(4) Depending on the extent of functions to be examined and the relationship between functions and systems, different approaches to FHA may be taken. Where there is a clear correlation between functions and systems, and where system and function interrelationships are relatively simple, it may be feasible to conduct separate FHA’s for each system. However, this is conditional providing any interface aspects are properly considered and easily understood.
However, a top-down approach from an airplane level perspective should be taken in planning and conducting an FHA where system and function interrelationships are more complex.
(5) After each failure condition is classified, refer to figure 2 to identify the failure condition probability and software and complex hardware DALs. For example, the probability requirement for a hazardous failure condition for a Class I airplane should be less than 1 x 10-5.
In addition, the primary system for a Class I airplane should have software and complex hardware DALs of C and, if required, the secondary system for a Class I airplane should have software and complex hardware DALs of D.
(6) The classification of failure conditions does not depend on whether a system or function is required by any specific regulation. Some systems required by specific regulations, such as transponders, position lights, and public address systems, may have the potential for only minor failure conditions. Conversely, other systems not required by any specific regulation, such as flight management systems and automatic landing systems, may have the potential for major, hazardous, or catastrophic failure conditions.
(7) The classification of failure conditions should consider all relevant factors.
Examples of factors include the nature of the failure modes, which includes common mode faults, system degradation resulting from failures, flight crew actions, flight crew workload, performance degradation, reduced operational capability, effects on airframe, etc. It is particularly important to consider factors that would alleviate or intensify the severity of a failure condition. An example of an alleviating factor would be the continued performance of identical or operationally similar functions by other systems not affected by a failure condition. Examples of intensifying factors would include unrelated conditions that would reduce the ability of the crew to cope with a failure condition, such as weather or other adverse operational or environmental conditions. The ability of a system to inform the pilot of potential or real failure conditions so that timely corrective action can be taken to reduce the effects of the combination of events is desirable. This approach may reduce the severity of the failure condition.
(8) Because of the large number of combinations of failures, various mitigating factors, airplane characteristic effects, and similar factors, a specific FHA and the related safety assessments may be significantly different for each evaluated airplane type and configuration.
These factors preclude providing a concrete example of a FHA that applies across the board to every installation. However, general examples may be provided that illustrate the concepts involved in an FHA. It is critical to unde rstand that significant engineering judgment and common sense are necessary to provide a practical and acceptable evaluation of the airplane and its systems.
c. Appendix 1 provides a partial list of FHA for consideration for part 23 IFR Class I airplanes with typical functions and, in general, the related failure conditions are at the aircraft 27
level. The criteria at the aircraft level are useful to derive the system FHA. The failure conditions for the examples in Appendix 1 cannot be applied indiscriminately to a particular airplane installation. This table is primarily for use to reduce the regulatory burden on applicants who are not familiar with the various methods and procedures generally used in industry to conduct safety assessments. It is only intended to be a guide, not a certification checklist, since it does not include all the information necessary for an FHA for a specific airplane with its various functions and its intended use. The functions listed in the partial FHA as a guide for the classification of failure conditions when the functions are installed. The list of functions is not intended to suggest that the functions are required for Class I airplanes. Even if there is guidance information in Appendix 1, the applicable regulations provide the requirements of the functions for installations.
(1) The applicant should use Appendix 1 and the appropriate certification authority as a point of departure for the specific system or airplane assessment. It can be used to arrive at the appropriate failure conditions for a specific system by similarity to or by interpolating between the example systems. It does not necessarily provide, by itself, an answer for an applicant’s system unless that system is exactly as described. Its sole purpose is to assist applicants by illustrating typical functions and the related failure conditions. This appendix addresses general applicability, which is valuable for determining software and complex hardware DALs, and it should not be utilized to replace any specific guidance intended for individual types of equipment, systems, and installations. The FHA results are airplane characteristic and system architecture dependent. The examples in this appendix are based on traditional airplanes and traditional architectures. Section 23.1309 is a regulation of general requirements and should not be used to supersede any specific requirements of part 23.
