b. A step-by-step diagram to comply with § 23.1309(a), (a)(1), (a)(2), and (a)(3) is shown in figure 1. These steps are described below.
(1) Evaluate all airplane systems and each item of equipment in order to determine whether they are the following:
(a) Essential to safe operation; or
(b) Not essential to safe operation.
(2) Determine that operation of installed equipment has no unacceptable adverse effects.
Verify this by applicable flight or ground checks, as follows:
(a) If it can be determined that the operation of the installed equipment will not adversely affect equipment essential to safe operation, the requirements of § 23.1309(a)(1)(i) have been satisfied; and
(b) If it is determined that the operation of the installed equipment has an adverse effect on equipment not essential to safe operation and a means exists to inform the pilot of the effect, the requirements of § 23.1309(a)(1)(ii) have been met. An acceptable means to inform the pilot that the affected system is not performing properly would include any visual or aural method (flags, lights, horns, loss of display, etc.).
(3) Determine that failure or malfunction of the installed equipment could not result in unacceptable hazards.
(a) Each item of equipment must be evaluated for general installation hazards. These types of hazards would normally include those hazards that would directly compromise the safety of the airplane or its occupants, such as fire, smoke, explosion, toxic gases, depressurization, etc. A hazard could also result from loss of equipment or systems essential to safe operations when the minimum required functions are lost. Individual failure of redundant equipment would not necessarily be considered a hazard. For example, the single failure of either a communication transceiver or a navigation receiver (but not both) during IFR operation is not considered a hazard; however, a single failure of a common power supply to those systems would be considered a hazard.
(b) Systems and equipment essential to safe operation must also be assessed for probability of malfunction or failure. Where the installation is conventional, and where there is a high degree of similarity in installations and a significant amount of service history is available for review, this determination can be an engineering judgment. Service history should show that past malfunctions or failures have not resulted in hazards and there are no unresolved problems.
(c) Hazards identified and found to result from probable failures are not acceptable in multiengine airplanes. In these situations, a design change may be required to remove the hazard or to reduce the probability of failure, such as increasing redundancy, substitution of more reliable equipment, annunciation, etc.
(d) If it has been determined that a probable failure or malfunction could result in a hazard to a single-engine airplane, that hazard must be minimized or prevent hazards in a multiengine airplane. To minimize is to reduce, lessen, or diminish a hazard to the least practical amount with current technology and materials. Design features should be taken into account to prevent hazards either by ensuring that the failure condition will not occur or by having redundancy or annunciation with the associated flight crew’s corrective action. In either case, the hazards should be addressed to the least practical amount to the point at which the effort to further reduce a hazard significantly exceeds any benefit in terms of safety derived from that reduction that is practical for this type of airplane. Additional efforts would not result in any significant improvements of safety and would inappropriately add to the cost of the product without a commensurate benefit. This determination should come from an experienced engineering judgment based on the criticality of the hazard and the intended kinds of operation.
FIGURE 1. METHOD OF COMPLIANCE DIAGRAM OF § 23.1309(a) THROUGH AMENDMENT 23-49 Start Assessment All Airplanes Corrective Measures Unacceptable Will Operation of this Equipment have Adverse Effect on Equipment Essential to Safe Operation?
Any Adverse Effect on Other Equipment?
Is there a means to Inform the Pilot of Effect?
Meets Requirements of § 23.1309(a)(1) Will Any Probable Failure or Malfunction Result in a Hazard?
Corrective Measures Unacceptable Single or Multiengine?
Has Hazard Been Minimized?
