In-flight upset - 154 km west of Learmonth, WA, 7 October 2008,

The safety assessment process should be planned and managed to provide thenecessary assurance that all relevant failure conditions have been identifiedand that all significant combinations of failures which could cause thosefailure conditions have been considered.ARP 4761 provided a detailed description of the safety assessment process, basedaround the three main activities of functional hazard assessment (FHA), preliminarysystem safety assessment (PSSA), and system safety assessment (SSA).Developments in Airbus guidance materialsIn 1996, the aircraft manufacturer issued ABD0200 (Guidelines and requirementsfor the system designers) as the reference document for its system designers. Itadvised that the manual had a modular structure so that the ‘continued evolution ofcommon Airbus practices could be captured and incorporated’.In addition to ABD0200, the manufacturer developed a higher-level manualAP2288 (Requirements for system and equipment development) to define its systemdevelopment process. This manual described each process by providing details onobjectives, main ‘actors’, activities, and related inputs and outputs.The manufacturer advised that these two manuals contained a large volume ofguidance material and incorporated the principles of ARP4754, ARP4761 and otherrelevant industry standards. It also noted that that the manuals were updated inresponse to in-service feedback, such as the results of accident and incidentinvestigations, or regulatory changes.Additional guidance materialStandards such as DO-178 and ARP4754 provided general guidance for developingsafety-critical software; they were not designed to provide detailed guidance orchecklists of specific issues to consider when developing or reviewing requirementsfor a safety-critical system. However, a number of textbooks and guidance manualshave been published that do provide more detailed guidance 117 , and severalinstitutions now provide training courses for design engineers and safety analysts.Checklists are often used when developing and reviewing system requirements, andresearch has shown that checklists focussing on safety-related aspects can increasethe chances of detecting safety-related design problems (Lutz, 1996). However,given the wide range and complexity of system designs, it is unreasonable to expectthat every specific, potential problem with every type of software design could bespecified in the form of checklists or guidance material.A review of a sample of guidance manuals and checklists did not identify anyspecific guidance that was directly applicable to the design limitation associatedwith the A330/A340 FCPC algorithm for processing AOA data. Although manyreferred to the importance of checking input values, and referred to intermittentfaults, none appeared to specifically refer to a multiple data-spike situation.117Examples include NASA (2004), Joint Software System Safety Committee of the US (1999), andStorey (1996).- 102 -