b. Acceptable application of software and complex hardware DALs. It is necessary to consider the possibility of requirement, design, and implementation errors in order to comply with the requirements of § 23.1309. Errors made during the design and development of systems have traditionally been detected and corrected by exhaustive tests conducted on the system and its components. These tests used direct inspection and other direct verification methods capable of completely characterizing system the performance. These direct techniques may still be appropriate for simple systems, which perform a limited number of functions and which are not highly integrated with other airplane systems.
(1) For more complex or integrated systems, exhaustive testing may either be impossible because all of the systems states cannot be determined or it may be impractical due to the number of tests that must be accomplished. For these types of systems, compliance may be shown by the use of software and complex hardware DALs. The software and complex hardware DALs should be determined by the severity of potential effects on the airplane in case of system malfunctions or loss of functions.
c. Software and complex hardware DALs criteria for part 23 airplanes. The DALs in figure 2 and throughout this AC correlate to the software level in RTCA/DO-178B and the complex design assurance level in RTCA/DO-254 documents. The classification of the failure condition and airplane class must be determined before figure 2 is used to determine these levels.
These levels in figure 2 are acceptable for part 23 airplanes instead of software levels in paragraph 2.2.2 in RTCA/DO-178B and of the complex hardware design assurance levels defined in paragraph 2.2 in RTCA/DO-254.
d. Complex hardware level D. AC 20-152 provides an exclusion from FAA review for complex hardware design assurance level “D” developed under DO-254. The exclusion from FAA review of life cycle data only applies for minor failure conditions and will not apply to level D for the reduced levels shown for major and hazardous failure conditions identified in figure 2.
e. System architecture for determination of the appropriate DALs.
(1) SAE S-18, Airplane Safety Assessment Committee, revised ARP 4754 to ARP 4754A and is revising ARP 4761. The committee developed new concepts for DAL and Design Assurance Levels in ARP 4754A. These SAE documents are guidelines for assigning the DALs that start from the aircraft/system level and end at the item/component level. ARP 4754A addresses the development phase in two phases: Function Development Phase and Item Development Phase, with two different types of development processes.
(2) These assignments depend on the failure condition classification, the number of independent failure paths, and their associated independence attributes. The independence attributes are the functional independence, design independence, and physical independence. In essence, functional independence ensures that the functional requirements that are implemented in the design are different, whereas design independence ensures that the hardware or software design, in which the functions are implemented, is different.
(3) There may be significant difference in the guidance provided on the use of system architecture for appropriate determination of the DALs between this AC and guidelines contained in ARP 4754A. Where apparent differences exist between this AC and ARP 4754A, this AC takes precedence. The FAA recognizes that consideration of system architecture for determining DALs is appropriate and may lead to lower levels in some specific cases. Figure 2 in this AC already allows reduction of software and complex hardware DALs for Class I, II, and III airplanes; therefore, no additional reductions from these levels are permitted without the Small Airplane Directorate approval or there is established specific policy or guidance. If the Small Airplane Directorate has established specific guidance or policy for these levels, then the approval can made by the ACO. For commuter category airplanes, the guidance in ARP 4754A is more likely to be appropriate since its DALs are higher. There may be acceptability only if additional credit for architecture is requested for hazardous or catastrophic failure conditions in Class IV, commuter category airplanes.
f. Equipment installed in part 23 airplanes that performs functions addressed by TSO standards. Equipment installed in part 23 airplanes that performs functions addressed by TSO standards should meet applicable TSO standards. FAA prefers the equipment meet design approval of the functional TSO. However, the equipment is not required to have TSO authorization, but it would need to meet other equivalent minimum performance standards acceptable to the Administrator. The TSO data should include the equipment complex hardware and software DALs. For both TSO and non-TSO equipment, the safety assessment and figure 2 should be used to check the complex hardware and software DALs against the installation requirements.
22. Electromagnetic protection for electrical/electronic systems.
Current trends indicate increasing reliance on electrical/electronic systems for safe operations.
Electromagnetic effects, environmental effects, and environmental qualifications should be considered for systems that perform flight, propulsion, navigation, and instrumentation functions. The software and complex hardware DALs shown in figure 2 are not applicable for HIRF and lightning protection levels. For guidance for the protection against these effects, refer to the latest version of AC 21-16F, AC 23-17C, AC 20-136A, and AC 20-158.
11/17/2011 AC 23.1309-1E Appendix 1 APPENDIX 1.
