In-flight upset - 154 km west of Learmonth, WA, 7 October 2008,

More documents

Recommendations

Info

$a947-1 flexplate fracture forward flexible coupling main rotor drive ...$

estimated high-energy neutron fluxes present at the time and location of the threeoccurrences were 700 (12 September 2006), 1,000 (7 October 2008) and 1,700 (27December 2008) neutrons per cm 2 per hour. 159The most useful method for ascertaining whether a type of equipment behaviour isrelated to SEE is to use correlations of the rate of events compared with thepredicted neutron flux, as well as taking into account other hypotheses andinformation about the system of interest. This approach was of limited value in thiscase due to the small number of occurrences involved.Component testingSimilar types of RAM chips to those used in the LTN-101 ADIRU were tested fortheir susceptibility to SEU in 1993 by specialists contracted by the ADIRUmanufacturer. Both types of RAM were found to be susceptible to SEU. For theCPU RAM the equivalent 160 estimated mean time between SEU operated in a polarregion at 45,000 feet was about 75 days. For the wait-state RAM, the mean timewas 175 days. The test report recommended that the manufacturer consider variousmeans of improving resilience to SEE, including the substitution of more resilientRAM and the use of EDAC.Three variants of a chip 161 similar to the CPU RAM type and two variants of thewait-state chip type 162 were tested for proton 163 and heavy-ion 164 SEU susceptibilityin 1994. All chips tested were reported to be ‘very susceptible to both heavy ionsand protons’ though they exhibited different levels of susceptibility.The wait-state RAM type was tested in 1999 for susceptibility to heavy-ionbombardment, and was compared with two other types of RAM. Of the three typesof RAM tested, that used in the LTN-101 was the most resilient to heavy-ion SEU.There were no SEE tests of the CPU chip or ASIC chip known to the investigation.During the investigation, the ATSB received expert advice that the susceptibility ofa specific component to SEE could vary significantly between components with thesame part number from the same batch (up to a factor of 2 or 3), and even more forcomponents from different batches (up to a factor of 10). The expert advised theATSB that the component-level test results were typical of devices of the period.159160161162These figures were calculated by establishing the level of solar modulation of galactic cosmic raysfrom ground-level monitors for the time of the occurrences and applying the QinetiQ AtmosphericRadiation Model (QARM) to calculate the in-flight levels. See http://qarm.space.qinetiq.com.The mean time between SEU has been adjusted here to account for the different amount of RAMin the study versus the amount of RAM in the LTN-101 ADIRU program memory.The chips tested were Micron Tech MT5C2568, MT5C2568-35 and MT5C2568-70, withsomewhat similar characteristics to the Austin chips that were used in the LTN-101.The chips tested were Mosaic MSM8128K and MSM8128KL, with very similar characteristics tothe Mosaic chips that were used in the LTN-101.163 The effects of proton and neutron SEE are comparable, so SEE testing using one is generallyrepresentative of the other.164A heavy ion is an ionic (charged) particle heavier than a helium nucleus; that is, more than abouttwice as heavy as a neutron. High-energy heavy ions are present in the atmosphere and can causeSEE, but do not penetrate the atmosphere or aircraft skin as deeply as high-energy neutrons. Atnormal aircraft altitudes, neutrons are the predominant form of high-energy particle.- 146 -
