AC 23-17C

Advisory circular · SYSTEMS AND EQUIPMENT GUIDE FOR CERTIFICATION OF PART 23 AIRPLANES AND AIRSHIPS

Approved
November 17, 2011
Last reviewed
January 30, 2020
Cancels
AC23-17B
Family
AC 23-17 · 4 versions
Revision
C
14 CFR parts
23

Guidance, not mandatory unless a rule or AD requires it. DRS record last changed October 23, 2026.

Show pages 196–207
Page 208Open in PDF

200 that the engine quits is useless. A warning light system that would comply with this proposal would be sophisticated enough to read transients and trends, and would give a useful warning to the pilot. The FAA expects this proposal to result in fuel systems that provide the pilot with useful engine operating information; thereby, it would offer more value to the operator. Today, fuel pumps are more reliable than those built in the 1940s and 50s. Consequently, airplane operators are more concerned about reducing engine-operating costs than they are about the probability of a fuel pump failure.

A fuel flow indicator offers additional value compared to a fuel pressure indicator. It enables the operator to monitor the engine's fuel consumption and compare it to fuel consumption listed in the airplane flight manual. If a fuel monitoring system is installed that automatically controls the engine or helps the pilot to properly lean the fuel mixture, then engine operation would be optimized and the direct operating costs would go down through reduced fuel consumption. Reciprocating engines run better if the fuel to air mixture is leaned out according to the optimum (manufacturer's) specified setting. Furthermore, fuel flow also rotates to power, and pilots can use fuel flow readings to quickly access the health of their engine during critical phases of flight, such as takeoff.

Comprehensive engine monitors and redesigned electronic engine instrument displays are also being used in experimental aircraft. The FAA should encourage airplane manufacturers to utilize new technology to improve operation and reduce operating costs. New engine monitoring systems may improve reliability and engine life resulting in increased safety.

The proposal would achieve the same safety objective as the current rule; the crew would have sufficient warning of any negative trend that could lead to partial or total engine failure. However, the proposal recognizes that this objective can be achieved by measuring fuel pressure, fuel flow, or with a "smart" fuel monitoring system.”

This proposal was further explained by Final Rule, Docket 28011 as follows:

“Transport Canada questions the ability to show compliance with the requirement in Sec. 23,1549 to identify maximum and, if applicable, minimum safe operating limits as well as the normal operating range of the instrument. This commenter points out that the typical fuel flow meter is a digital type, and it would be difficult for the applicant to provide equivalent markings. Engine manufacturers provide the information required by Sec. 23.1549, which is then usually transcribed to the installed fuel pressure gauge. It appears that this information would not be presented through the use of typical digital fuel flow meters. The commenter offers the following suggestion: "FAR 23.1549 was written with a traditional dial instrument in mind where the engine limitations could be easily displayed on the face of the unit and monitored by the crew. To allow flow meters or other fuel system monitors to satisfy the requirements of Sec. 23.1549 where such a gauge no longer exists, compliance could be shown by (1) different colors to indicate changing trends in system performance (e.g., amber color for a low pressure/flow condition, red for

Page 209Open in PDF

201 impending engine failure), or (2) placarding, if appropriate, to indicate the normal and abnormal operating ranges"

The FAA agrees with the commenters' suggestions as an acceptable means of compliance with § 23.1549. Suggested items (1) and (2) above offer the pilot a means to determine fuel flow limitations, which may be needed if a fuel flow meter is installed.

A commenter from Australia supports the proposal; however, the commenter feels the proposed text would require a monitoring system that provides a warning of any trend that could lead to engine failure, which is a difficult compliance requirement. The commenter further states: "The historic requirement, and the NPRM preamble, clearly addresses fuel pressure (as an indication of the availability of fuel flow) or fuel flow only. Such wording may stifle the development of monitoring instrumentation for small airplanes". The commenter suggests that, for clarification, the proposed text for Sec. 23.1305(b)(4)(ii), be amended to read as follows: "That continuously monitors the fuel system and warns the pilot of any fuel flow trend that could lead to engine failure".

The FAA agrees with the commenter the proposed wording may be too broad, making compliance difficult or the system unnecessarily complex. The FAA encourages "smart" systems; however, the intent of the proposal was to warn the pilot of any fuel flow trend and, for that reason, the final rule and the preamble adopt the commenters' language.

Section 23.1305 is adopted with the change in § 23.1305(b)(4)(ii) to add the words "fuel flow" before the word "trend.”

