the basis of either past service experience or analysis with similar components in comparable airplane applications, or both.
Note: Normally, there is no quantitative analysis intended in this application. This should not be confused with a probable failure condition when used for a safety assessment process.
ll. Probable failure conditions. Those failure conditions anticipated to occur one or more times during the entire operational life of each airplane. These failure conditions may be determined on the basis of past service experience with similar components in comparable airplane applications. For quantitative assessments, refer to the probability values shown for minor failure conditions in figure 2.
mm. Qualitative. Those analytical processes that assess system and airplane safety in an objective non-numerical manner.
nn. Quantitative. Those analytical processes that apply mathematical methods to assess the system and airplane safety.
oo. Redundancy. The presence of more than one independent means for accomplishing a given function. Each means of accomplishing the function need not be identical.
pp. Reliability. The determination that a system, subsystem, unit, or part will perform its intended function for a specified interval under certain operational and environmental conditions.
qq. Remote failure conditions. Those failure conditions that are unlikely to occur to each airplane during its total life but that may occur several times when considering the total operational life of a number of airplanes of this type. For quantitative assessments, refer to the probability values shown for major failure conditions in figure 2.
rr. Secondary system . A redundancy system that provides the same function as the primary system.
ss. Similarity. The process of showing that the equipment type, form, function, design, and installation have only minor differences to previously approved equipment. The safety and operational characteristics and other qualities of the new proposed installation should have no appreciable effects on the airworthiness of the airplane.
tt. Simple hardware item. An item with a comprehensive combination of deterministic tests and analyses appropriate to the design assurance level that ensures correct functional performance under all foreseeable operating conditions, with no anomalous behavior.--Source:
RTCA/DO-254, paragraph 1.6 and Order 8110.105.
uu. Simple system. Usually a system that can be evaluated by only qualitative analysis and it is not complex. Functional performance is determined by combination of tests and analyses.
See the definitions for “conventional” and “complex” systems for more information.
vv. Single failure concept. The objective of this design concept is to permit the airplane to continue safe flight and landing after any single failure. Protection from multiple malfunctions or failures should be provided when the first malfunction or failure would not be detected during normal operations of the airplane, which includes preflight checks, or if the first malfunction or failure would inevitably cause other malfunctions or failures.
ww. System. A combination of components, parts, and elements that are interconnected to perform one or more functions.
xx. Warning. A clear and unambiguous indication to the flight crew or pilot of a failure that requires immediate corrective action. An inherent characteristic of the airplane or a device that will give clearly distinguishable indications of malfunction or misleading information may provide this warning.
9. Application of § 23.1309(a), (a)(1), (a)(2), and (a)(3), as adopted by Amendments 23-41 and 23-49.
If the certification basis for the airplane is Amendment 23-14, § 23.1309(a) (See Note in paragraph 10.) is appropriate to use for systems in airplanes approved to fly either VFR or IFR, or both. With the certification basis at Ame ndment 23-14, systems that must meet the singlefailure concept with the requirements of § 23.1309(a) should comply if the guidance in paragraph 10 of this AC is used. Under the certification basis at Amendment 23-14, compliance with § 23.1309(b) is not required and a safety assessment is not necessary, but it may be used.
For complex systems, the requirements of Amendment 23-14 may not provide an adequate level of safety. Then, the certification basis should be Amendment 23-41 or 23-49 as appropriate. In accordance with AC 21.101-1, in cases where no regulatory standards are defined in the existing certification basis for the design change, but applicable regulatory standards exist in a subsequent amendment to the regulations, the subsequent amendment will be made part of the certification basis. Therefore, the change must comply with later appropriate regulations.
10. Showing compliance with the requirements of § 23.1309 (a) through Amendment 23-
49.
Note: The requirements of paragraphs (a), (a)(1), (a)(2), and (a)(3) of § 23.1309, as amended by Amendments 23-41 and 23-49, are the same requirements as paragraphs (a), (b), and (c) of § 23.1309, as amended by Amendment 23-14. These same requirements in paragraphs (a), (a)(1), (a)(2), and (a)(3) (above) were deleted in § 23.1309 by Amendment 23-62 because there was a significant revision of § 23.1309.
a. In order to show compliance with the requirements of § 23.1309(a), (a)(1), (a)(2), and
(a)(3), it will be necessary to verify that the installed systems and each item of equipment will cause no unacceptable adverse effects and to verify that the airplane is adequately protected against any hazards that could result from probable malfunctions or failures. Analyze, inspect, and test equipment, systems, and installations to ensure compliance with the requirements of § 23.1309(a), (a)(1), (a)(2), and (a)(3).
b. A step-by-step diagram to comply with § 23.1309(a), (a)(1), (a)(2), and (a)(3) is shown in figure 1. These steps are described below.