Meets Requirements of § 23.1309(a)(2) & (3) No Yes Yes No No Yes Yes No Yes No Yes Single Engine Multiengine 17
11. Application of § 23.1309(a)(4), as adopted by Amendment 23-49.
a. For those commuter airplanes that include the certification basis of Amendments 23-34, 23-41, or 23-49, § 23.1309(a)(4) requires all applicable systems and installations to be designed to safeguard against hazards to the airplane in the event of their failure. This requirement in § 23.1309(a)(4) for commuter airplanes was introduced into part 23 airplanes by Amendment 23- 34 before the safety assessment process was included by Amendment 23-41.
b. Design features should be taken into account to safeguard against hazards either by ensuring that the failure condition will not occur or by having redundancy or annunciation with the associated flight crew’s corrective action. The reliability should be such that independent failures of the redundant systems are not probable during the same flight. If a redundant system is required, a probable failure in one system should not adversely affect the other system’s operation. No probable failure should result in a “safe” indication of an “unsafe” condition so that the flight crew would incorrectly assume the system is available or functional. When the unsafe condition is annunciated or detected, the AFM should have clear and precise corrective procedures for handling the failure without an excessive increase in workload.
c. Service history for similar installations may be utilized to meet part or all of this requirement if a system or installation has a significant and favorable service history in environments similar to the airplane. The claim of similarity should be based on equipment type, function, design and installation similarities, and other relevant attributes. It is the applicant’s responsibility to provide accepted/approved data that supports any similarity claims to a previous installation. More information is available in Order 8110.4C.
12. Application of § 23.1309(a)(1) and (a)(2), as adopted by Amendments 23-62.
a. Section 23.1309(a) requires the airplane equipment and systems be designed and installed so that:
(1) Those required for type certification or by operating rules perform as intended under the airplane operating and environmental conditions, including the indirect effects of lightning strikes.
(2) Any equipment and system does not adversely affect the safety of the airplane or its occupants, or the proper functioning of those covered by paragraph (a)(1) of this section.
b. Section 23.1309(a) has requirements for different classes of equipment and systems installed in the airplane, that is, those that are required and not required. Section 23.1309(a)(1) covers the equipment and systems installed to meet a regulatory requirement. Such systems and equipment are required to “perform as intended under the airplane’s operating and environmental conditions.”
c. Section 23.1309(a) gives the conditional qualifiers “under the airplane operating and environmental conditions.” This section describes two actions for the applicant. First, the 18
applicant must consider the full normal operating envelope of the airplane, as defined by the AFM, with any modification to that envelope associated with abnormal or emergency procedures and any anticipated crew action. Second, the applicant must consider the anticipated external and internal airplane environmental conditions, as well as any additional conditions where equipment and systems are assumed to “perform as intended.” Although certain operating conditions are foreseeable, achieving normal performance when they exist is not always possible and may not need to be considered. For example, you may foresee ash clouds from volcanic eruptions; however, airplanes with current technology cannot safely fly in such clouds.
d. Other external environmental conditions such as atmospheric turbulence, HIRF, lightning, and precipitation, which the airplane is reasonably expected to encounter, must be considered.
These severities of the external environmental conditions to be considered are limited to those established by certification standards and precedence. Also, the environmental effect within the airplane must be considered. These effects should include vibration and acceleration loads, variations in fluid pressure and electrical power, and fluid or vapor contamination due to either the normal environment or accidental leaks or spillage and handling by personnel.
e. We accept equipment susceptible to failures if these failures do not contribute significantly to the existing risks (e.g., some degradation in functionality and capability is routinely allowed during some environmental qualifications, such as HIRF and lightning testing). For example, system lightning protecti on allows momentary lost or upset of specific functions of electrical/electronic systems. These functions are for failure conditions that are hazardous or major. But, the function must recover in a timely manner after the airplane is exposed to lightning. See AC 20-158 and AC 20-136B for more specific guidance. The safety assessment process of § 23.1309 does not supersede either the HIRF or lightning specific requirements. Environmental effects such as HIRF and lightning should not be considered in combination with another single failure or pre-existing latent failure.
f. Using § 23.1309(a)(2), we must analyze any installed equipment or system that has potential failure condition(s) that are catastrophic, hazardous, major, or minor to determine their impact on the safe operation of the airplane. Usually, normal installation practices can be based on a relatively simple qualitative installation evaluation. If the possible safety impacts, including failure modes or effects, are questionable, or isolation between systems is provided by complex means, more formal structured evaluation methods or a design change may be necessary.
