FIGURE 2. RELATIONSHIP AMONG AI RPLANE CLASSES, PROBABILITIES,
SEVERITY OF FAILURE CONDITIONS, AND
SOFTWARE AND COMPLEX HARDWARE DAL Classification of Failure Conditions No Safety Effect <----Minor-----> <----Major----> <--Hazardous---> < Catastrophic> Allowable Qualitative Probability No Probability Requirement Probable Remote Extremely Remote Extremely Improbable Effect on Airplane No effect on operational capabilities or safety Slight reduction in functional capabilities or safety margins Significant reduction in functional capabilities or safety margins Large reduction in functional capabilities or safety margins Normally with hull loss Effect on Occupants Inconvenience for passengers Physical discomfort for passengers Physical distress to passengers, possibly including injuries Serious or fatal injury to an occupant Multiple fatalities Effect on Flight No effect on flight Slight increase in Physical discomfort Physical distress or Fatal Injury or Crew crew workload or use of emergency procedures or a significant increase in workload excessive workload impairs ability to perform tasks incapacitation Classes of Airplanes:
Allowable Quantitative Probabilities and Software (SW) and Complex Hardware (HW) Development Assurance Levels (Note 2) Class I (Typically SRE 6,000 pounds or less) No Probability or SW and HW Development Assurance Levels Requirement <10-3 Note 1 P=D <10-4 Notes 1 and 4 P=C, S=D <10-5 Note 4 P=C, S=D <10-6 Note 3 P=C, S=C Class II (Typically MRE, STE, or MTE 6,000 pounds or less) No Probability or SW and HW Development Assurance Levels Requirement <10-3 Note 1 P=D <10-5 Notes 1 and 4 P=C, S=D <10-6 Note 4 P=C, S=C <10-7 Note 3 P=C, S=C Class III (Typically SRE, STE, MRE, and MTE greater than 6,000 pounds) No Probability or SW and HW Development Assurance Levels Requirement <10-3 Note 1 P=D <10-5 Notes 1 and 4 P=C, S=D <10-7 Note 4 P=C, S=C <10-8 Note 3 P=B, S=C Class IV (Typically Commuter Category) No Probability or SW and HW Development Assurance Levels Requirement <10-3 Note 1 P=D <10-5 Notes 1 and 4 P=C, S=D <10-7 Note 4 P=B, S=C <10-9 Note 3 P=A, S=B Note 1: Numerical values indicate an order of probability range and are provided here as a reference.
Note 2: The letters of the alphabet denote the typical SW and HW Development Assurance Levels for Primary System (P) and Secondary System (S). For example, HW or SW Development Assurance Level A on Primary System is noted by P=A.
Note 3: At airplane function level, no single failure will result in a Catastrophic Failure Condition.
Note 4. Secondary System (S) may not be required to meet probability goals. If installed, S should meet stated criteria.
d. The criteria shown in figure 2 directly reflect the historical accident and equipment probability of failure data in the CAR 3 and 14 CFR part 23 airplane fleet. Characteristics of the airplane, such as stall speed, handling characteristics, cruise altitude, ease of recognizing system failures, recognition of entry into stall, pilot workload, and other factors (which include pilot training and experience) affect the pilot’s ability to safely handle various types of system failures in small airplanes. The criteria considered for all airplanes’ failure conditions is based on service experience, operational exposure rates, and total airplane system reliability. The values for individual system probability of failure could be higher than probability values shown in figure 2 for specific failure conditions because it considers the installed airplane systems, events, and factors.
e. These classes were defined based on the way accident and safety statistics are currently collected. Generally, the classes deal with airpla nes of historical equivalent levels of system complexity, type of use, system reliability, and historical divisions of airplanes according to these characteristics. However, these classes could change because of new technologies. The placement of a specific airplane in a class should be done in reference to all of the airplane’s missions and performance characteristics. The applicant should have the concurrence of the certification authority that is knowledgeable about the applicable airplane class early in the program. When unusual situations develop, consult the Small Airplane Directorate to obtain specific policy guidance or approval.
