RTCA/DO-178B Software Considerations in Airborne Systems and Equipment Certification RTCA/DO-254 Design Assurance Guidance for Airborne Electronic Hardware
(2) Society of Automotive Engineers (SAE), Inc. The following SAE, Inc., Aerospace Recommended Practice (ARP) documents are available from SAE, 400 Commonwealth Drive, Warrendale, PA 15096-0001 or from their website at www.sae.org.
ARP 4754A Guidelines for Development of Civil Aircraft and Systems ARP 4761 Guidelines and Methods for Conducting the Safety Assessment Process on Civil Airborne Systems and Equipment Note: ARPs 4754A and 4761 provide guidelines and methods of performing the safety assessment for certification of civil aircraft. The guidelines in ARP 4754A were developed in the context of 14 CFR part 25. It may be applicable to other 14 CFRs, such as parts 23, 27, 29, 33, and 35.
This AC is not intended to constrain the applicant to the use of these documents in the definition of their particular methods of satisfying the objectives of this AC. However, these documents contain material and methods of performing the System Safety Assessment (SSA) that an applicant may choose to use. The guidance in this AC takes precedence over the recommended practices in these ARPs if there is a conflict. (See paragraph 21 for more guidance) Contact the Small Airplane Directorate if there are conflicts with other guidance or ACs and this AC.
5. Applicability.
a. In addition to specific part 23 design requirements, § 23.1309 requirements, except as identified below, are applicable to any equipment or system installed in the airplane. This section addresses general requirements and does not supersede any specific requirements contained in other part 23 sections. New a dvance technology in electrical, electronic, and mechanical systems designs that include complex electronics with software, complex hardware, HIRF, and/or lightning requires a § 23.1309 analysis. An SSA is required to determine the level of certitude for the processes in standard and guidance documents such as RTCA/DO-178B, RTCA/DO-254, AC 20-136A, and AC 20-158 or equivalent. Section 23.1309 should be used to determine failure condition, probability of failure condition, software Development Assurance Level (DAL), and complex hardware DALs shown in Figure 2. The safety assessment process is used to determine the failure condition classification, which determines the HIRF and lightning protection levels (reduced DALs in Figure 2 are not used). For simple and conventional mechanical or analog electromechanical systems, or both, with well-established design and certification processes (where the installation is not complex), safety analysis may be satisfied by a qualitative assessment such as the single-failure concept and experience based on serviceproven designs and engineering judgment. In this case, a FHA, a design appraisal, and an installation appraisal addressed in this AC may satisfy § 23.1309 as shown in Figure 3.
b. Section 23.1309 does not apply to the performance, flight characteristics requirements of subpart B, and structural loads and strength requirements of subparts C and D. However, except as noted below, § 23.1309 does apply to systems that comply with subparts B, C, D, and E requirements. The flight structure such as wing, empennage, control surfaces and their simple systems; the fuselage, engine mounting, and landing gear and their related primary attachments are excluded. For example, § 23.1309 does not apply to an airplane's inherent stall characteristics or their evaluation of § 23.201, but does apply to a stick pusher (stall barrier) system installed to attain compliance with § 23.201. We will determine additional exceptions in the future. Until then, contact the Small Airplane Directorate for determination and approval of proposed exceptions not included in this AC.
c. Experienced engineering and operational judgment should be applied when determining whether or not a system is complex. Comparison with similar, previously approved systems is sometimes helpful. All relevant systems attributes should be considered. For example, the design may be complex, such as a satellite communication system used only by the passenger, but its failure may cause only minor safety effects.
6. Regulations and AC background.
a. Regulation.
(1) Amendment 23-14 (effective December 20, l973) adopted the original airworthiness standards in § 23.1309(a). Before amendment 23-14, neither the Civil Air Regulations (CAR) part 3, nor 14 CFR part 23, contained safety requirements in § 23.1309 for equipment, systems, and installations in small airplanes. In 1968, the FAA instituted an extensive review of the airworthiness standards of part 23. Because of the increased use of part 23 airplanes in all weather operations and the pilot’s increased reliance on installed systems and equipment, the FAA issued § 23.1309 to provide an acceptable level of safety for such equipment, systems, and installations. When the FAA adopted § 23.1309 (Amendment 23-14), it did not envision installation of systems that perform critical functions in small airplanes; therefore, before Amendment 23-41, this section did not contain safety standards for evaluating critical functions.
When such equipment, systems, and installations were included in the airplane design, they were evaluated under special conditions in accordance with the procedures of 14 CFR part 21.