(1) Evaluate all airplane systems and each item of equipment in order to determine whether they are the following:
(a) Essential to safe operation; or
(b) Not essential to safe operation.
(2) Determine that operation of installed equipment has no unacceptable adverse effects.
Verify this by applicable flight or ground checks, as follows:
(a) If it can be determined that the operation of the installed equipment will not adversely affect equipment essential to safe operation, the requirements of § 23.1309(a)(1)(i) have been satisfied; and
(b) If it is determined that the operation of the installed equipment has an adverse effect on equipment not essential to safe operation and a means exists to inform the pilot of the effect, the requirements of § 23.1309(a)(1)(ii) have been met. An acceptable means to inform the pilot that the affected system is not performing properly would include any visual or aural method (flags, lights, horns, loss of display, etc.).
(3) Determine that failure or malfunction of the installed equipment could not result in unacceptable hazards.
(a) Each item of equipment must be evaluated for general installation hazards. These types of hazards would normally include those hazards that would directly compromise the safety of the airplane or its occupants, such as fire, smoke, explosion, toxic gases, depressurization, etc. A hazard could also result from loss of equipment or systems essential to safe operations when the minimum required functions are lost. Individual failure of redundant equipment would not necessarily be considered a hazard. For example, the single failure of either a communication transceiver or a navigation receiver (but not both) during IFR operation is not considered a hazard; however, a single failure of a common power supply to those systems would be considered a hazard.
(b) Systems and equipment essential to safe operation must also be assessed for probability of malfunction or failure. Where the installation is conventional, and where there is a high degree of similarity in installations and a significant amount of service history is available for review, this determination can be an engineering judgment. Service history should show that past malfunctions or failures have not resulted in hazards and there are no unresolved problems.
(c) Hazards identified and found to result from probable failures are not acceptable in multiengine airplanes. In these situations, a design change may be required to remove the hazard or to reduce the probability of failure, such as increasing redundancy, substitution of more reliable equipment, annunciation, etc.
(d) If it has been determined that a probable failure or malfunction could result in a hazard to a single-engine airplane, that hazard must be minimized or prevent hazards in a multiengine airplane. To minimize is to reduce, lessen, or diminish a hazard to the least practical amount with current technology and materials. Design features should be taken into account to prevent hazards either by ensuring that the failure condition will not occur or by having redundancy or annunciation with the associated flight crew’s corrective action. In either case, the hazards should be addressed to the least practical amount to the point at which the effort to further reduce a hazard significantly exceeds any benefit in terms of safety derived from that reduction that is practical for this type of airplane. Additional efforts would not result in any significant improvements of safety and would inappropriately add to the cost of the product without a commensurate benefit. This determination should come from an experienced engineering judgment based on the criticality of the hazard and the intended kinds of operation.
FIGURE 1. METHOD OF COMPLIANCE DIAGRAM OF § 23.1309(a) THROUGH AMENDMENT 23-49 Start Assessment All Airplanes Corrective Measures Unacceptable Will Operation of this Equipment have Adverse Effect on Equipment Essential to Safe Operation?
Any Adverse Effect on Other Equipment?
Is there a means to Inform the Pilot of Effect?
Meets Requirements of § 23.1309(a)(1) Will Any Probable Failure or Malfunction Result in a Hazard?
Corrective Measures Unacceptable Single or Multiengine?
Has Hazard Been Minimized?