Unit testingIn 2005, as part of the ADIRU manufacturer’s investigation of another LTN-101ADIRU failure mode (known as ‘dozing’, see section 3.9.3), testing was conductedto determine the LTN-101 model’s susceptibility to neutron SEE. The neutronfluxes used in the test were very high (billions of neutrons per cm² per second) toemulate neutron exposure over long periods of normal operation. The followingLTN-101 ADIRU versions were tested:• ADIRU with the newer CPU module incorporating EDAC (part number466871) and software version -0315. Four test runs were performed that resultedin several different anomalies, most commonly a ‘system functional shutdown’(or hanging). The calculated mean time between failures (MTBF) was about6,200 hours, with failure defined as the system shutting down.• ADIRU with the same type of CPU module as on units 4167 and 4122 (partnumber 465474) and software version -0315. One test run was performed thatdemonstrated a corruption of the ADIRU software after about 1 minute ofneutron bombardment. The calculated MTBF for this sample was about30,300 hours.The test report concluded that SEE had ‘a real and varied effect’ on the LTN-101’soperation. During the investigation, the ADIRU manufacturer advised that thefunctional shutdowns that were generated during the testing were similar to dozingevents but had different BITE data signatures (see section 3.9.3 for more details ondozing events). An expert on SEE advised the ATSB that the results were typical ofsystems of the period.None of the tests generated data spikes or other data output anomalies. However,only limited testing was done, with only one test run on a CPU module with thesame part number as unit 4167 and 4122. The similarity of the CPU module to themodules in the affected units (in terms of the batch numbers of key components)could not be determined. The testing was conducted with neutrons at 14 millionelectron-volts, which was in the ‘high-energy’ range as defined by IEC 62396 buttowards the low end of that range. Consequently, the test was not sufficient toexamine the model’s susceptibility to the full range of neutrons at the higher energylevels that exist in the atmosphere. For example, higher energy particles are morelikely to trigger a MBU, which can produce different system effects than a SEU. Inaddition, the data-spike failure mode might not have been triggered due to itsrelative rarity compared with other types of effects.During the investigation, the parties to the investigation of the 7 October 2008occurrence discussed the advantages and disadvantages of additional SEE testing ofLTN-101 ADIRUs, particularly unit 4167. The ATSB received expert advice thatthe best way of determining if SEE could have produced the data-spike failuremode was to test the affected units at a test facility that could produce a broadspectrum of neutron energies. However, the ADIRU manufacturer and aircraftmanufacturer did not consider that such testing would be worthwhile for severalreasons, including that:• A level of susceptibility to SEE had already been demonstrated through previousunit and component testing.• Design changes had been made to the later production ADIRUs to incorporateEDAC in the CPU, which would mitigate the effects of SEE.- 147 -
Page 1:
ATSB TRANSPORT SAFETY REPORTAviatio
Page 4 and 5:
Published by: Australian Transport
Page 6 and 7:
3 FACTUAL INFORMATION: AIR DATA INE
Page 9 and 10:
DOCUMENT RETRIEVAL INFORMATIONRepor
Page 11:
TERMINOLOGY USED IN THIS REPORTOccu
Page 14 and 15:
CSMCSSCVRDADSDCDGACDMCDMUEASAECAMED
Page 16 and 17:
RAMRTCASATCOMSAESAOSDSECSEESEUSSASS
Page 18 and 19:
FCPC design limitationAOA is a crit
Page 20 and 21:
- xviii -
Page 22 and 23:
associated with a master caution ch
Page 24 and 25:
Figure 2: Aircraft track and key ev
