In-flight upset - 154 km west of Learmonth, WA, 7 October 2008,

generally involves conducting a failure mode and effect analysis (FMEA) 110 oneach item of equipment and determining equipment failure rates. Further discussionof PSSA methods such as fault tree analysis and FMEA is provided in section 2.6.3.Safety assessment activities are generally conducted by different engineers (safetyanalysts) than those who design the system (design engineers).Safety assessment for the A330/A340 EFCSOverall, the aircraft manufacturer’s methodology for conducting safety analysisactivities was consistent with the guidance provided in the European ACJ to JAR25.1309 and the FAA’s AC25.1309.In terms of the FHA, the aircraft manufacturer advised that the identification andclassification of the failure conditions for the A330/A340 EFCS was based onengineering analysis, knowledge that it had from its previous experience, and theFMEAs provided by the manufacturers of related equipment. The classificationswere based on the effects of the failure condition on the system as well as otherfactors such as handling qualities, aircraft performance, and aerodynamic loads onthe aircraft structure. The FHA documentation included the description of thefailure condition (including its repercussion or effect on the aircraft), theclassification (or level of effect), and the rationale used to justify the classification.The range of EFCS functions considered during the FHA included the processing ofADIRU parameters. For each ADIRU parameter used by the FCPCs, the FHAgenerated a list of failure conditions. The failure conditions related to the FCPCs’processing AOA data are discussed in section 2.5.3.With regard to the PSSA, the aircraft manufacturer advised that its identification ofthe failure scenarios leading to the failure conditions and the determination of theirprobability levels were also based on engineering analysis, knowledge that it hadfrom its previous experience, and the FMEAs provided by the manufacturers of therelated equipment. It used qualitative methods to assess design problems,environmental hazards and human factors aspects, and both qualitative andquantitative methods for assessing physical or hardware failures. The depth of therequired assessment depended on the classification of the failure condition (that is,more detailed analysis was conducted for catastrophic failure conditions than forminor or major failure conditions).The EFCS PSSA for the first A330/A340 model was finalised in June 1991, and theresults of relevant PSSA activities for the FCPC algorithm for processing AOA dataare discussed in section 2.5.3. The FMEA for the LTN-101 was finalised inSeptember 1992 and the results are discussed in section 3.8.The EFCS SSA was finalised in November 1992. The aircraft manufacturerreported that it verified that the safety requirements were met, and ensured that allthe necessary design features were incorporated into the system architecture,110FMEA is a very widely used bottom-up method for determining system reliability in manyindustries. It involves reasoning forwards from a specific failure mode to the effects of the failuremode. For each component of interest, it involves identifying the function(s) of the component, theways in which the component can fail (or failure modes), and the effects of each failure mode onthe item of equipment or the system. It often involves determining failure rates for each failuremode. Further details are provided in the US Military Standard MIL-STD-1629A (Procedures forperforming a failure mode, effects and criticality analysis) and ARP 4761.- 94 -