In-flight upset - 154 km west of Learmonth, WA, 7 October 2008,

There were two primary comparisons between the COM and MON channels’processes. The first comparison was conducted on the control orders generated bythe FCPC when it was the master. More specifically:• The COM channel computed the control orders, and the MON channelconducted the same computations and compared the results.• If a difference was detected that exceeded a threshold value for a predeterminedperiod of time, then:– the master FCPC was rendered inoperative 77– a F/CTL PRIM [1, 2 or 3] FAULT message was generated– the FCPC with the next highest priority took over as the master.The second comparison was conducted on the servo-control loop with each controlsurface. More specifically:• The computer’s COM channel sent servo signals to the hydraulic actuators tomove the control surface to the appropriate position (based on orders from themaster FCPC). The MON channel also computed the appropriate control surfaceposition and compared the results.• If a difference was detected between the computations and the position of theactuator or the control surface, and the difference exceeded a threshold value fora predetermined period of time, then:– the computer no longer performed that control function (but the rest of thecomputer’s functions were still available)– a fault message related to the computer and the control surface was generated– the computer with the next highest priority for the affected control surfacetook over as the servo-controller.For example, if a discrepancy was detected between the elevator position and thecomputed elevator position, and this difference was confirmed after the specifiedtime period, then a F/CTL PRIM 1 PITCH FAULT was generated. FCPC 2 thenbecame the servo-controller for the elevators.The predetermined time period for the servo-control loops comparison wassignificantly shorter than that for the control order comparison.2.1.4 Monitoring of ADIRU parametersGeneral monitoring logicAs the EFCS had full authority over the aircraft’s flightpath in normal law, it wasimportant that an FCPC’s control orders were based on the most accurate flight dataparameters from the ADIRUs.77In some cases the flight crew could reactivate the affected FCPC by following the recommendedECAM actions.- 70 -