Page 210Open in PDF

23.1307 Miscellaneous equipment

The corresponding rule in CAR 3 is CAR 3.655.

The corresponding airworthiness criteria is section 6.5, Airship Design Criteria, FAA-P-8110-2, Change 2.

Amendment 23-43 and Subsequent

A proposed revision in NPRM 90-23 explains a revision to this amendment as follows: “This proposal deletes the word "an approved" in Section 23.1307, and adds a new requirement that all equipment items necessary for the airplane to operate in the NAS to its maximum approved altitude and in all kinds of operations for which it is approved must be included in the type design.

Conference proposal 432 recommended deleting Section 23.1307(a) in its entirety, because it was redundant to Section 23.785(b). Conference proposal 433 recommended deleting only the word "approved" in Section 23.1307(a).

Both Sections 23.1307 and 23.785(b) contain seat requirements; however, Section

23.1307(a) only requires a seat or berth for each occupant, while Section 23.785(b) contains specific design requirements for each seat, berth, safety belt, and shoulder harness, but does not include requirements for a seat or berth to be provided for each occupant. The requirements of Section 23.1307(a) were added by amendment 23-23 to eliminate questions as to the maximum seating capacity and compliance with the emergency exit requirements. The FAA does not consider these requirements to be redundant and plans no further action on these recommendations.

A new paragraph (c) is added because the FAA considers it necessary to clarify the type design requirements for part 23 airplanes relative to equipment items.

Frequently, manufacturers have requested their airplanes be approved relative to structural, performance, and propulsion requirements for a specific altitude without also requesting approval of necessary equipment to operate at that altitude. The FAA considers it necessary for the type design to include all equipment necessary for the type design to include all equipment necessary for operation in accordance with the limitations required by Sections 23.1559 and 23.1583.”

Amendment 23-49 and Subsequent

A proposed revision in NPRM 94-21explains this amendment as follows: “This proposal would remove the requirement of Sec. 23.1307(a) which is being added to Sec. 23.785. The discussion of sec. 23.785 covers this change. Also, the provisions of Sec. 23.1307(b)(1), (b)(2), and (b)(3), are being removed from Sec. 23.1307. These requirements have been previously added to Secs. 23.1361, 23.1351, and 23.1357, respectively; therefore, they are redundant and may be removed. The designator for paragraph (c) has also been removed from the remaining text of this section.”

Page 211Open in PDF

23.1308 High-Intensity Radiated Fields (HIRF) Protection

There are no corresponding rule or airworthiness criteria in CAR 3 or the Airship Design Criteria.

Amendment 23-57 and Subsequent

See AC 20-158 and Policy Memo AIR-100-HIRF Final Rule under 21.101, “Application of High-intensity Radiated Fields (HIRF) Protection Final Rule under §21.101.”

Final Rule FAA-2006-23657 stated: “The electromagnetic HIRF environment results from the transmission of electromagnetic energy from radar, radio, television, and other ground-based, shipborne, or airborne radio frequency (RF) transmitters. This environment has the capability of adversely affecting the operation of aircraft electrical and electronic systems. Although the HIRF environment did not pose a significant threat to earlier generations of aircraft, in the late 1970s designs for civil aircraft were first proposed that included flight-critical electronic controls, electronic displays, and electronic engine controls, such as those used in military aircraft.

These systems are more susceptible to the adverse effects of operation in the HIRF environment. Accidents and incidents involving civil aircraft with flight critical electrical and electronic systems have also brought attention to the need to protect these critical systems from high-intensity radiated fields. Further, the need to protect these systems in aircraft has increased substantially in recent years because of—

(1) A greater dependence on electrical and electronic systems performing functions required for the continued safe flight and landing of aircraft;

(2) The reduced electromagnetic shielding afforded by some composite materials used in aircraft designs;

(3) The increase in susceptibility of electrical and electronic systems to HIRF because of increased data bus or processor operating speeds, higher density integrated circuits and cards, and greater sensitivities of electronic equipment;

(4) Expanded frequency usage, especially above 1 gigahertz (GHz);

(5) The increased severity of the HIRF environment due to an increase in the number and power of RF transmitters; and

(6) The adverse effects experienced by some aircraft when exposed to HIRF.