(2) Amendment 23-34 (effective February 17, 1987) expanded § 23.1309 to include certification of commuter category airplanes. This expansion added a requirement to ensure applicable systems and installations are designed to safeguard against hazards. It also added requirements for equipment identified as essential loads and the affected power sources.
(3) Amendment 23-41 (effective November 26, 1990) retained in § 23.1309 the existing safety requirements adopted by amendment 23-14 for airplane equipment, systems, and installations that are not complex and that do not perform critical functions. For those cases where the applicant includes complex systems, or systems that perform critical functions, Amendment 23-41, § 23.1309, provides additional requirements for certification and identifying such equipment, systems, and installations. This amendment permitted the approval of more advanced systems having the capability to perform critical functions.
(4) Amendment 23-49 (effective March 11, 1996), amended § 23.1309(a)(4) to correct Amendment 23-41, which inadvertently removed the commuter category requirement originally added by Amendment 23-34 as § 23.1309(d).
(5) Amendment 23-62 consolidated and revised the existing requirements to reduce the certification burden. The FAA removed § 23.1301(d) and clarified the requirement in § 23.1309(a) to improve standardization for systems and equipment certification, particularly for non-required equipment and non-essential functions embedded within complex avionic systems.
Section 23.1309(b) requires minor, major, hazardous, or catastrophic failure condition(s) that occur during certification testing have a root cause analysis and corrective action. Section
23.1309(c) updates the safety assessment process terminology. Amendment 23-62 also made § 23.1309(d) compatible with § 23.1322 (Warning, caution, and advisory lights) for the design of systems and controls, including indications and annunciations. The power source capacity and distribution requirements, which are not directly related to the other safety and analysis requirements from § 23.1309, Amendment 23-49, were moved to a new section in § 23.1310 with clarification.
(6) Qualitative and quantitative analyses are often used in assessing the acceptability of complex designs that have a high degree of integration, use new technology, are new or different applications of conventional technology, or are designs that perform critical functions. These assessments lead to the selective use of quantitative analyses to support experienced engineering and operational judgment and to supplement qualitative analyses and tests. Numerical probability ranges associated with the terms used in § 23.1309 are accepted for evaluating quantitative analyses that have a logical and acceptable inverse relationship between the probability and severity of each failure condition.
b. AC.
(1) AC Revisions.
(a) The revision from AC 23.1309-1B to AC 23.1309-1C on March 12, 1999, provided the four-tier certification classes with different criteria for probability of failures and software levels for systems. The purpose of this certification approach is to increase safety by enhancing equipment on General Aviation (GA) airplanes that facilitate new technologies.
(b) Since the issuance of AC 23.1309-1C, there has been a large number of electronic displays and electronic systems installed on part 23 airplanes, especially Primary Flight Displays (PFD), Multifunction Flight Displays (MFD), Integrated Flight Systems, and Synthetic Vision Systems (SVS). A study of the FAA Alaska Capstone demonstration program for new avionics systems technology determined that four-tier certification classes demonstrated significant operational safety benefit and reduced accident rates. These installations, especially on Class I and II airplanes, would have been too costly without the establishment of the four-tier certification classes of airplanes as shown in paragraph 15.
(2) Broad causes of fatal accidents. Accident rate is a function of many factors. These factors include human performance, weather, design, operation, training, maintenance, and 5
airspace system infrastructure. For all airplanes, but particularly GA airplanes, pilot decisionmaking causes most accidents. Pilot decision-making accidents are often the result of a lack of situational awareness relative to terrain or weather, or to a loss of control due to excess workload. Correct pilot interventions and actions have prevented some of these accidents.
Increases in avionics equipage rates that improve pilot situational awareness or simplify the task have a significant positive impact on the GA accident rate. The Aircraft Owners and Pilots Association, Air Safety Foundation, conducted a study of safety effects of glass cockpits and concluded that technologically advanced aircraft provide added situational awareness tools that have dramatically improved aspects of GA safety. Technologically advanced aircraft deliver multiple safety benefits to GA pilots, but pilot training tied to experience has to evolve with it.
(3) Installing affordable systems.
(a) Enhancing the quantity, quality, and presentation of situational data in the cockpit can improve pilot situational awareness, efficiency, and safety. Many studies have shown that equipping these airplanes with safety devices such as Terrain Awareness Warning Systems (TAWS), Graphical Weather Displays, Map Displays, Integrated Flight Systems, SVS, and Enhanced Vision Systems may dramatically reduce a number of accident types. Pilots have reported that integrated flight displays help reduce workload, improve situational awareness, and increase safety.