f. For example, airplanes with considerably more than 10 catastrophic failure conditions, that have greater performance characteristics and incorporate many complex systems and advance technologies may have lower probability values and higher DALs. These airplanes’ probability values and DALs may fall between the classes of the airplanes. For instance, the performance characteristics of a complex airplane including airplane handling qualities and stall speed may be similar to existing Class II airplanes. However, this airplane’s mission and other performance characteristics including high speed, high altitude, and extended range operations may be similar to existing Class III airplanes. The major difference between the DALs for Class II and Class III airplanes is for primary systems whose failure would result in a catastrophic failure condition for the airplane. Since this complex airplane falls between these two classes, it is reasonable to choose the higher DAL and a lower probability level.
g. For example, in part 23, turbine-engine airplanes traditionally have been subject to more stringent requirements than a single-engine reciprocating airplane. A single-engine reciprocating airplane generally has a wider stall-cruise speed ratio than traditional turbine-engine airplanes.
Such an airplane with a stall speed under 61 knots with simple systems, and with otherwise similar characteristics to a traditional single-engine reciprocating airplane (except for a higher cruise speed and a more reliable engine that is simpler to operate), can be treated as a Class I airplane under this analysis. Conversely, if a single-engine reciprocating airplane has the performance, mission capability, and system complexity of a higher class (such as cabin pressurization, high cruise altitude, and extended range), then that type of airplane design may align itself with the safety requirements of a higher class (for example, Class II airplane). These determinations should be made during the development of the certification basis.
h. This AC uses terminology similar to AC 25.1309-1A. However, the specific means of compliance for § 25.1309 are defined differently due to the higher safety level required for transport category airplanes. However, there are some similarities with part 23 commuter category airplanes.
16. Safety assessments.
a. The applicant is responsible for identifying and classifying each failure condition and choosing the methods for safety assessment. The applicant should then obtain early concurrence from the cognizant certificating authority on the identification of failure conditions, their classifications, and the choice of an acceptable means of compliance. Figure 3 provides an overview of the information flow to conduct a safety assessment. This figure is a guide and it does not include all information provided in this AC or the documents referenced in section 4 of this AC.
b. Functional hazard assessment (FHA).
(1) Before an applicant proceeds with a detailed safety assessment, an FHA of the airplane and system functions to determine the need for and the scope of subsequent analysis should be prepared. This assessment may be conducted using service experience, engineering and operational judgment, or service experience and a top-down deductive qualitative examination of each function. An FHA is a systematic, comprehensive examination of airplane and system functions to identify potential no safety effect, minor, major, hazardous, and catastrophic failure conditions that may arise, not only as a result of malfunctions or failure to function but also as a result of normal responses to unusual or abnormal external factors. The FHA concerns the operational vulnerabilities of systems rather than a detailed analysis of the actual implementation.
(2) Each system function should be examined regarding the other functions performed by the system because the loss or malfunction of all functions performed by the system may result in a more severe failure condition than the loss of a single function. In addition, each system function should be examined regarding functions performed by other airplane systems because the loss or malfunction of different but related functions, provided by separate systems, may affect the severity of failure conditions postulated for a particular system.
(3) The FHA is an engineering tool that should be performed early in the design and updated as necessary. It is used to define the high-level airplane or system safety objectives that should be considered in the proposed system architectures. Also, it should be used to assist in determining the DALs for the systems. Many systems may need only a simple review of the system design by the applicant to determine the hazard classification. An FHA requires experienced engineering judgment and early coordination between the applicant and the certification authority.
FIGURE 3. DEPTH OF ANALYSIS FLOW CHART Conduct Functional Hazard Assessment Is there a safety effect?
Note: FHA may be based on a design and installation appraisal for these systems NO YES Is the Failure Condition Minor?
Is the system and installation similar to a previous design?