Recognizing the need to address the vulnerability of aircraft electrical and electronic systems to HIRF, the FAA published a notice of proposed rulemaking (NPRM) on February 1, 2006 (71 FR 5553). The NPRM includes a description of the HIRF- related incidents that provided some of the impetus for this rulemaking. It also

Page 212Open in PDF

204 includes a description of the collaborative efforts the FAA undertook in developing these rule changes. We encourage interested readers to refer to the NPRM for additional information.

This final rule amends the airworthiness standards for normal, utility, acrobatic, and commuter category airplanes certificated under part 23; transport category airplanes certificated under part 25; normal category rotorcraft certificated under part 27; and transport category rotorcraft certificated under part 29. Under the rule, applicants for certification of aircraft under these parts are required to demonstrate that any electrical and electronic system that performs a function whose failure would prevent the continued safe flight and landing of the aircraft must be designed and installed so that—

(1) Each function is not adversely affected during and after the time the aircraft is exposed to a specifically designated HIRF environment (HIRF environment I);

(2) Each electrical and electronic system automatically recovers normal operation of that function, in a timely manner, after the aircraft is exposed to HIRF environment I, unless this conflicts with other operational or functional requirements of that system;

and

(3) Each electrical and electronic system is not adversely affected during and after the aircraft is exposed to a less severe, but more commonly encountered HIRF environment (HIRF environment II). HIRF environment I sets forth test and analysis levels that are used to demonstrate that an aircraft and its systems meet basic HIRF certification requirements. HIRF environment I represents the range of electromagnetic field strengths that an aircraft could encounter during its operational life. HIRF environment II is an estimate of the electromagnetic field strengths more likely to be encountered in the airspace above an airport or heliport at which routine departure and arrival operations take place. The rule also contains specific provisions for rotorcraft that differ from those applicable to airplanes. The rule requires rotorcraft to meet additional HIRF certification standards because rotorcraft operating under visual flight rules (VFR) do not have to comply with the same minimum safe altitude restrictions for airplanes specified in § 91.119 and, therefore, may operate closer to RF transmitters. Accordingly, any electrical and electronic system that performs a function required during operation under VFR and whose failure would prevent the continued safe flight and landing of the rotorcraft must be designed and installed so that the function is not adversely affected during and after the time the rotorcraft is exposed to a specified HIRF environment unique to rotorcraft (HIRF environment III). HIRF environment III presents worst case estimates of the electromagnetic field strength in the airspace in which VFR rotorcraft operations are permitted. Rotorcraft operating under instrument flight rules (IFR), however, normally have to comply with more restrictive altitude limitations and, therefore, electrical and electronic systems with functions required for IFR operations must not be adversely affected when the rotorcraft is exposed to

Page 213Open in PDF

205 HIRF environments I and II. This final rule also establishes equipment HIRF test levels for electrical and electronic systems. It requires each electrical and electronic system that performs a function whose failure would significantly reduce the capability of the aircraft or the ability of the flightcrew to respond to an adverse operating condition to be designed and installed such that it is not affected adversely when the equipment providing the function is exposed to equipment HIRF test level 1 or 2. HIRF test level 1 allows an applicant to use an industry standard test method for compliance. HIRF test level 2 allows an applicant to use equipment test levels developed for the specific aircraft being certificated. Either of these test levels may be used to demonstrate HIRF protection. Additionally, the final rule requires each electrical and electronic system that performs a function whose failure would reduce (but not significantly) the capability of the aircraft or the ability of the flightcrew to respond to an adverse operating condition to be designed and installed such that it is not affected adversely when the equipment providing these functions is exposed to equipment HIRF test level 3. HIRF test level 3, like HIRF test level 1, allows an applicant to use an industry standard test method for compliance that is not as rigorous as that specified by HIRF test levels 1 or 2. HIRF environments I, II, and III, and equipment HIRF test levels 1, 2, and 3 are found in the appendices to the parts revised by this rule. The rule also includes provisions that provide relief from the new testing requirements for equipment previously certificated under HIRF special conditions issued in accordance with § 21.16. These provisions permit the installation of an electrical or electronic system that performs a function whose failure would prevent the continued safe flight and landing of the aircraft, if an applicant can show that the system continues to comply with previously issued HIRF special conditions. This relief, however, will only be available for a five-year period and will only apply to equipment certificated under HIRF special conditions issued before December 1, 2007. To obtain this relief an applicant must be able to—

(1) Provide evidence that the system was the subject of HIRF special conditions issued before December 1, 2007;

(2) Show that there have been no system design changes that would invalidate the HIRF immunity characteristics originally demonstrated under the previously issued HIRF special conditions; and

(3) Provide the data used to demonstrate compliance with the HIRF special conditions under which the system was previously approved.