(b) The aviation industry as a whole is on the threshold of a revolutionary change in communication, navigation, and surveillance of aircraft operations. The Next Generation Air Transportation System will overhaul the National Airspace System (NAS) to take advantage of new technology. It will also likely result in the long-term replacement of many avionics and instrument equipment in the existing fleet as well as in new production aircraft. Facilitating safety equipment installation should enhance the NAS efficiency and safety. If GA is to operate within a revised NAS, new technologies should be available and affordable for GA aircraft.
With the four-tier certification class criteria, new technologies are affordable for GA. If GA had only one class for certification, due to the cost of equipment for the NAS architecture, implementation would be incomplete or exclude large portions of the GA fleet from the NAS system. Neither situation is desirable or acceptable.
7. Acronyms.
14 CFR Title 14 Code of Federal Regulation AC Advisory Circular ACO Aircraft Certification Office AFM Airplane Flight Manual AFMS Airplane Flight Manual Supplement ARP Aerospace Recommended Practice ATC Amended Type Certificate CAR Civil Air Regulations CFR Code of Federal Regulations CHT Cylinder Head Temperature DAL Development Assurance Level 6
EEC Electronic Engine Control EGT Engine Gas Temperature EPR Engine Pressure Ratio FAA Federal Aviation Administration FHA Functional Hazard Assessment FMEA Failure Modes and Effects Analysis FTA Fault Tree Analysis GA General Aviation GNSS Global Navigation Satellite System HW Hardware HIRF High Intensity Radiated Fields ICA Instructions for Continued Airworthiness ICAO International Civil Aviation Organization IFR Instrument Flight Rules ILS Instrument Landing System IMC Instrument Meteorological Conditions MFD Multifunction Flight Display MRE Multiple Reciprocating Engine MTE Multiple Turbine Engine MTBF Mean Time Between Failures NAS National Airspace System P Primary System PFD Primary Flight Display PMA Parts Manufacturer Approval PSSA Preliminary System Safety Assessment R Reserved S Secondary System SAE Society of Automotive Engineers SRE Single Reciprocating Engine SSA System Safety Assessment STE Single Turbine Engine STC Supplemental Type Certificate SVS Synthetic Vision Systems SW Software TCAS Traffic Collision Avoidance System TIA Type Inspection Authorization TAWS Terrain Awareness Warning System TC Type Certificate TIT Turbine Inlet Temperature TSO Technical Standard Order VFR Visual Flight Rules WAAS Wide Area Augmentation System 7
8. Definitions.
a. Adverse effect. A response of a system that results in an undesirable operation of an airplane system, or subsystem.
b. Analysis. An evaluation based on decomposition into simple elements.
c. Adverse operating condition. A set of environmental or operational circumstances applicable to the airplane, combined with a failure or other emergency situation that results in a significant increase in normal flight crew workload.
d. Assessment. An evaluation based upon engineering judgment.
e. Attribute. A feature, characteristic, or aspect of a system or a device, or a condition affecting its operation. Some examples would include design, construction, technology, installation, functions, applications, operational uses, and environmental and operational stresses. It would also include relationships with other systems, functions, and flight or structural characteristics.
f. Average probability per flight hour. A representation of the number of times the subject failure condition is predicted to occur during the entire operating life of all airplanes of a type, divided by the anticipated total operating hours of all airplanes of that type.
Note: The average probability per flight hour is normally calculated as the probability of a failure condition occurring during a typical flight of mean duration divided by that mean duration. See Appendix 3.
g. Caution. A clear and unambiguous indication to the flight crew or pilot of a failure that requires subsequent crew action. An inherent characteristic of the airplane or a device that will give clearly distinguishable indications of malfunction or misleading information may provide this caution.
h. Complex hardware item. All items that are not simple are considered to be complex.
