the aft overhead is the electrical system maintenance panel (Figure 4). Each of these switches are guarded momentary action toggle switches. These switches are intended for maintenance use only and as such are out of the pilots normal reach. The four IDG field switches permit energizing the generator field when the generator control switch is off. These switches have no effect when the generator control switches are on. The two APU generator field switches permit energizing and de-energizing the APU generator fields. Indicators illuminate when the respective generator fields are off. The Split System Breaker switch will alternately open and close the SSB. This switch is inoperative in flight (AIR Mode). The SSB indicator illuminates when the SSB is open.

Parameters of the electrical power generation system can be displayed on the EICAS maintenance page (Figure 5). Voltage, frequency and load are displayed as well as IDG oil temperatures. A synoptic page displays the configuration of the AC electrical system by showing green for the parts of the system that are energized and amber for the parts that are not energized.

The brains of the 747-400 electrical power generation system (EPGS) are contained in the four Generator Control Units (GCU), originally P/N 60B40162-1 and two Bus Control Units (BCU) originally P/N 60B40162-2. Each of these units is operated by a microprocessor which controls system operation, provides fault protection, and performs automatic built-in-test (BIT).

During development testing of this system, a number of special characteristics were found too late to be changed before initial entry into service. Still other characteristics were discovered during early in-service operations. While these characteristics did not affect the safety of operations, they did pose somewhat of a nuisance to the operators. Each item was carefully documented ,analyzed, and tested. Modifications, i.e. corrections, for these characteristics were then

incorporated into the next release of the GCU and BCU, 60B40162-6 and 60B40162-7 respectively, which began delivery with new airplanes in October 1989. Approximately 120 separate changes were incorporated in this revision. While many of these fixes were the result of software changes, some internal hardware also required changing. Each of the internal circuit boards and wire harnesses was either modified or replaced. Airplane retrofit was accomplished by Boeing Service Bulletin 747-24-2122.

Here are twenty four examples of special characteristics found during the development and early in-service experience. Twenty of these, and many other characteristics, were corrected by the Service Bulletin and on follow-on deliveries.

BCU-1 is normally powered from the Main Battery Bus and BCU-2 from the APU Battery Bus. However, each BCU also receives operating power from its respective XP receptacle. If power is applied to an XP receptacle before turning on the Battery Switch, an "ELEC BCU" fail message is generated an EICAS because the BCU failed to sense battery power. Also, since one BCU will typically receive power before the other, the powered BCU seeing no ARINC-429 signal from the other, causes the autoland function to be locked-out. In addition, the load shedding function does not function as intended when this happens. Powering up in this manner will display an "ELEC BCU' message on the EICAS status page, preventing the airplane from being dispatched in this condition. The proper operating procedure, until the -6 and -7 control units are installed, is to always power up with the battery switch before connecting the external power cables. In addition it is necessary to wait a minimum of 20 seconds after turning on the battery switch in order for the BCU's to complete their self test. The standby power switch must also be OFF during this time to prevent a nuisance "ELEC BCU" message.

A number of nuisance messages were found to occur due to the built-in-test functions in this system. A nuisance message is generated when the built-in-test erroneously detects something failed. In the -1 and -2 control units, all messages are latched, i.e. permanently set until the units are powered down. Thus, even if a condition was temporarily detected as failed, for example due to an unforeseen sequence of events during power-up, a permanent message was set. While these erroneous messages are eliminated in the -6 and -7 control units, the original system has to be completely powered down (including removal of the ground power plugs) to clear any nuisance messages, In the -6 and -7 version, latching of messages has been removed in addition to modifying the built-in-test logic. Where latching is truly required, it will be performed within the Integrated Display System and the Central Maintenance Computer.

Pressing the APU generator control switch commands the APU generator to be connected. When applying the APU generator to the bus, it may be the first source an the bus or it may be transferring from either the IDGs or from external power. When the APU generator is the first source an the bus, the action takes place immediately. But when transferring from an IDG, the IDG must first synchronize with the APU generator. Synchronization by an IDG is fast enough that the delay is normally not noticeable. Power transfers to external power, however, may take a few seconds while the APU engine changes speed to synchronize with external power. This time delay is sometimes confusing to the operator. Thinking that the APU did not respond, the operator may attempt a second or third try at the switch. In the original version, a second attempt at the switch (before the APU has synchronized with external power) causes the command to be reversed, further confusing the operator. The reason for this is that the BCU control logic resets the previous switch command when the switch is pressed again. To further complicate things, there is a situation where two actuations of the APU Generator Control Switch are required to reset the APU generator (see Unplanned Characteristic No. 17). In the -7 BCU, the switch latched logic is not reset until after its initial power transfer is complete (or after 4.5 seconds, if power transfer does not complete). Thus each new actuation of the switch is sensed in proper relation to its intended command.