Operational and environmental qualification requirements for those equipment, systems, and installations are reduced to the necessary tests that show their normal or abnormal functioning does not adversely affect the proper functioning of the equipment, systems, or installations under § 23.1309 (a)(1) and does not otherwise adversely influence the safety of the aircraft or its occupants. Examples of adverse influences include fire, explosion, exposing passengers to high voltages, etc.
g. Section 23.1309(a)(2) requires the applicant to show that all required and non required equipment and systems (including approved “amenities,” such as a coffee pot and entertainment systems) have no safety effect on the operation of the airplane. Section 23.1309(a)(2) does not require non-required equipment and systems to function properly during all airplane operations once in service if analysis shows that all potential failure condition(s) have no adverse safety 19
effects on safe operation of the airplane. The equipment or system must function in accordance with the manufacturer’s operating manual or specification. An applicant’s statement of intended function must be sufficiently specific and detailed so the FAA can evaluate whether the system is appropriate for the intended function(s) and the associated flight crew tasks. However, we would require equipment or systems to function when they are tested to verify that they do not interfere with the operation of other airplane equipment and systems and do not pose a hazard themselves. The normal operation of non-required systems should not interfere with the proper operation of any required systems or present a hazard themselves. Non-required systems are not required to perform their intended function throughout the aircraft operating and environmental conditions. However, in situations where the non-required system has failed, there can be no adverse safety effect to the aircraft, its occupants, or any adverse effect on required equipment and systems. Malfunctioning and erroneous behavior of all systems, including non-required, should be addressed under § 23.1309(c).
13. Application of § 23.1309(b), as adopted by Amendment 23-62.
a. Section 23.1309 (b) requires for minor, major, hazardous, or catastrophic failure condition(s) which occur during TIA or FAA flight-certification testing must have root cause analysis and corrective action. Testing is an important aspect of the overall compliance processes with §§ 23.1301 and 23.1309. The applicant should conduct bench, ground, and/or flight testing when necessary to validate hazard classifications, acceptability of crew procedures, human factors, and other assumptions made during the root cause analysis processes and corrective actions. The applicant must also discuss with the project ACO what aspects of this testing will need to be included in the FAA certification testing. Those aspects required for formal certification testing must be included in the appropriate FAA approved test plans and conducted on an FAA conformed test article in the presence of the FAA or delegated FAA witness in accordance with Order 8110.4C. Before receiving TIA, the applicant should be able to show qualitatively that the proposed design change will meet the requirements of section
23.1309.
b. The FAA will typically conduct some level of function and qualitative reliability testing during certification to ensure required functions demonstrate an acceptable level. The FAA will also conduct other required certification tests and analyses. These tests are meant to verify availability, accuracy, and qualitative reliability of the system. The FAA expects the applicant to show that the system does not exhibit unintended or undesirable functionality failure conditions that are minor, major, hazardous, or catastrophic. The FAA also expects that failures, malfunctions, and design errors with potential safety hazards have a full assessment of the problem, root cause analysis processes, and corrective action.
c. It is not intended for the probability requirements based on random distribution across a fleet of aircraft be applied on the beginning phase and to be fully complaint with this requirements. It is not appropriate to apply probability values to the typical certification flight test because the sample is too small. Failures during TIA and FAA flight-certification testing must have root cause analysis and corrective action (include traceability to production within the change) with robust corrections and substantiation of the corrections. The regulations do not required FAA approval for the root cause analysis.
