or a discomfort to the flight crew or physical distress to passengers or cabin crew, possibly including injuries.
(4) Hazardous. Failure conditions that would reduce the capability of the airplane or the ability of the crew to cope with adverse operating conditions to the extent that there would be the following:
(a) A large reduction in safety margins or functional capabilities;
(b) Physical distress or higher workload such that the flight crew cannot be relied upon to perform their tasks accurately or completely; or
(c) Serious or fatal injury to an occupant other than the flight crew.
(5) Catastrophic. Failure conditions that are expected to result in multiple fatalities of the occupants, or incapacitation or fatal injury to a flight crewmember normally with the loss of the airplane.
Notes: (1) The phrase “are expected to result” is not intended to require 100 percent certainty that the effects will always be catastrophic. Conversely, just because the effects of a given failure, or combination of failures, could conceivably be catastrophic in extreme circumstances, it is not intended to imply that the failure condition will necessarily be considered catastrophic. (2) The term “catastrophic” was defined in previous versions of advisory materials as a failure condition that would prevent continued safe flight and landing.
y. Function. The lowest defined level of a specific action of a system, equipment, and flight crew performance aboard the airplane that, by itself, provides a completely recognizable operational capability (e.g., an airplane heading is a function). One or more systems may contain a specific function or one system may contain multiple functions.
z. Functional hazard assessment. A systematic, comprehensive examination of airplane and system functions to identify potential minor, major, hazardous, and catastrophic failure conditions that may arise as a result of a malfunction or a failure to function.
aa. Hazard. A potentially unsafe condition resulting from failures, malfunctions, external events, errors, or combinations thereof. This term is intended for single malfunctions or failures that are considered probable based on either past service experience or analysis with similar components in comparable airplane applications, or both. There is no quantitative analysis intended in this application.
Note: There is a difference between “hazardous” as used in general policy or regulations and “hazardous failure condition” as used in an FHA. When the term "hazard" or "hazardous" is used in general policy or regulations, it is generally used as shown in this definition. A hazard could be a failure condition that relates to major, hazardous, or catastrophic.
bb. Improbable failure conditions. Those failure conditions unlikely to occur in each airplane during its total life, but that may occur several times when considering the total operational life of a number of airplanes of this type. Also, those failure conditions not anticipated to occur to each airplane during its total life but that may occur a few times when considering the total operational life of all airplanes of this type. For quantitative assessments, refer to the probability values shown for major and hazardous failure conditions in figure 2. For more specific guidance, see definitions of “remote failure conditions” and “extremely remote failure conditions” cc. Item. One or more hardware and/or software elements treated as a unit.
dd. Installation appraisal. A qualitative appraisal of the integrity and safety of the installation. Any deviations from normal industry-accepted installation practices should be evaluated.
ee. Latent failure. A failure is latent until it is made known to the flight crew or maintenance personnel.
ff. Malfunction. Failure of a system, subsystem, unit, or part to operate in the normal or usual manner. The occurrence of a condition whereby the operation is outside specified limits.
gg. Minimize. To reduce, lessen, or diminish a hazard to the least practical amount with current technology and materials. The least practical amount is that point at which the effort to further reduce a hazard significantly exceeds any benefit in terms of safety derived from that reduction. Additional efforts would not result in any significant improvements to safety and would inappropriately add to the cost of the product without a commensurate benefit.
hh. Power source. A system that provides power to installed equipment. This system would normally include prime mover(s), required power converter(s), energy storage device(s), and required control and interconnection means.
ii. Primary function. A function installed to comply with applicable regulations for the required function and provides the most pertinent controls or information instantly and directly to the pilot. For example, the PFD is a single physical unit that always provides the primary display and complies with the requirements of all the following: altitude, airspeed, aircraft heading (direction) and attitude. The PFD is located directly in front of the pilot and used instantly and first by the pilot. A standby or another display intended to be used in the event of failure of the PFD or as a cross reference is an example of a secondary system. For example, a brake control system normally uses the electronic brake system most of the time because of its better performance, but it does not comply with all the requirements. In this case, the mechanical brakes are used as the backup systems; yet, it is consider the primary with regard to meeting the requirements and the electronic brake system is the secondary.
jj. Primary system. A system that provides the primary function.
kk. Probable. Probable as defined for § 23.1309(a) through Amendment 23-49, as a probable malfunction or failure, is any single malfunction or failure that is considered likely on 12
the basis of either past service experience or analysis with similar components in comparable airplane applications, or both.
