In-flight upset - 154 km west of Learmonth, WA, 7 October 2008,

Unit testingIn 2005, as part of the ADIRU manufacturer’s investigation of another LTN-101ADIRU failure mode (known as ‘dozing’, see section 3.9.3), testing was conductedto determine the LTN-101 model’s susceptibility to neutron SEE. The neutronfluxes used in the test were very high (billions of neutrons per cm² per second) toemulate neutron exposure over long periods of normal operation. The followingLTN-101 ADIRU versions were tested:• ADIRU with the newer CPU module incorporating EDAC (part number466871) and software version -0315. Four test runs were performed that resultedin several different anomalies, most commonly a ‘system functional shutdown’(or hanging). The calculated mean time between failures (MTBF) was about6,200 hours, with failure defined as the system shutting down.• ADIRU with the same type of CPU module as on units 4167 and 4122 (partnumber 465474) and software version -0315. One test run was performed thatdemonstrated a corruption of the ADIRU software after about 1 minute ofneutron bombardment. The calculated MTBF for this sample was about30,300 hours.The test report concluded that SEE had ‘a real and varied effect’ on the LTN-101’soperation. During the investigation, the ADIRU manufacturer advised that thefunctional shutdowns that were generated during the testing were similar to dozingevents but had different BITE data signatures (see section 3.9.3 for more details ondozing events). An expert on SEE advised the ATSB that the results were typical ofsystems of the period.None of the tests generated data spikes or other data output anomalies. However,only limited testing was done, with only one test run on a CPU module with thesame part number as unit 4167 and 4122. The similarity of the CPU module to themodules in the affected units (in terms of the batch numbers of key components)could not be determined. The testing was conducted with neutrons at 14 millionelectron-volts, which was in the ‘high-energy’ range as defined by IEC 62396 buttowards the low end of that range. Consequently, the test was not sufficient toexamine the model’s susceptibility to the full range of neutrons at the higher energylevels that exist in the atmosphere. For example, higher energy particles are morelikely to trigger a MBU, which can produce different system effects than a SEU. Inaddition, the data-spike failure mode might not have been triggered due to itsrelative rarity compared with other types of effects.During the investigation, the parties to the investigation of the 7 October 2008occurrence discussed the advantages and disadvantages of additional SEE testing ofLTN-101 ADIRUs, particularly unit 4167. The ATSB received expert advice thatthe best way of determining if SEE could have produced the data-spike failuremode was to test the affected units at a test facility that could produce a broadspectrum of neutron energies. However, the ADIRU manufacturer and aircraftmanufacturer did not consider that such testing would be worthwhile for severalreasons, including that:• A level of susceptibility to SEE had already been demonstrated through previousunit and component testing.• Design changes had been made to the later production ADIRUs to incorporateEDAC in the CPU, which would mitigate the effects of SEE.- 147 -