Meets Requirements of § 23.1309(a)(2) & (3) No Yes Yes No No Yes Yes No Yes No Yes Single Engine Multiengine 17
11. Application of § 23.1309(a)(4), as adopted by Amendment 23-49.
a. For those commuter airplanes that include the certification basis of Amendments 23-34, 23-41, or 23-49, § 23.1309(a)(4) requires all applicable systems and installations to be designed to safeguard against hazards to the airplane in the event of their failure. This requirement in § 23.1309(a)(4) for commuter airplanes was introduced into part 23 airplanes by Amendment 23- 34 before the safety assessment process was included by Amendment 23-41.
b. Design features should be taken into account to safeguard against hazards either by ensuring that the failure condition will not occur or by having redundancy or annunciation with the associated flight crew’s corrective action. The reliability should be such that independent failures of the redundant systems are not probable during the same flight. If a redundant system is required, a probable failure in one system should not adversely affect the other system’s operation. No probable failure should result in a “safe” indication of an “unsafe” condition so that the flight crew would incorrectly assume the system is available or functional. When the unsafe condition is annunciated or detected, the AFM should have clear and precise corrective procedures for handling the failure without an excessive increase in workload.
c. Service history for similar installations may be utilized to meet part or all of this requirement if a system or installation has a significant and favorable service history in environments similar to the airplane. The claim of similarity should be based on equipment type, function, design and installation similarities, and other relevant attributes. It is the applicant’s responsibility to provide accepted/approved data that supports any similarity claims to a previous installation. More information is available in Order 8110.4C.
12. Application of § 23.1309(a)(1) and (a)(2), as adopted by Amendments 23-62.
a. Section 23.1309(a) requires the airplane equipment and systems be designed and installed so that:
(1) Those required for type certification or by operating rules perform as intended under the airplane operating and environmental conditions, including the indirect effects of lightning strikes.
(2) Any equipment and system does not adversely affect the safety of the airplane or its occupants, or the proper functioning of those covered by paragraph (a)(1) of this section.
b. Section 23.1309(a) has requirements for different classes of equipment and systems installed in the airplane, that is, those that are required and not required. Section 23.1309(a)(1) covers the equipment and systems installed to meet a regulatory requirement. Such systems and equipment are required to “perform as intended under the airplane’s operating and environmental conditions.”
c. Section 23.1309(a) gives the conditional qualifiers “under the airplane operating and environmental conditions.” This section describes two actions for the applicant. First, the 18
applicant must consider the full normal operating envelope of the airplane, as defined by the AFM, with any modification to that envelope associated with abnormal or emergency procedures and any anticipated crew action. Second, the applicant must consider the anticipated external and internal airplane environmental conditions, as well as any additional conditions where equipment and systems are assumed to “perform as intended.” Although certain operating conditions are foreseeable, achieving normal performance when they exist is not always possible and may not need to be considered. For example, you may foresee ash clouds from volcanic eruptions; however, airplanes with current technology cannot safely fly in such clouds.
d. Other external environmental conditions such as atmospheric turbulence, HIRF, lightning, and precipitation, which the airplane is reasonably expected to encounter, must be considered.
These severities of the external environmental conditions to be considered are limited to those established by certification standards and precedence. Also, the environmental effect within the airplane must be considered. These effects should include vibration and acceleration loads, variations in fluid pressure and electrical power, and fluid or vapor contamination due to either the normal environment or accidental leaks or spillage and handling by personnel.
e. We accept equipment susceptible to failures if these failures do not contribute significantly to the existing risks (e.g., some degradation in functionality and capability is routinely allowed during some environmental qualifications, such as HIRF and lightning testing). For example, system lightning protecti on allows momentary lost or upset of specific functions of electrical/electronic systems. These functions are for failure conditions that are hazardous or major. But, the function must recover in a timely manner after the airplane is exposed to lightning. See AC 20-158 and AC 20-136B for more specific guidance. The safety assessment process of § 23.1309 does not supersede either the HIRF or lightning specific requirements. Environmental effects such as HIRF and lightning should not be considered in combination with another single failure or pre-existing latent failure.
f. Using § 23.1309(a)(2), we must analyze any installed equipment or system that has potential failure condition(s) that are catastrophic, hazardous, major, or minor to determine their impact on the safe operation of the airplane. Usually, normal installation practices can be based on a relatively simple qualitative installation evaluation. If the possible safety impacts, including failure modes or effects, are questionable, or isolation between systems is provided by complex means, more formal structured evaluation methods or a design change may be necessary.