Note: Normally, there is no quantitative analysis intended in this application. This should not be confused with a probable failure condition when used for a safety assessment process.
ll. Probable failure conditions. Those failure conditions anticipated to occur one or more times during the entire operational life of each airplane. These failure conditions may be determined on the basis of past service experience with similar components in comparable airplane applications. For quantitative assessments, refer to the probability values shown for minor failure conditions in figure 2.
mm. Qualitative. Those analytical processes that assess system and airplane safety in an objective non-numerical manner.
nn. Quantitative. Those analytical processes that apply mathematical methods to assess the system and airplane safety.
oo. Redundancy. The presence of more than one independent means for accomplishing a given function. Each means of accomplishing the function need not be identical.
pp. Reliability. The determination that a system, subsystem, unit, or part will perform its intended function for a specified interval under certain operational and environmental conditions.
qq. Remote failure conditions. Those failure conditions that are unlikely to occur to each airplane during its total life but that may occur several times when considering the total operational life of a number of airplanes of this type. For quantitative assessments, refer to the probability values shown for major failure conditions in figure 2.
rr. Secondary system . A redundancy system that provides the same function as the primary system.
ss. Similarity. The process of showing that the equipment type, form, function, design, and installation have only minor differences to previously approved equipment. The safety and operational characteristics and other qualities of the new proposed installation should have no appreciable effects on the airworthiness of the airplane.
tt. Simple hardware item. An item with a comprehensive combination of deterministic tests and analyses appropriate to the design assurance level that ensures correct functional performance under all foreseeable operating conditions, with no anomalous behavior.--Source:
RTCA/DO-254, paragraph 1.6 and Order 8110.105.
uu. Simple system. Usually a system that can be evaluated by only qualitative analysis and it is not complex. Functional performance is determined by combination of tests and analyses.
See the definitions for “conventional” and “complex” systems for more information.
vv. Single failure concept. The objective of this design concept is to permit the airplane to continue safe flight and landing after any single failure. Protection from multiple malfunctions or failures should be provided when the first malfunction or failure would not be detected during normal operations of the airplane, which includes preflight checks, or if the first malfunction or failure would inevitably cause other malfunctions or failures.
ww. System. A combination of components, parts, and elements that are interconnected to perform one or more functions.
xx. Warning. A clear and unambiguous indication to the flight crew or pilot of a failure that requires immediate corrective action. An inherent characteristic of the airplane or a device that will give clearly distinguishable indications of malfunction or misleading information may provide this warning.
9. Application of § 23.1309(a), (a)(1), (a)(2), and (a)(3), as adopted by Amendments 23-41 and 23-49.
If the certification basis for the airplane is Amendment 23-14, § 23.1309(a) (See Note in paragraph 10.) is appropriate to use for systems in airplanes approved to fly either VFR or IFR, or both. With the certification basis at Ame ndment 23-14, systems that must meet the singlefailure concept with the requirements of § 23.1309(a) should comply if the guidance in paragraph 10 of this AC is used. Under the certification basis at Amendment 23-14, compliance with § 23.1309(b) is not required and a safety assessment is not necessary, but it may be used.
For complex systems, the requirements of Amendment 23-14 may not provide an adequate level of safety. Then, the certification basis should be Amendment 23-41 or 23-49 as appropriate. In accordance with AC 21.101-1, in cases where no regulatory standards are defined in the existing certification basis for the design change, but applicable regulatory standards exist in a subsequent amendment to the regulations, the subsequent amendment will be made part of the certification basis. Therefore, the change must comply with later appropriate regulations.
10. Showing compliance with the requirements of § 23.1309 (a) through Amendment 23-
49.
