In-flight upset - 154 km west of Learmonth, WA, 7 October 2008,

If this scenario occurred, the FCPC would treat the second AOA spike as valid dataafter the end of the memorisation period.Scenario D in Figure 29 illustrates an example of this scenario involving incorrectinputs from AOA 1. AOA 2 remains at the actual value, while AOA 1 has twolarge-value spikes with the second present 1.2 seconds after the start of the first .The calculation of AOA FCPC input is as follows:• Before the first spike, the average of AOA 1 and AOA 2 (AOA average ) is used asthe basis of AOA FCPC input .• After the first spike is detected, the last valid value of AOA FCPC input is used for1.2 seconds.• After the 1.2-second memorisation period, the next values of AOA 1 and AOA 2are assumed to be valid, and they are used to calculate AOA FCPC input .• Following this initial sample, the normal mode of calculating AOA FCPC input isagain used (that is, the current AOA average followed by rate limiting). This meansthat, while the second AOA 1 spike is still present, it directly affectsAOA FCPC input .• After the second spike stops, the rate limiting causes the AOA FCPC input value tosteadily decrease back to the correct value (that is, the current average of AOA 1and AOA 2).Simultaneous AOA deviationsAnother scenario where incorrect AOA values from the ADIRUs couldsignificantly influence the value of AOA FCPC input involved simultaneous deviationsof two AOA values. The deviations had to be of similar magnitude throughout theirperiod of deviation. If this occurred, the algorithm would reject the correct AOAand base the AOA FCPC input on the average of the two remaining, incorrect values.The aircraft manufacturer had identified this scenario when it developed theA330/A340 aircraft. However, a simultaneous failure of two ADRs (or relatedcomponents) was considered to be ‘extremely improbable’ (section 2.5.3). 802.1.7 Effects of AOA changes on elevator control ordersTwo of the EFCS’s flight envelope mechanisms could respond to high AOA FCPC inputvalues and initiate a nose-down elevator command: high AOA protection and antipitch-up compensation. If both corrective mechanisms were triggered at the sametime, their contributions were added. The characteristics of the two EFCSmechanisms are summarised in Table 19.80By extension, another potential (and less likely) scenario could involve simultaneous deviations ofall three AOA values.- 76 -