(2) In addition to the general technical guidance provided in Appendix 1, a sample of one suggested format is provided in Appendix 2 for documenting the results of an FHA. This format illustrates how factors other than those directly illustrated in Appendix 1 are pertinent. It also illustrates that failure conditions are not limited to only the three general types shown in Appendix 1. The actual data shown in Appendix 2 is only used to illustrate the typical approach and should not be viewed as technically representative of any particular airplane. A complete FHA could be comprised of the layout shown in Appendix 2 by utilizing pertinent technical considerations identified in Appendix 1, which are modified and expanded to reflect the specific proposed airplane design under consideration.
d. Part 23 airplanes cover a wide range of airplane sizes and capabilities. These airplanes range from single-engine, single-seat, low-performance airplanes to complex multiengine, highspeed, high-performance airplanes. At the bottom end of these part 23 airplane types, there are several compensating characteristics that mitigate many of the effects of a failure. Docile handling characteristics, low stall speeds, spin resistant designs, lower probability of operation in extreme weather conditions, and the inherent design philosophies used to design single-engine airplanes are specific examples of characteristics to consider in an FHA for systems installed in this class of airplane. Usually, air traffic control support is not a mitigating factor.
17. Failure conditions.
a. Failure conditions with no safety effect. An FHA with a design and installation appraisal to establish independence from other functions is necessary for the safety assessment of these failure conditions. In general, common design practice provides physical and functional isolation from related components, which are essential to safe operation. If the applicant chooses not to do a detailed FHA, the safety effects may be derived from the design and installation appraisal performed by the applicant.
b. Analysis of minor failure conditions. An analysis should consider the effects of system failures on other systems or their functions. An FHA with a design and installation appraisal to establish independence from other functions is necessary for the safety assessment of these failure conditions. In general, common design practice provides physical and functional isolation from components that are essential to safe operation. If the applicant chooses not to do a detailed FHA, the safety effects may be derived from the design and installation appraisal performed by the applicant.
c. Analysis of major failure conditions. An assessment based on engineering judgment is a qualitative assessment, as are several of the methods described below:
(1) Similarity allows validation of a requirement by comparison to the requirements of similar certified systems. The similarity argument gains strength as the period of experience with the system increases. If the system is similar in its relevant attributes to those used in other airplanes and if the functions and effects of failure would be the same, then a design and installation appraisal and satisfactory service history of either the equipment being analyzed or of a similar design is usually acceptable for showing compliance. It is the applicant’s responsibility to provide data that is accepted, approved, or both, and that supports any claims of similarity to a previous installation.
(2) For systems that are not complex and where similarity cannot be used as the basis for compliance, then compliance may be shown by means of a qualitative assessment that shows that the major failure conditions of the system, as installed, are consistent with the FHA (for example, redundant systems).
(3) To show that malfunctions are indeed remote in systems of high complexity without redundancy (for example, a system with a self-monitoring microprocessor), it is necessary to conduct a qualitative functional FTA or FMEA supported by failure rate data and fault detection coverage analysis.
(4) An analysis of a redundant system in the airplane is usually complete if it shows isolation between redundant system channels and satisfactory reliability for each channel. For complex systems, where functional redundancy is required, a qualitative FMEA or FTA may be necessary to determine that redundancy actually exists (for example, no single failure affects all functional channels).
d. Analysis of hazardous and catastrophic failure conditions. For these failure conditions, a thorough safety assessment is necessary. The assessment usually consists of an 29
appropriate combination of qualitative and quantitative analyses. Except as specified in the next paragraphs below, a detailed safety analysis must be completed for each hazardous and catastrophic failure condition identified by an FHA. The analysis will usually be a combination of qualitative and quantitative assessments of the design.
(1) For simple and conventional installations (that is, low complexity and similarity in relevant attributes), it may be possible to assess a hazardous or catastrophic failure condition as being extremely remote or extremely improbable, respectively, on the basis of experienced engineering judgment using only qualitative analysis. The basis for the assessment will be the degree of redundancy, the established independence and isolation of the channels, and the reliability record of the technology involved. Satisfactory service experience on similar systems commonly used in many airplanes may be sufficient when a close similarity is established regarding both the system design and operating conditions.
(2) For complex systems where true similarity in all relevant attributes, including installation attributes, can be rigorously established, it may also be possible to assess a hazardous or catastrophic failure condition as being extremely remote or extremely improbable, respectively, on the basis of experienced engineering judgment using only qualitative analysis.
A high degree of similarity in both design and application is required.
(3) No catastrophic failure condition (Note 3 in figure 2) should result from the failure of a single component, part, or element of a system. Experienced engineering judgment and service history should show that a catastrophic failure condition by a single failure mode is not a practical possibility. The logic and rationale used in the assessment should be so straightforward and obvious that the failure mode simply would not occur unless it is associated with an unrelated failure condition that would, in itself, be catastrophic.
