In-flight upset - 154 km west of Learmonth, WA, 7 October 2008,

conditions using a top-down approach. If such failure scenarios are identified, theirprobability and consequences can then be analysed.When the FCPC algorithm for processing AOA data was developed in 1991 to1992,the aircraft manufacturer’s top-down search for weaknesses was not completelyeffective. With complex, highly-integrated systems, detecting failure scenarios isdifficult. The traditional processes for identifying failure scenarios use methodssuch as fault tree analysis that rely heavily on expert judgements, and there appearsto have been limited guidance available to design engineers and safety analysts toassist with these judgements. This situation was not specific to any manufacturer.In this case, the design limitation could probably have been identified if thedesigner engineers and safety analysts had conducted a systematic examination ofthe effects of all types of input values on the algorithm, for each of its modes ofoperation, and especially for the transitions between the modes. Based on theevidence available to the investigation, the extent that this was done could not bedetermined. Its thoroughness would have been adversely affected if anyassumptions were made on the types of potential AOA input values that wereexpected. It should be noted that such a systematic examination would not be asimple task for a whole, complex system. However, for a specific design change toa small part of a system, or for safety-critical functions, it is more justifiable. It isalso possible to conduct a partial examination of the effects of different input valueson an algorithm, if an exhaustive examination is not feasible.In recent years there have been many efforts directed at improving the efficiencyand effectiveness of safety assessment activities, and the aircraft manufacturer hasbeen significantly involved in many of these activities. These efforts include thedevelopment of improved guidance material for design engineers and safetyanalysts. However, it is also worth noting that system designs are generallybecoming more complex over time in an effort to meet multiple competingobjectives, including safety.In addition to the development of general guidance material, a focus of recentdevelopment work has been on model-based development and automated safetyanalysis. These approaches will undoubtedly assist design engineers and safetyanalysts, and help simplify the nature of their tasks with complex systems in thefuture. However, it is not clear that they would have been effective for identifyingthe design limitation in this case. For example, automated safety analysis techniquesagain focus on the effects of known equipment failure modes (a bottom-upapproach), and to date they have only dealt with relatively simple types of failuremodes. A failure mode involving multiple incorrect inputs a specific time apartwould probably be beyond the scope of this approach, at least at this time.Limitations of design requirements and assumptionsPast research has shown that most software design problems for safety-criticalsystems are due to incomplete requirements, particularly with regard to theinteraction between different systems. The development of complete and correctrequirements is a very important part of a system development process, and SSAactivities are one of the necessary activities for ensuring that the requirements areappropriate.The design limitation with the FCPC’s AOA algorithm appears to be an example ofincomplete requirements. However, this characterisation may not be particularly- 197 -