11/17/2011 AC 23.1309-1E Appendix 1 APPENDIX 1 (CONTINUED) Aircraft Function Classification of Failure Conditions Analysis Consideration Total Loss of Function Loss of Primary Means of Providing Function Misleading and/or Malfunction Without Warning Display of airspeed information Major.
May be Hazardous for higher performance airplanes.
Minor Major.
May be hazardous or catastrophic for higher performance airplanes.
For electronic displays, dual independent airspeed systems generally meet requirements for 14 CFR part 23, §§ 23.1301, 23.1309, & 23.1311 and for conventional mechanical or analog electromechanical systems. A single airspeed display meets 14 CFR part 91 requirements to operate under IFR. If the certification basis includes Amendment 23-43 or later, two independent power sources are required by § 23.1331. The two power sources in § 23.1331 are not applicable for pitot-static pneumatic systems. Classification is usually Major, if overspeed and underspeed airspeed alerting is acceptable (alerting may be provided by inherent aerodynamic qualities or independent alerting system);
otherwise, loss of function, malfunction, or misleading of information is Hazardous. It may be catastrophic when co mbined with the loss of stall warning or overspeed warning functions. Assume s no vertical speed indicator. Existing single pitot static systems that are heated have been historically acceptable based on similarity and may be used for programs that have certification basis prior to Amendment 23-42. If a single or dual air da ta computer is used, it must meet the requirements of this AC with respect to safety and DAL.
Display of Flight Path Vector Minor R Major Providing the other normal cues remains for primary flight information, loss of the sensor should remove the flight path vector. The pilot should recognize it and use other displays. Misleading indication could cause the pilot to temporarily maneuver the aircraft using erroneous guidance information.
Display of rate-ofturn information Minor Minor Minor Rate-of-turn display is generally required to operate under 14 CFR part 91 IFR requirements unless a third attitude is installed. If the certification basis includes Amendment 23-43 or later, two independent power sources are required. In IMC, misleading rate-of-turn information is consider to be Minor if there is a functional attitude display.
Display of slip-skid information Minor Minor Minor R *Note: This table is only intended to be a guide and is not a certification checklist since it may not include all the information necessary for an FHA on part 23 IFR Class I airplanes with its various functions and its intended use. This partial FHA does not reflect considerations needed to properly develop FHA. See paragraph 16 and its associated subparagraphs for more complete guidance. R = Reserved, intentionally left blank.
A1-3
11/17/2011 AC 23.1309-1E Appendix 1 APPENDIX 1 (CONTINUED) Aircraft Function Classification of Failure Conditions Analysis Consideration Total Loss of Function Loss of Primary Means of Providing Function Misleading and/or Malfunction Without Warning Display of time information Minor Minor Minor R Display of primary navigation information Major Major.
Minor, if two navigation systems are installed.
Major for CAT I ILS. Hazardous or major depending on type of WAAS operations.
Two navigation systems are generally installed to support navigation, but two are not required for 14 CFR part 91 operations. Dual ILS receivers below Category I limits are required with single antenna for part 91 operations. See AC 20-138B for more guidance on WAAS operations.
Display of navigation information on MFD Minor R Minor Pilot should cross check with the course deviation indicator and other navigation sources.
Weather displays for situation awareness Minor Minor Minor Pilot is responsible to use standard procedures. It is used for only strategic planning and operation and is not intended for tactical maneuvering.
Terrain Awareness and Warning System (TAWS) Minor R Major The loss of that system should be no greater than 10-3 per average flight hour, and the possibility of misleading information on the display due to undetected or latent failures should be no greater than 10-4 per average flight hour. For a Class A TAWS, the software development assurance level should be at least to Level C as defined in RTCA DO-178B or an acceptable alternative approved by the FAA. For Class B TAWS, the software development assurance level should be at least to Level D providing the required alerts and visual annunciations are independent of the terrain display(s). If the required alerts and visual annunciations are integrated on the displays, the DAL should be at least Level C. NOTE: A terrain display is not mandato ry for Class B equipment. See AC 23-18 for more information.