14. Application of § 23.1309(b), as adopted by Amendments 23-41 and 23-49 and § 23.1309(c), as adopted by Amendment 23-62.
a. The installed systems should be evaluated by performing a safety assessment as shown in this AC. The depth and scope of the safety assessment depends on the types of functions performed by the systems, the severity of the failure conditions, and whether the system is complex. For instance, the safety assessment for a slightly modified single-engine airplane with simple systems might consist only of an FHA with a design and installation appraisal. This FHA will be much less extensive than the FHA for a commuter category or a multiple turbine-engine airplane with more complex systems. The types of analyses selected by an applicant and approved by the certification authority should be based on factors such as the system architecture, complexity, particular design, etc.
b. The safety assessment objective is to ensure an acceptable safety level for equipment and systems installed on the airplane. A logical and acceptable inverse relationship should exist between the average probability per flight hour and the severity of failure conditions effects (as shown in figure 2). This figure defines the appropriate airplane systems probability standards for four certification classes of airplanes designed to part 23 standards. The relationship between probability and severity of failure condition effects are as follows:
(1) Failure conditions with no safety effect have no probability requirement.
(2) Minor failure conditions may be probable.
(3) Major failure conditions must be no more frequent than remote.
(4) Hazardous failure conditions must be no more frequent than extremely remote.
(5) Catastrophic failure conditions must be extremely improbable.
c. Compliance with § 23.1309(c) may be shown by analysis and, where necessary, by appropriate ground, flight, or simulator test. The analysis should consider—
(1) Possible modes of failure, including malfunctions and damage from external sources;
(2) The probability of multiple failures and the probability or undetected faults;
(3) The resulting effects on the airplane and occupants, considering the stage of flight and operating conditions; and
(4) The crew warning cues, corrective action required, and the crew's capability of determining faults.
15. Four certification classes of airplanes.
a. The four-certification classes of airplanes for this AC are shown in figure 2 and the acronyms are defined in paragraph 7. They are Class I (Typically SRE 6,000 pounds (lbs.) or less (Maximum Certificated Gross Takeoff Weight)), Class II (Typically MRE, MTE and STE, 6,000 pounds or less), Class III (Typically SRE, STE, MRE, and MTE greater than 6,000 pounds), and Class IV (Typically Commuter Category).
b. Numerical values are assigned for use in cases where the impact of system failures is examined by quantitative methods of analysis. Also, the related software and complex hardware DALs for the various failure conditions are part of the matrix in figure 2 for most systems.
These levels should be used unless there are some unique architecture considerations. For these unusual situations there should be specific policy, guidance, or approval by the Small Airplane Directorate. (See paragraph 21 for more information) The probability standards are based on historical accident data, systems analyses, and engineering judgment for each class of airplane.
c. In assessing the acceptability of a design, the FAA recognized the need to establish rational probability values. Historically, failures in GA airplanes that might result in catastrophic failure conditions are predominately associated with the primary flight instruments in IMC. Historical evidence indicates that the probability of a fatal accident in restricted visibility due to operational and airframe-related causes is approximately one per ten thousand flight hours or 1 x 10-4 per flight hour for single-engine airplanes under 6,000 pounds.
Furthermore, from accident databases, it appears that about 10 percent of the total was attributed to failure conditions caused by the airplane's systems. It is reasonable to expect that the probability of a fatal accident from all such failure conditions would not be greater than one per one hundred thousand flight hours or 1 x 10-5 per flight hour for a newly designed airplane. From past service history, it is also assumed that there are about ten potential failure conditions in an airplane that could be catastrophic. The allowable target average probability per flight hour of 1 x 10-5 was thus apportioned equally among these failure conditions, which resulted in an allocation of not greater than 1 x 10-6 to each. The upper limit for the average probability per flight hour for catastrophic failure conditions would be 1 x 10-6, which establishes an approximate probability value for the term "extremely improbable."
Failure conditions having less severe effects could be relatively more likely to occur. Similarly, airplanes over 6,000 pounds have a lower fatal accident rate; therefore, they have a lower probability value for catastrophic failure conditions.