Is the Failure Condition Major?
YES NO NO YES YES NO NO Verify by design and installation appraisal 17(a) & (b) YES Verify similarity 17(c) & (d) Is the system simple?
Is the system redundant?
YES NO Conduct qualitative assessment 17(c) Conduct qualitative and quantitative assessments YES Is the system simple and conventional?
Conduct qualitative assessments 17(d) NO Note: Numbers in parenthesis refer to the paragraphs in this AC Conduct qualitative and quantitative assessments 17(c) 26
(4) Depending on the extent of functions to be examined and the relationship between functions and systems, different approaches to FHA may be taken. Where there is a clear correlation between functions and systems, and where system and function interrelationships are relatively simple, it may be feasible to conduct separate FHA’s for each system. However, this is conditional providing any interface aspects are properly considered and easily understood.
However, a top-down approach from an airplane level perspective should be taken in planning and conducting an FHA where system and function interrelationships are more complex.
(5) After each failure condition is classified, refer to figure 2 to identify the failure condition probability and software and complex hardware DALs. For example, the probability requirement for a hazardous failure condition for a Class I airplane should be less than 1 x 10-5.
In addition, the primary system for a Class I airplane should have software and complex hardware DALs of C and, if required, the secondary system for a Class I airplane should have software and complex hardware DALs of D.
(6) The classification of failure conditions does not depend on whether a system or function is required by any specific regulation. Some systems required by specific regulations, such as transponders, position lights, and public address systems, may have the potential for only minor failure conditions. Conversely, other systems not required by any specific regulation, such as flight management systems and automatic landing systems, may have the potential for major, hazardous, or catastrophic failure conditions.
(7) The classification of failure conditions should consider all relevant factors.
Examples of factors include the nature of the failure modes, which includes common mode faults, system degradation resulting from failures, flight crew actions, flight crew workload, performance degradation, reduced operational capability, effects on airframe, etc. It is particularly important to consider factors that would alleviate or intensify the severity of a failure condition. An example of an alleviating factor would be the continued performance of identical or operationally similar functions by other systems not affected by a failure condition. Examples of intensifying factors would include unrelated conditions that would reduce the ability of the crew to cope with a failure condition, such as weather or other adverse operational or environmental conditions. The ability of a system to inform the pilot of potential or real failure conditions so that timely corrective action can be taken to reduce the effects of the combination of events is desirable. This approach may reduce the severity of the failure condition.
(8) Because of the large number of combinations of failures, various mitigating factors, airplane characteristic effects, and similar factors, a specific FHA and the related safety assessments may be significantly different for each evaluated airplane type and configuration.
These factors preclude providing a concrete example of a FHA that applies across the board to every installation. However, general examples may be provided that illustrate the concepts involved in an FHA. It is critical to unde rstand that significant engineering judgment and common sense are necessary to provide a practical and acceptable evaluation of the airplane and its systems.
c. Appendix 1 provides a partial list of FHA for consideration for part 23 IFR Class I airplanes with typical functions and, in general, the related failure conditions are at the aircraft 27
level. The criteria at the aircraft level are useful to derive the system FHA. The failure conditions for the examples in Appendix 1 cannot be applied indiscriminately to a particular airplane installation. This table is primarily for use to reduce the regulatory burden on applicants who are not familiar with the various methods and procedures generally used in industry to conduct safety assessments. It is only intended to be a guide, not a certification checklist, since it does not include all the information necessary for an FHA for a specific airplane with its various functions and its intended use. The functions listed in the partial FHA as a guide for the classification of failure conditions when the functions are installed. The list of functions is not intended to suggest that the functions are required for Class I airplanes. Even if there is guidance information in Appendix 1, the applicable regulations provide the requirements of the functions for installations.