To obtain no-break power transfers between the APU generator and external power, the APU is speed jogged to obtain momentary synchronization. The power then transfers when the frequency of the two sources are within 5 Hz and +/-90 degrees phase angle. Speed jogging only occurs when the frequency difference exceeds 5 Hz. As long as the two frequencies are not exactly the same, phase alignment within +/- 90 degrees will quickly occur. However, if synchronization (paralleling) does not occur within 3.5 seconds, the system is designed to perform a 'break," transfer. Synchronization may not occur quickly enough if both sources are nearly the same frequency. When both frequencies are within 0.14 Hz of the same frequency, phase alignment can take longer than 3.5 seconds, resulting in a "break" transfer. This characteristic is modified in the -7 GCU to always command the APU to speed jog, even when the frequency difference is less than 5 Hz.

Another characteristic of APU speed jogging was found to occur when one external power source was above 400 Hz and the other was below 400 Hz. Assume that the airplane was operating on external power with XP1 at 415 Hz and XP2 at 385 Hz. Selecting the APUl switch would commence the APU speed joqqinq toward 415 Hz. If the APU2 switch were selected before XP1 had a chance to transfer to APU generator #1, then the speed jogging would reverse direction, toward 385 Hz. This would cause a 'break' transfer on the APU generator #1 side. This is revised in the -7 BCU so that the first power transfer will be completed before the direction of speed jogging is reversed.

Assume that external Power is to be connected to an unpowered airplane. Depending an the previous state of operation, the SSB can be either open or closed before external power is applied. If the SSB was already closed, then pressing both external power control switches at exactly the same time will cause the external power control to lock up, preventing any application of external power. The same is true of the APU Generator Control Switches. The airplane must be completely powered down to recover from this condition, i.e. battery switch off and both external power plugs disconnected. This characteristic is modified in the -7 BCU so that simultaneous switch operation will not prevent power application.

System voltage, frequency and load are displayed on the flight deck maintenance display. The information that it displays is transmitted to the indication system from the BCU over an ARINC-429 communication link. The original BCU design transmitted a default frequency of 122 Hz when the APU generators were not running. Since the frequency for this condition should be indicated as zero, the -7 BCU has been revised to indicate "FREQ 0" for this condition.

The system will not permit external power to be applied to the aircraft buses unless the power quality is within acceptable limits. However, when external power is plugged into the airplane, these indicators at the external power receptacle illuminate even if power quality is outside of these limits. With the -7 BCU installed, these indicators will only illuminate when external power quality is within limits.

When external power or APU power is connected to the buses, both the "AVAILABLE" light and the "ON" light on their respective control switches remain illuminated. This was causing the face of the switch to be hot to the touch. With the -7 BCU installed, the "AVAILABLE" light is extinguished whenever the "ON" light is illuminated.

The system is designed such that a single generator can supply all four main buses. To do this the split system breaker (SSB) must be closed, which would normally be the case. However, if for some unforeseen reason the SSB were to open in flight in combination with temporary loss of all four generators, the SSB will not automatically re-close when a single generator is restored. Thus the restoration of a single generator, in this case, would power only two main buses. A second generator must be restored an the opposite side of the sync bus in order to restore power to the remaining two main buses. Powering at least one generator on each half of the sync bus will close the SSB in flight. [It should be noted here that this represents a highly improbable failure mode. While it is intended that the restoration of the first generator will apply power to all four main buses, even restoring power to only one bus will still power all four DC buses. This is because there is no split system contactor in the DC Tie Bus and a single TRU can supply all four main DC buses.] With the -6 and -7 control units installed, the SSB will automatically re-close under this condition so that a single generator will restore power to all four main buses.

