In-flight upset - 154 km west of Learmonth, WA, 7 October 2008,

it is very difficult if not impossible to identify all the design errors or possible waysin which the system may not perform as desired. For example, a UK Health andSafety Commission (1998) report stated:Computer systems are vulnerable because they almost invariably containdesign faults in their software (and perhaps in their hardware) that aretriggered when the computer system receives appropriate inputs. Many ofthese faults will have been present from inception, and others will have beenintroduced during any changes that have taken place throughout the systemlifetime. The reality is that even programs of surprisingly modest size andcomplexity must be assumed to contain design faults. It is the responsibility ofthe designer, having done whatever is possible to minimise the number ofresidual faults, to try to ensure that any remaining ones do not have anunacceptable effect upon other systems with which the computer systeminteracts: in particular, that they do not compromise the safety of the widersystem.There is widespread agreement that when software problems contribute to accidentsand serious incidents, the problems are usually due to flaws in the designrequirements. In other words, the software worked according to its design, but therewas a problem with the design itself rather than the way the software code waswritten. For aerospace systems, the problems generally involve incompleteness inthe requirements, particular in terms of the interactions between systems and theinability of the software to handle certain states or conditions (Lutz 1993, Leveson2004a).There has been no systematic evaluation of the contribution of software designproblems leading to aircraft flight control system occurrences. Although problemswith software requirements have previously contributed to such occurrences (forexample, see section 1.16.1), the investigation found no salient evidence to suggestthat such systems have not, to date, generally performed at appropriate safety levels.The aircraft manufacturer noted that the accident rate for modern aircraft with morecomplex system designs (such as the A320, A330 and A340) is lower than that forprevious generations of aircraft. It also stated that, even though systems continue todevelop in line with technological advances, SSA and other system developmentprocesses also continue to develop and become more sophisticated.2.6.2 Developments in industry standards and guidanceSeveral industry standards and guidance documents were issued in the 1990s fordeveloping complex aircraft systems and meeting the requirements ofJAR/FAR 25.1309. Airbus and/or its related organisations were involved in thedevelopment of these documents. 112Design objective 178BA major revision of DO-178A (section 2.3.5) was issued in December 1992. Thenew version (DO-178B) was developed as a result of the rapid advances in software112Many other standards have been issued in recent years for the development of safety-criticalsystems or software in various industries, but only those specifically applicable to aircraft systemshave been included in this report.- 99 -