11/17/2011 AC 23.1309-1E Appendix 1 APPENDIX 1 (CONTINUED) Aircraft Function Classification of Failure Conditions Analysis Consideration Total Loss of Function Loss of Primary Means of Providing Function Misleading and/or Malfunction Without Warning Display of powerplant thrust reverser position No effect No effect Major No certification credit is given for enhanced performance when a thrust reverser is installed.
Thrust reversal Minor Minor Variable (inadvertent deployment) No certification credit is given for enhanced performance when a thrust reverser is installed. No credit can be given for a warning.
Display of powerplant torque Minor Minor Major Misleading torque could affect takeoff performance.
Display of powerplant propeller blade angle No safety effect No safety effect No safety effect System is not normally used in part 23 airplanes. Propeller governor would control r.p.m.
Electronic displays of significant powerplant parameters Minor to Hazardous R Hazardous Reversionary display is considered not available. If the risk of possible engine failure due to pilot mishandling can be mitigated by appropriate procedures or by EEC, the loss of function may be major or minor.
Visual warnings, cautions, and alerts R R R Failure conditions depend on the criticality of systems being monitored and pilot action required.
Display of air temperature Minor R Minor R *Note: This table is only intended to be a guide and is not a certification checklist since it may not include all the information necessary for an FHA on part 23 IFR Class I airplanes with its various functions and its intended use. This partial FHA does not reflect considerations needed to properly develop FHA. See paragraph 16 and its associated subparagraphs for more complete guidance. R = Reserved, intentionally left blank.
A1-11
11/17/2011 AC 23.1309-1E Appendix 1 APPENDIX 1 (CONTINUED) Aircraft Function Classification of Failure Conditions Analysis Consideration Total Loss of Function Loss of Primary Means of Providing Function Misleading and/or Malfunction Without Warning Overspeed warning Minor Minor Minor Airspeed may be used as a backup to the overspeed warning for continued safe flight and landing. Crew recognizes conditions by other equipment and procedures.
Primary weather radar Minor to Major depended on the intended operations R Major The loss could be major when the equipment is required by operational regulations. Also, Air Traffic guidance in some locations might not be available to provide hazardous weather information. It could be minor if there are appropriate AFM limitations.
Flight Information Service Weather Minor Minor Minor Normal operating procedures should states that the weather information should be used only as a strategic planning tool for pilot decision.
Electronic Chart on the MFD Minor Major, if paperless cockpit.
Minor, if backup available Major with ownship position.
While we are not requiring any backup, we strongly recommend that AFMS normal procedure section recommend that the pilot carry a paper backup with at least all other necessary information to make a successful approach at their destination or alternate airport. In addition, the AFMS should contai n emergency procedures for loss of approach charts on the MFD. A backup to the electroni c charts on the MFD could be an Electronic Flight Bag with charts, paper approach charts of the destination and alternate airports, or a pilot simply make notes of minimums and all other necessary information to make a successful approach at their destination or alternate airport. When the own-ship position is shown, it is not considered the primary navigation display, so a primary navigation display is required.
*Note: This table is only intended to be a guide and is not a certification checklist since it may not include all the information necessary for an FHA on part 23 IFR Class I airplanes with its various functions and its intended use. This partial FHA does not reflect considerations needed to properly develop FHA. See paragraph 16 and its associated subparagraphs for more complete guidance. R = Reserved, intentionally left blank.
A1-12
11/17/2011 AC 23.1309-1E Appendix 1 APPENDIX 1 (CONTINUED) Aircraft Function Classification of Failure Conditions Analysis Consideration Total Loss of Function Loss of Primary Means of Providing Function Misleading and/or Malfunction Without Warning Aural warnings Major R Major Aural alerts tend to be reserved for required flight crew’s immediate corrective action.
Failure conditions depend on the criticality of the system. Crew recognizes conditions by other equipment and procedures.
Electrical system indication Minor Minor Major Depends on crew reference and analysis.
Vacuum pressure indication Minor Minor Major Provides an indication that flight instruments are operating within power source limits.
Electrical power Catastrophic, if primary flight instruments require electrical power.
Hazardous for IFR. Depends upon capability of secondary power system.
Installation dependent Depends on electrical system loads and the criticality of the functions.
*Note: This table is only intended to be a guide and is not a certification checklist since it may not include all the information necessary for an FHA on part 23 IFR Class I airplanes with its various functions and its intended use. This partial FHA does not reflect considerations needed to properly develop FHA. See paragraph 16 and its associated subparagraphs for more complete guidance. R = Reserved, intentionally left blank.