Where airport rules require push-back before engine start, the APU would normally provide electric power during this time. However, in cases where the APU is inoperative it may be necessary to push back using one engine to supply electric power. Assuming that the aircraft was powered from the two external power plugs before starting the engine, the split system breaker (SSB) would be open. When only one engine is started, it's generator will power only one half of the sync bus. External power continues to supply the other half of the sync bus. That half of the sync bus would then become unpowered when external power is disconnected unless the SSB is manually closed before push-back. This makes it necessary to operate the SSB control switch on the overhead maintenance panel, which is inconvenient since the pilot cannot reach this switch from his normal position. The -6/-7 version of the system changes the operation so that the SSB will close automatically when the first engine generator comes on line.

The SSB is open when the airplane is powered from the two APU generators. Transferring to a single XP source (XP1) in this condition transfers the left sync bus to the XP source, leaving the right sync bus powered from APU generator #2. Subsequent shutdown of APU generators leaves the SSB open causing the right sync bus to become unpowered. The SSB switch must be operated to restore power to the right half of the sync bus. The -7 BCU has been modified to automatically reclose the SSB under this condition, eliminating the need to operate the SSB switch.

When transferring from IDG's to APU or XP with only a single source available, the single source will automatically connect to both halves of the sync bus. But when both APU sources or both XF sources are available, each source will connect only to its respective side of the sync bus. Ordinarily both sources would be selected, thus powering both sides of the sync bus. But consider the case where the "AVAIL" lights are inoperative on one APU generator or one external power source-, unless the operator pressed the switch with the inoperative lights, APU power or XP power would not be applied to that half of the sync bus. That side of the sync bus would then become unpowered when the IDG's were shut down. This was changed in the -6 and -7 units to automatically close the split system breaker (SSB) when the IDG's are shut down under this condition, preventing a dead bus.

The BCU's monitor their respective battery voltages for the purpose of displaying battery voltage on the EICAS Maintenance page. BCU-1 monitors the main battery and BCU-2 monitors the APU battery. An "ELEC BCU" message was generated if this voltage was below 10 volts or above 30 volts. Since the battery can normally exceed 30 volts during charging, this logic would generate a nuisance "ELEC BCU" Message. Prior to delivery of the -2 BCU this was corrected by the addition of zener diodes in the airplane wiring, to prevent the BCU from seeing voltage in excess of 30 volts. Due to the zener in the system, the battery voltage indication an EICAS cannot read above 30 volts. This characteristic is changed in the -7 BCU so that the zener diodes are no longer required and true battery voltage, when it is above 30 volts, can be displayed on EICAS. The message generated when the battery sense input is below 18 volts is changed to BAT BUS SENSE INPUT FAIL and is displayed on CMC only.

A self test of the electrical power generation system can be initiated manually from Central Maintenance Computer (CMC). The request for a self test is transmitted from the CMC to the BCU over an ARINC-429 digital data transmission bus. If for some unknown reason the CMC should fail in such a manner that it repeatedly transmitted a request for test, while it did not affect system control or protection, it was found to temporarily cause blanking of the electrical system display on EICAS. To overcome this possibility the 747-400 airplanes had a relay installed in the ARINC-429 line to disable this input during flight. As a result of the added relay, the BCU detects that this input is disabled and displays a nuisance `CMC>BCU BUS" message on the CMC. The software in the -7 BCU is modified such that the relay in the ARINC line will no longer be required. In addition, the CMC nuisance indication is eliminated by inhibiting this message when the airplane is in the AIR MODE.

The system automatically sheds the utility and galley buses in the air whenever there are less than two IDG's powering the buses. This affects maintenance when jacking the airplane because the system would sense AIR MODE and unnecessarily shed the utility and galley buses. This has been modified in the -7 BCU so that AIR MODE load shed will not occur if the airplane is powered from external Power. Load shed will still occur if the airplane is being powered from the APU generators. This is so that an attempt to inadvertently take off using APU generators only (i.e. without the IDG's powering the buses) would be readily detectable. AIR MODE is detected whenever the weight-on-wheels sensors are off the ground or engine speed on three or more engines is above approximately 74% N2 (67% N3 for RR engine).

The system has Sustained Unlike Source Protection (SUSP) which will trip the BTB if either the APU generator or external power source remain continuously paralleled with an IDG (i.e. the GCB fails to trip). Slow drop-out of the XPC due to the spike suppression circuit can cause this to occur. The spike suppression circuit in the -7 BCU has been modified to increase XPC drop-out time. The GCU software has also been modified to positively prevent inadvertent SUSP tripping.

This occurred because the input power to the APU battery charger is removed during APU cranking. The BCU erroneously flagged this as a failure of the battery charger. A 1.7 minute time delay for this message has been added to the -7 BCU to Prevent a nuisance indication.