Note: The requirements of paragraphs (a), (a)(1), (a)(2), and (a)(3) of § 23.1309, as amended by Amendments 23-41 and 23-49, are the same requirements as paragraphs (a), (b), and (c) of § 23.1309, as amended by Amendment 23-14. These same requirements in paragraphs (a), (a)(1), (a)(2), and (a)(3) (above) were deleted in § 23.1309 by Amendment 23-62 because there was a significant revision of § 23.1309.
a. In order to show compliance with the requirements of § 23.1309(a), (a)(1), (a)(2), and
(a)(3), it will be necessary to verify that the installed systems and each item of equipment will cause no unacceptable adverse effects and to verify that the airplane is adequately protected against any hazards that could result from probable malfunctions or failures. Analyze, inspect, and test equipment, systems, and installations to ensure compliance with the requirements of § 23.1309(a), (a)(1), (a)(2), and (a)(3).
b. A step-by-step diagram to comply with § 23.1309(a), (a)(1), (a)(2), and (a)(3) is shown in figure 1. These steps are described below.
(1) Evaluate all airplane systems and each item of equipment in order to determine whether they are the following:
(a) Essential to safe operation; or
(b) Not essential to safe operation.
(2) Determine that operation of installed equipment has no unacceptable adverse effects.
Verify this by applicable flight or ground checks, as follows:
(a) If it can be determined that the operation of the installed equipment will not adversely affect equipment essential to safe operation, the requirements of § 23.1309(a)(1)(i) have been satisfied; and
(b) If it is determined that the operation of the installed equipment has an adverse effect on equipment not essential to safe operation and a means exists to inform the pilot of the effect, the requirements of § 23.1309(a)(1)(ii) have been met. An acceptable means to inform the pilot that the affected system is not performing properly would include any visual or aural method (flags, lights, horns, loss of display, etc.).
(3) Determine that failure or malfunction of the installed equipment could not result in unacceptable hazards.
(a) Each item of equipment must be evaluated for general installation hazards. These types of hazards would normally include those hazards that would directly compromise the safety of the airplane or its occupants, such as fire, smoke, explosion, toxic gases, depressurization, etc. A hazard could also result from loss of equipment or systems essential to safe operations when the minimum required functions are lost. Individual failure of redundant equipment would not necessarily be considered a hazard. For example, the single failure of either a communication transceiver or a navigation receiver (but not both) during IFR operation is not considered a hazard; however, a single failure of a common power supply to those systems would be considered a hazard.
(b) Systems and equipment essential to safe operation must also be assessed for probability of malfunction or failure. Where the installation is conventional, and where there is a high degree of similarity in installations and a significant amount of service history is available for review, this determination can be an engineering judgment. Service history should show that past malfunctions or failures have not resulted in hazards and there are no unresolved problems.
(c) Hazards identified and found to result from probable failures are not acceptable in multiengine airplanes. In these situations, a design change may be required to remove the hazard or to reduce the probability of failure, such as increasing redundancy, substitution of more reliable equipment, annunciation, etc.
(d) If it has been determined that a probable failure or malfunction could result in a hazard to a single-engine airplane, that hazard must be minimized or prevent hazards in a multiengine airplane. To minimize is to reduce, lessen, or diminish a hazard to the least practical amount with current technology and materials. Design features should be taken into account to prevent hazards either by ensuring that the failure condition will not occur or by having redundancy or annunciation with the associated flight crew’s corrective action. In either case, the hazards should be addressed to the least practical amount to the point at which the effort to further reduce a hazard significantly exceeds any benefit in terms of safety derived from that reduction that is practical for this type of airplane. Additional efforts would not result in any significant improvements of safety and would inappropriately add to the cost of the product without a commensurate benefit. This determination should come from an experienced engineering judgment based on the criticality of the hazard and the intended kinds of operation.
FIGURE 1. METHOD OF COMPLIANCE DIAGRAM OF § 23.1309(a) THROUGH AMENDMENT 23-49 Start Assessment All Airplanes Corrective Measures Unacceptable Will Operation of this Equipment have Adverse Effect on Equipment Essential to Safe Operation?
Any Adverse Effect on Other Equipment?
