In-flight upset - 154 km west of Learmonth, WA, 7 October 2008,

3.8.3 Summary analysesThe FMEA results were grouped together in a failure mode and effects summary(FMES) for each module. Based on this information, higher level summaries weredeveloped for each module in terms of the overall failure rate (for the IR and ADRparts separately), and the proportion of the failures that were detected andundetected. For example, the estimated detected failure rate for the CPU modulewas 6.34 failures per million flight hours, and the undetected failure rate was0.10 failures per million flight hours. The overall BITE effectiveness for the CPUmodule was calculated to be 98.52%.The ADIRU manufacturer’s safety analysis document compared the summary datawith the Airbus safety objectives. In terms of the safety objective for an ‘undetectedfailure of one IR or one ADR’, it was calculated to be 0.72 × 10 -5 per flight hour,which was less than the objective of 3 × 10 -5 per flight hour.3.8.4 Failure analysis of output parametersThe Airbus ADIRS equipment specification required that the ADIRU manufacturerdetermine the detected and undetected failure rate of 10 failure conditions for53 output data parameters (including AOA) (Table 27). It did not state anyrequirements regarding the probability levels of the failure conditions.Table 27: Output parameter failure conditionsFailure conditionLoss of transmissionDescriptionA ‘dead’ output on one or more outgoing databuses.OscillatoryGain errorTransport delay errorRepetitive variations around a central value with an outputamplitude out of tolerance.Output value is X times the actual physical value, with X beingsuch that the output parameter may be out of tolerance.Delays in transmitting output data.Frozen outputA constant value the same as that previously transmitted.Limited errorLimited driftLarge errorLarge driftIndeterminate outputA parameter out of tolerance in terms of its value but still withinthe defined range (that is, within specified limits).A parameter drifting from its actual value at a rate that was lessthan the defined limit per minute.Same as ‘limited error’, but the value is outside the definedrange.Same as ‘limited drift’, but the value drifts at a rate greater thanthe define limit per minute.Output could have any value with respect to the correct value.- 156 -