Page 26 and 27:
The crew decided that they needed t
Page 28 and 29:
1.3 Damage to aircraftThere was sig
Page 30 and 31:
• The flight crew provided inputs
Page 32 and 33:
exceeding a predefined safe flight
Page 34 and 35:
Table 1: Examples of ADIRU flight d
Page 36 and 37:
Inertial reference partThe IR part
Page 38 and 39:
ADIRS switching controlsIn normal o
Page 40 and 41:
Processing by ADIRUs and FCPCsEach
Page 42 and 43:
The information presented on the fl
Page 44 and 45:
A system could flag its output data
Page 46 and 47:
Table 4: Summary of indications for
Page 48 and 49:
Figure 17: ECAM engine / warning di
Page 50 and 51:
Table 6: Required actions associate
Page 52 and 53:
For internal aircraft communication
Page 54 and 55:
Table 7: Sequence of events (from t
Page 56 and 57:
In summary, the source of most of t
Page 58 and 59:
Summary of IR data for the occurren
Page 60 and 61:
Figure 22: QAR plot showing oscilla
Page 62 and 63:
QAR dataOverall, the QAR recorded 4
Page 64 and 65:
Flight crew pitch inputsDuring manu
Page 66 and 67:
They provided information for maint
Page 68 and 69:
Table 11: Cockpit effect messages d
Page 70 and 71:
Table 13: Troubleshooting data rela
Page 72 and 73:
position 1 on QPA. Further details
Page 74 and 75:
class 1 fault messages shown in Tab
Page 76 and 77:
If there was a discrepancy between
Page 78 and 79:
1.15 Survival aspectsInformation on
Page 80 and 81:
did not identify any faults. The BI
Page 82 and 83:
Comparison of the three occurrences
Page 84 and 85:
1.17.2 Processes for reporting and
Page 87 and 88:
2 FACTUAL INFORMATION: ELECTRICAL F
Page 89 and 90:
monitored external systems that pro
Page 91 and 92:
Each FCPC used a number of paramete
Page 93 and 94:
AOA computation logicThe FCPC softw
Page 95 and 96:
Figure 29: FCPC processing of sever
Page 97 and 98:
Table 19: Characteristics of elevat
Page 99 and 100:
Simulation of AOA values for the fi
Page 101 and 102:
2.2.2 Review of recorded flight con
Page 103 and 104:
second PRIM 3 FAULT. The role of ma
Page 105 and 106:
The ACJ was built around the princi
Page 107 and 108:
• It stated that the identificati
Page 109 and 110:
The second part of the V-cycle invo
Page 111 and 112:
• Functional requirements. These
Page 113 and 114:
2.4.5 Safety assessment activitiesG
Page 115 and 116: equipment software and aircraft ins
Page 117 and 118: 2.5.4 Factors associated with the i
Page 119 and 120: it is very difficult if not impossi
Page 121 and 122: applicable to highly-integrated or
Page 123 and 124: Ongoing developmentsA range of rese
Page 125 and 126: To conduct an effective fault tree
Page 127 and 128: According to this model, accidents
Page 129 and 130: 3 FACTUAL INFORMATION: AIR DATA INE
Page 131 and 132: • inertial reference input/output
Page 133 and 134: 3.3 Examination of data-spike patte
Page 135 and 136: Figure 38: ARINC 429 word for an AO
Page 137 and 138: 3.3.4 Data-spike patterns for the 7
Page 139 and 140: Figure 43: Qualitative correlation
Page 141 and 142: etween the values of any of the fou
Page 143 and 144: 3.4.3 Calculating parameter valuesA
Page 145 and 146: 3.4.5 Packaging the ARINC 429 wordT
Page 147 and 148: 3.4.8 Transmitting data to other sy
Page 149 and 150: ARINC 429 packaging analysisThe ADI
Page 151 and 152: component configurations of differe
Page 153 and 154: manufacturer reported such BITE dat
Page 155 and 156: 3.6 Potential trigger types3.6.1 Ba
Page 157 and 158: such as liquids or small loose frag
Page 159 and 160: wires). The electric 144 field stre
Page 161 and 162: Although the investigation could no
Page 163 and 164: 3.6.6 Single event effectsBackgroun
Page 165: until a few years ago, were not dir