(1) The applicant should use Appendix 1 and the appropriate certification authority as a point of departure for the specific system or airplane assessment. It can be used to arrive at the appropriate failure conditions for a specific system by similarity to or by interpolating between the example systems. It does not necessarily provide, by itself, an answer for an applicant’s system unless that system is exactly as described. Its sole purpose is to assist applicants by illustrating typical functions and the related failure conditions. This appendix addresses general applicability, which is valuable for determining software and complex hardware DALs, and it should not be utilized to replace any specific guidance intended for individual types of equipment, systems, and installations. The FHA results are airplane characteristic and system architecture dependent. The examples in this appendix are based on traditional airplanes and traditional architectures. Section 23.1309 is a regulation of general requirements and should not be used to supersede any specific requirements of part 23.
(2) In addition to the general technical guidance provided in Appendix 1, a sample of one suggested format is provided in Appendix 2 for documenting the results of an FHA. This format illustrates how factors other than those directly illustrated in Appendix 1 are pertinent. It also illustrates that failure conditions are not limited to only the three general types shown in Appendix 1. The actual data shown in Appendix 2 is only used to illustrate the typical approach and should not be viewed as technically representative of any particular airplane. A complete FHA could be comprised of the layout shown in Appendix 2 by utilizing pertinent technical considerations identified in Appendix 1, which are modified and expanded to reflect the specific proposed airplane design under consideration.
d. Part 23 airplanes cover a wide range of airplane sizes and capabilities. These airplanes range from single-engine, single-seat, low-performance airplanes to complex multiengine, highspeed, high-performance airplanes. At the bottom end of these part 23 airplane types, there are several compensating characteristics that mitigate many of the effects of a failure. Docile handling characteristics, low stall speeds, spin resistant designs, lower probability of operation in extreme weather conditions, and the inherent design philosophies used to design single-engine airplanes are specific examples of characteristics to consider in an FHA for systems installed in this class of airplane. Usually, air traffic control support is not a mitigating factor.
17. Failure conditions.
a. Failure conditions with no safety effect. An FHA with a design and installation appraisal to establish independence from other functions is necessary for the safety assessment of these failure conditions. In general, common design practice provides physical and functional isolation from related components, which are essential to safe operation. If the applicant chooses not to do a detailed FHA, the safety effects may be derived from the design and installation appraisal performed by the applicant.
b. Analysis of minor failure conditions. An analysis should consider the effects of system failures on other systems or their functions. An FHA with a design and installation appraisal to establish independence from other functions is necessary for the safety assessment of these failure conditions. In general, common design practice provides physical and functional isolation from components that are essential to safe operation. If the applicant chooses not to do a detailed FHA, the safety effects may be derived from the design and installation appraisal performed by the applicant.
c. Analysis of major failure conditions. An assessment based on engineering judgment is a qualitative assessment, as are several of the methods described below:
(1) Similarity allows validation of a requirement by comparison to the requirements of similar certified systems. The similarity argument gains strength as the period of experience with the system increases. If the system is similar in its relevant attributes to those used in other airplanes and if the functions and effects of failure would be the same, then a design and installation appraisal and satisfactory service history of either the equipment being analyzed or of a similar design is usually acceptable for showing compliance. It is the applicant’s responsibility to provide data that is accepted, approved, or both, and that supports any claims of similarity to a previous installation.
(2) For systems that are not complex and where similarity cannot be used as the basis for compliance, then compliance may be shown by means of a qualitative assessment that shows that the major failure conditions of the system, as installed, are consistent with the FHA (for example, redundant systems).
(3) To show that malfunctions are indeed remote in systems of high complexity without redundancy (for example, a system with a self-monitoring microprocessor), it is necessary to conduct a qualitative functional FTA or FMEA supported by failure rate data and fault detection coverage analysis.