See definition of simple hardware item. Source: RTCA/DO-254, Appendix C and Order 8110.105.
i. Complex system. A system is “complex” when its operation, failure modes, or failure effects are difficult to comprehend without the aid of analytical methods or structured assessment methods. FMEA and FTA are examples of such structured assessment methods. Increased system complexity is often caused by such items as sophisticated components and multiple interrelationships. For example, for these types of systems, a portion of the compliance may be shown by the use of DALs such as by processes in RTCA/DO-178B or RTCA/DO-254 or equivalent. See the definitions for “conventional” and “simple” for more information.
j. Continued safe flight and landing. This phrase means that the airplane is capable of continued controlled flight and landing, possibly using emergency procedures, without requiring 8
exceptional pilot skill or strength. Upon landing, some airplane damage may occur as a result of a failure condition.
k. Conventional system. A system is considered “conventional” if its function, the technological means to implement its function, and its intended usage are all the same as, or closely similar to, that of previously approved systems that are commonly used. The systems that have established an adequate service history and the means of compliance for approval are generally accepted as "conventional." Normally conventional and simple systems may be analyzed by qualitative assessments as shown in Figure 3. See the definitions for complex and simple systems for more information.
l. Critical function. A function whose loss would prevent the continued safe flight and landing of the airplane.
Note: The term “critical function” is associated with a catastrophic failure condition. Newer documents may not refer specifically to the term “critical function.”
m. Design appraisal. A qualitative appraisal of the integrity and safety of the system design. An effective appraisal requires experienced judgment.
n. Design assurance level. All of those planned and systematic actions used to substantiate, at an adequate level of confidence, that design errors have been identified and corrected such that the items (hardware, software) satisfy the applicable certification basis. This term may be used in some SAE and RTCA documents, but in this AC it is intended that design assurance levels will correlate to the same levels as the DALs for the safety assessment process. See section 21 for more information.
o. Development Assurance Level (DAL). All those planned and systematic actions used to substantiate, to an adequate level of confidence, that errors in requirements, design, and implementation have been identified and corrected such that the system satisfies the applicable certification basis.
Note: For this AC, DALs in figure 2 and throughout this AC are also intended to correlate to software levels in RTCA/DO-178B and complex hardware design assurance levels in RTCA/DO-254 for the system or item. See section 21 for more information.
p. Equipment essential to safe operation. Equipment installed in order to comply with the applicable certification requirements of part 23 or operational requirements of parts 91, 121, and
135.
q. Error. An omission or incorrect action by a crewmember or maintenance personnel, or a mistake in requirements, design, or implementation.
r. Essential function. A function whose loss would reduce the capability of the airplane or the ability of the crew to cope with adverse operating conditions.
Note: The term “essential function” is associated with failure conditions between major and hazardous. Newer documents may not refer specifically to the term “essential function.”
s. Event. An internal or external occurrence that has its origin distinct from the airplane, such as atmospheric conditions (for example, gusts, temperature variations, icing, and, runway conditions, conditions of communication, navigation, and surveillance services, bird-strike, fire, leaking fluids, tire burst, HIRF exposure, lightning, uncontained failure of high energy rotating machines, etc.). The term is not intended to cover sabotage.
t. Essential load. Equipment essential to safe operation that requires a power source for normal operation.
u. Extremely remote failure conditions. Those failure conditions not anticipated to occur to each airplane during its total life but which may occur a few times when considering the total operational life of all airplanes of this type. For quantitative assessments, refer to the probability values shown for hazardous failure conditions in figure 2.
v. Extremely improbable failure condition. For commuter category airplanes, those failure conditions so unlikely that they are not anticipated to occur during the entire operational life of all airplanes of one type. For other classes of airplanes, the likelihood of occurrence may be greater. For quantitative assessments, refer to the probability values shown for catastrophic failure conditions in figure 2.
w. Failure. An occurrence that affects the operation of a component, part, or element such that it can no longer function as intended (this includes both loss of function and malfunction).
Note: Errors may cause failures but are not considered failures.
x. Failure conditions. A condition having an effect on either the airplane or its occupants, or both, either direct or consequential, which is caused or contributed to by one or more failures or errors considering flight phase and relevant adverse operational or environmental conditions or external events. Failure conditions may be classified according to their severity as follows:
(1) No safety effect. Failure conditions that would have no effect on safety (that is, failure conditions that would not affect the operational capability of the airplane or increase crew workload).
(2) Minor. Failure conditions that would not significantly reduce airplane safety and involve crew actions that are within their capabilities. Minor failure conditions may include a slight reduction in safety margins or functional capabilities, a slight increase in crew workload (such as routine flight plan changes), or some physical discomfort to passengers or cabin crew.
(3) Major. Failure conditions that would reduce the capability of the airplane or the ability of the crew to cope with adverse operating conditions to the extent that there would be a significant reduction in safety margins or functional capabilities. In addition, the failure condition has a significant increase in crew workload or in conditions impairing crew efficiency;
or a discomfort to the flight crew or physical distress to passengers or cabin crew, possibly including injuries.