This message occurred on CMC due to APU engine shutdown without first disconnecting the APU generator. In this situation the APB is tripped by a command from the APU Generator Control Unit (AGCU) instead of the BCU. Since the BCU did not issue the command to trip, its logic perceived the APB or AGCU as failed. In addition, after the APU is restarted, it requires two actuations of the APU Generator Control Switch to restore power to the APU generator. Both of these characteristics have been revised in the -7 BCU to eliminate the nuisance indication.

With high oil viscosity due to engine cold soak, the oil pressure build-up in relation to engine speed during starting occurs late in relation to engine speed. This causes Monitor BIT to erroneously generate the "IDG LOW OIL PRESS" message on the CMC and results in the "ELEC GEN SYS" message an EICAS Status. This is modified in the -6 GCU to prevent the nuisance indication.

Slower engine deceleration rates are experienced when an engine is shut down in flight than when it is shut down while the airplane is stopped. This caused the GCU logic to incorrectly generate this message on EICAS Status. This has been revised in the -6 6CU to eliminate the nuisance message.

The GCU interprets the IDG air/oil cooler valve as failed if the valve is open when it has not been commanded open by the GCU. This results in an "ELEC IDG VALVE" message sent to EICAS and an "IDG COOLER VALVE" message sent to the CMC. The cooler valve, however, can also be opened by the engine control system (EEC) as well as by low pneumatic pressure. This always results in a nuisance message on CMC. The EICAS message, however, is inhibited by the EIU when the valve is commanded open by the EEC and also when engine N2 is less than 88%. A nuisance message can still occur due to low pneumatic pressure at engine speeds above 88%. The logic for the CMC message was modified in the -6 GCU, but the logic for the EICAS will not be changed until the next EICAS modification. Since the EICAS message is latched by the EIU, the nuisance EICAS message may still occur.

A truly failed valve will still be indicated if the valve does not open when commanded to open by the GCU.

This message occurred when the battery reached full charge and the charger switched to the float charge made. The battery reaches approximately 32 volts at the end of charging when the charger switches to 27.5 volts for the float charge mode. At this time the battery is temporarily at a higher voltage than the charger. This will, cause the battery to discharge for a few seconds, until the battery voltage matches the charger voltage. If there is more than 7.0 amperes load on the Hot Battery Bus, the "BAT DISCH APU" message will appear. This temporary message was inhibited in the Integrated Display System Electronics Interface Unit (EIU) by increasing the time delay for this message to 60 seconds,

EICAS Advisory originally displayed this message whenever the SSB was open. Since it is normal for the SSB to be open when operating from the APU or external power, this message was an annoyance. The logic of the EIU was changed to only display the message if the SSB was open when it should be closed. Fortunately this information was already available from the BCU via the ARINC-429 serial data link.

If the airplane is taxied with the electrical system powered from only the APU generators, advancing three or more throttles causes the system to switch to the AIR MODE. This results in an immediate load shed of all utility buses and galley buses. To prevent this load shedding, the airplane should remain on IDG electrical power until completing taxi. Load shed is designed to protect the IDG's from overload by automatically shedding these loads whenever the airplane is in the AIR MODE and there are less than two IDG's powering the system. AIR MODE is sensed either by the weight on wheels sensors or whenever three or more engines are above airmode speed (74% N2 for GE engine, 73% N2 for PW engine, or 67% N3 for RR engine). This feature also alerts the crew if takeoff is attempted with the electrical system powered from the APU generators.

When transferring power from XP to APU, the APU speed jogs to synchronize with the external power frequency. If the external power frequency is low (near 380 Hz), the APU is decelerating when the power transfer occurs. The shock load application while the APU is decelerating can cause the APU to go under-speed. This is a characteristic of the APU and its controller. All power may be lost when this happens, depending on whether one or both APB switches were selected. This is because XP disconnects immediately after the APB closes. If only one APB switch was selected, then only half of the sync bus would go dead. Reselecting an APU generator or XP source onto a dead bus would reestablish power to all buses. With the -7 BCU installed, the SSB would automatically re-close under this condition, transferring power to the opposite XP and preventing a dead sync bus.

The above condition can also occur when transferring from IDG power to APU generator power. If the second APU generator control switch is pressed before the first APU generator has transferred power, both APU generators may get power applied at the same time, This can be avoided by waiting for the first APU generator to transfer power before selecting the second generator.