(4) An analysis of a redundant system in the airplane is usually complete if it shows isolation between redundant system channels and satisfactory reliability for each channel. For complex systems, where functional redundancy is required, a qualitative FMEA or FTA may be necessary to determine that redundancy actually exists (for example, no single failure affects all functional channels).
d. Analysis of hazardous and catastrophic failure conditions. For these failure conditions, a thorough safety assessment is necessary. The assessment usually consists of an 29
appropriate combination of qualitative and quantitative analyses. Except as specified in the next paragraphs below, a detailed safety analysis must be completed for each hazardous and catastrophic failure condition identified by an FHA. The analysis will usually be a combination of qualitative and quantitative assessments of the design.
(1) For simple and conventional installations (that is, low complexity and similarity in relevant attributes), it may be possible to assess a hazardous or catastrophic failure condition as being extremely remote or extremely improbable, respectively, on the basis of experienced engineering judgment using only qualitative analysis. The basis for the assessment will be the degree of redundancy, the established independence and isolation of the channels, and the reliability record of the technology involved. Satisfactory service experience on similar systems commonly used in many airplanes may be sufficient when a close similarity is established regarding both the system design and operating conditions.
(2) For complex systems where true similarity in all relevant attributes, including installation attributes, can be rigorously established, it may also be possible to assess a hazardous or catastrophic failure condition as being extremely remote or extremely improbable, respectively, on the basis of experienced engineering judgment using only qualitative analysis.
A high degree of similarity in both design and application is required.
(3) No catastrophic failure condition (Note 3 in figure 2) should result from the failure of a single component, part, or element of a system. Experienced engineering judgment and service history should show that a catastrophic failure condition by a single failure mode is not a practical possibility. The logic and rationale used in the assessment should be so straightforward and obvious that the failure mode simply would not occur unless it is associated with an unrelated failure condition that would, in itself, be catastrophic.
18. Assessment methods.
a. Assessment methods. Methods for qualitatively and quantitatively assessing the causes, severity, and likelihood of potential failure conditions are available to support experienced engineering and operational judgment. Some of these methods are structured. The various types of analyses are based on either inductive or deductive approaches. The applicant should select analyses to validate the safety of a particular design based on factors such as the system architecture, complexity, criticality of the function, etc. ARP 4761 has more details of the various methods. Descriptions of typical types of analyses that might be used are provided below.
(1) Design appraisal. A qualitative appraisal of the integrity and safety of the system design. An effective appraisal requires experienced judgment.
(2) Installation appraisal. This is a qualitative appraisal of the integrity and safety of the installation. Any deviations from normal, industry-accepted installation practices should be evaluated. An effective appraisal requires experienced judgment.
(3) Failure Modes and Effects Analysis (FMEA). A structured, inductive, and bottomup analysis that is used to evaluate the effects on the system and the airplane of each possible 30
element or component failure. When properly formatted, it should aid in identifying latent failures and the possible causes of each failure mode. ARP 4761 provides methodology and detailed guidelines that may be used to perform this type of analysis. An FMEA could be a piece-part FMEA or a functional FMEA. For modern microcircuit-based line replaceable units and systems, an exhaustive piece-part FMEA is not practically feasible with the present state of the art. In that context, an FMEA may be more functional than piece-part oriented. A functional-oriented FMEA can lead to uncertainties in the qualitative and quantitative aspects, which can be compensated for by more conservative assessments, such as the following:
Assuming all failure modes result in failure conditions of interest, carefully choosing system architecture, and using lessons learned from similar technology.
(4) Fault Tree Analysis (FTA). A structured, deductive, and top-down analysis that is used to identify the conditions, failures, and events that would cause each defined failure condition. FTAs are graphical methods of id entifying the logical relationship between each particular failure condition and the primary element or component failures, other events, or combinations thereof that can cause it. The fault tree should be developed to the lowest level for which failure rates can be substantiated. Rates derived from applicable service experience, acceptable industry wide sources, manufacturer’s accelerating testing data, or from an FMEA may be used as inputs to the lowest level events.