*Note: This table is only intended to be a guide and is not a certification checklist since it may not include all the information necessary for an FHA on part 23 IFR Class I airplanes with its various functions and its intended use. This partial FHA does not reflect considerations needed to properly develop FHA. See paragraph 16 and its associated subparagraphs for more complete guidance. R = Reserved, intentionally left blank.
A1-4
11/17/2011 AC 23.1309-1E Appendix 1 APPENDIX 1 (CONTINUED) Aircraft Function Classification of Failure Conditions Analysis Consideration Total Loss of Function Loss of Primary Means of Providing Function Misleading and/or Malfunction Without Warning Communication Minor.
Total loss of navigation and communication is Hazardous.
Minor Major, if data link.
Otherwise, Minor.
Future installations may use data link for primary functions and voice for secondary.
Traffic information for situation awareness Minor Minor Minor to Major depending on the intended function of the alert warning or caution signal.
Pilot is responsible to use standard “see and avoid procedures”. Traffic information is not an approved substitute for traffic avoidance. See the applicable AC and TSO for additional guidance.
Mode A or C Transponder Minor R Minor to Major depending on the intended function of signals from the transponder.
Air traffic control may receive misleading or loss of airplane identification, or altitude, which increases their workload. An incorrect resolution advisory may increase pilot workload in another aircraft. See the appli cable AC and TSO for additional guidance.
Display of radio altitude information Minor R Minor Not required for 14 CFR part 91 operations, Category I ILS. Loss of function may affect other equipment that depends upon radio altimeter.
*Note: This table is only intended to be a guide and is not a certification checklist since it may not include all the information necessary for an FHA on part 23 IFR Class I airplanes with its various functions and its intended use. This partial FHA does not reflect considerations needed to properly develop FHA. See paragraph 16 and its associated subparagraphs for more complete guidance. R = Reserved, intentionally left blank.
A1-5
11/17/2011 AC 23.1309-1E Appendix 1 APPENDIX 1 (CONTINUED) Aircraft Function Classification of Failure Conditions Analysis Consideration Total Loss of Function Loss of Primary Means of Providing Function Misleading and/or Malfunction Without Warning Display of vertical speed information Minor R Mino r or Major. Not required for most 14 CFR part 91 operations. May be major classification when required by the operational requirements of parts 91 (Category II), 121, and 135 and it is considered required equipment essential to safe operation.
Display of flight guidance commands (Category I operation) Minor R Major Not required for 14 CFR part 91 operations, Category I ILS. For Category II ILS, an autopilot or flight director is required. Minor for loss of flight guidance commands for Category I operations providing the other normal cues remains for primary flight information. Loss of the sensor should re move the guidance command. The pilot should recognize it and use other displays. Misleading indication could cause the pilot to temporary maneuver the airplane if using erroneous guidance information.
Autopilot Minor, with warning. Major, without warning.
R Major, single axis and limited authority.
Hazardous, multiaxis and limited authority.
Catastrophic, if authority is unlimited.
Malfunction effects of autopilot hardovers are very dependent on the design and installation details. Maximum inputs (hardove rs) or (slowovers) to aircraft primary control surfaces should not exceed aircraft structural limits. See AC 23.17C under section
23.1329 for additional information.
Autopilot guidance or flight director cue on display Minor Minor Major for pitch.
Minor for roll.
Pilot must monitor autopilot operation and disconnect autopilot to recover flight promptly. May cause go around and reductions in safety margins.
*Note: This table is only intended to be a guide and is not a certification checklist since it may not include all the information necessary for an FHA on part 23 IFR Class I airplanes with its various functions and its intended use. This partial FHA does not reflect considerations needed to properly develop FHA. See paragraph 16 and its associated subparagraphs for more complete guidance. R = Reserved, intentionally left blank.
A1-6
11/17/2011 AC 23.1309-1E Appendix 1 APPENDIX 1 (CONTINUED) Aircraft Function Classification of Failure Conditions Analysis Consideration Total Loss of Function Loss of Primary Means of Providing Function Misleading and/or Malfunction Without Warning Autopilot, inability to disengage with A/P disconnect switch Major Major Major The pilot is assumed to overcome the servo slip clutches in both pitch and roll and able to maintain control of aircraft. Minor if the circuit breaker to disconnect the autopilot is readily available in flight.