18. Assessment methods.
a. Assessment methods. Methods for qualitatively and quantitatively assessing the causes, severity, and likelihood of potential failure conditions are available to support experienced engineering and operational judgment. Some of these methods are structured. The various types of analyses are based on either inductive or deductive approaches. The applicant should select analyses to validate the safety of a particular design based on factors such as the system architecture, complexity, criticality of the function, etc. ARP 4761 has more details of the various methods. Descriptions of typical types of analyses that might be used are provided below.
(1) Design appraisal. A qualitative appraisal of the integrity and safety of the system design. An effective appraisal requires experienced judgment.
(2) Installation appraisal. This is a qualitative appraisal of the integrity and safety of the installation. Any deviations from normal, industry-accepted installation practices should be evaluated. An effective appraisal requires experienced judgment.
(3) Failure Modes and Effects Analysis (FMEA). A structured, inductive, and bottomup analysis that is used to evaluate the effects on the system and the airplane of each possible 30
element or component failure. When properly formatted, it should aid in identifying latent failures and the possible causes of each failure mode. ARP 4761 provides methodology and detailed guidelines that may be used to perform this type of analysis. An FMEA could be a piece-part FMEA or a functional FMEA. For modern microcircuit-based line replaceable units and systems, an exhaustive piece-part FMEA is not practically feasible with the present state of the art. In that context, an FMEA may be more functional than piece-part oriented. A functional-oriented FMEA can lead to uncertainties in the qualitative and quantitative aspects, which can be compensated for by more conservative assessments, such as the following:
Assuming all failure modes result in failure conditions of interest, carefully choosing system architecture, and using lessons learned from similar technology.
(4) Fault Tree Analysis (FTA). A structured, deductive, and top-down analysis that is used to identify the conditions, failures, and events that would cause each defined failure condition. FTAs are graphical methods of id entifying the logical relationship between each particular failure condition and the primary element or component failures, other events, or combinations thereof that can cause it. The fault tree should be developed to the lowest level for which failure rates can be substantiated. Rates derived from applicable service experience, acceptable industry wide sources, manufacturer’s accelerating testing data, or from an FMEA may be used as inputs to the lowest level events.
(5) Common cause analysis. The acceptance of adequate probability of failure conditions is often derived from the assessment of multiple systems based on the assumption that failures are independent. Therefore, it is necessary to recognize that such independence may not exist in the practical sense, and specific studies are necessary to ensure that independence can either be assured or deemed acceptable. The “common cause analysis” is divided into three areas of study:
(a) Zonal safety analysis. This analysis has the objective of ensuring that the equipment installations within each zone of the airplane are at an adequate safety standard regarding design and installation standards, interference between systems, and maintenance errors.
(b) Particular risk analysis. Particular risks are defined as those events or influences outside the systems concerned (e.g., fire, leaking fluids, bird strike, tire burst, HIRF exposure, lightning, uncontained failure of high energy rotating machines, etc.). Each risk should be the subject of a specific study to examine and document the simultaneous or cascading effects, or influences, which may violate independence.
(c) Common mode analysis. This analysis is performed to confirm the assumed independence of the events that were considered in combination for a given failure condition.
The effects of specification, design, implementation, installation, maintenance errors, manufacturing errors, environmental factors other than those already considered in the particular risk analysis, and failures of system components should be considered.
19. Assessment of failure condition probabilities and analysis considerations.
a. An assessment of the probability of a failure condition may be either qualitative or quantitative. An analysis may range from a simple report that interprets test results or compares two similar systems to a detailed analysis that may or may not include estimated numerical probabilities. The depth and scope of an analysis depends on the type of functions performed by the system, the severity of failure conditions, and whether the system is complex. A quantitative analysis is intended to supplement, but not replace, qualitative methods based on engineering and operational judgment. A quantitative analysis is often used for catastrophic or hazardous failure conditions of systems that are complex and major failure conditions that are complex without redundancy. For the cases were there is insufficient service experience to help substantiate their safety, or that have attributes that differ significantly from those of conventional systems.
b. A probability analysis may be either an FMEA or an FTA, which also includes numerical probability information. Numerical values are assigned to the probabilistic terms included in the requirements for use in those cases where the impact of system failures is examined by quantitative analysis methods.
c. The probabilities of primary failures can be determined from failure rate data and exposure times using failure rates derived from either service experience on identical or similar items, manufacturer’s accelerating testing data, or from acceptable industry standards.