PARTIAL LIST OF FUNCTIONAL HAZARD ASSESSMENT (FHA) FOR CONSIDERATION TO MEET 14 CFR PART 23 REQUIREMENTS FOR IFR CLASS I AIRPLANES
Aircraft Function Classification of Failure Conditions Analysis Consideration Total Loss of Function Loss of Primary Means of Providing Function Misleading and/or Malfunction Without Warning Display of attitude information to control roll and pitch Catastrophic Major Catastrophic For electronic displays, dual independent attitude systems generally meet requirements for 14 CFR part 23, §§ 23.1301, 23.1309, & 23.1311 for airplanes with less than 10 passengers and for conventional mechanical or analog electromechanical systems. A single attitude display meets 14 CFR part 91 requirements to operate under IFR. If the certification basis includes Amendment 23-43 or later, two independent power sources are required by § 23.1331. The requirement for two power sources in § 23.1331 are not applicable for pitot-static pneumatic systems. Partial panel techniques may be used in some cases where it has been historically shown to be acceptable.
Credit (mitigation) may be given for automatic flight control systems if the system can maintain stable attitude independent of the primary attitude display.
Display of Major Minor Major A hazardously misleading heading is usually when the accuracy error is greater directional heading than 10 degrees on the primary heading instrument and it is an undetected error.
information Assumes installation of a single stabilized heading system and only a nonstabilized magnetic compass to operate under IFR for 14 CFR part 91. If the certification basis includes Amendment 23-43 or later, two independent power sources are required by § 23.1331. The requirement of two power sources of § 23.1331 are not applicable for pitot-static pneumatic systems. Navigation assumed to be operating. See AC 23-17C for additional information.
*Note: This table is only intended to be a guide and is not a certification checklist since it may not include all the information necessary for an FHA on part 23 IFR Class I airplanes with its various functions and its intended use. This partial FHA does not reflect considerations needed to properly develop FHA. See paragraph 16 and its associated subparagraphs for more complete guidance. R = Reserved, intentionally left blank.
A1-1
11/17/2011 AC 23.1309-1E Appendix 1 APPENDIX 1 (CONTINUED) Aircraft Function Classification of Failure Conditions Analysis Consideration Total Loss of Function Loss of Primary Means of Providing Function Misleading and/or Malfunction Without Warning Display of altitude information Hazardous Minor Catastrophic For electronic displays, dual independent altitude systems generally meet requirements for 14 CFR part 23, §§ 23.1301, 23.1309, & 23.1311 and for conventional mechanical or analog electromechanical systems. A single altitude display meets 14 CFR part 91 requirements to operate under IFR. If the certification basis includes Amendment 23-43 or later, two independent power sources are required by § 23.1331. The requirement of two power sources of § 23.1331 are not applicable for pitot-static pneumatic systems.
Existing single static systems that are heated have been historically acceptable based on similarity and may be used for programs that have certification basis prior to Amendment
23-42. If a single or dual air data computer is used, it must meet the requirements of this AC with respect to safety and DAL.
*Note: This table is only intended to be a guide and is not a certification checklist since it may not include all the information necessary for an FHA on part 23 IFR Class I airplanes with its various functions and its intended use. This partial FHA does not reflect considerations needed to properly develop FHA. See paragraph 16 and its associated subparagraphs for more complete guidance. R = Reserved, intentionally left blank.
A1-2
11/17/2011 AC 23.1309-1E Appendix 1 APPENDIX 1 (CONTINUED) Aircraft Function Classification of Failure Conditions Analysis Consideration Total Loss of Function Loss of Primary Means of Providing Function Misleading and/or Malfunction Without Warning Display of airspeed information Major.
May be Hazardous for higher performance airplanes.
Minor Major.
May be hazardous or catastrophic for higher performance airplanes.
For electronic displays, dual independent airspeed systems generally meet requirements for 14 CFR part 23, §§ 23.1301, 23.1309, & 23.1311 and for conventional mechanical or analog electromechanical systems. A single airspeed display meets 14 CFR part 91 requirements to operate under IFR. If the certification basis includes Amendment 23-43 or later, two independent power sources are required by § 23.1331. The two power sources in § 23.1331 are not applicable for pitot-static pneumatic systems. Classification is usually Major, if overspeed and underspeed airspeed alerting is acceptable (alerting may be provided by inherent aerodynamic qualities or independent alerting system);
otherwise, loss of function, malfunction, or misleading of information is Hazardous. It may be catastrophic when co mbined with the loss of stall warning or overspeed warning functions. Assume s no vertical speed indicator. Existing single pitot static systems that are heated have been historically acceptable based on similarity and may be used for programs that have certification basis prior to Amendment 23-42. If a single or dual air da ta computer is used, it must meet the requirements of this AC with respect to safety and DAL.
