In-flight upset - 154 km west of Learmonth, WA, 7 October 2008,

Nevertheless, the FCPC’s AOA algorithm could not effectively manage a scenariowhere there were multiple spikes such that one triggered a memorisation period andanother was present 1.2 seconds later. The problem was that, if a 1.2-secondmemorisation period was triggered, the FCPCs accepted the next values of AOA 1and AOA 2 after the end of the memorisation period as valid. In other words, thealgorithm did not effectively handle the transition from the end of a memorisationperiod back to the normal operating mode when a second data spike was present.5.2.2 Risk associated with the design limitationThe first in-flight upset resulted in a large number of injuries, some of them serious,and it was very distressing to many of the aircraft’s occupants. However, it is veryunlikely that the FCPC design limitation could have been associated with a moreadverse outcome. More specifically:• The 10° nose-down elevator command was very close to the highest magnitudepossible from the EFCS’s two corrective mechanisms. The second AOA spikeof 50.6° resulted in the AOA value used by the FCPCs (AOA FCPC input ) being 26°.If the AOA FCPC input had been over 30°, the EFCS would have reverted toalternate law, which would have resulted in one of its corrective mechanisms(high AOA protection) not being active.• There was limited potential for multiple pitch-downs of the same magnitude. Asdemonstrated during the occurrence flight, the fault-detection processes of theFCPCs would be expected to lead to the EFCS reverting to alternate law aftertwo pitch-downs.• The aircraft only descended a total of 690 ft during the first pitch-down.Although this was due in part to prompt action by the flight crew, the magnitudeof the pitch-down would have been much less if the same AOA spike patternhad occurred when the aircraft was closer to the ground. Anti pitch-upcompensation was not available when the aircraft was in the approachconfiguration or the speed was less than 0.65 Mach (which occurs duringdescent and initial climb). In addition, high AOA protection would have had noeffect when the aircraft was below 500 ft above ground level. Flight simulationsalso showed that an undesired pitch-down just above 500 ft would be easilyrecoverable by a flight crew.• If a pitch-down had occurred during climb or descent, more of the aircraft’soccupants would have had their seat belts fastened (as the seat-belt sign wouldhave been illuminated).It is possible to conceive of situations where a flight crew could overreact to asignificant nose-down command, which could result in more significantaccelerations experienced in the cabin. In addition, if the cabin crew had been usingservice carts at the time, this could have led to more serious injuries. However, itwould seem very unlikely that the pitch-down could have led to the loss of theaircraft or a large number of fatalities. Accordingly, the 7 October 2008 accidentfitted the classification of a ‘hazardous’ effect rather than a ‘catastrophic’ effect, asdefined by the relevant European certification requirements.Determining the risk level of a failure condition, such as an undesired pitch-downcommand, involves considering the probability as well as the consequences of thecondition. It is impossible to eliminate all potential hazards, and a system design- 193 -