Conventional mathematics of probability can then be used to calculate the estimated probability of each failure condition as a function of the estimated probabilities of the various identified contributory failures or other events. See Appendix D of ARP 4761 for more information.
d. When calculating the estimated probability of each failure condition, a margin may be necessary to account for uncertainty. A margin is not normally required for an analysis that is based on proven data or from operational experience and tests. Where data has limited background for substantiation, a margin may be required depending on the available justification.
e. The applicant should obtain early certification authority concurrence for an acceptable classification of the failure conditions and probability for each minor, major, hazardous, and catastrophic failure condition. Early concurrence on the classification of the failure conditions may reduce the applicant’s efforts in determining the probabilities resulting from changes.
f. The details on how to calculate the “average probability per flight hour” for a failure condition are given in Appendix 3. The “average probability per flight hour” is the probability of occurrence, normalized by the flight time of a failure condition during a single flight. If the probability of a subject failure condition occurring during a typical flight of mean duration for the airplane type, divided by the flight’s mean duration in hours, is likely to be significantly different from the predicted average rate of occurrence of that failure condition during the entire operational life of all airplanes of that type, then a risk model that better reflects the failure condition should be used. The single flight is analyzed to be representative of an average over 32
all possible flights of the fleet of airplanes to be certified. The calculation of the “average probability per flight hour” for a failure condition should consider the following:
(1) The average flight duration and the average flight profile for the airplane type to be certified. A common assumption for part 23 airplanes is that the average flight duration is 1 hour;
(2) All combinations of failures and events that contribute to the failure condition;
(3) The conditional probability if a sequence of events is necessary to produce the failure condition;
(4) The relevant "at risk" time if an event is only relevant during certain flight phases;
and
(5) The average exposure time if the failure can persist for multiple flights.
20. Operational and maintenance considerations.
a. Alerts
(1) Section 23.1309(d) requires information concerning unsafe system operating condition(s) must be provided in a timely manner to the crew to enable them to take appropriate corrective action. An appropriate alert must be provided if immediate pilot awareness and immediate or subsequent corrective action is required. The particular method of indication depends on the urgency and need for flight crew awareness or action necessary for the particular failure. Inherent airplane characteristics may be used in lieu of dedicated indications and annunciations if they can be shown to be timely and effective. However, the use of periodic maintenance or flight crew checks to detect significant latent failures when they occur should not be used in lieu of practical and reliable failure monitoring and indications.
(2) Section 23.1309(d) specifies that the design of systems and controls, including indications and annunciations, must be design to minimize crew errors, which could create additional hazards. The additional hazards to be minimized include those caused by inappropriate actions by a crewmember in response to the failure, or those that could occur after a failure.
b. Flight crew and maintenance task. These tasks, which relate to compliance, should be appropriate and reasonable. Quantitative assessments of the probabilities of flight crew and maintenance errors are not considered feasible. Reasonable tasks are those for which full credit can be taken because the flight crew or ground crew can realistically be anticipated to perform them correctly when they are required or scheduled. For the purposes of quantitative analysis, a probability of one can be assumed for flight crew and maintenance tasks that have been evaluated and found to be reasonable. In addition, based on experienced engineering and operational judgment, the discovery of obvious failures during normal operation and 33
maintenance of the airplane may be considered, even though such failures are not the primary purpose or focus of the operational or maintenance actions.
c. Flight crew action. When assessing the ability of the flight crew to cope with a failure condition, the information provided to the crew and the complexity of the required action should be considered.
(1) If the evaluation indicates that a potential failure condition can be alleviated or overcome in a timely manner without jeopardizing other safety related flight crew tasks and without requiring exceptional pilot skill or strength, correct crew action may be assumed in both qualitative and quantitative assessments.
(2) Annunciation that requires flight crew actions should be evaluated to determine if the required actions can be accomplished in a timely manner without exceptional pilot skills. If the evaluation indicates that a potential failure condition can be alleviated or overcome during the time available without jeopardizing other safety related flight crew tasks and without requiring exceptional pilot skill or strength, credit may be taken for correct and appropriate corrective action for both qualitative and quantitative assessments. Similarly, credit may be taken for correct flight crew performance if overall flight crew workload during the time available is not excessive and if the tasks do not require exceptional pilot skill or strength.
