In-flight upset - 154 km west of Learmonth, WA, 7 October 2008,

FCPC design limitationAOA is a critically important flight parameter, and full-authority flight controlsystems such as those equipping A330/A340 aircraft require accurate AOA data tofunction properly. The aircraft was fitted with three ADIRUs to provide redundancyand enable fault tolerance, and the FCPCs used the three independent AOA valuesto check their consistency. In the usual case, when all three AOA values were validand consistent, the average value of AOA 1 and AOA 2 was used by the FCPCs fortheir computations. If either AOA 1 or AOA 2 significantly deviated from the othertwo values, the FCPCs used a memorised value for 1.2 seconds. The FCPCalgorithm was very effective, but it could not correctly manage a scenario wherethere were multiple spikes in either AOA 1 or AOA 2 that were 1.2 seconds apart.Although there were many injuries on the 7 October 2008 flight, it is very unlikelythat the FCPC design limitation could have been associated with a more adverseoutcome. Accordingly, the occurrence fitted the classification of a ‘hazardous’effect rather than a ‘catastrophic’ effect as described by the relevant certificationrequirements. As the occurrence was the only known case of the design limitationaffecting an aircraft’s flightpath in over 28 million flight hours on A330/A340aircraft, the limitation was within the acceptable probability range defined in thecertification requirements for a hazardous effect.As with other safety-critical systems, the development of the A330/A340 flightcontrol system during 1991 and 1992 had many elements to minimise the risk of adesign error. These included peer reviews, a system safety assessment (SSA), andtesting and simulations to verify and validate the system requirements. None ofthese activities identified the design limitation in the FCPC’s AOA algorithm.The ADIRU failure mode had not been previously encountered, or identified by theADIRU manufacturer in its safety analysis activities. Overall, the design,verification and validation processes used by the aircraft manufacturer did not fullyconsider the potential effects of frequent spikes in data from an ADIRU.ADIRU data-spike failure modeThe data-spike failure mode on the LTN-101 model ADIRU involved intermittentspikes (incorrect values) on air data parameters such as airspeed and AOA beingsent to other systems as valid data without a relevant fault message being displayedto the crew. The inertial reference parameters (such as pitch attitude) containedmore systematic errors as well as data spikes, and the ADIRU generated a faultmessage and flagged the output data as invalid. Once the failure mode started, theADIRU’s abnormal behaviour continued until the unit was shut down. After itspower was cycled (turned OFF and ON), the unit performed normally.There were three known occurrences of the data-spike failure mode. In addition tothe 7 October 2008 occurrence, there was an occurrence on 12 September 2006involving the same ADIRU (serial number 4167) and the same aircraft. The otheroccurrence on 27 December 2008 involved another of the same operator’s A330aircraft (VH-QPG) but a different ADIRU (serial number 4122). However, nofactors related to the operator’s aircraft configuration, operating practices ormaintenance practices were found to be associated with the failure mode.Many of the data spikes were generated when the ADIRU’s central processor unit(CPU) module intermittently combined the data value from one parameter with thelabel for another parameter. The exact mechanism that produced this problem could- xvi -