Upon issuance of this rule, the FAA does not foresee the need to issue special conditions, like those previously issued for HIRF, to include special conditions permitting equipment evaluations in a laboratory environment using test levels of 100 V/m (200 V/m for VFR rotorcraft). Therefore, if an installation cannot meet the requirements of paragraph (d), the installation will need to comply with the HIRF certification requirements specified in paragraph (a). Paragraph (d)(1) requires an applicant to provide objective evidence that the system was the subject of HIRF special conditions that were issued before December 1, 2007. In meeting

Page 214Open in PDF

206 subparagraph (d)(1), it is not essential that the HIRF special conditions be issued for the same make and model of aircraft, but only that they were used as the basis for showing HIRF compliance for the electrical or electronic system intended for the specific installation. After the rule becomes effective, the FAA generally will no longer use special conditions as a means for an applicant to show protection from the HIRF environment for new equipment installation certifications. The date specified in paragraph (d)(1), however, provides a sufficient time period beyond the effective date of the rule to allow applicants to use HIRF special conditions that are currently being developed as part of a new installation’s certification basis to be processed and issued. Paragraph (d)(2) requires the applicant to show that there have been no system design changes that would invalidate the HIRF immunity characteristics originally demonstrated under previously issued HIRF special conditions. If a change has been made to the system, and the change cannot be substantiated through analysis as having no impact on the previously demonstrated HIRF immunity characteristics, the system must comply with the general requirements of the rule as specified in paragraph (a) of each section. Paragraph (d)(3) requires the applicant to provide the data used to demonstrate compliance with HIRF special conditions.

The term ‘‘data’’ includes, but is not limited to, items such as the HIRF certification qualification test report used to demonstrate compliance; installation instructions, as appropriate, to support HIRF immunity of the system; and instructions for continued airworthiness (ICA) to maintain the integrity of the system’s demonstrated HIRF immunity. To assist prospective applicants, Appendix 2 of AC 20–158 provides guidance on one means, but not the only means, of complying with these provisions.”

Page 215Open in PDF

23.1309 Equipment, systems, and installations

There is no corresponding rule in CAR 3.

The corresponding airworthiness criteria is section 6.6, Airship Design Criteria, FAA-P-8110-2, Change 2.

Amendment 23-14 and Subsequent

A proposed revision in NPRM 71-13 explains the adoption of this amendment as follows: “Because of the increasing reliance on systems and equipment in the modern, complex, high performance airplanes, the FAA believes that the proposed amendments to Secs. 23.1301, 23.1305, and 23.1309 are necessary to insure the reliability of such systems and equipment.”

Adoption of this rule is also explained by Final Rule, Docket 11011 as follows: “The other commentator objected to the proposed section on the ground that it could be interpreted to require the complete elimination of radio interference which is impossible. That is not the intent and the FAA does not agree with that interpretation. Similarly worded requirements already exist in the Federal Aviation Regulations and have not been misinterpreted to place an undue burden on manufacturers. However, based on further review, the proposed section has been revised to require that equipment installed in single engine airplanes be designed to minimize hazards to the airplane in the event of a probable malfunction or failure.”

The FAA has reviewed the part 1 definition of the word “instrument,” and other data and has concluded as follows:

a. Where a light is sufficient, the instrument requirement should be changed to a warning means.

b. Where trend information is needed, the word “indicator” should be retained.

c. Where point information or steps in a sequence need to be shown, the words should be changed to “indicating means” (that is, the functioning of the ice protection system).

Software Order 8110.49 “Software Approval Guidelines”, issued June 3, 2003, provides guidelines for the approval of software based systems using RTCA DO-178B.

See AC 23.1309-1E, “System Safety Analysis and Assessment for Part 23 Airplanes,” for additional guidance.

Page 216Open in PDF

208 Airplane Parachute Recovery Systems Use of a parachute recovery system is not covered by part 23. Applications for installing this system will require special conditions.

Synthetic Vision See AC 23-26, Synthetic Vision and Pathway Depictions on the Primary Flight Display for additional guidance on Synthetic Vision installations as well as AC 23.1309-1E.

Amendment 23-17 A proposed revision in NPRM 75-10 had a minor editorial change in adding commas in the title.

