In-flight upset - 154 km west of Learmonth, WA, 7 October 2008,

The flight crew of the 12 September 2006 flight discussed their event withmaintenance watch, and completed a technical log entry. At the time, the eventappeared to be primarily associated with nuisance ECAM messages. There was noautopilot disconnection, and no effect on the flight control system. The crew turnedthe ADIRU off in flight, and the anomalous behaviour ceased. Line maintenancepersonnel realigned the unit and conducted a system test, and no further problemswere identified.Incident reporting, and incident investigation in order to prevent accidents, arevitally important components of a safety management system. However, equipmentfaults on modern aircraft are not uncommon. In a system comprising multipleredundant units, the failure of one unit typically does not lead to any effect on theoperation of a flight. Thorough investigations cannot be conducted into any incidentor fault unless there are indications of an underlying problem that could influencefuture safety. In this case, the benefits of a detailed investigation were not obvious.5.5.2 Systems for recording the in-service performance of equipmentAn issue encountered by the investigation was that the full performance histories ofthe major line-replaceable units (LRUs) on an aircraft, such as the ADIRUs orFCPCs, were not able to be easily reviewed or evaluated. Equipment manufacturersgenerally only have details of in-service problems when a unit is removed from theaircraft and sent to them for examination. They do not normally receive informationby operators on other in-service problems that do not warrant removal of the unit.Operators generally record these in-service problems in a database, and the databaserecord for each problem or event includes the aircraft and the type of equipmentinvolved. However, it generally does not include the specific unit(s) that may beassociated with the problem. Problems that recur over a short period could bereadily identified with this system by reviewing recent entries. However, problemsthat recur over a longer period would not be readily identified, particularly if theunits had been moved to a different position or another aircraft during that period.The existing situation meant that the full extent to which specific units, or groups ofunits of a particular type, were experiencing or reporting faults was generally notbeing assessed in a systemic way by either operators or manufacturers.Manufacturers also did not have an accurate picture of the extent to which unitswere shut down during a flight due to reported performance problems. A moredetailed recording system could therefore provide benefits for assessing the overallsafety, reliability and availability of each type of unit, and better identify potentiallyproblematic units.Even if the operator’s technical log database had recorded the unit associated witheach log entry, this enhanced recording would not have prevented the 7 October2008 occurrence. The history of previously reported faults for this unit was notfrequent enough or atypical enough to have warranted further investigation.5.5.3 Initial flight crew responseThere was a 2-minute period between the commencement of the ADIRU failure andthe flight control system’s first pitch-down command. The only flight crew actionthat would have prevented this pitch-down command was to select the ADR part ofADIRU 1 OFF.- 207 -