FIGURE 2. RELATIONSHIP AMONG AI RPLANE CLASSES, PROBABILITIES,
SEVERITY OF FAILURE CONDITIONS, AND
SOFTWARE AND COMPLEX HARDWARE DAL Classification of Failure Conditions No Safety Effect <----Minor-----> <----Major----> <--Hazardous---> < Catastrophic> Allowable Qualitative Probability No Probability Requirement Probable Remote Extremely Remote Extremely Improbable Effect on Airplane No effect on operational capabilities or safety Slight reduction in functional capabilities or safety margins Significant reduction in functional capabilities or safety margins Large reduction in functional capabilities or safety margins Normally with hull loss Effect on Occupants Inconvenience for passengers Physical discomfort for passengers Physical distress to passengers, possibly including injuries Serious or fatal injury to an occupant Multiple fatalities Effect on Flight No effect on flight Slight increase in Physical discomfort Physical distress or Fatal Injury or Crew crew workload or use of emergency procedures or a significant increase in workload excessive workload impairs ability to perform tasks incapacitation Classes of Airplanes:
Allowable Quantitative Probabilities and Software (SW) and Complex Hardware (HW) Development Assurance Levels (Note 2) Class I (Typically SRE 6,000 pounds or less) No Probability or SW and HW Development Assurance Levels Requirement <10-3 Note 1 P=D <10-4 Notes 1 and 4 P=C, S=D <10-5 Note 4 P=C, S=D <10-6 Note 3 P=C, S=C Class II (Typically MRE, STE, or MTE 6,000 pounds or less) No Probability or SW and HW Development Assurance Levels Requirement <10-3 Note 1 P=D <10-5 Notes 1 and 4 P=C, S=D <10-6 Note 4 P=C, S=C <10-7 Note 3 P=C, S=C Class III (Typically SRE, STE, MRE, and MTE greater than 6,000 pounds) No Probability or SW and HW Development Assurance Levels Requirement <10-3 Note 1 P=D <10-5 Notes 1 and 4 P=C, S=D <10-7 Note 4 P=C, S=C <10-8 Note 3 P=B, S=C Class IV (Typically Commuter Category) No Probability or SW and HW Development Assurance Levels Requirement <10-3 Note 1 P=D <10-5 Notes 1 and 4 P=C, S=D <10-7 Note 4 P=B, S=C <10-9 Note 3 P=A, S=B Note 1: Numerical values indicate an order of probability range and are provided here as a reference.
Note 2: The letters of the alphabet denote the typical SW and HW Development Assurance Levels for Primary System (P) and Secondary System (S). For example, HW or SW Development Assurance Level A on Primary System is noted by P=A.
Note 3: At airplane function level, no single failure will result in a Catastrophic Failure Condition.
Note 4. Secondary System (S) may not be required to meet probability goals. If installed, S should meet stated criteria.
d. The criteria shown in figure 2 directly reflect the historical accident and equipment probability of failure data in the CAR 3 and 14 CFR part 23 airplane fleet. Characteristics of the airplane, such as stall speed, handling characteristics, cruise altitude, ease of recognizing system failures, recognition of entry into stall, pilot workload, and other factors (which include pilot training and experience) affect the pilot’s ability to safely handle various types of system failures in small airplanes. The criteria considered for all airplanes’ failure conditions is based on service experience, operational exposure rates, and total airplane system reliability. The values for individual system probability of failure could be higher than probability values shown in figure 2 for specific failure conditions because it considers the installed airplane systems, events, and factors.
e. These classes were defined based on the way accident and safety statistics are currently collected. Generally, the classes deal with airpla nes of historical equivalent levels of system complexity, type of use, system reliability, and historical divisions of airplanes according to these characteristics. However, these classes could change because of new technologies. The placement of a specific airplane in a class should be done in reference to all of the airplane’s missions and performance characteristics. The applicant should have the concurrence of the certification authority that is knowledgeable about the applicable airplane class early in the program. When unusual situations develop, consult the Small Airplane Directorate to obtain specific policy guidance or approval.