Amendments 23-34 through 23-40 Amendment 23-34 added requirements for commuter category airplanes that were later adopted for all part 23 airplanes. A proposed revision in NPRM 83-17 “added the requirements from part 135, Appendix A., § 59”.

Amendment 23-41 and Subsequent Based on an opinion from the FAA Chief Counsel’s Office, a general rule such as § 23.1309 cannot be used to add requirements to a specific rule in 14 CFR part 23.

The 23.1309 safety assessment should be used to determine the software assurance levels.

A proposed revision in NPRM 89-6 explains this amendment as follows: “Current Part 23 airplane airworthiness requirements are based on single-fault or fail-safe concepts and, when they were promulgated, the FAA did not envision use of complex, safety-critical systems in such airplanes. This proposal will require examination of systems and equipment for their criticality for continued safe flight and will permit the continued use of the existing reliability requirements of Part 23 for airplanes whose systems are not complex and do not perform safety-critical functions. For those cases where the manufacturer finds it necessary or desirable to include complex, safety-critical systems, the proposal includes requirements for identifying those systems and defines additional requirements needed for their certification. The proposed changes to Section 23.1309 are summarized as follows:

Proposed paragraphs (a), (a)(1), (a)(2), and (a)(3) of Section 1309 are derived from current paragraphs (a), (b), and (c) of Section 23.1309. Under proposed Section

23.1309(a)(1), the systems and installations, as well as the items of equipment, will be required to meet those requirements contained in current Section 23.1309(a). Under proposed Section 23.1309(a)(2), the systems and installations, as well as the items of equipment for single-engine airplanes will be required to meet those requirements

Page 217Open in PDF

Change 1 AC 23-17C 7/16/2012

209 contained in current Section 23.1309(c) and proposed Section 23.1309(a)(3) will require these items on a multiengine airplane to meet the requirements contained in current Section 23.1309(b).

A new Section 1309(b) is proposed which will require a detailed examination of each item of equipment, system, and installation. This examination is to determine whether a failure would affect the airplane's continued safe flight and landing. Each item of equipment, each system, and each installation identified by such an examination as being critical to the safe operation of the airplane would be required to meet additional requirements. This will permit the approval of more advanced systems that were not envisioned when Section 23.1309 was added to Part 23, without the need for special conditions.

A new Section 23.1309(c) is proposed to require identification of loads which are "essential loads" and requires the airplane power sources for these loads to meet requirements consistent with other airplane airworthiness requirements. These requirements are substantially equivalent to section 59(b) of Appendix A to Part 135.

A new Section 23.1309(d) is proposed to allow reduction of power loads when showing compliance with proposed Section 23.1309(c)(2). This provision is substantially equivalent to section 59(c)(3) of Appendix A to Part 135.

A new Section 23.1309(e) is proposed to require that the design of each electrical system, each item of equipment, and each installation take into account critical environmental conditions. Critical environmental and atmospheric conditions would include radio frequency energy and direct and indirect effects of lightning. Section

23.867 now requires the airplane structure to be protected from the effects of lightning and Section 23.954 now requires the airplane fuel system to be protected from the effects of lightning.

A new Section 23.1309(f) is proposed to provide a definition of the systems to which the requirements of this section are applicable and specifically identifies certain items to which they are not applicable.

Early in the development of minimum requirements for transport category airplanes, it was realized that more complex systems were being added to airplane designs and there was a need to include requirements which specifically addressed equipment, systems, and their installation. This was accomplished by the addition of Section 4b.606 to Part 4b of the Civil Air Regulations (CAR), Amendment 4b-6, effective March 5, 1952, in part, accomplished this objective. The preamble to that amendment included the following in regard to that addition:

An amendment clarifying the requirements for equipment, systems, and installations with regard to functioning and reliability is made in Subpart F. In addition, it specifies dual power supply for those installations the functioning of which is necessary to show compliance with the Civil Air Regulations.

Page 218Open in PDF

210 This requirement, as adopted by that amendment, was retained in CAR Part 4b until that regulation was recodified to the Federal Aviation Regulations, Part 25, effective February 1, 1965. At that time, this requirement, substantially unchanged, was identified as Section 25.1309. For many years the "single fault" or "fail safe" concept of this requirement, along with experience based on service-proven designs and engineering judgment, were used to successfully evaluate most airplane systems and equipment.