Operational and environmental qualification requirements for those equipment, systems, and installations are reduced to the necessary tests that show their normal or abnormal functioning does not adversely affect the proper functioning of the equipment, systems, or installations under § 23.1309 (a)(1) and does not otherwise adversely influence the safety of the aircraft or its occupants. Examples of adverse influences include fire, explosion, exposing passengers to high voltages, etc.
g. Section 23.1309(a)(2) requires the applicant to show that all required and non required equipment and systems (including approved “amenities,” such as a coffee pot and entertainment systems) have no safety effect on the operation of the airplane. Section 23.1309(a)(2) does not require non-required equipment and systems to function properly during all airplane operations once in service if analysis shows that all potential failure condition(s) have no adverse safety 19
effects on safe operation of the airplane. The equipment or system must function in accordance with the manufacturer’s operating manual or specification. An applicant’s statement of intended function must be sufficiently specific and detailed so the FAA can evaluate whether the system is appropriate for the intended function(s) and the associated flight crew tasks. However, we would require equipment or systems to function when they are tested to verify that they do not interfere with the operation of other airplane equipment and systems and do not pose a hazard themselves. The normal operation of non-required systems should not interfere with the proper operation of any required systems or present a hazard themselves. Non-required systems are not required to perform their intended function throughout the aircraft operating and environmental conditions. However, in situations where the non-required system has failed, there can be no adverse safety effect to the aircraft, its occupants, or any adverse effect on required equipment and systems. Malfunctioning and erroneous behavior of all systems, including non-required, should be addressed under § 23.1309(c).
13. Application of § 23.1309(b), as adopted by Amendment 23-62.
a. Section 23.1309 (b) requires for minor, major, hazardous, or catastrophic failure condition(s) which occur during TIA or FAA flight-certification testing must have root cause analysis and corrective action. Testing is an important aspect of the overall compliance processes with §§ 23.1301 and 23.1309. The applicant should conduct bench, ground, and/or flight testing when necessary to validate hazard classifications, acceptability of crew procedures, human factors, and other assumptions made during the root cause analysis processes and corrective actions. The applicant must also discuss with the project ACO what aspects of this testing will need to be included in the FAA certification testing. Those aspects required for formal certification testing must be included in the appropriate FAA approved test plans and conducted on an FAA conformed test article in the presence of the FAA or delegated FAA witness in accordance with Order 8110.4C. Before receiving TIA, the applicant should be able to show qualitatively that the proposed design change will meet the requirements of section
23.1309.
b. The FAA will typically conduct some level of function and qualitative reliability testing during certification to ensure required functions demonstrate an acceptable level. The FAA will also conduct other required certification tests and analyses. These tests are meant to verify availability, accuracy, and qualitative reliability of the system. The FAA expects the applicant to show that the system does not exhibit unintended or undesirable functionality failure conditions that are minor, major, hazardous, or catastrophic. The FAA also expects that failures, malfunctions, and design errors with potential safety hazards have a full assessment of the problem, root cause analysis processes, and corrective action.
c. It is not intended for the probability requirements based on random distribution across a fleet of aircraft be applied on the beginning phase and to be fully complaint with this requirements. It is not appropriate to apply probability values to the typical certification flight test because the sample is too small. Failures during TIA and FAA flight-certification testing must have root cause analysis and corrective action (include traceability to production within the change) with robust corrections and substantiation of the corrections. The regulations do not required FAA approval for the root cause analysis.
14. Application of § 23.1309(b), as adopted by Amendments 23-41 and 23-49 and § 23.1309(c), as adopted by Amendment 23-62.
a. The installed systems should be evaluated by performing a safety assessment as shown in this AC. The depth and scope of the safety assessment depends on the types of functions performed by the systems, the severity of the failure conditions, and whether the system is complex. For instance, the safety assessment for a slightly modified single-engine airplane with simple systems might consist only of an FHA with a design and installation appraisal. This FHA will be much less extensive than the FHA for a commuter category or a multiple turbine-engine airplane with more complex systems. The types of analyses selected by an applicant and approved by the certification authority should be based on factors such as the system architecture, complexity, particular design, etc.
b. The safety assessment objective is to ensure an acceptable safety level for equipment and systems installed on the airplane. A logical and acceptable inverse relationship should exist between the average probability per flight hour and the severity of failure conditions effects (as shown in figure 2). This figure defines the appropriate airplane systems probability standards for four certification classes of airplanes designed to part 23 standards. The relationship between probability and severity of failure condition effects are as follows:
(1) Failure conditions with no safety effect have no probability requirement.