A1-13
Appendix 2 APPENDIX 2. SAMPLE FUNCTIONAL
HAZARD ASSESSMENT (FHA) FORMAT Function Failure Condition Hazard Description Phase Effect of Failure Condition on Aircraft/Crew Classification Reference to Supporting Material Verification Display of Loss of primary means All Crew would not be able to use Major AC 23.1311- Qualitative attitude of attitude information primary means of attitude 1C analysis.
information used for control in roll information and would have to to control roll and pitch. resort to standby or other means. May require and pitch Information from standby or other means still available.
As long as it is clear that the primary means cannot be relied upon, then using the standby or other means would create an increase in crew workload, but doubtful anything more severe.
Hypothetical cases where it is not clear as to the integrity of the information may come under the “Misleading attitude information” case below.
FTA May use PSSA or SSA Display of Loss of all means of All If certified for IFR operation, the Catastrophic AC 23.1311- Quantitative attitude attitude information. crew would not have sufficient 1C FTA and information information to maintain a proper Qualitative to control roll attitude and would likely analysis.
and pitch inadvertently exceed attitude limits, which could result in the loss of control of the aircraft.
May use PSSA or SSA *Note: This sample FHA is intended to be a guide for format purposes only to illustrate what items should be considered when performing an FHA. Since other pertinent information regarding the type of airplane and its features is not provided, the technical content may not be appropriate for other airplanes.
A2-1
Appendix 2 APPENDIX 2. SAMPLE FUNCTIONAL
HAZARD ASSESSMENT (FHA) FORMAT Function Failure Condition Hazard Description Phase Effect of Failure Condition on Aircraft/Crew Classification Reference to Supporting Material Verification Display of Incorrect attitude All Generally, this condition would be Major AC 23.1311- Qualitative attitude information on one the incorrect attitude with warning 1C analysis.
information display, but not on all on one means of attitude to control displays (not misleading information. For this condition, May require roll and in nature). the crew would realize that this FTA pitch information was incorrect. If there is any chance this would not be clear, the scenario would have to be considered “Misleading attitude information” as described below.
May use PSSA or SSA Display of Misleading attitude All If certified for IFR operation, the Catastrophic AC 23.1311- Quantitative attitude information. crew would unknowingly follow 1C FTA and information incorrect attitude information, and Qualitative to control Note: Failure condition inadvertently exceed attitude limits analysis.
roll and with misleading data which could result in the loss of pitch provided to the autopilot that is handled with the autopilot failure conditions.
control of the aircraft. May use PSSA or SSA Display of Total Loss of oil pressure All Assumes oil temperature is used as Minor AC 23.1311- Design and powerplant display a backup 1C Installation indication Appraisal oil pressure (Next function) (Next failure condition, and so on) *Note: This sample FHA is intended to be a guide for format purposes only to illustrate what items should be considered when performing an FHA. Since other pertinent information regarding the type of airplane and its features is not provided, the technical content may not be appropriate for other airplanes.
A2-2
Appendix 3 APPENDIX 3. CALCULATION
OF THE AVERAGE PROBABILITY PER FLIGHT HOUR
1. The purpose of this material is to provide guidance for calculating the "average probability per flight hour" for a failure condition so that it can be compared with the quantitative requirements of § 23.1309. The process of calculating the "average probability per flight hour" for a failure condition is a four-step process and based on the assumption that the life of an aircraft is a sequence of "average flights."
Step 1: Determination of the "average flight;"
Step 2: Calculation of the probability of a failure condition for a certain "average flight;"
Step 3: Calculation of the "average probability per flight" of a failure condition; and Step 4: Calculation of the "average probability per flight hour" of a failure condition.
a. Determination of the “average flight:” The "average probability per flight hour" is to be based on an "average flight." The applicant should estimate the average flight duration and average flight profile for the fleet of aircraft to be certified. The average flight duration should be estimated based on the applicant’s expectations and historical experience for similar types.
