In-flight upset - 154 km west of Learmonth, WA, 7 October 2008,

and filtering of five parameters, including AOA. The standard was retrofitted to theoperator’s fleet of A330 aircraft, and completed in November 2009.The revised algorithm for processing AOA data again based AOA FCPC input on theaverage of AOA 1 and AOA 2, but it did not include the 1.2-second memorisationperiod. Additional processes were used to monitor the consistency of the three AOAvalues The new algorithm also introduced a mechanism to monitor the overallconsistency or oscillation of each AOA, with the associated ADR being rejected forthe remainder of the flight if a problem was detected. In the event that an ADR wasrejected due to a problem with AOA data, the flight warning system (FWS) wouldnot issue any spurious stall warnings associated with that ADR’s data.Subsequent FCPC software standards were developed for use on allA330/A340 aircraft. These later standards included the redesign of the AOAalgorithm (as discussed above), as well as modified algorithms for a number ofother ADIRU parameters used by the FCPCs. During 2011, the new softwarestandards were certified by EASA for all but one of the A330/A340 models. Thestandard for the last model was expected to be certified in February 2012.When retrofit action has been completed, the aircraft manufacturer (in consultationwith EASA) will cancel the relevant OEBs.ATSB assessmentThe ATSB is satisfied that the action being taken by the aircraft manufacturer willsatisfactorily address the safety issue.7.1.2 Processes for developing flight control computer algorithmsMinor safety issueWhen developing the A330/A340 flight control primary computer software in theearly 1990s, the aircraft manufacturer’s system safety assessment and otherdevelopment processes did not fully consider the potential effects of frequent spikesin the data from an air data inertial reference unit.Action taken by AirbusFollowing the 7 October 2008 occurrence, the aircraft manufacturer reviewed theFCPC algorithms for processing each ADIRU parameter on the A330/A340 aircraft.The review examined the amplitude, duration and frequency of data spikes thatcould potentially affect the FCPC’s control of the aircraft’s flightpath. In addition todata spikes, other potential incorrect data patterns were also considered. Based onthis review, modifications were made to the algorithms for processing a number ofthe ADIRU parameters used by the FCPCs.In addition to the A330/A340, the manufacturer also reviewed the algorithms usedfor processing ADIRU parameters by the flight control computers on the A320 andA380 aircraft.The manufacturer also advised that it will apply the lessons learnt from the7 October 2008 occurrence in terms of the types of incorrect data patterns to betaken into account during future design definition and modification. Accordingly,- 219 -