In-flight upset - 154 km west of Learmonth, WA, 7 October 2008,

that involved a NAV IR and/or NAV ADR fault message during the period from2003 to 2008, excluding the data-spike occurrences (section 3.9.2). Of these, theADIRU had been removed for examination on 24 occasions. The ADIRUmanufacturer had attributed the problem to a SEU on two occasions.One of these occasions involved a NAV IR 1 FAULT message on ADIRU 4122 on18 July 2008. The BITE data showed that a checksum fault had occurred (that is,the BITE detected that the copy of operational software stored in read-only memorywas different to the version loaded into RAM when the ADIRU was in operation).The ADIRU manufacturer reported that they had records of about 100 similarevents on LTN-101 units since 2000, and that similar errors had resulted during theunit testing in 2005.A high proportion of the 116 events were soft faults that resulted in the ADIRUshutting down. Insufficient information was available for most of these events todetermine the origin of the faults.The investigation considered the likelihood of two events occurring on a single unit.A typical computer silicon chip, or integrated circuit, is primarily made of millionsof tiny devices called transistors, each of which operates by accumulating anddistributing electric charges within the chip. At a nominal rate of 6,000 neutrons percm 2 per hour, a device with similar susceptibility and capacity to the CPU RAM onthe LTN-101 ADIRU was estimated to have an SEE every 75,000 operatinghours 166 , with the effects depending on the transistor or transistors affected.Accordingly, it is extremely unlikely that two separate SEEs involving the sametransistor would occur on a single unit. However, more than one transistor couldproduce the same failure mode if affected by SEE, and this would increase thelikelihood of the effect occurring more than once in the life of a unit. In addition, aparticular unit or group of units may have greater susceptibility relative to otherunits. Overall, the likelihood of two instances of a rare type of SEE occurring onone unit due to separate strikes on a small number of transistors was difficult toaccurately estimate but it was not considered negligible.3.6.7 SummaryThe investigation examined a range of potential triggers that may have initiated thedata-spike failure mode within the CPU module, and key points for each aresummarised in Table 26. Although a definitive conclusion could not be reached,there was sufficient information from multiple sources to conclude that most of thepotential triggers were very unlikely to have been involved.166Typically, an A330 might fly 4,500 hours in a year (with 70% of the total time spent at cruiselevels where neutron flux is highest). At that rate, 75,000 flight hours would equate to about 17years of aircraft operation. This is a ‘best case’ analysis as the flux value does not take intoaccount particles other than neutrons or neutrons at lower energy levels, or that a single neutronmay be able to pass through multiple transistors (that is, a side-on strike). It is possible that thecombined effects of these tolerances could reduce this period of aircraft operation by at least oneor two orders of magnitude.- 149 -