Electrical-Electronic primary powered flight controls Catastrophic Minor Hazardous to catastrophic Assumes redundant electrical/electronic primary flight control systems with no manual reversion that provide independent control for each axis. Hazardous for loss of one channel on the lateral or longitudinal axis.
Some fly-by-wire system designs may incorporate many solutions which mitigate the severity of the loss of a single channel. They may have three or four independent channels for pitch and roll, so the loss of one has little functional effect and control can be maintained with a single channel, although normally with the loss of some envelope protections. Additionally there may be mitig ating factors such as inherent stability which can reduce hazards.
Stability augmentation Variable Minor Variable It needs to be evaluated on a case-by-case basis since it depends on aircraft stability and handling characteristics when installed and required to meet minimum performance and flight handling requirements.
Stick pusher Hazardous, if loss is not annunciated.
Major if the stall warning is functioning.
Minor, if failure is annunciated and the stall warning is functioning.
Minor Catastrophic to hazardous if the pilot is able to override or able for quick disconnect.
The system is installed to protect against a hazardous stall characteristic and/or unrecoverable catastrophic condition such as a deep stall. Assumes dual systems to prevent single-failure modes. Stick pusher malfunction with or without warning can be catastrophic depending on phase of flight and system attributes. Airplane response to stick pusher may be considered and pilot procedures may mitigate to a lower failure condition.
*Note: This table is only intended to be a guide and is not a certification checklist since it may not include all the information necessary for an FHA on part 23 IFR Class I airplanes with its various functions and its intended use. This partial FHA does not reflect considerations needed to properly develop FHA. See paragraph 16 and its associated subparagraphs for more complete guidance. R = Reserved, intentionally left blank.
A1-7
11/17/2011 AC 23.1309-1E Appendix 1 APPENDIX 1 (CONTINUED) Aircraft Function Classification of Failure Conditions Analysis Consideration Total Loss of Function Loss of Primary Means of Providing Function Misleading and/or Malfunction Without Warning Stick shakers with Stall warning Major without other means of stall warning and unannunciated loss of stall warning.
Minor for annunciated loss of stall warning Major without other means of stall warning and unannunciated loss of stall warning.
Minor for annunciated loss of stall warning Major without other means of stall warning.
Assumes that inherent airplane characteristics do not exist so the pilot is aware of being close to stall (for example, stick force changes, buffeting, etc.).
Trim control Minor Minor Major, if manual trim. Catastrophic or hazardous for electrical.
Studies have shown trim runaways are not a significant problem if pilot takes quick corrective action. Major, for trim runaways if there is a trim-in-motion aural alert.
Hazardous or catastrophic for trim runaways without a failure indication depending on trim authority and phase of flight.
Gear control Major Minor Major R Brake control Major, for airplanes 6,000 lbs. Minor, for airplanes 6,000 lbs.
Major. Could be minor, if thrust reversers are installed.
Major Electronic anti-skid and brake systems can cause significant ground handling problems if they malfunction under adverse conditions due to asymmetrical loading. Light airplanes braking loss is not as significant and can be reviewed on a case-by-case basis.
Display of trim indications Minor Minor Variable Each airplane has to be reviewed on a case-by-case basis. The most severe case is the phase of flight before takeoff. After takeoff, the trim position indication is not as critical because the pilot will adjust the trim position to relieve the control forces.
Display of gear indications Minor R Minor R *Note: This table is only intended to be a guide and is not a certification checklist since it may not include all the information necessary for an FHA on part 23 IFR Class I airplanes with its various functions and its intended use. This partial FHA does not reflect considerations needed to properly develop FHA. See paragraph 16 and its associated subparagraphs for more complete guidance. R = Reserved, intentionally left blank.
A1-8
11/17/2011 AC 23.1309-1E Appendix 1 APPENDIX 1 (CONTINUED) Aircraft Function Classification of Failure Conditions Analysis Consideration Total Loss of Function Loss of Primary Means of Providing Function Misleading and/or Malfunction Without Warning Display of fuel level indication Minor Minor Minor Pilot is required to calculate fuel range and endurance during normal flight planning operations.
Display of powerplant indication tachometer Minor Minor Minor Assumes fixed pitch propeller and reciprocating engine; otherwise, a propeller governor will maintain the engine r.p.m. Turbofan and turbojet engines may need r.p.m. data for inflight restart capability. Refer to 14 CFR part 23, § 23.1311.
