In-flight upset - 154 km west of Learmonth, WA, 7 October 2008,

2.3.2 Regulatory requirementsThe relevant certification requirements for a flight control system were specified inJAR 25.671 and JAR 25.1309. The FARs had the same requirements.JAR 25.671 (Control Systems: General) dealt with specific types of failures thatcould affect the functioning of the control surfaces. It effectively stated that theaircraft had to be capable of continued safe flight and landing following specifictypes of ‘failures or jamming’ in the flight control system or associated controlsurfaces. A specific failure, or combination of failures, that could affect thecontinued safe flight and landing had to be demonstrated, by analysis or test, to be‘extremely improbable’ (see section 2.3.3 for the definitions of probability terms).JAR 25.1309 (Equipment, systems and installations) applied to a range of differentaircraft systems, including the flight control system. It outlined more detailedrequirements than JAR 25.671, including the following:(b) The aeroplane systems and associated components, consideredseparately and in relation to other systems, must be designed so that(1) The occurrence of any failure condition which would prevent thecontinued safe flight and landing of the aeroplane is extremelyimprobable; and(2) The occurrence of any other failure condition which would reducethe capability of the aeroplane or the ability of the crew to cope withadverse operating conditions is improbable...(d) Compliance with the requirements of sub-paragraph (b) of this paragraphmust be shown by analysis, and where necessary, by appropriate ground,flight, or simulator tests. The analysis must consider(1) Possible modes of failure, including malfunctions and damage fromexternal sources;(2) The probability of multiple failures and undetected failures;(3) The resulting effects on the aeroplane and occupants, considering thestage of flight and operating conditions; and(4) The crew warning cues, corrective action required, and the capabilityof detecting faults.2.3.3 European Advisory Circular Joint No. 1 to 25.1309Advisory Circular Joint (ACJ) No. 1 to JAR 25.1309 outlined guidance fordemonstrating compliance with JAR 25.1309. A key concept in the ACJ was a‘failure condition’, which referred to a condition that resulted from a failure in theaircraft system, and caused or contributed to an undesirable effect on thefunctioning of the system or the complete aircraft. 91 The failure condition couldalso occur due to a scenario involving a combination of failures, including failuresin related aircraft systems.91An example of a failure condition is ‘total loss of wheel braking’ and an example of a failure thatcould lead to this condition is ‘brake system control unit – power supply failure’. For furtherdetails see ARP4761 (discussed in section 2.6.2).- 84 -