In-flight upset - 154 km west of Learmonth, WA, 7 October 2008,

useful in this case. If the EFCS specification included a requirement for the AOAalgorithm to be robust to all types of failures of a single ADIRU (and not just anAOA runaway), this would not have necessarily led to any additional analysis,simulation or testing of the design. According to the manufacturer, the developmentprocess had already considered other types of incorrect ADIRU outputs. Arequirement that the design should be robust against multiple data spikes wouldprobably have been more effective, but such a specific requirement wouldrealistically only have been included if the design limitation had already beenidentified, or similar design problems had been identified in the past. In otherwords, it seems more useful to consider the incomplete requirements of the FCPCalgorithm as a problem with the SSA and other design evaluation activities, ratherthan simply a problem with the requirements themselves.The aircraft manufacturer advised that it had assumed during the developmentprocess that the algorithm was robust to any problem on a single ADIRU. Therewas no evidence that this assumption was formally stated in the SSA or the systemspecification. However, as already noted, the development process considered othertypes of incorrect ADIRU outputs that were known or expected, and including aformal assumption would not necessarily have led to any additional analysis,simulation or testing.Limitations of simulation and testing activitiesAnother means of detecting a design problem is through the use of the simulationand testing activities conducted during the verification and validation processes.However, the selection of the simulations and tests needs to be prioritised based onan identified need, and this will usually focus on confirming that the design meetsthe specified requirements, and that it effectively manages identified failure modesor specific types of incorrect inputs. Any activities beyond the scope of verifyingthe explicitly-defined design requirements must rely on the expertise of thoseinvolved, which is as fallible as any other human activity.Due to the wide range of potential inputs into a complex system such as the EFCS,simulation and testing programs cannot exhaustively examine all the possiblepatterns of inputs. In the case of the FCPC algorithm for processing AOA, thesimulation and testing activities examined the new design’s ability to handle thesituation that led to the redesign. They also included previously identified tests toensure there were no regression problems with the system design. However, theywould not realistically have included a scenario involving multiple AOA dataspikes1.2 seconds apart unless the potential problem had previously beenidentified.SummaryOverall, the manufacturer’s development process for the A330/A340 EFCS in theearly 1990s included many appropriate, state-of-the-art safety assurancemethodologies, and its SSA process was consistent with industry standards at thetime. Nevertheless, a design limitation was inadvertently introduced during theredesign of the FCPC algorithm for processing AOA data.The aircraft manufacturer’s bottom-up search for failure scenarios was unlikely tobe effective in identifying the design limitation because the ADIRU failure modehad not been previously encountered, or identified by the ADIRU manufacturer inits FMEA. The exact reasons why the top-down search processes did not detect the- 198 -