In-flight upset - 154 km west of Learmonth, WA, 7 October 2008,

modifications were made to its guidance document ABD0200 (Guidelines andrequirements for the system designers).7.2 Air data inertial reference unit issues7.2.1 Data-spike failure mode occurrencesMinor safety issueOne of the aircraft’s three air data inertial reference units (ADIRU 1) exhibited adata-spike failure mode, during which it transmitted a significant amount ofincorrect data on air data parameters to other aircraft systems, without flagging thatthis data was invalid. The invalid data included frequent spikes in angle of attackdata. Including the 7 October 2008 occurrence, there have been three occurrences ofthe same failure mode on LTN-101 ADIRUs, all on A330 aircraft.Action taken by Northrop Grumman CorporationThe ADIRU manufacturer advised in November 2010 that it had examined a widerange of possible mechanisms within the LTN-101’s central processing unit (CPU)module that may have produced the air data reference data spikes. Although theexact mechanism could not be identified, it was considering options to improve therobustness of some of the CPU module’s processing activities.7.2.2 Design of built-in test equipmentMinor safety issueFor the data-spike failure mode, the built-in test equipment of the LTN-101 air datainertial reference unit was not effective, for air data reference, in detecting theproblem, communicating appropriate fault information, and flagging affected dataas invalid.Action taken by Northrop Grumman CorporationThe ADIRU manufacturer conducted a detailed review of options for improving theLTN-101 BITE so that another instance of the data-spike failure mode would bedetected. The options included comparisons of the data and/or label fields that wereexpected to be outputted on certain parameters with the data and/or label fieldsactually outputted. However, during testing it was found that these modificationoptions adversely affected the performance of high-frequency tasks.Subsequently, at the aircraft manufacturer’s request, the ADIRU manufacturerenhanced the wraparound monitor test on the dummy label (section 3.7.3) toimprove the ADIRU’s ability to detect data transmission failures. More specifically:• The filter was reduced from three consecutive failures to two.• A class 1 maintenance fault message will be declared if two output databusesfail from either the IR part or the ADR part (previously all databuses had to failfrom one part to reach a class 1 level).- 220 -