In-flight upset - 154 km west of Learmonth, WA, 7 October 2008,

• indicated AOA, ADR discrete word #1, impact pressure, TAT and barometriccorrection (in millibars).Two of the parameter pairs that were found to exhibit some correlation in therecorded data (section 3.3.4) shared a memory location. These pairs were Mach andaltitude, and computed airspeed and altitude. Although corrected AOA showedsome correlation with altitude, it did not share a memory location with any of thealtitude parameters. Similarly, ADR discrete #1, which incorporated static heat,probe heat, and other status information, showed some correlation with altitude butdid not share a memory location with any of the altitude parameters.The ARINC 429 words were queued in RAM in two 16-bit halves. The leastsignificant half comprised the label (bits 1-8) and data bits 9-16 while the mostsignificant half included data bits 17-29. In other words, the label was in the same16-bit half as the least significant data bits and the most significant data bits were inthe other half. For most parameters, the FDR recorded bits from the most significanthalf of the ARINC 429 word; for example, only Mach bits 16-27 were recorded bythe FDR.In summary, a queuing process that combined the least significant half of oneARINC 429 word with the most significant half of a different word would beconsistent with many of the recorded data spikes (particularly for Mach andcomputed airspeed). However this process would not explain the spurious probeheat faults that were recorded on the PFR, as four of the five probe heat discreteswere located in the least significant 16 bits of the discrete word, which included thelabel. In addition, the IR parameters did not queue the data for multiple parametersin the same location, and therefore a problem with queuing within the samememory location would not explain the IR data spikes.3.4.7 Generating parity bitsThe parity bit was calculated and appended to the ARINC 429 word in hardwarewithin the air data and the inertial reference input/output modules. Receivingsystems used the parity bit to check whether the data had been corrupted during orafter transmission, and they would reject any such corrupted data.Depending on the design of the receiving systems, numerous fault messages couldbe generated. For example, the FCPCs would report an ADIRU problem ifinsufficient valid data was received. In addition, for some parameters the otherADIRUs would also detect any words that had an incorrect parity using the digitalair data system (section 1.12.6). No such faults were recorded on the occurrenceflights.The FDR and QAR systems both checked the parity of the data words, and any datawords with incorrect parity were not recorded. As many data spikes were recordedby both systems, there appeared to be no parity bit problems with the data outputtedby the ADIRU.In summary, the data problems associated with the data-spike failure mode occurredprior to the parity bit being added by the input/output modules.- 126 -