(2) Minor failure conditions may be probable.
(3) Major failure conditions must be no more frequent than remote.
(4) Hazardous failure conditions must be no more frequent than extremely remote.
(5) Catastrophic failure conditions must be extremely improbable.
c. Compliance with § 23.1309(c) may be shown by analysis and, where necessary, by appropriate ground, flight, or simulator test. The analysis should consider—
(1) Possible modes of failure, including malfunctions and damage from external sources;
(2) The probability of multiple failures and the probability or undetected faults;
(3) The resulting effects on the airplane and occupants, considering the stage of flight and operating conditions; and
(4) The crew warning cues, corrective action required, and the crew's capability of determining faults.
15. Four certification classes of airplanes.
a. The four-certification classes of airplanes for this AC are shown in figure 2 and the acronyms are defined in paragraph 7. They are Class I (Typically SRE 6,000 pounds (lbs.) or less (Maximum Certificated Gross Takeoff Weight)), Class II (Typically MRE, MTE and STE, 6,000 pounds or less), Class III (Typically SRE, STE, MRE, and MTE greater than 6,000 pounds), and Class IV (Typically Commuter Category).
b. Numerical values are assigned for use in cases where the impact of system failures is examined by quantitative methods of analysis. Also, the related software and complex hardware DALs for the various failure conditions are part of the matrix in figure 2 for most systems.
These levels should be used unless there are some unique architecture considerations. For these unusual situations there should be specific policy, guidance, or approval by the Small Airplane Directorate. (See paragraph 21 for more information) The probability standards are based on historical accident data, systems analyses, and engineering judgment for each class of airplane.
c. In assessing the acceptability of a design, the FAA recognized the need to establish rational probability values. Historically, failures in GA airplanes that might result in catastrophic failure conditions are predominately associated with the primary flight instruments in IMC. Historical evidence indicates that the probability of a fatal accident in restricted visibility due to operational and airframe-related causes is approximately one per ten thousand flight hours or 1 x 10-4 per flight hour for single-engine airplanes under 6,000 pounds.
Furthermore, from accident databases, it appears that about 10 percent of the total was attributed to failure conditions caused by the airplane's systems. It is reasonable to expect that the probability of a fatal accident from all such failure conditions would not be greater than one per one hundred thousand flight hours or 1 x 10-5 per flight hour for a newly designed airplane. From past service history, it is also assumed that there are about ten potential failure conditions in an airplane that could be catastrophic. The allowable target average probability per flight hour of 1 x 10-5 was thus apportioned equally among these failure conditions, which resulted in an allocation of not greater than 1 x 10-6 to each. The upper limit for the average probability per flight hour for catastrophic failure conditions would be 1 x 10-6, which establishes an approximate probability value for the term "extremely improbable."
Failure conditions having less severe effects could be relatively more likely to occur. Similarly, airplanes over 6,000 pounds have a lower fatal accident rate; therefore, they have a lower probability value for catastrophic failure conditions.
FIGURE 2. RELATIONSHIP AMONG AI RPLANE CLASSES, PROBABILITIES,
SEVERITY OF FAILURE CONDITIONS, AND
SOFTWARE AND COMPLEX HARDWARE DAL Classification of Failure Conditions No Safety Effect <----Minor-----> <----Major----> <--Hazardous---> < Catastrophic> Allowable Qualitative Probability No Probability Requirement Probable Remote Extremely Remote Extremely Improbable Effect on Airplane No effect on operational capabilities or safety Slight reduction in functional capabilities or safety margins Significant reduction in functional capabilities or safety margins Large reduction in functional capabilities or safety margins Normally with hull loss Effect on Occupants Inconvenience for passengers Physical discomfort for passengers Physical distress to passengers, possibly including injuries Serious or fatal injury to an occupant Multiple fatalities Effect on Flight No effect on flight Slight increase in Physical discomfort Physical distress or Fatal Injury or Crew crew workload or use of emergency procedures or a significant increase in workload excessive workload impairs ability to perform tasks incapacitation Classes of Airplanes:
Allowable Quantitative Probabilities and Software (SW) and Complex Hardware (HW) Development Assurance Levels (Note 2) Class I (Typically SRE 6,000 pounds or less) No Probability or SW and HW Development Assurance Levels Requirement <10-3 Note 1 P=D <10-4 Notes 1 and 4 P=C, S=D <10-5 Note 4 P=C, S=D <10-6 Note 3 P=C, S=C Class II (Typically MRE, STE, or MTE 6,000 pounds or less) No Probability or SW and HW Development Assurance Levels Requirement <10-3 Note 1 P=D <10-5 Notes 1 and 4 P=C, S=D <10-6 Note 4 P=C, S=C <10-7 Note 3 P=C, S=C Class III (Typically SRE, STE, MRE, and MTE greater than 6,000 pounds) No Probability or SW and HW Development Assurance Levels Requirement <10-3 Note 1 P=D <10-5 Notes 1 and 4 P=C, S=D <10-7 Note 4 P=C, S=C <10-8 Note 3 P=B, S=C Class IV (Typically Commuter Category) No Probability or SW and HW Development Assurance Levels Requirement <10-3 Note 1 P=D <10-5 Notes 1 and 4 P=C, S=D <10-7 Note 4 P=B, S=C <10-9 Note 3 P=A, S=B Note 1: Numerical values indicate an order of probability range and are provided here as a reference.