Display of powerplant Cylinder Head Temperature (CHT) Minor Minor Minor Assumes a CHT indicator is required. Refer to 14 CFR part 23, § 23.1305.
Display of powerplant indication coolant temperature Minor Minor Minor Refer to 14 CFR part 23, § 23.1305.
Display of powerplant indication oil pressure Minor Minor Minor Assumes oil temperature is used as a backup.
Display of powerplant indication oil temperature Minor Minor Minor Assumes oil pressure is used as a backup.
*Note: This table is only intended to be a guide and is not a certification checklist since it may not include all the information necessary for an FHA on part 23 IFR Class I airplanes with its various functions and its intended use. This partial FHA does not reflect considerations needed to properly develop FHA. See paragraph 16 and its associated subparagraphs for more complete guidance. R = Reserved, intentionally left blank.
A1-9
11/17/2011 AC 23.1309-1E Appendix 1 APPENDIX 1 (CONTINUED) Aircraft Function Classification of Failure Conditions Analysis Consideration Total Loss of Function Loss of Primary Means of Providing Function Misleading and/or Malfunction Without Warning Display of powerplant indication manifold pressure Minor Minor Minor Assumes backup use of CHT, Engine Gas Temperature (EGT), and possible fuel flow readings if installed.
Display of powerplant air inlet temperature Minor Minor Minor R Display of powerplant indication fuel pressure Minor Minor Minor R Display of powerplant indication fuel flow Minor Minor Major Manifold pressure and r.p.m. or torque indications can be used as an emergency backup to control power until a safe landing can be made.
Display of powerplant fire warning Major Major Major Required for commuter category and part 23 turbojet powered airplanes using special conditions. Part 23 airplanes usually ha ve one fire warning system on board.
Display of powerplant indication thrust Minor Minor Hazardous System is not normally used in part 23 airplanes. Torque, Engine Pressure Ratio (EPR), EGT, or Turbine Inlet Temperature (TIT), fuel flow, and r.p.m. are normally displayed.
) *Note: This table is only intended to be a guide and is not a certification checklist since it may not include all the information necessary for an FHA on part 23 IFR Class I airplanes with its various functions and its intended use. This partial FHA does not reflect considerations needed to properly develop FHA. See paragraph 16 and its associated subparagraphs for more complete guidance. R = Reserved, intentionally left blank.
A1-10
11/17/2011 AC 23.1309-1E Appendix 1 APPENDIX 1 (CONTINUED) Aircraft Function Classification of Failure Conditions Analysis Consideration Total Loss of Function Loss of Primary Means of Providing Function Misleading and/or Malfunction Without Warning Display of powerplant thrust reverser position No effect No effect Major No certification credit is given for enhanced performance when a thrust reverser is installed.
Thrust reversal Minor Minor Variable (inadvertent deployment) No certification credit is given for enhanced performance when a thrust reverser is installed. No credit can be given for a warning.
Display of powerplant torque Minor Minor Major Misleading torque could affect takeoff performance.
Display of powerplant propeller blade angle No safety effect No safety effect No safety effect System is not normally used in part 23 airplanes. Propeller governor would control r.p.m.
Electronic displays of significant powerplant parameters Minor to Hazardous R Hazardous Reversionary display is considered not available. If the risk of possible engine failure due to pilot mishandling can be mitigated by appropriate procedures or by EEC, the loss of function may be major or minor.
Visual warnings, cautions, and alerts R R R Failure conditions depend on the criticality of systems being monitored and pilot action required.
Display of air temperature Minor R Minor R *Note: This table is only intended to be a guide and is not a certification checklist since it may not include all the information necessary for an FHA on part 23 IFR Class I airplanes with its various functions and its intended use. This partial FHA does not reflect considerations needed to properly develop FHA. See paragraph 16 and its associated subparagraphs for more complete guidance. R = Reserved, intentionally left blank.
A1-11
11/17/2011 AC 23.1309-1E Appendix 1 APPENDIX 1 (CONTINUED) Aircraft Function Classification of Failure Conditions Analysis Consideration Total Loss of Function Loss of Primary Means of Providing Function Misleading and/or Malfunction Without Warning Overspeed warning Minor Minor Minor Airspeed may be used as a backup to the overspeed warning for continued safe flight and landing. Crew recognizes conditions by other equipment and procedures.
