In-flight upset - 154 km west of Learmonth, WA, 7 October 2008,

problem could not be determined based on the available information. However,overall it can be concluded that the design, verification and validation processes(including safety assessment) used by the aircraft manufacturer did not fullyconsider the potential effects of frequent spikes in the data from an ADIRU.This occurrence provided several lessons or reminders for the manufacturers ofcomplex, safety-critical systems, and these lessons are discussed further insection 5.6.5.3 ADIRU data-spike failure mode5.3.1 Nature of the failure modeThe AOA data spikes that occurred during the 7 October 2008 flight were just oneaspect of a specific failure mode involving the LTN-101 model ADIRU. The keyfeatures of the failure mode were as follows:• The ADIRU outputted numerous spikes on air data reference (ADR) parameters.The spikes had short durations (less than 1 second), occurred at different timesand frequencies for each parameter, and had a limited number of values formany of the parameters. With the exception of the data spikes, all of the ADRoutput data appeared to be correct. The ADIRU outputted the data spikes toother systems as valid data.• The ADIRU also outputted numerous spikes on inertial reference (IR)parameters, with similar characteristics to the ADR spikes. In addition, the restof the IR data varied from the expected values, usually showing some oscillatorycharacteristics. The ADIRU outputted almost all of its IR data to other systemsas invalid data.• The ADIRU generated an IR fault caution message but it did not generate anADR fault message.• Although some of the ADIRU’s fault detection processes had worked (forexample, to flag the IR data as invalid and generate an IR fault), no faultmessages were recorded in the unit’s built-in test equipment (BITE) memory. Inaddition, some routine BITE information was not recorded.• Once the failure mode started, the ADIRU’s abnormal behaviour occurred at arelatively constant rate until it was shut down. After its power was cycled(turned off and on), the unit performed normally (that is, the problem was a‘soft’ fault).Overall, the data-spike failure mode affected a wide range of the ADIRU’sfunctional areas. The failure mode is only known to have occurred on threeoccasions, with very similar behaviour occurring on each occasion. Two of thoseoccasions involved the same ADIRU (serial number 4167).Although there were instances of ADIRU failures on other occasions, they did notexhibit the same effects on the output data. However, the effects on the recordedBITE data were similar to another LTN-101 failure mode known as dozing, whichwas also a soft fault. In contrast to the data-spike events, dozing was considered abenign failure mode since all data output from the ADIRU had ceased. There wasinsufficient evidence to determine whether any common contributing factors wereinvolved in producing the two failure modes.- 199 -