Display of Flight Path Vector Minor R Major Providing the other normal cues remains for primary flight information, loss of the sensor should remove the flight path vector. The pilot should recognize it and use other displays. Misleading indication could cause the pilot to temporarily maneuver the aircraft using erroneous guidance information.
Display of rate-ofturn information Minor Minor Minor Rate-of-turn display is generally required to operate under 14 CFR part 91 IFR requirements unless a third attitude is installed. If the certification basis includes Amendment 23-43 or later, two independent power sources are required. In IMC, misleading rate-of-turn information is consider to be Minor if there is a functional attitude display.
Display of slip-skid information Minor Minor Minor R *Note: This table is only intended to be a guide and is not a certification checklist since it may not include all the information necessary for an FHA on part 23 IFR Class I airplanes with its various functions and its intended use. This partial FHA does not reflect considerations needed to properly develop FHA. See paragraph 16 and its associated subparagraphs for more complete guidance. R = Reserved, intentionally left blank.
A1-3
11/17/2011 AC 23.1309-1E Appendix 1 APPENDIX 1 (CONTINUED) Aircraft Function Classification of Failure Conditions Analysis Consideration Total Loss of Function Loss of Primary Means of Providing Function Misleading and/or Malfunction Without Warning Display of time information Minor Minor Minor R Display of primary navigation information Major Major.
Minor, if two navigation systems are installed.
Major for CAT I ILS. Hazardous or major depending on type of WAAS operations.
Two navigation systems are generally installed to support navigation, but two are not required for 14 CFR part 91 operations. Dual ILS receivers below Category I limits are required with single antenna for part 91 operations. See AC 20-138B for more guidance on WAAS operations.
Display of navigation information on MFD Minor R Minor Pilot should cross check with the course deviation indicator and other navigation sources.
Weather displays for situation awareness Minor Minor Minor Pilot is responsible to use standard procedures. It is used for only strategic planning and operation and is not intended for tactical maneuvering.
Terrain Awareness and Warning System (TAWS) Minor R Major The loss of that system should be no greater than 10-3 per average flight hour, and the possibility of misleading information on the display due to undetected or latent failures should be no greater than 10-4 per average flight hour. For a Class A TAWS, the software development assurance level should be at least to Level C as defined in RTCA DO-178B or an acceptable alternative approved by the FAA. For Class B TAWS, the software development assurance level should be at least to Level D providing the required alerts and visual annunciations are independent of the terrain display(s). If the required alerts and visual annunciations are integrated on the displays, the DAL should be at least Level C. NOTE: A terrain display is not mandato ry for Class B equipment. See AC 23-18 for more information.
*Note: This table is only intended to be a guide and is not a certification checklist since it may not include all the information necessary for an FHA on part 23 IFR Class I airplanes with its various functions and its intended use. This partial FHA does not reflect considerations needed to properly develop FHA. See paragraph 16 and its associated subparagraphs for more complete guidance. R = Reserved, intentionally left blank.
A1-4
11/17/2011 AC 23.1309-1E Appendix 1 APPENDIX 1 (CONTINUED) Aircraft Function Classification of Failure Conditions Analysis Consideration Total Loss of Function Loss of Primary Means of Providing Function Misleading and/or Malfunction Without Warning Communication Minor.
Total loss of navigation and communication is Hazardous.
Minor Major, if data link.
Otherwise, Minor.
Future installations may use data link for primary functions and voice for secondary.
Traffic information for situation awareness Minor Minor Minor to Major depending on the intended function of the alert warning or caution signal.
Pilot is responsible to use standard “see and avoid procedures”. Traffic information is not an approved substitute for traffic avoidance. See the applicable AC and TSO for additional guidance.
Mode A or C Transponder Minor R Minor to Major depending on the intended function of signals from the transponder.
Air traffic control may receive misleading or loss of airplane identification, or altitude, which increases their workload. An incorrect resolution advisory may increase pilot workload in another aircraft. See the appli cable AC and TSO for additional guidance.
Display of radio altitude information Minor R Minor Not required for 14 CFR part 91 operations, Category I ILS. Loss of function may affect other equipment that depends upon radio altimeter.
*Note: This table is only intended to be a guide and is not a certification checklist since it may not include all the information necessary for an FHA on part 23 IFR Class I airplanes with its various functions and its intended use. This partial FHA does not reflect considerations needed to properly develop FHA. See paragraph 16 and its associated subparagraphs for more complete guidance. R = Reserved, intentionally left blank.