(4) Hazardous. Failure conditions that would reduce the capability of the airplane or the ability of the crew to cope with adverse operating conditions to the extent that there would be the following:
(a) A large reduction in safety margins or functional capabilities;
(b) Physical distress or higher workload such that the flight crew cannot be relied upon to perform their tasks accurately or completely; or
(c) Serious or fatal injury to an occupant other than the flight crew.
(5) Catastrophic. Failure conditions that are expected to result in multiple fatalities of the occupants, or incapacitation or fatal injury to a flight crewmember normally with the loss of the airplane.
Notes: (1) The phrase “are expected to result” is not intended to require 100 percent certainty that the effects will always be catastrophic. Conversely, just because the effects of a given failure, or combination of failures, could conceivably be catastrophic in extreme circumstances, it is not intended to imply that the failure condition will necessarily be considered catastrophic. (2) The term “catastrophic” was defined in previous versions of advisory materials as a failure condition that would prevent continued safe flight and landing.
y. Function. The lowest defined level of a specific action of a system, equipment, and flight crew performance aboard the airplane that, by itself, provides a completely recognizable operational capability (e.g., an airplane heading is a function). One or more systems may contain a specific function or one system may contain multiple functions.
z. Functional hazard assessment. A systematic, comprehensive examination of airplane and system functions to identify potential minor, major, hazardous, and catastrophic failure conditions that may arise as a result of a malfunction or a failure to function.
aa. Hazard. A potentially unsafe condition resulting from failures, malfunctions, external events, errors, or combinations thereof. This term is intended for single malfunctions or failures that are considered probable based on either past service experience or analysis with similar components in comparable airplane applications, or both. There is no quantitative analysis intended in this application.
Note: There is a difference between “hazardous” as used in general policy or regulations and “hazardous failure condition” as used in an FHA. When the term "hazard" or "hazardous" is used in general policy or regulations, it is generally used as shown in this definition. A hazard could be a failure condition that relates to major, hazardous, or catastrophic.
bb. Improbable failure conditions. Those failure conditions unlikely to occur in each airplane during its total life, but that may occur several times when considering the total operational life of a number of airplanes of this type. Also, those failure conditions not anticipated to occur to each airplane during its total life but that may occur a few times when considering the total operational life of all airplanes of this type. For quantitative assessments, refer to the probability values shown for major and hazardous failure conditions in figure 2. For more specific guidance, see definitions of “remote failure conditions” and “extremely remote failure conditions” cc. Item. One or more hardware and/or software elements treated as a unit.
dd. Installation appraisal. A qualitative appraisal of the integrity and safety of the installation. Any deviations from normal industry-accepted installation practices should be evaluated.
ee. Latent failure. A failure is latent until it is made known to the flight crew or maintenance personnel.
ff. Malfunction. Failure of a system, subsystem, unit, or part to operate in the normal or usual manner. The occurrence of a condition whereby the operation is outside specified limits.
gg. Minimize. To reduce, lessen, or diminish a hazard to the least practical amount with current technology and materials. The least practical amount is that point at which the effort to further reduce a hazard significantly exceeds any benefit in terms of safety derived from that reduction. Additional efforts would not result in any significant improvements to safety and would inappropriately add to the cost of the product without a commensurate benefit.
hh. Power source. A system that provides power to installed equipment. This system would normally include prime mover(s), required power converter(s), energy storage device(s), and required control and interconnection means.
ii. Primary function. A function installed to comply with applicable regulations for the required function and provides the most pertinent controls or information instantly and directly to the pilot. For example, the PFD is a single physical unit that always provides the primary display and complies with the requirements of all the following: altitude, airspeed, aircraft heading (direction) and attitude. The PFD is located directly in front of the pilot and used instantly and first by the pilot. A standby or another display intended to be used in the event of failure of the PFD or as a cross reference is an example of a secondary system. For example, a brake control system normally uses the electronic brake system most of the time because of its better performance, but it does not comply with all the requirements. In this case, the mechanical brakes are used as the backup systems; yet, it is consider the primary with regard to meeting the requirements and the electronic brake system is the secondary.
jj. Primary system. A system that provides the primary function.
kk. Probable. Probable as defined for § 23.1309(a) through Amendment 23-49, as a probable malfunction or failure, is any single malfunction or failure that is considered likely on 12
the basis of either past service experience or analysis with similar components in comparable airplane applications, or both.