Is there a means to Inform the Pilot of Effect?
Meets Requirements of § 23.1309(a)(1) Will Any Probable Failure or Malfunction Result in a Hazard?
Corrective Measures Unacceptable Single or Multiengine?
Has Hazard Been Minimized?
Meets Requirements of § 23.1309(a)(2) & (3) No Yes Yes No No Yes Yes No Yes No Yes Single Engine Multiengine 17
11. Application of § 23.1309(a)(4), as adopted by Amendment 23-49.
a. For those commuter airplanes that include the certification basis of Amendments 23-34, 23-41, or 23-49, § 23.1309(a)(4) requires all applicable systems and installations to be designed to safeguard against hazards to the airplane in the event of their failure. This requirement in § 23.1309(a)(4) for commuter airplanes was introduced into part 23 airplanes by Amendment 23- 34 before the safety assessment process was included by Amendment 23-41.
b. Design features should be taken into account to safeguard against hazards either by ensuring that the failure condition will not occur or by having redundancy or annunciation with the associated flight crew’s corrective action. The reliability should be such that independent failures of the redundant systems are not probable during the same flight. If a redundant system is required, a probable failure in one system should not adversely affect the other system’s operation. No probable failure should result in a “safe” indication of an “unsafe” condition so that the flight crew would incorrectly assume the system is available or functional. When the unsafe condition is annunciated or detected, the AFM should have clear and precise corrective procedures for handling the failure without an excessive increase in workload.
c. Service history for similar installations may be utilized to meet part or all of this requirement if a system or installation has a significant and favorable service history in environments similar to the airplane. The claim of similarity should be based on equipment type, function, design and installation similarities, and other relevant attributes. It is the applicant’s responsibility to provide accepted/approved data that supports any similarity claims to a previous installation. More information is available in Order 8110.4C.
12. Application of § 23.1309(a)(1) and (a)(2), as adopted by Amendments 23-62.
a. Section 23.1309(a) requires the airplane equipment and systems be designed and installed so that:
(1) Those required for type certification or by operating rules perform as intended under the airplane operating and environmental conditions, including the indirect effects of lightning strikes.
(2) Any equipment and system does not adversely affect the safety of the airplane or its occupants, or the proper functioning of those covered by paragraph (a)(1) of this section.
b. Section 23.1309(a) has requirements for different classes of equipment and systems installed in the airplane, that is, those that are required and not required. Section 23.1309(a)(1) covers the equipment and systems installed to meet a regulatory requirement. Such systems and equipment are required to “perform as intended under the airplane’s operating and environmental conditions.”
c. Section 23.1309(a) gives the conditional qualifiers “under the airplane operating and environmental conditions.” This section describes two actions for the applicant. First, the 18
applicant must consider the full normal operating envelope of the airplane, as defined by the AFM, with any modification to that envelope associated with abnormal or emergency procedures and any anticipated crew action. Second, the applicant must consider the anticipated external and internal airplane environmental conditions, as well as any additional conditions where equipment and systems are assumed to “perform as intended.” Although certain operating conditions are foreseeable, achieving normal performance when they exist is not always possible and may not need to be considered. For example, you may foresee ash clouds from volcanic eruptions; however, airplanes with current technology cannot safely fly in such clouds.
d. Other external environmental conditions such as atmospheric turbulence, HIRF, lightning, and precipitation, which the airplane is reasonably expected to encounter, must be considered.
These severities of the external environmental conditions to be considered are limited to those established by certification standards and precedence. Also, the environmental effect within the airplane must be considered. These effects should include vibration and acceleration loads, variations in fluid pressure and electrical power, and fluid or vapor contamination due to either the normal environment or accidental leaks or spillage and handling by personnel.
e. We accept equipment susceptible to failures if these failures do not contribute significantly to the existing risks (e.g., some degradation in functionality and capability is routinely allowed during some environmental qualifications, such as HIRF and lightning testing). For example, system lightning protecti on allows momentary lost or upset of specific functions of electrical/electronic systems. These functions are for failure conditions that are hazardous or major. But, the function must recover in a timely manner after the airplane is exposed to lightning. See AC 20-158 and AC 20-136B for more specific guidance. The safety assessment process of § 23.1309 does not supersede either the HIRF or lightning specific requirements. Environmental effects such as HIRF and lightning should not be considered in combination with another single failure or pre-existing latent failure.