(3) Unless flight crew actions are accepted as normal airmanship, the appropriate procedures should be included in the FAA approved AFM or in the AFM revision or supplement. The AFM should include procedures for operation of complex systems such as integrated flight guidance and control systems. These procedures should include proper pilot response to cockpit indications, diagnosis of system failures, discussion of possible pilot-induced flight control system problems, and use of the system in a safe manner.
d. Maintenance actions. Credit may be taken for correct accomplishment of maintenance tasks in both qualitative and quantitative assessments if the tasks are evaluated and found to be reasonable. Required maintenance tasks, which mitigate hazards, should be provided for use in the FAA approved maintenance programs such as the ICA. Annunciated failures will be corrected before the next flight or a maximum duration will be established before a maintenance action is required. If the latter is acceptable, the analysis should establish the maximum allowable interval before the maintenance action is required. A scheduled maintenance task may detect latent failures. If this approach is taken, and the failure condition is hazardous or catastrophic, then a maintenance task should be established. Some latent failures can be assumed to be identified based upon a return to service test on the equipment following its removal and repair (component MTBF should be the basis for the check interval time).
21. Software and complex hardware DALs for airborne system and applications.
a. Background. AC 20-115B discusses how RTCA/DO-178B provides an acceptable means for showing that software complies with pertinent airworthiness requirements. AC 20- 152 and Order 8110.105 provide acceptable means for showing that complex hardware complies with the pertinent airworthiness requirements.
b. Acceptable application of software and complex hardware DALs. It is necessary to consider the possibility of requirement, design, and implementation errors in order to comply with the requirements of § 23.1309. Errors made during the design and development of systems have traditionally been detected and corrected by exhaustive tests conducted on the system and its components. These tests used direct inspection and other direct verification methods capable of completely characterizing system the performance. These direct techniques may still be appropriate for simple systems, which perform a limited number of functions and which are not highly integrated with other airplane systems.
(1) For more complex or integrated systems, exhaustive testing may either be impossible because all of the systems states cannot be determined or it may be impractical due to the number of tests that must be accomplished. For these types of systems, compliance may be shown by the use of software and complex hardware DALs. The software and complex hardware DALs should be determined by the severity of potential effects on the airplane in case of system malfunctions or loss of functions.
c. Software and complex hardware DALs criteria for part 23 airplanes. The DALs in figure 2 and throughout this AC correlate to the software level in RTCA/DO-178B and the complex design assurance level in RTCA/DO-254 documents. The classification of the failure condition and airplane class must be determined before figure 2 is used to determine these levels.
These levels in figure 2 are acceptable for part 23 airplanes instead of software levels in paragraph 2.2.2 in RTCA/DO-178B and of the complex hardware design assurance levels defined in paragraph 2.2 in RTCA/DO-254.
d. Complex hardware level D. AC 20-152 provides an exclusion from FAA review for complex hardware design assurance level “D” developed under DO-254. The exclusion from FAA review of life cycle data only applies for minor failure conditions and will not apply to level D for the reduced levels shown for major and hazardous failure conditions identified in figure 2.
e. System architecture for determination of the appropriate DALs.
(1) SAE S-18, Airplane Safety Assessment Committee, revised ARP 4754 to ARP 4754A and is revising ARP 4761. The committee developed new concepts for DAL and Design Assurance Levels in ARP 4754A. These SAE documents are guidelines for assigning the DALs that start from the aircraft/system level and end at the item/component level. ARP 4754A addresses the development phase in two phases: Function Development Phase and Item Development Phase, with two different types of development processes.
(2) These assignments depend on the failure condition classification, the number of independent failure paths, and their associated independence attributes. The independence attributes are the functional independence, design independence, and physical independence. In essence, functional independence ensures that the functional requirements that are implemented in the design are different, whereas design independence ensures that the hardware or software design, in which the functions are implemented, is different.
(3) There may be significant difference in the guidance provided on the use of system architecture for appropriate determination of the DALs between this AC and guidelines contained in ARP 4754A. Where apparent differences exist between this AC and ARP 4754A, this AC takes precedence. The FAA recognizes that consideration of system architecture for determining DALs is appropriate and may lead to lower levels in some specific cases. Figure 2 in this AC already allows reduction of software and complex hardware DALs for Class I, II, and III airplanes; therefore, no additional reductions from these levels are permitted without the Small Airplane Directorate approval or there is established specific policy or guidance. If the Small Airplane Directorate has established specific guidance or policy for these levels, then the approval can made by the ACO. For commuter category airplanes, the guidance in ARP 4754A is more likely to be appropriate since its DALs are higher. There may be acceptability only if additional credit for architecture is requested for hazardous or catastrophic failure conditions in Class IV, commuter category airplanes.
f. Equipment installed in part 23 airplanes that performs functions addressed by TSO standards. Equipment installed in part 23 airplanes that performs functions addressed by TSO standards should meet applicable TSO standards. FAA prefers the equipment meet design approval of the functional TSO. However, the equipment is not required to have TSO authorization, but it would need to meet other equivalent minimum performance standards acceptable to the Administrator. The TSO data should include the equipment complex hardware and software DALs. For both TSO and non-TSO equipment, the safety assessment and figure 2 should be used to check the complex hardware and software DALs against the installation requirements.
