In-flight upset - 154 km west of Learmonth, WA, 7 October 2008,

The ADIRU manufacturer’s analysis of the potential failure conditions was basedon the FMEA results and its knowledge of the ADIRU’s design. The safety analysisdocument noted that many of the conditions overlapped. With regard to‘indeterminate output’, the safety analysis document stated the following:An indeterminate output can have any value with respect to the correct value,and may, therefore, greatly exceed tolerance limits and cause failure warnings.It can also be radically variable with respect to the correct value. It appears tobe a combination of all the above defined failure categories, except Loss ofTransmission, plus additional factors, such as indeterminate processing faults.It generally will affect more than one output label.Based on this description, a data-spike occurrence could be considered as consistentwith an indeterminate output scenario. In addition, data spikes could also beconsidered to be consistent with a ‘large error’ scenario.The equipment specification did not state whether the failure conditions of interestwere permanent, transitory or intermittent. The discussion of the failure conditionsin the ADIRU manufacturer’s safety analysis document was consistent with either apermanent or transitory effect on the value of an output parameter, and there was nodiscussion of the potential for frequent or intermittent data spikes.The ADIRU manufacturer’s safety analysis provided estimated probabilities foreach of the 10 failure conditions for each parameter. For example, the estimatedindeterminate output failure rate for corrected AOA was 8.72 failures per millionflight hours (detected) and 0.11 failures per million flight hours (undetected). Thisestimation included a range of different failure types that were unrelated to thedata spike failure mode.3.9 ADIRU in-service performance3.9.1 Reliability levelsThe Airbus ADIRS equipment specification outlined minimum reliabilityrequirements. For the ADIRU, these were:• mean time between unscheduled removals (MTBUR 169 ) of 6,000 hours• mean time between failures (MTBF 170 ) of 6,315 hours.Units subject to an unscheduled removal were sent to the ADIRU manufacturer forexamination. If the reported problem was verified, then the fault was considered afailure. MTBUR data was based on the number of units returned for examination,and MTBF data was based on the number of returned units for which verifiedfailures were found. 171169170171The MTBUR was obtained by dividing the total number of flight hours logged by all units over acertain period of time by the number of units removed during that same period.The MTBF was obtained by dividing the total number of flight hours logged by all units over acertain period of time by the number of the units that failed during that the same period.Removal of a unit to update software or move the unit to another location were not counted as‘removals’ for MTBUR purposes.- 157 -