f. Using § 23.1309(a)(2), we must analyze any installed equipment or system that has potential failure condition(s) that are catastrophic, hazardous, major, or minor to determine their impact on the safe operation of the airplane. Usually, normal installation practices can be based on a relatively simple qualitative installation evaluation. If the possible safety impacts, including failure modes or effects, are questionable, or isolation between systems is provided by complex means, more formal structured evaluation methods or a design change may be necessary.
Operational and environmental qualification requirements for those equipment, systems, and installations are reduced to the necessary tests that show their normal or abnormal functioning does not adversely affect the proper functioning of the equipment, systems, or installations under § 23.1309 (a)(1) and does not otherwise adversely influence the safety of the aircraft or its occupants. Examples of adverse influences include fire, explosion, exposing passengers to high voltages, etc.
g. Section 23.1309(a)(2) requires the applicant to show that all required and non required equipment and systems (including approved “amenities,” such as a coffee pot and entertainment systems) have no safety effect on the operation of the airplane. Section 23.1309(a)(2) does not require non-required equipment and systems to function properly during all airplane operations once in service if analysis shows that all potential failure condition(s) have no adverse safety 19
effects on safe operation of the airplane. The equipment or system must function in accordance with the manufacturer’s operating manual or specification. An applicant’s statement of intended function must be sufficiently specific and detailed so the FAA can evaluate whether the system is appropriate for the intended function(s) and the associated flight crew tasks. However, we would require equipment or systems to function when they are tested to verify that they do not interfere with the operation of other airplane equipment and systems and do not pose a hazard themselves. The normal operation of non-required systems should not interfere with the proper operation of any required systems or present a hazard themselves. Non-required systems are not required to perform their intended function throughout the aircraft operating and environmental conditions. However, in situations where the non-required system has failed, there can be no adverse safety effect to the aircraft, its occupants, or any adverse effect on required equipment and systems. Malfunctioning and erroneous behavior of all systems, including non-required, should be addressed under § 23.1309(c).
13. Application of § 23.1309(b), as adopted by Amendment 23-62.
a. Section 23.1309 (b) requires for minor, major, hazardous, or catastrophic failure condition(s) which occur during TIA or FAA flight-certification testing must have root cause analysis and corrective action. Testing is an important aspect of the overall compliance processes with §§ 23.1301 and 23.1309. The applicant should conduct bench, ground, and/or flight testing when necessary to validate hazard classifications, acceptability of crew procedures, human factors, and other assumptions made during the root cause analysis processes and corrective actions. The applicant must also discuss with the project ACO what aspects of this testing will need to be included in the FAA certification testing. Those aspects required for formal certification testing must be included in the appropriate FAA approved test plans and conducted on an FAA conformed test article in the presence of the FAA or delegated FAA witness in accordance with Order 8110.4C. Before receiving TIA, the applicant should be able to show qualitatively that the proposed design change will meet the requirements of section
23.1309.
b. The FAA will typically conduct some level of function and qualitative reliability testing during certification to ensure required functions demonstrate an acceptable level. The FAA will also conduct other required certification tests and analyses. These tests are meant to verify availability, accuracy, and qualitative reliability of the system. The FAA expects the applicant to show that the system does not exhibit unintended or undesirable functionality failure conditions that are minor, major, hazardous, or catastrophic. The FAA also expects that failures, malfunctions, and design errors with potential safety hazards have a full assessment of the problem, root cause analysis processes, and corrective action.
c. It is not intended for the probability requirements based on random distribution across a fleet of aircraft be applied on the beginning phase and to be fully complaint with this requirements. It is not appropriate to apply probability values to the typical certification flight test because the sample is too small. Failures during TIA and FAA flight-certification testing must have root cause analysis and corrective action (include traceability to production within the change) with robust corrections and substantiation of the corrections. The regulations do not required FAA approval for the root cause analysis.