The average flight duration should reflect the applicant’s best estimate of the cumulative flight hours divided by the cumulative aircraft flights for the service life of the aircraft. The average flight profile should be based on the operating weight and performance expectations for the average aircraft when flying a flight of average duration in an ICAO standard atmosphere. The duration of each flight phase (e.g., takeoff, climb, cruise, descent, approach and landing) in the “average flight” should be based on the average flight profile. Average taxi times for departure and arrival at an average airport should be considered where appropriate and added to the average flight time to obtain "average flight--block time." The average flight duration and profile should be used as the basis for determining the "average probability per flight hour" for quantitative safety assessment as means of compliance with this AC.
b. Calculation of the probability of a failure condition for a certain "average flight:"
The probability of a failure condition occurring on an "average flight" should be determined by structured methods (see ARP 4761 for various methods) and should consider all elements (e.g., combinations of failures and events) that contribute to a failure condition. If there is only an effect when failures occur in a certain order, the calculation should account for the conditional probability that the failures occur in the sequence necessary to produce a failure condition. The probabilities of the basic events (component or part level failures) that contribute to the probability of a failure condition should consider the following:
(1) The individual part, component, and assembly failure rates utilized in calculating the "average probability per flight hour" should be estimates of the mature constant failure rates after infant mortality and prior to wear-out. Alternatively, a non-constant failure rate can be used (i.e.
Weibull or other accepted means). Inspection intervals or component life limits employed to protect against wear out are to be placed in chapter 4 or 5 of the maintenance manual. In either case, the failure rate should be based on all causes of failure (operational, environmental, etc.).
Where available, service history of same or similar components in the same or similar environment should be used.
A3-1
11/17/2011 APPENDIX 3 (CONTINUED) AC 23.1309-1E Appendix 3
(2) If the failure is only relevant during certain flight phases, the calculation should be based on the probability of failure during the relevant "at risk" time for the "average flight."
(3) If one or more failed elements in the system can persist for multiple flights (latent, dormant, or hidden failures), the calculation has to consider the relevant exposure times (e.g., time intervals between maintenance checks/ inspections). In such cases, the probability of the failure condition increases with the number of flights during the latency period.
(4) If the failure rate of one element varies during different flight phases, the calculation should consider the failure rate and related time increments in such a manner as to establish the probability of the failure condition occurring on an "average flight." It is assumed that the "average flight" can be divided into n phases (e.g., phase 1, ... , phase n). Let T F the "average flight" duration, Tj the duration of phase j and tj the transition point between Tj and Tj+1, j = 1, ... , n . I.e.
n TF = Tj and tj - tj-1 = Tj ; j = 1, ... , n j=1 Let j(t) the failure rate function during phase j, i.e. for t [tj-1,tj].
Remark: j(t) may be equal 0 for all t [tj-1,tj] for a specific phase j.
Let PFlight (failure) the probability that the element fails during one certain flight (including non-flying time) and PPhase j (failure) the probability that the element fails in phase j.
Two cases are possible:
(i) The element is checked operative at the beginning of a certain flight. Then PFlight (failure) n PPhase j (failure) n Pfailure tt ,t j1 j j=1 j1 n ti 1 exp i x dx i=1 t i-1 A3-2
11/17/2011 APPENDIX 3 (CONTINUED) AC 23.1309-1E Appendix 3
(ii) The state of the item is unknown at the beginning of a certain flight. Then PFlight (failure) = P prior (failure) 1 Pprior (failure) 1 n exp ti i x dx i=1 t i-1 where Pprior (failure) is the probability that the failure of the element has occurred prior to a certain flight.
Note: For the two mathematical operators, ∏ is a product sign and ∈ is element of.
(5) If there is only an effect when failures occur in a certain order, the calculation should account for the conditional probability that the failures occur in the sequence necessary to produce a failure condition.
c. Calculation of the “average probability per flight” of a failure condition: The next step is to calculate the "average probability per flight" for a failure condition, that is, the probability of a failure condition for each flight (which might be different, although all flights are "average flights") during the relevant time (for example, the least common multiple of the exposure times or the aircraft life) have to be calculated, summed up, and divided by the number of flights during that period. The principles of calculating are described below and are in more detail in ARP 4761.
N P failure conditionFlight k k=1PAverage per Flight failure condition N
Note: N is the number of all flights during the relevant time, and PFlight k is the probability that a failure condition occurs in flight k. In the special case of a duplex system (i.e., one component failure latent, the other detected), this method results in an "average probability per flight," which equals the product of both failure rates multiplied by the "average flight" duration TF multiplied by one-half (50 percent) of the relevant exposure time.
d. Calculation of the “average probability per flight hour” of a failure condition: Once the "average probability per flight" is calculated, it should be normalized by dividing it by the "average flight" duration TF in “flight hours” to obtain the "average probability per flight hour."
This quantitative value should be used in conjunction with the hazard category/effect established by the FHA to determine if it is compliant for the failure condition being analyzed.
PAverage per Flight failure condition PAverage per FH failure condition TF A3-3