In-flight upset - 154 km west of Learmonth, WA, 7 October 2008,

• All three events occurred in a broadly similar, geographical area (within a radiusof 760 km). There was significant public interest during the investigation in thepotential effects of transmissions from the Harold E. Holt Naval CommunicationStation, which was located in this area. However, based on several differenttypes of evidence, the investigation found that it was very unlikely that thestation’s transmissions would have adversely affected the ADIRU. This includesevidence from ADIRU and aircraft testing, and the fact that the magnitude of thestation’s transmissions at the location of the three occurrences was severalorders of magnitude below what the ADIRU (and aircraft) were designed andtested to tolerate.• Two events involved the same ADIRU (unit 4167), and the other event involvedan ADIRU with a similar configuration and serial number (unit 4122). Therewas nothing unique or anomalous with the affected units’ software, and therewere over 8,000 LTN-101 units in service. Accordingly, it was reasonable toconclude that some aspect of the affected units’ hardware was probablyassociated with the failure mode.Failure mechanismA series of analyses determined that the failure mode almost certainly occurred withthe ADIRU’s central processing unit (CPU) module. More specifically, evidenceindicated that many of the data spikes for ADR parameters were produced when theCPU module packaged the 32-bit output data words. These data spikes were foundto be the result of the data word being packaged with either the wrong label field, orthe wrong data field. Evidence also indicated that the CPU module’s dataprocessing stages before and after the data packaging operated normally for theADR data.The packaging problem was intermittent rather than consistent. In addition, it wasvery unlikely that each data spike was due to a separate fault, failure or triggerevent. A much more likely scenario is that the failure initiated a problem in ahigher-order process for organising the storage or retrieval of buffered data withinthe CPU module. Other symptoms of the failure mode, such as the corruption of theIR data and the storing of BITE data, also involved buffering data in memory. Theinvestigation was not able to identify the precise mechanism involved, althoughsome possibilities were able to be excluded (such as corruption of the data labels orproblems with the wait states).Unit susceptibilityAs discussed above, the failure mode probably involved some form of hardwareproblem. The data-packaging process involved several components within the CPUmodule, including the CPU chip, application-specific integrated circuit (ASIC), await-state random access memory (RAM) chip, and four RAM chips for generalCPU use. The investigation was not able to identify which of these component(s)were directly involved.There can be variations in the properties of components with the same part number,including those manufactured within the same batch but even more so for thosemanufactured in different batches. The two affected ADIRUs had CPU-modulecomponents that were manufactured in the same or adjacent batches. Due tolimitations in the way that component details were recorded, the investigation wasunable to determine how many other ADIRUs contained components that were- 202 -