Page 169 and 170: that involved a NAV IR and/or NAV A
Page 171 and 172: EMI from other aircraft systems (su
Page 173 and 174: from ADIRU 1 was not correctly reco
Page 175 and 176: • Detected failure. Any failure w
Page 177 and 178: The ADIRU manufacturer’s analysis
Page 179 and 180: the aircraft and ADIRU manufacturer
Page 181 and 182: 4 FACTUAL INFORMATION: CABIN SAFETY
Page 183 and 184: Summary details of the cabin crew
Page 185 and 186: section, and the ninth flight atten
Page 187 and 188: Table 29: Significant cabin communi
Page 189 and 190: Figure 48: Example of damage to the
Page 191 and 192: 4.3.2 Seat belt examinationsSix pas
Page 193 and 194: The flight crew’s procedures requ
Page 195 and 196: takeoff, landing or when the seat-b
Page 197 and 198: Table 31: Levels of injuryInjury le
Page 199 and 200: 4.6.4 Injuries to seated occupants
Page 201 and 202: The percentage of occupants who wer
Page 203 and 204: Statistical analyses 197 were done
Page 205 and 206: passengers reported that they had h
Page 207 and 208: that seat belts should be worn only
Page 209: 4.8.2 Handholds in the cabinThe FAA
Page 212 and 213: Figure 53: Overview of the 7 Octobe
Page 214 and 215: process needs to ensure that there
Page 216 and 217:
and determine whether they could le
Page 218 and 219:
useful in this case. If the EFCS sp
Page 220 and 221:
5.3.2 Risk associated with the fail
Page 222 and 223:
• All three events occurred in a
Page 224 and 225:
place. Although aviation manufactur
Page 226 and 227:
equiring cabin crew to enforce the
Page 228 and 229:
With the information available to t
Page 230 and 231:
ADIRU 1 affected the operation of a
Page 233 and 234:
6 FINDINGSFrom the evidence availab
Page 235:
• As of April 2010, the LTN-101 a
Page 238 and 239:
did not illuminate. The new OEB (A3
Page 240 and 241:
modifications were made to its guid
Page 242 and 243:
this advice. At the time of the fir
Page 245 and 246:
APPENDIX A: VERTICAL ACCELERATIONST
Page 247 and 248:
APPENDIX B: FLIGHT RECORDER INFORMA
Page 249 and 250:
APPENDIX C: POST-FLIGHT REPORTThe f
Page 251 and 252:
- 231 -
Page 253 and 254:
- 233 -
Page 255 and 256:
APPENDIX D: OTHER DATA-SPIKE OCCURR
Page 257 and 258:
Occurrence on 27 December 2008Overv
Page 259 and 260:
Figure D2: FDR data for the 27 Dece
Page 261 and 262:
ADIRU informationADIRU 1 was the sa
Page 263 and 264:
APPENDIX E: ADIRU TESTINGTest plan
Page 265 and 266:
Visual inspectionsExternal visual i
Page 267 and 268:
(ADR) output databuses. Loading on
Page 269 and 270:
Unit 4167 passed 2,223 of 2,272 tes
Page 271 and 272:
dwells (sustained testing at a fixe
Page 273 and 274:
APPENDIX F: AIRCRAFT LEVEL TESTINGI
Page 275 and 276:
APPENDIX G: ELECTROMAGNETIC RADIATI
Page 277 and 278:
cannot be ‘decoded’ by the rece
Page 279 and 280:
APPENDIX H: SINGLE EVENT EFFECTSNot
Page 281 and 282:
Factors affecting SEE exposureAn ai
Page 283 and 284:
portions of memory are constantly b
Page 285:
Depending on the form of EDAC, sing
Page 288 and 289:
• crew actions: the passenger’s
Page 290 and 291:
The questionnaire respondents were
Page 292 and 293:
was centred across the passenger’
Page 294 and 295:
Previous occurrencesThe seat belt m
Page 296 and 297:
Australian turbulence eventsThe mos
Page 299 and 300:
APPENDIX L: SEAT BELT USE IN ROAD V
Page 301:
Table L1: Recent seat belt use rate
Page 304 and 305:
US Federal Aviation AdministrationT
Page 307 and 308:
APPENDIX N: SOURCES AND SUBMISSIONS
Page 309 and 310:
Hanson, RJ 1987, Conducted electrom
Page 311 and 312:
Tvaryanas, AP 2003, ‘Epidemiology
Page 313:
In-flight upset - 154 km west of Le
show all

In-flight upset - 154 km west of Learmonth, WA, 7 October 2008,

Create successful ePaper yourself

Delete template?

Save as template?