Note 2: The letters of the alphabet denote the typical SW and HW Development Assurance Levels for Primary System (P) and Secondary System (S). For example, HW or SW Development Assurance Level A on Primary System is noted by P=A.
Note 3: At airplane function level, no single failure will result in a Catastrophic Failure Condition.
Note 4. Secondary System (S) may not be required to meet probability goals. If installed, S should meet stated criteria.
d. The criteria shown in figure 2 directly reflect the historical accident and equipment probability of failure data in the CAR 3 and 14 CFR part 23 airplane fleet. Characteristics of the airplane, such as stall speed, handling characteristics, cruise altitude, ease of recognizing system failures, recognition of entry into stall, pilot workload, and other factors (which include pilot training and experience) affect the pilot’s ability to safely handle various types of system failures in small airplanes. The criteria considered for all airplanes’ failure conditions is based on service experience, operational exposure rates, and total airplane system reliability. The values for individual system probability of failure could be higher than probability values shown in figure 2 for specific failure conditions because it considers the installed airplane systems, events, and factors.
e. These classes were defined based on the way accident and safety statistics are currently collected. Generally, the classes deal with airpla nes of historical equivalent levels of system complexity, type of use, system reliability, and historical divisions of airplanes according to these characteristics. However, these classes could change because of new technologies. The placement of a specific airplane in a class should be done in reference to all of the airplane’s missions and performance characteristics. The applicant should have the concurrence of the certification authority that is knowledgeable about the applicable airplane class early in the program. When unusual situations develop, consult the Small Airplane Directorate to obtain specific policy guidance or approval.
f. For example, airplanes with considerably more than 10 catastrophic failure conditions, that have greater performance characteristics and incorporate many complex systems and advance technologies may have lower probability values and higher DALs. These airplanes’ probability values and DALs may fall between the classes of the airplanes. For instance, the performance characteristics of a complex airplane including airplane handling qualities and stall speed may be similar to existing Class II airplanes. However, this airplane’s mission and other performance characteristics including high speed, high altitude, and extended range operations may be similar to existing Class III airplanes. The major difference between the DALs for Class II and Class III airplanes is for primary systems whose failure would result in a catastrophic failure condition for the airplane. Since this complex airplane falls between these two classes, it is reasonable to choose the higher DAL and a lower probability level.
g. For example, in part 23, turbine-engine airplanes traditionally have been subject to more stringent requirements than a single-engine reciprocating airplane. A single-engine reciprocating airplane generally has a wider stall-cruise speed ratio than traditional turbine-engine airplanes.
Such an airplane with a stall speed under 61 knots with simple systems, and with otherwise similar characteristics to a traditional single-engine reciprocating airplane (except for a higher cruise speed and a more reliable engine that is simpler to operate), can be treated as a Class I airplane under this analysis. Conversely, if a single-engine reciprocating airplane has the performance, mission capability, and system complexity of a higher class (such as cabin pressurization, high cruise altitude, and extended range), then that type of airplane design may align itself with the safety requirements of a higher class (for example, Class II airplane). These determinations should be made during the development of the certification basis.