In-flight upset - 154 km west of Learmonth, WA, 7 October 2008,

mode with the ADIRU that had not been previously identified by the ADIRUmanufacturer. Given the increasing complexity of such systems, this investigationhas offered an insight into the types of issues that will become relevant for futureinvestigations. It also identified a number of specific lessons or reminders for themanufacturers of new complex, safety-critical systems to consider. These include:• System safety assessments (SSAs) and other design evaluation activities shouldrecognise that ADIRUs and similar types of equipment can generate a widerange of patterns of incorrect data, including patterns not previouslyexperienced.• Failure mode effects analyses (FMEAs) have a limited ability to identify allequipment failure modes, particularly for complex, highly-integrated systems.• Where practicable for safety-critical functions, SSA and other design evaluationactivities should consider the effects of different values of system inputs in eachmode of operation, particularly during transitions between modes.• The BITE for ADIRUs and similar types of equipment should check the resultsof each key stage in the processing of output data.• SEEs are a potential hazard to aircraft systems that contain high-densityintegrated circuits. Designers should consider the risk of SEE and includespecific features in the system design to mitigate the effects of such events,especially in systems with a potentially significant influence on flight safety.• The in-service performance records for safety-critical line-replaceable unitsshould include all reported performance problems, not just those that result inthe removal of the unit from the aircraft.• The records for the key components within safety-critical systems shouldinclude details such as production or batch codes as well as the part numberwhere practicable.A broader lesson concerns the safety assessment activities needed for complexsystems. In recent years there have been developments in the guidance material forsystem development processes and research into new approaches for SSA.However, design engineers and safety analysts also perform a safety-criticalfunction, yet the investigation found little published research that has examined thehuman factors issues affecting such personnel. In other words, there has beenlimited research that has systematically evaluated how these personnel conduct theirevaluations of systems, and how the design of their tasks, tools, training andguidance material can be improved so that the likelihood of design errors isminimised. The need for further research and development in this area will becomemore important as system complexity increases over time.- 211 -