22. Electromagnetic protection for electrical/electronic systems.
Current trends indicate increasing reliance on electrical/electronic systems for safe operations.
Electromagnetic effects, environmental effects, and environmental qualifications should be considered for systems that perform flight, propulsion, navigation, and instrumentation functions. The software and complex hardware DALs shown in figure 2 are not applicable for HIRF and lightning protection levels. For guidance for the protection against these effects, refer to the latest version of AC 21-16F, AC 23-17C, AC 20-136A, and AC 20-158.
11/17/2011 AC 23.1309-1E Appendix 1 APPENDIX 1.
PARTIAL LIST OF FUNCTIONAL HAZARD ASSESSMENT (FHA) FOR CONSIDERATION TO MEET 14 CFR PART 23 REQUIREMENTS FOR IFR CLASS I AIRPLANES
Aircraft Function Classification of Failure Conditions Analysis Consideration Total Loss of Function Loss of Primary Means of Providing Function Misleading and/or Malfunction Without Warning Display of attitude information to control roll and pitch Catastrophic Major Catastrophic For electronic displays, dual independent attitude systems generally meet requirements for 14 CFR part 23, §§ 23.1301, 23.1309, & 23.1311 for airplanes with less than 10 passengers and for conventional mechanical or analog electromechanical systems. A single attitude display meets 14 CFR part 91 requirements to operate under IFR. If the certification basis includes Amendment 23-43 or later, two independent power sources are required by § 23.1331. The requirement for two power sources in § 23.1331 are not applicable for pitot-static pneumatic systems. Partial panel techniques may be used in some cases where it has been historically shown to be acceptable.
Credit (mitigation) may be given for automatic flight control systems if the system can maintain stable attitude independent of the primary attitude display.
Display of Major Minor Major A hazardously misleading heading is usually when the accuracy error is greater directional heading than 10 degrees on the primary heading instrument and it is an undetected error.
information Assumes installation of a single stabilized heading system and only a nonstabilized magnetic compass to operate under IFR for 14 CFR part 91. If the certification basis includes Amendment 23-43 or later, two independent power sources are required by § 23.1331. The requirement of two power sources of § 23.1331 are not applicable for pitot-static pneumatic systems. Navigation assumed to be operating. See AC 23-17C for additional information.
*Note: This table is only intended to be a guide and is not a certification checklist since it may not include all the information necessary for an FHA on part 23 IFR Class I airplanes with its various functions and its intended use. This partial FHA does not reflect considerations needed to properly develop FHA. See paragraph 16 and its associated subparagraphs for more complete guidance. R = Reserved, intentionally left blank.
A1-1
11/17/2011 AC 23.1309-1E Appendix 1 APPENDIX 1 (CONTINUED) Aircraft Function Classification of Failure Conditions Analysis Consideration Total Loss of Function Loss of Primary Means of Providing Function Misleading and/or Malfunction Without Warning Display of altitude information Hazardous Minor Catastrophic For electronic displays, dual independent altitude systems generally meet requirements for 14 CFR part 23, §§ 23.1301, 23.1309, & 23.1311 and for conventional mechanical or analog electromechanical systems. A single altitude display meets 14 CFR part 91 requirements to operate under IFR. If the certification basis includes Amendment 23-43 or later, two independent power sources are required by § 23.1331. The requirement of two power sources of § 23.1331 are not applicable for pitot-static pneumatic systems.
Existing single static systems that are heated have been historically acceptable based on similarity and may be used for programs that have certification basis prior to Amendment
23-42. If a single or dual air data computer is used, it must meet the requirements of this AC with respect to safety and DAL.
*Note: This table is only intended to be a guide and is not a certification checklist since it may not include all the information necessary for an FHA on part 23 IFR Class I airplanes with its various functions and its intended use. This partial FHA does not reflect considerations needed to properly develop FHA. See paragraph 16 and its associated subparagraphs for more complete guidance. R = Reserved, intentionally left blank.
A1-2