A1-5
11/17/2011 AC 23.1309-1E Appendix 1 APPENDIX 1 (CONTINUED) Aircraft Function Classification of Failure Conditions Analysis Consideration Total Loss of Function Loss of Primary Means of Providing Function Misleading and/or Malfunction Without Warning Display of vertical speed information Minor R Mino r or Major. Not required for most 14 CFR part 91 operations. May be major classification when required by the operational requirements of parts 91 (Category II), 121, and 135 and it is considered required equipment essential to safe operation.
Display of flight guidance commands (Category I operation) Minor R Major Not required for 14 CFR part 91 operations, Category I ILS. For Category II ILS, an autopilot or flight director is required. Minor for loss of flight guidance commands for Category I operations providing the other normal cues remains for primary flight information. Loss of the sensor should re move the guidance command. The pilot should recognize it and use other displays. Misleading indication could cause the pilot to temporary maneuver the airplane if using erroneous guidance information.
Autopilot Minor, with warning. Major, without warning.
R Major, single axis and limited authority.
Hazardous, multiaxis and limited authority.
Catastrophic, if authority is unlimited.
Malfunction effects of autopilot hardovers are very dependent on the design and installation details. Maximum inputs (hardove rs) or (slowovers) to aircraft primary control surfaces should not exceed aircraft structural limits. See AC 23.17C under section
23.1329 for additional information.
Autopilot guidance or flight director cue on display Minor Minor Major for pitch.
Minor for roll.
Pilot must monitor autopilot operation and disconnect autopilot to recover flight promptly. May cause go around and reductions in safety margins.
*Note: This table is only intended to be a guide and is not a certification checklist since it may not include all the information necessary for an FHA on part 23 IFR Class I airplanes with its various functions and its intended use. This partial FHA does not reflect considerations needed to properly develop FHA. See paragraph 16 and its associated subparagraphs for more complete guidance. R = Reserved, intentionally left blank.
A1-6
11/17/2011 AC 23.1309-1E Appendix 1 APPENDIX 1 (CONTINUED) Aircraft Function Classification of Failure Conditions Analysis Consideration Total Loss of Function Loss of Primary Means of Providing Function Misleading and/or Malfunction Without Warning Autopilot, inability to disengage with A/P disconnect switch Major Major Major The pilot is assumed to overcome the servo slip clutches in both pitch and roll and able to maintain control of aircraft. Minor if the circuit breaker to disconnect the autopilot is readily available in flight.
Electrical-Electronic primary powered flight controls Catastrophic Minor Hazardous to catastrophic Assumes redundant electrical/electronic primary flight control systems with no manual reversion that provide independent control for each axis. Hazardous for loss of one channel on the lateral or longitudinal axis.
Some fly-by-wire system designs may incorporate many solutions which mitigate the severity of the loss of a single channel. They may have three or four independent channels for pitch and roll, so the loss of one has little functional effect and control can be maintained with a single channel, although normally with the loss of some envelope protections. Additionally there may be mitig ating factors such as inherent stability which can reduce hazards.
Stability augmentation Variable Minor Variable It needs to be evaluated on a case-by-case basis since it depends on aircraft stability and handling characteristics when installed and required to meet minimum performance and flight handling requirements.
Stick pusher Hazardous, if loss is not annunciated.
Major if the stall warning is functioning.
Minor, if failure is annunciated and the stall warning is functioning.
Minor Catastrophic to hazardous if the pilot is able to override or able for quick disconnect.
The system is installed to protect against a hazardous stall characteristic and/or unrecoverable catastrophic condition such as a deep stall. Assumes dual systems to prevent single-failure modes. Stick pusher malfunction with or without warning can be catastrophic depending on phase of flight and system attributes. Airplane response to stick pusher may be considered and pilot procedures may mitigate to a lower failure condition.
*Note: This table is only intended to be a guide and is not a certification checklist since it may not include all the information necessary for an FHA on part 23 IFR Class I airplanes with its various functions and its intended use. This partial FHA does not reflect considerations needed to properly develop FHA. See paragraph 16 and its associated subparagraphs for more complete guidance. R = Reserved, intentionally left blank.
A1-7
11/17/2011 AC 23.1309-1E Appendix 1 APPENDIX 1 (CONTINUED) Aircraft Function Classification of Failure Conditions Analysis Consideration Total Loss of Function Loss of Primary Means of Providing Function Misleading and/or Malfunction Without Warning Stick shakers with Stall warning Major without other means of stall warning and unannunciated loss of stall warning.
Minor for annunciated loss of stall warning Major without other means of stall warning and unannunciated loss of stall warning.