14. Application of § 23.1309(b), as adopted by Amendments 23-41 and 23-49 and § 23.1309(c), as adopted by Amendment 23-62.
a. The installed systems should be evaluated by performing a safety assessment as shown in this AC. The depth and scope of the safety assessment depends on the types of functions performed by the systems, the severity of the failure conditions, and whether the system is complex. For instance, the safety assessment for a slightly modified single-engine airplane with simple systems might consist only of an FHA with a design and installation appraisal. This FHA will be much less extensive than the FHA for a commuter category or a multiple turbine-engine airplane with more complex systems. The types of analyses selected by an applicant and approved by the certification authority should be based on factors such as the system architecture, complexity, particular design, etc.
b. The safety assessment objective is to ensure an acceptable safety level for equipment and systems installed on the airplane. A logical and acceptable inverse relationship should exist between the average probability per flight hour and the severity of failure conditions effects (as shown in figure 2). This figure defines the appropriate airplane systems probability standards for four certification classes of airplanes designed to part 23 standards. The relationship between probability and severity of failure condition effects are as follows:
(1) Failure conditions with no safety effect have no probability requirement.
(2) Minor failure conditions may be probable.
(3) Major failure conditions must be no more frequent than remote.
(4) Hazardous failure conditions must be no more frequent than extremely remote.
(5) Catastrophic failure conditions must be extremely improbable.
c. Compliance with § 23.1309(c) may be shown by analysis and, where necessary, by appropriate ground, flight, or simulator test. The analysis should consider—
(1) Possible modes of failure, including malfunctions and damage from external sources;
(2) The probability of multiple failures and the probability or undetected faults;
(3) The resulting effects on the airplane and occupants, considering the stage of flight and operating conditions; and
(4) The crew warning cues, corrective action required, and the crew's capability of determining faults.
15. Four certification classes of airplanes.
a. The four-certification classes of airplanes for this AC are shown in figure 2 and the acronyms are defined in paragraph 7. They are Class I (Typically SRE 6,000 pounds (lbs.) or less (Maximum Certificated Gross Takeoff Weight)), Class II (Typically MRE, MTE and STE, 6,000 pounds or less), Class III (Typically SRE, STE, MRE, and MTE greater than 6,000 pounds), and Class IV (Typically Commuter Category).
b. Numerical values are assigned for use in cases where the impact of system failures is examined by quantitative methods of analysis. Also, the related software and complex hardware DALs for the various failure conditions are part of the matrix in figure 2 for most systems.
These levels should be used unless there are some unique architecture considerations. For these unusual situations there should be specific policy, guidance, or approval by the Small Airplane Directorate. (See paragraph 21 for more information) The probability standards are based on historical accident data, systems analyses, and engineering judgment for each class of airplane.
c. In assessing the acceptability of a design, the FAA recognized the need to establish rational probability values. Historically, failures in GA airplanes that might result in catastrophic failure conditions are predominately associated with the primary flight instruments in IMC. Historical evidence indicates that the probability of a fatal accident in restricted visibility due to operational and airframe-related causes is approximately one per ten thousand flight hours or 1 x 10-4 per flight hour for single-engine airplanes under 6,000 pounds.
Furthermore, from accident databases, it appears that about 10 percent of the total was attributed to failure conditions caused by the airplane's systems. It is reasonable to expect that the probability of a fatal accident from all such failure conditions would not be greater than one per one hundred thousand flight hours or 1 x 10-5 per flight hour for a newly designed airplane. From past service history, it is also assumed that there are about ten potential failure conditions in an airplane that could be catastrophic. The allowable target average probability per flight hour of 1 x 10-5 was thus apportioned equally among these failure conditions, which resulted in an allocation of not greater than 1 x 10-6 to each. The upper limit for the average probability per flight hour for catastrophic failure conditions would be 1 x 10-6, which establishes an approximate probability value for the term "extremely improbable."
Failure conditions having less severe effects could be relatively more likely to occur. Similarly, airplanes over 6,000 pounds have a lower fatal accident rate; therefore, they have a lower probability value for catastrophic failure conditions.