In-flight upset - 154 km west of Learmonth, WA, 7 October 2008,

not be determined. However, the failure mode was probably initiated by a single,rare type of trigger event combined with a marginal susceptibility to that type ofevent within the CPU module’s hardware. The key components of the two affectedunits were very similar, and overall it was considered likely that only a smallnumber of units exhibited a similar susceptibility.Some of the potential triggering events examined by the investigation included asoftware ‘bug’, software corruption, a hardware fault, physical environment factors(such as temperature or vibration), and electromagnetic interference (EMI) fromother aircraft systems, other on-board sources, or external sources (such as a navalcommunication station located near Learmonth). Each of these possibilities wasfound to be unlikely based on multiple sources of evidence. The other potentialtriggering event was a single event effect (SEE) resulting from a high-energyatmospheric particle striking one of the integrated circuits within the CPU module.There was insufficient evidence available to determine if an SEE was involved, butthe investigation identified SEE as an ongoing risk for airborne equipment.The LTN-101 had built-in test equipment (BITE) to detect almost all potentialproblems that could occur with the ADIRU, including potential failure modesidentified by the aircraft manufacturer. However, none of the BITE tests weredesigned to detect the type of problem that occurred with the air data parameters.The failure mode has only been observed three times in over 128 million hours ofunit operation, and the unit met the aircraft manufacturer’s specifications forreliability and undetected failure rates. Without knowing the exact failuremechanism, there was limited potential for the ADIRU manufacturer to redesignunits to prevent the failure mode. However, it will develop a modification to theBITE to improve the probability of detecting the failure mode if it occurs onanother unit.Use of seat beltsAt least 60 of the aircraft’s passengers were seated without their seat belts fastenedat the time of the first pitch-down. Consistent with previous in-flight upsetaccidents, the injury rate, and injury severity, was substantially greater for thosewho were not seated or seated without their seat belts fastened.Passengers are routinely reminded every flight to keep their seat belts fastenedduring flight whenever they are seated, but it appears some passengers routinely donot follow this advice. This investigation provided some insights into the types ofpassengers who may be more likely not to wear seat belts, but it also identified thatthere has been very little research conducted into this topic by the aviation industry.Investigation processThe Australian Transport Safety Bureau investigation covered a range of complexissues, including some that had rarely been considered in depth by previous aviationinvestigations. To do this, the investigation required the expertise and cooperationof several external organisations, including the French Bureau d’Enquêtes etd’Analyses pour la sécurité de l’aviation civile, US National Transportation SafetyBoard, the aircraft and FCPC manufacturer (Airbus), the ADIRU manufacturer(Northrop Grumman Corporation), and the operator.- xvii -