f. For example, airplanes with considerably more than 10 catastrophic failure conditions, that have greater performance characteristics and incorporate many complex systems and advance technologies may have lower probability values and higher DALs. These airplanes’ probability values and DALs may fall between the classes of the airplanes. For instance, the performance characteristics of a complex airplane including airplane handling qualities and stall speed may be similar to existing Class II airplanes. However, this airplane’s mission and other performance characteristics including high speed, high altitude, and extended range operations may be similar to existing Class III airplanes. The major difference between the DALs for Class II and Class III airplanes is for primary systems whose failure would result in a catastrophic failure condition for the airplane. Since this complex airplane falls between these two classes, it is reasonable to choose the higher DAL and a lower probability level.
g. For example, in part 23, turbine-engine airplanes traditionally have been subject to more stringent requirements than a single-engine reciprocating airplane. A single-engine reciprocating airplane generally has a wider stall-cruise speed ratio than traditional turbine-engine airplanes.
Such an airplane with a stall speed under 61 knots with simple systems, and with otherwise similar characteristics to a traditional single-engine reciprocating airplane (except for a higher cruise speed and a more reliable engine that is simpler to operate), can be treated as a Class I airplane under this analysis. Conversely, if a single-engine reciprocating airplane has the performance, mission capability, and system complexity of a higher class (such as cabin pressurization, high cruise altitude, and extended range), then that type of airplane design may align itself with the safety requirements of a higher class (for example, Class II airplane). These determinations should be made during the development of the certification basis.
h. This AC uses terminology similar to AC 25.1309-1A. However, the specific means of compliance for § 25.1309 are defined differently due to the higher safety level required for transport category airplanes. However, there are some similarities with part 23 commuter category airplanes.
16. Safety assessments.
a. The applicant is responsible for identifying and classifying each failure condition and choosing the methods for safety assessment. The applicant should then obtain early concurrence from the cognizant certificating authority on the identification of failure conditions, their classifications, and the choice of an acceptable means of compliance. Figure 3 provides an overview of the information flow to conduct a safety assessment. This figure is a guide and it does not include all information provided in this AC or the documents referenced in section 4 of this AC.
b. Functional hazard assessment (FHA).
(1) Before an applicant proceeds with a detailed safety assessment, an FHA of the airplane and system functions to determine the need for and the scope of subsequent analysis should be prepared. This assessment may be conducted using service experience, engineering and operational judgment, or service experience and a top-down deductive qualitative examination of each function. An FHA is a systematic, comprehensive examination of airplane and system functions to identify potential no safety effect, minor, major, hazardous, and catastrophic failure conditions that may arise, not only as a result of malfunctions or failure to function but also as a result of normal responses to unusual or abnormal external factors. The FHA concerns the operational vulnerabilities of systems rather than a detailed analysis of the actual implementation.
(2) Each system function should be examined regarding the other functions performed by the system because the loss or malfunction of all functions performed by the system may result in a more severe failure condition than the loss of a single function. In addition, each system function should be examined regarding functions performed by other airplane systems because the loss or malfunction of different but related functions, provided by separate systems, may affect the severity of failure conditions postulated for a particular system.
(3) The FHA is an engineering tool that should be performed early in the design and updated as necessary. It is used to define the high-level airplane or system safety objectives that should be considered in the proposed system architectures. Also, it should be used to assist in determining the DALs for the systems. Many systems may need only a simple review of the system design by the applicant to determine the hazard classification. An FHA requires experienced engineering judgment and early coordination between the applicant and the certification authority.
FIGURE 3. DEPTH OF ANALYSIS FLOW CHART Conduct Functional Hazard Assessment Is there a safety effect?
Note: FHA may be based on a design and installation appraisal for these systems NO YES Is the Failure Condition Minor?
Is the system and installation similar to a previous design?
Is the Failure Condition Major?
YES NO NO YES YES NO NO Verify by design and installation appraisal 17(a) & (b) YES Verify similarity 17(c) & (d) Is the system simple?
Is the system redundant?
YES NO Conduct qualitative assessment 17(c) Conduct qualitative and quantitative assessments YES Is the system simple and conventional?
Conduct qualitative assessments 17(d) NO Note: Numbers in parenthesis refer to the paragraphs in this AC Conduct qualitative and quantitative assessments 17(c) 26