However, in the late 1960's there appeared a number of safety-critical systems that were utilizing new technical complexity to accomplish safety-critical functions. Due to the increasing complexity of the technology being used to develop these systems, it was becoming increasingly difficult to apply engineering judgment as the only means of determining the effects or likelihood of failure conditions. The increasing difficulty in evaluating these complex systems, along with the potential hazards to the airplane that could result from their failure made it necessary to provide duplicate and triplicate systems to assure an acceptable level of safety.

At about this same time, the development of rational methods for safety assessment of systems led to the conclusion that an inverse relationship should exist between the probability of a failure condition and its effect on the airplane. That is, the more serious the effect, the lower the probability must be that it will occur.

The availability of this rational method for safety analysis of systems, along with the increasing difficulty in applying the then existing "single fault" or "fail safe" concept, prompted the FAA to propose an amendment to Section 25.1309 which would permit the use of this rational method as an acceptable means of accomplishing safety analysis. That proposed revision to Section 25.1309, which specified a level of safety in qualitative terms, and required assessments to be made, was adopted by Amendment 25-23 on April 1, 1970.

At that time, the FAA also realized that more complex systems were being utilized in small airplanes and that there was a need to add a reliability requirement to Part 23.

Accordingly, rulemaking action was initiated which resulted in Section 23.1309 being added to Part 23 by Amendment 23.14, effective December 20, 1973. The requirements of that new Section 23.1309 were similar to those of Section 25.1309 prior to Amendment 25-23 which where based on the "single fault" or "fail safe" concept. At that time, it was not envisioned that complex safety-critical systems, utilizing technology now available, would be used in the designs of small airplanes.

Therefore, there was no identified need to include provisions for use of the rational method of analysis in Part 23, as had been done in Part 25 by Amendment 25-23.

Experience has shown that the envisioned rate of technical growth of systems used in small airplanes was inaccurate and that safety-critical systems are now being proposed for use on Part 23 airplanes. As with the earlier experience with Part 25, the FAA is finding that it is difficult to apply "single fault" concepts to these complex systems and to utilize the application of engineering judgment as the only means of

Page 219Open in PDF

211 determining the effects or likelihood of certain failure conditions. Accordingly, there is now a need to revise the reliability requirements of Part 23 to allow the use of the latest available rational method for safety analysis of these complex safety-critical systems to assure continuation of the level of safety intended for airplanes certificated to Part 23. Such safety critical systems are currently being proposed for approval and there is an urgent need to accomplish this proposed rule change.

A recommendation for a complete change of Section 23.1309 was submitted as a part of the Small Airplane Airworthiness Review Program. That recommendation, conference proposal number 434, was discussed during the October 22-26, 1984, Small Airplane Airworthiness Review Program conference held in St. Louis, Missouri. A copy of the transcript of all discussions held during the conference is filed in Docket No. 23494, and may be examined by interested persons.

At that conference a commenter on the recommendation noted that it dealt with failures that cause hazards which do not have catastrophic potential, but does not deal with hazards which are potentially catastrophic. As noted in the above discussion, in the development of requirements for small airplane systems it was originally recognized that failures of systems could produce hazards and the earlier requirements addressed protection from those failures, but did not address safetycritical systems whose failures could be potentially catastrophic or would be catastrophic. As proposed, Section 23.1309 addresses all levels of hazards and the proposed requirements are based on the criticality of the system.

This would be accomplished by requiring all of the airplane's systems to be reviewed to determine (1) if the airplane is dependent upon a system function for continued safe flight and landing, and (2) if a failure of any system on the airplane, not limited to VFR conditions, would significantly reduce the ability of the crew to cope with the adverse operating conditions. For airplanes that do not include systems which perform either of these safety critical functions, the single-fault or fail-safe concept requirements would continue to be applicable as proposed in Section 23.1309(a).

If the design of the airplane includes systems that perform a function that is needed for continued safety flight and landing of the airplane and, accordingly, whose failure could be catastrophic, the systems would be required to meet standards that establish that failures of the system must be extremely improbable. In addition, on airplanes designed for any type of operation other than VFR, the systems whose failures would significantly reduce the airplane's capability, of the ability of the crew to cope with the adverse operating conditions and, thereby, be potentially catastrophic would be required to meet standards that establish that failures of these systems are improbable. This standard is applicable if a system failure would reduce the capability of the airplane or the crew to cope with adverse operating conditions. It was recognized that any failure will reduce the airplane's or crew's capability by some degree, but that reduction may not be of the degree that will make operation of the airplane potentially catastrophic. The intent of this proposed standard, Section

23.1309(b), is to have those systems whose failure would be catastrophic or