In-flight upset - 154 km west of Learmonth, WA, 7 October 2008,

equipment software and aircraft installation. The final assessment contained over2,000 pages of documentation, and data from the SSA was included in thecertification dossier that was provided to the certifying authority (that is, theDGAC).2.5 Development of the algorithm for processing AOA2.5.1 Preliminary A330/A340 FCPC algorithmThe FCPC algorithm for processing AOA data was a small but important element ofthe overall EFCS. The general safety objectives for the algorithm (and the rest ofthe EFCS) were based on JAR 25.671, JAR 25.1309 and associated guidancematerial, and included the safety objective that no single failure should result in acatastrophic failure condition. The aircraft manufacturer advised that otherrequirements for the algorithm were that the:• AOA values from the three ADIRUs were to be acquired by each channel (COMand MON) of each FCPC• aircraft behaviour must be acceptable in the case of a runaway of one of thethree AOA values.Consistent with the aircraft manufacturer’s objective (section 2.4.3), the preliminarydesign of the FCPC algorithm was the same as that certified for the A320 in 1988. Itdid not include a memorisation period and had several other differences to thealgorithm that was ultimately used on the production A330/A340 aircraft (describedin sections 2.1.4 and 2.1.5).The preliminary FCPC algorithm for processing AOA data was subject to themanufacturer’s processes for generating requirements, verification and validation,including safety assessment. None of these activities, up until flight testing,identified any need to change the algorithm’s design.In December 1991, during a test flight on an A340, a problem was identified withthe operation of the preliminary algorithm. The algorithm did not effectivelymanage a specific situation where AOA 2 and AOA 3 on one side of the aircraftwere temporarily incorrect and AOA 1 on the other side of the aircraft was correct,resulting in ADR 1 being rejected.2.5.2 Redesign of the preliminary algorithmAfter reviewing the problem that was identified during flight testing, the aircraftmanufacturer redesigned the FCPC algorithm. This led to the final algorithm forprocessing AOA data, which included the 1.2-second memorisation period andseveral other changes (described in sections 2.1.4 and 2.1.5).The manufacturer advised that the 1.2-second duration of the memorisation periodwas considered to be the maximum time period that the aircraft could use amemorised AOA value in dynamic manoeuvres. Accordingly, the FCPCs required acurrent AOA value to be obtained at the end of the memorisation period, and thefinal algorithm was designed to ensure that a second memorisation period wouldnot be triggered without a new value first being obtained.- 95 -