(5) Common cause analysis. The acceptance of adequate probability of failure conditions is often derived from the assessment of multiple systems based on the assumption that failures are independent. Therefore, it is necessary to recognize that such independence may not exist in the practical sense, and specific studies are necessary to ensure that independence can either be assured or deemed acceptable. The “common cause analysis” is divided into three areas of study:
(a) Zonal safety analysis. This analysis has the objective of ensuring that the equipment installations within each zone of the airplane are at an adequate safety standard regarding design and installation standards, interference between systems, and maintenance errors.
(b) Particular risk analysis. Particular risks are defined as those events or influences outside the systems concerned (e.g., fire, leaking fluids, bird strike, tire burst, HIRF exposure, lightning, uncontained failure of high energy rotating machines, etc.). Each risk should be the subject of a specific study to examine and document the simultaneous or cascading effects, or influences, which may violate independence.
(c) Common mode analysis. This analysis is performed to confirm the assumed independence of the events that were considered in combination for a given failure condition.
The effects of specification, design, implementation, installation, maintenance errors, manufacturing errors, environmental factors other than those already considered in the particular risk analysis, and failures of system components should be considered.
19. Assessment of failure condition probabilities and analysis considerations.
a. An assessment of the probability of a failure condition may be either qualitative or quantitative. An analysis may range from a simple report that interprets test results or compares two similar systems to a detailed analysis that may or may not include estimated numerical probabilities. The depth and scope of an analysis depends on the type of functions performed by the system, the severity of failure conditions, and whether the system is complex. A quantitative analysis is intended to supplement, but not replace, qualitative methods based on engineering and operational judgment. A quantitative analysis is often used for catastrophic or hazardous failure conditions of systems that are complex and major failure conditions that are complex without redundancy. For the cases were there is insufficient service experience to help substantiate their safety, or that have attributes that differ significantly from those of conventional systems.
b. A probability analysis may be either an FMEA or an FTA, which also includes numerical probability information. Numerical values are assigned to the probabilistic terms included in the requirements for use in those cases where the impact of system failures is examined by quantitative analysis methods.
c. The probabilities of primary failures can be determined from failure rate data and exposure times using failure rates derived from either service experience on identical or similar items, manufacturer’s accelerating testing data, or from acceptable industry standards.
Conventional mathematics of probability can then be used to calculate the estimated probability of each failure condition as a function of the estimated probabilities of the various identified contributory failures or other events. See Appendix D of ARP 4761 for more information.
d. When calculating the estimated probability of each failure condition, a margin may be necessary to account for uncertainty. A margin is not normally required for an analysis that is based on proven data or from operational experience and tests. Where data has limited background for substantiation, a margin may be required depending on the available justification.
e. The applicant should obtain early certification authority concurrence for an acceptable classification of the failure conditions and probability for each minor, major, hazardous, and catastrophic failure condition. Early concurrence on the classification of the failure conditions may reduce the applicant’s efforts in determining the probabilities resulting from changes.
f. The details on how to calculate the “average probability per flight hour” for a failure condition are given in Appendix 3. The “average probability per flight hour” is the probability of occurrence, normalized by the flight time of a failure condition during a single flight. If the probability of a subject failure condition occurring during a typical flight of mean duration for the airplane type, divided by the flight’s mean duration in hours, is likely to be significantly different from the predicted average rate of occurrence of that failure condition during the entire operational life of all airplanes of that type, then a risk model that better reflects the failure condition should be used. The single flight is analyzed to be representative of an average over 32
all possible flights of the fleet of airplanes to be certified. The calculation of the “average probability per flight hour” for a failure condition should consider the following:
(1) The average flight duration and the average flight profile for the airplane type to be certified. A common assumption for part 23 airplanes is that the average flight duration is 1 hour;
(2) All combinations of failures and events that contribute to the failure condition;
(3) The conditional probability if a sequence of events is necessary to produce the failure condition;
(4) The relevant "at risk" time if an event is only relevant during certain flight phases;
and
(5) The average exposure time if the failure can persist for multiple flights.