Note: Normally, there is no quantitative analysis intended in this application. This should not be confused with a probable failure condition when used for a safety assessment process.
ll. Probable failure conditions. Those failure conditions anticipated to occur one or more times during the entire operational life of each airplane. These failure conditions may be determined on the basis of past service experience with similar components in comparable airplane applications. For quantitative assessments, refer to the probability values shown for minor failure conditions in figure 2.
mm. Qualitative. Those analytical processes that assess system and airplane safety in an objective non-numerical manner.
nn. Quantitative. Those analytical processes that apply mathematical methods to assess the system and airplane safety.
oo. Redundancy. The presence of more than one independent means for accomplishing a given function. Each means of accomplishing the function need not be identical.
pp. Reliability. The determination that a system, subsystem, unit, or part will perform its intended function for a specified interval under certain operational and environmental conditions.
qq. Remote failure conditions. Those failure conditions that are unlikely to occur to each airplane during its total life but that may occur several times when considering the total operational life of a number of airplanes of this type. For quantitative assessments, refer to the probability values shown for major failure conditions in figure 2.
rr. Secondary system . A redundancy system that provides the same function as the primary system.
ss. Similarity. The process of showing that the equipment type, form, function, design, and installation have only minor differences to previously approved equipment. The safety and operational characteristics and other qualities of the new proposed installation should have no appreciable effects on the airworthiness of the airplane.
tt. Simple hardware item. An item with a comprehensive combination of deterministic tests and analyses appropriate to the design assurance level that ensures correct functional performance under all foreseeable operating conditions, with no anomalous behavior.--Source:
RTCA/DO-254, paragraph 1.6 and Order 8110.105.
uu. Simple system. Usually a system that can be evaluated by only qualitative analysis and it is not complex. Functional performance is determined by combination of tests and analyses.
See the definitions for “conventional” and “complex” systems for more information.
vv. Single failure concept. The objective of this design concept is to permit the airplane to continue safe flight and landing after any single failure. Protection from multiple malfunctions or failures should be provided when the first malfunction or failure would not be detected during normal operations of the airplane, which includes preflight checks, or if the first malfunction or failure would inevitably cause other malfunctions or failures.
ww. System. A combination of components, parts, and elements that are interconnected to perform one or more functions.
xx. Warning. A clear and unambiguous indication to the flight crew or pilot of a failure that requires immediate corrective action. An inherent characteristic of the airplane or a device that will give clearly distinguishable indications of malfunction or misleading information may provide this warning.
9. Application of § 23.1309(a), (a)(1), (a)(2), and (a)(3), as adopted by Amendments 23-41 and 23-49.
If the certification basis for the airplane is Amendment 23-14, § 23.1309(a) (See Note in paragraph 10.) is appropriate to use for systems in airplanes approved to fly either VFR or IFR, or both. With the certification basis at Ame ndment 23-14, systems that must meet the singlefailure concept with the requirements of § 23.1309(a) should comply if the guidance in paragraph 10 of this AC is used. Under the certification basis at Amendment 23-14, compliance with § 23.1309(b) is not required and a safety assessment is not necessary, but it may be used.
For complex systems, the requirements of Amendment 23-14 may not provide an adequate level of safety. Then, the certification basis should be Amendment 23-41 or 23-49 as appropriate. In accordance with AC 21.101-1, in cases where no regulatory standards are defined in the existing certification basis for the design change, but applicable regulatory standards exist in a subsequent amendment to the regulations, the subsequent amendment will be made part of the certification basis. Therefore, the change must comply with later appropriate regulations.
10. Showing compliance with the requirements of § 23.1309 (a) through Amendment 23-
49.
Note: The requirements of paragraphs (a), (a)(1), (a)(2), and (a)(3) of § 23.1309, as amended by Amendments 23-41 and 23-49, are the same requirements as paragraphs (a), (b), and (c) of § 23.1309, as amended by Amendment 23-14. These same requirements in paragraphs (a), (a)(1), (a)(2), and (a)(3) (above) were deleted in § 23.1309 by Amendment 23-62 because there was a significant revision of § 23.1309.
a. In order to show compliance with the requirements of § 23.1309(a), (a)(1), (a)(2), and
(a)(3), it will be necessary to verify that the installed systems and each item of equipment will cause no unacceptable adverse effects and to verify that the airplane is adequately protected against any hazards that could result from probable malfunctions or failures. Analyze, inspect, and test equipment, systems, and installations to ensure compliance with the requirements of § 23.1309(a), (a)(1), (a)(2), and (a)(3).