In-flight upset - 154 km west of Learmonth, WA, 7 October 2008,

monitored external systems that provided data to them, such as the ADIRUs, tocheck the validity and consistency of this data (section 2.1.4).• Data diversity. The computers’ clocks were not synchronised, and the COM andMON channels’ clocks in each computer were not synchronised. The computersand channels therefore used data sampled from the sensors and external systems(such as the ADIRUs) at slightly different times, which added robustness to themonitoring processes.• Equipment dissimilarity. The hardware and software for the FCPCs and FCSCswere different. In addition, the software for the COM and the MON channelswere developed by different teams using the same specification. The use ofseparate design implementations reduced the potential influence of commonmodefailures or software coding errors.• Flight control law reconfiguration. If there were certain types of faults orprocessing problems, the EFCS reverted to a lower level of control law becauseit could not provide flight envelope protections with the appropriate level ofreliability.• Physical segregation. The computers were installed in separate locations on theaircraft, which helped prevent a total loss of functionality in the event of sometypes of damaging events. Hydraulic and electrical system routes were alsosegregated.2.1.3 FCPC self-monitoring logicAs illustrated in Figure 27, each FCPC consisted of two physically independentchannels; a COM channel and a MON channel. Both channels obtained separateinputs from other systems, such as the ADIRUs and the position sensors in thecontrol surfaces.Figure 27: Self-monitoring processes for elevator movement (simplified)- 69 -