20. Operational and maintenance considerations.
a. Alerts
(1) Section 23.1309(d) requires information concerning unsafe system operating condition(s) must be provided in a timely manner to the crew to enable them to take appropriate corrective action. An appropriate alert must be provided if immediate pilot awareness and immediate or subsequent corrective action is required. The particular method of indication depends on the urgency and need for flight crew awareness or action necessary for the particular failure. Inherent airplane characteristics may be used in lieu of dedicated indications and annunciations if they can be shown to be timely and effective. However, the use of periodic maintenance or flight crew checks to detect significant latent failures when they occur should not be used in lieu of practical and reliable failure monitoring and indications.
(2) Section 23.1309(d) specifies that the design of systems and controls, including indications and annunciations, must be design to minimize crew errors, which could create additional hazards. The additional hazards to be minimized include those caused by inappropriate actions by a crewmember in response to the failure, or those that could occur after a failure.
b. Flight crew and maintenance task. These tasks, which relate to compliance, should be appropriate and reasonable. Quantitative assessments of the probabilities of flight crew and maintenance errors are not considered feasible. Reasonable tasks are those for which full credit can be taken because the flight crew or ground crew can realistically be anticipated to perform them correctly when they are required or scheduled. For the purposes of quantitative analysis, a probability of one can be assumed for flight crew and maintenance tasks that have been evaluated and found to be reasonable. In addition, based on experienced engineering and operational judgment, the discovery of obvious failures during normal operation and 33
maintenance of the airplane may be considered, even though such failures are not the primary purpose or focus of the operational or maintenance actions.
c. Flight crew action. When assessing the ability of the flight crew to cope with a failure condition, the information provided to the crew and the complexity of the required action should be considered.
(1) If the evaluation indicates that a potential failure condition can be alleviated or overcome in a timely manner without jeopardizing other safety related flight crew tasks and without requiring exceptional pilot skill or strength, correct crew action may be assumed in both qualitative and quantitative assessments.
(2) Annunciation that requires flight crew actions should be evaluated to determine if the required actions can be accomplished in a timely manner without exceptional pilot skills. If the evaluation indicates that a potential failure condition can be alleviated or overcome during the time available without jeopardizing other safety related flight crew tasks and without requiring exceptional pilot skill or strength, credit may be taken for correct and appropriate corrective action for both qualitative and quantitative assessments. Similarly, credit may be taken for correct flight crew performance if overall flight crew workload during the time available is not excessive and if the tasks do not require exceptional pilot skill or strength.
(3) Unless flight crew actions are accepted as normal airmanship, the appropriate procedures should be included in the FAA approved AFM or in the AFM revision or supplement. The AFM should include procedures for operation of complex systems such as integrated flight guidance and control systems. These procedures should include proper pilot response to cockpit indications, diagnosis of system failures, discussion of possible pilot-induced flight control system problems, and use of the system in a safe manner.
d. Maintenance actions. Credit may be taken for correct accomplishment of maintenance tasks in both qualitative and quantitative assessments if the tasks are evaluated and found to be reasonable. Required maintenance tasks, which mitigate hazards, should be provided for use in the FAA approved maintenance programs such as the ICA. Annunciated failures will be corrected before the next flight or a maximum duration will be established before a maintenance action is required. If the latter is acceptable, the analysis should establish the maximum allowable interval before the maintenance action is required. A scheduled maintenance task may detect latent failures. If this approach is taken, and the failure condition is hazardous or catastrophic, then a maintenance task should be established. Some latent failures can be assumed to be identified based upon a return to service test on the equipment following its removal and repair (component MTBF should be the basis for the check interval time).
21. Software and complex hardware DALs for airborne system and applications.
a. Background. AC 20-115B discusses how RTCA/DO-178B provides an acceptable means for showing that software complies with pertinent airworthiness requirements. AC 20- 152 and Order 8110.105 provide acceptable means for showing that complex hardware complies with the pertinent airworthiness requirements.