In-flight upset - 154 km west of Learmonth, WA, 7 October 2008,

Figure 54: Summary of results of SSA activities for FCPC algorithmThere were alternative algorithm designs or additional features that, in hindsight,would have prevented the design limitation or reduced its influence. Examplesinclude rate limiting on the three AOA input values, range checks on the inputvalues, or reasonableness checks involving comparisons between pitch and AOA.However, a system development process needs to balance many competingrequirements, such as minimising the risk of introducing new failure conditions anddesign errors, minimising the data processing resources required, and unnecessarycomplexity. The inclusion of specific design features must be based on an identifiedneed, and in this case the system development process did not identify the designlimitation and therefore the need for any additional features.The development of the new algorithm occurred in the period from 1991 to 1992,and determining the exact reasons why all of the development activities at that timedid not identify the design limitation was made difficult by the amount ofinformation available nearly 20 years later. Nevertheless, it is possible to discusssome contextual factors and inherent limitations associated with the systemdevelopment process.Limitations of using identified equipment failure modesDuring design reviews and SSA activities, design engineers and safety analysts usea variety of approaches and sources of information to identify design problems (orfailure scenarios) that will lead to the failure conditions of concern. A key approachis to use knowledge of how relevant items of equipment can fail or produceincorrect outputs, examine the effects of these failure modes in a particular design,- 195 -