Minor for annunciated loss of stall warning Major without other means of stall warning.
Assumes that inherent airplane characteristics do not exist so the pilot is aware of being close to stall (for example, stick force changes, buffeting, etc.).
Trim control Minor Minor Major, if manual trim. Catastrophic or hazardous for electrical.
Studies have shown trim runaways are not a significant problem if pilot takes quick corrective action. Major, for trim runaways if there is a trim-in-motion aural alert.
Hazardous or catastrophic for trim runaways without a failure indication depending on trim authority and phase of flight.
Gear control Major Minor Major R Brake control Major, for airplanes 6,000 lbs. Minor, for airplanes 6,000 lbs.
Major. Could be minor, if thrust reversers are installed.
Major Electronic anti-skid and brake systems can cause significant ground handling problems if they malfunction under adverse conditions due to asymmetrical loading. Light airplanes braking loss is not as significant and can be reviewed on a case-by-case basis.
Display of trim indications Minor Minor Variable Each airplane has to be reviewed on a case-by-case basis. The most severe case is the phase of flight before takeoff. After takeoff, the trim position indication is not as critical because the pilot will adjust the trim position to relieve the control forces.
Display of gear indications Minor R Minor R *Note: This table is only intended to be a guide and is not a certification checklist since it may not include all the information necessary for an FHA on part 23 IFR Class I airplanes with its various functions and its intended use. This partial FHA does not reflect considerations needed to properly develop FHA. See paragraph 16 and its associated subparagraphs for more complete guidance. R = Reserved, intentionally left blank.
A1-8
11/17/2011 AC 23.1309-1E Appendix 1 APPENDIX 1 (CONTINUED) Aircraft Function Classification of Failure Conditions Analysis Consideration Total Loss of Function Loss of Primary Means of Providing Function Misleading and/or Malfunction Without Warning Display of fuel level indication Minor Minor Minor Pilot is required to calculate fuel range and endurance during normal flight planning operations.
Display of powerplant indication tachometer Minor Minor Minor Assumes fixed pitch propeller and reciprocating engine; otherwise, a propeller governor will maintain the engine r.p.m. Turbofan and turbojet engines may need r.p.m. data for inflight restart capability. Refer to 14 CFR part 23, § 23.1311.
Display of powerplant Cylinder Head Temperature (CHT) Minor Minor Minor Assumes a CHT indicator is required. Refer to 14 CFR part 23, § 23.1305.
Display of powerplant indication coolant temperature Minor Minor Minor Refer to 14 CFR part 23, § 23.1305.
Display of powerplant indication oil pressure Minor Minor Minor Assumes oil temperature is used as a backup.
Display of powerplant indication oil temperature Minor Minor Minor Assumes oil pressure is used as a backup.
*Note: This table is only intended to be a guide and is not a certification checklist since it may not include all the information necessary for an FHA on part 23 IFR Class I airplanes with its various functions and its intended use. This partial FHA does not reflect considerations needed to properly develop FHA. See paragraph 16 and its associated subparagraphs for more complete guidance. R = Reserved, intentionally left blank.
A1-9
11/17/2011 AC 23.1309-1E Appendix 1 APPENDIX 1 (CONTINUED) Aircraft Function Classification of Failure Conditions Analysis Consideration Total Loss of Function Loss of Primary Means of Providing Function Misleading and/or Malfunction Without Warning Display of powerplant indication manifold pressure Minor Minor Minor Assumes backup use of CHT, Engine Gas Temperature (EGT), and possible fuel flow readings if installed.
Display of powerplant air inlet temperature Minor Minor Minor R Display of powerplant indication fuel pressure Minor Minor Minor R Display of powerplant indication fuel flow Minor Minor Major Manifold pressure and r.p.m. or torque indications can be used as an emergency backup to control power until a safe landing can be made.
Display of powerplant fire warning Major Major Major Required for commuter category and part 23 turbojet powered airplanes using special conditions. Part 23 airplanes usually ha ve one fire warning system on board.
Display of powerplant indication thrust Minor Minor Hazardous System is not normally used in part 23 airplanes. Torque, Engine Pressure Ratio (EPR), EGT, or Turbine Inlet Temperature (TIT), fuel flow, and r.p.m. are normally displayed.
) *Note: This table is only intended to be a guide and is not a certification checklist since it may not include all the information necessary for an FHA on part 23 IFR Class I airplanes with its various functions and its intended use. This partial FHA does not reflect considerations needed to properly develop FHA. See paragraph 16 and its associated subparagraphs for more complete guidance. R = Reserved, intentionally left blank.
A1-10