Primary weather radar Minor to Major depended on the intended operations R Major The loss could be major when the equipment is required by operational regulations. Also, Air Traffic guidance in some locations might not be available to provide hazardous weather information. It could be minor if there are appropriate AFM limitations.
Flight Information Service Weather Minor Minor Minor Normal operating procedures should states that the weather information should be used only as a strategic planning tool for pilot decision.
Electronic Chart on the MFD Minor Major, if paperless cockpit.
Minor, if backup available Major with ownship position.
While we are not requiring any backup, we strongly recommend that AFMS normal procedure section recommend that the pilot carry a paper backup with at least all other necessary information to make a successful approach at their destination or alternate airport. In addition, the AFMS should contai n emergency procedures for loss of approach charts on the MFD. A backup to the electroni c charts on the MFD could be an Electronic Flight Bag with charts, paper approach charts of the destination and alternate airports, or a pilot simply make notes of minimums and all other necessary information to make a successful approach at their destination or alternate airport. When the own-ship position is shown, it is not considered the primary navigation display, so a primary navigation display is required.
*Note: This table is only intended to be a guide and is not a certification checklist since it may not include all the information necessary for an FHA on part 23 IFR Class I airplanes with its various functions and its intended use. This partial FHA does not reflect considerations needed to properly develop FHA. See paragraph 16 and its associated subparagraphs for more complete guidance. R = Reserved, intentionally left blank.
A1-12
11/17/2011 AC 23.1309-1E Appendix 1 APPENDIX 1 (CONTINUED) Aircraft Function Classification of Failure Conditions Analysis Consideration Total Loss of Function Loss of Primary Means of Providing Function Misleading and/or Malfunction Without Warning Aural warnings Major R Major Aural alerts tend to be reserved for required flight crew’s immediate corrective action.
Failure conditions depend on the criticality of the system. Crew recognizes conditions by other equipment and procedures.
Electrical system indication Minor Minor Major Depends on crew reference and analysis.
Vacuum pressure indication Minor Minor Major Provides an indication that flight instruments are operating within power source limits.
Electrical power Catastrophic, if primary flight instruments require electrical power.
Hazardous for IFR. Depends upon capability of secondary power system.
Installation dependent Depends on electrical system loads and the criticality of the functions.
*Note: This table is only intended to be a guide and is not a certification checklist since it may not include all the information necessary for an FHA on part 23 IFR Class I airplanes with its various functions and its intended use. This partial FHA does not reflect considerations needed to properly develop FHA. See paragraph 16 and its associated subparagraphs for more complete guidance. R = Reserved, intentionally left blank.
A1-13
Appendix 2 APPENDIX 2. SAMPLE FUNCTIONAL
HAZARD ASSESSMENT (FHA) FORMAT Function Failure Condition Hazard Description Phase Effect of Failure Condition on Aircraft/Crew Classification Reference to Supporting Material Verification Display of Loss of primary means All Crew would not be able to use Major AC 23.1311- Qualitative attitude of attitude information primary means of attitude 1C analysis.
information used for control in roll information and would have to to control roll and pitch. resort to standby or other means. May require and pitch Information from standby or other means still available.
As long as it is clear that the primary means cannot be relied upon, then using the standby or other means would create an increase in crew workload, but doubtful anything more severe.
Hypothetical cases where it is not clear as to the integrity of the information may come under the “Misleading attitude information” case below.
FTA May use PSSA or SSA Display of Loss of all means of All If certified for IFR operation, the Catastrophic AC 23.1311- Quantitative attitude attitude information. crew would not have sufficient 1C FTA and information information to maintain a proper Qualitative to control roll attitude and would likely analysis.
and pitch inadvertently exceed attitude limits, which could result in the loss of control of the aircraft.
May use PSSA or SSA *Note: This sample FHA is intended to be a guide for format purposes only to illustrate what items should be considered when performing an FHA. Since other pertinent information regarding the type of airplane and its features is not provided, the technical content may not be appropriate for other airplanes.
A2-1