AC 23.1309-1E

Appendix 2 APPENDIX 2. SAMPLE FUNCTIONAL

HAZARD ASSESSMENT (FHA) FORMAT Function Failure Condition Hazard Description Phase Effect of Failure Condition on Aircraft/Crew Classification Reference to Supporting Material Verification Display of Incorrect attitude All Generally, this condition would be Major AC 23.1311- Qualitative attitude information on one the incorrect attitude with warning 1C analysis.

information display, but not on all on one means of attitude to control displays (not misleading information. For this condition, May require roll and in nature). the crew would realize that this FTA pitch information was incorrect. If there is any chance this would not be clear, the scenario would have to be considered “Misleading attitude information” as described below.

May use PSSA or SSA Display of Misleading attitude All If certified for IFR operation, the Catastrophic AC 23.1311- Quantitative attitude information. crew would unknowingly follow 1C FTA and information incorrect attitude information, and Qualitative to control Note: Failure condition inadvertently exceed attitude limits analysis.

roll and with misleading data which could result in the loss of pitch provided to the autopilot that is handled with the autopilot failure conditions.

control of the aircraft. May use PSSA or SSA Display of Total Loss of oil pressure All Assumes oil temperature is used as Minor AC 23.1311- Design and powerplant display a backup 1C Installation indication Appraisal oil pressure (Next function) (Next failure condition, and so on) *Note: This sample FHA is intended to be a guide for format purposes only to illustrate what items should be considered when performing an FHA. Since other pertinent information regarding the type of airplane and its features is not provided, the technical content may not be appropriate for other airplanes.

A2-2

Appendix 3 APPENDIX 3. CALCULATION

OF THE AVERAGE PROBABILITY PER FLIGHT HOUR

1. The purpose of this material is to provide guidance for calculating the "average probability per flight hour" for a failure condition so that it can be compared with the quantitative requirements of § 23.1309. The process of calculating the "average probability per flight hour" for a failure condition is a four-step process and based on the assumption that the life of an aircraft is a sequence of "average flights."

Step 1: Determination of the "average flight;"

Step 2: Calculation of the probability of a failure condition for a certain "average flight;"

Step 3: Calculation of the "average probability per flight" of a failure condition; and Step 4: Calculation of the "average probability per flight hour" of a failure condition.

a. Determination of the “average flight:” The "average probability per flight hour" is to be based on an "average flight." The applicant should estimate the average flight duration and average flight profile for the fleet of aircraft to be certified. The average flight duration should be estimated based on the applicant’s expectations and historical experience for similar types.

The average flight duration should reflect the applicant’s best estimate of the cumulative flight hours divided by the cumulative aircraft flights for the service life of the aircraft. The average flight profile should be based on the operating weight and performance expectations for the average aircraft when flying a flight of average duration in an ICAO standard atmosphere. The duration of each flight phase (e.g., takeoff, climb, cruise, descent, approach and landing) in the “average flight” should be based on the average flight profile. Average taxi times for departure and arrival at an average airport should be considered where appropriate and added to the average flight time to obtain "average flight--block time." The average flight duration and profile should be used as the basis for determining the "average probability per flight hour" for quantitative safety assessment as means of compliance with this AC.

b. Calculation of the probability of a failure condition for a certain "average flight:"

The probability of a failure condition occurring on an "average flight" should be determined by structured methods (see ARP 4761 for various methods) and should consider all elements (e.g., combinations of failures and events) that contribute to a failure condition. If there is only an effect when failures occur in a certain order, the calculation should account for the conditional probability that the failures occur in the sequence necessary to produce a failure condition. The probabilities of the basic events (component or part level failures) that contribute to the probability of a failure condition should consider the following:

(1) The individual part, component, and assembly failure rates utilized in calculating the "average probability per flight hour" should be estimates of the mature constant failure rates after infant mortality and prior to wear-out. Alternatively, a non-constant failure rate can be used (i.e.

Weibull or other accepted means). Inspection intervals or component life limits employed to protect against wear out are to be placed in chapter 4 or 5 of the maintenance manual. In either case, the failure rate should be based on all causes of failure (operational, environmental, etc.).

Where available, service history of same or similar components in the same or similar environment should be used.

A3-1

11/17/2011 APPENDIX 3 (CONTINUED) AC 23.1309-1E Appendix 3

(2) If the failure is only relevant during certain flight phases, the calculation should be based on the probability of failure during the relevant "at risk" time for the "average flight."

(3) If one or more failed elements in the system can persist for multiple flights (latent, dormant, or hidden failures), the calculation has to consider the relevant exposure times (e.g., time intervals between maintenance checks/ inspections). In such cases, the probability of the failure condition increases with the number of flights during the latency period.

(4) If the failure rate of one element varies during different flight phases, the calculation should consider the failure rate and related time increments in such a manner as to establish the probability of the failure condition occurring on an "average flight." It is assumed that the "average flight" can be divided into n phases (e.g., phase 1, ... , phase n). Let T F the "average flight" duration, Tj the duration of phase j and tj the transition point between Tj and Tj+1, j = 1, ... , n . I.e.

n TF =  Tj and tj - tj-1 = Tj ; j = 1, ... , n j=1 Let j(t) the failure rate function during phase j, i.e. for t  [tj-1,tj].

Remark: j(t) may be equal 0 for all t  [tj-1,tj] for a specific phase j.

Let PFlight (failure) the probability that the element fails during one certain flight (including non-flying time) and PPhase j (failure) the probability that the element fails in phase j.

Two cases are possible:

(i) The element is checked operative at the beginning of a certain flight. Then PFlight (failure)  n PPhase j (failure)  n Pfailure tt ,t j1 j j=1 j1 n  ti  1 exp  i x dx i=1  t i-1 A3-2

11/17/2011 APPENDIX 3 (CONTINUED) AC 23.1309-1E Appendix 3

(ii) The state of the item is unknown at the beginning of a certain flight. Then PFlight (failure) = P prior (failure)    1  Pprior (failure) 1 n exp   ti i x dx   i=1  t i-1 where Pprior (failure) is the probability that the failure of the element has occurred prior to a certain flight.

Note: For the two mathematical operators, ∏ is a product sign and ∈ is element of.

(5) If there is only an effect when failures occur in a certain order, the calculation should account for the conditional probability that the failures occur in the sequence necessary to produce a failure condition.

c. Calculation of the “average probability per flight” of a failure condition: The next step is to calculate the "average probability per flight" for a failure condition, that is, the probability of a failure condition for each flight (which might be different, although all flights are "average flights") during the relevant time (for example, the least common multiple of the exposure times or the aircraft life) have to be calculated, summed up, and divided by the number of flights during that period. The principles of calculating are described below and are in more detail in ARP 4761.

N P failure conditionFlight k k=1PAverage per Flight failure condition N

Note: N is the number of all flights during the relevant time, and PFlight k is the probability that a failure condition occurs in flight k. In the special case of a duplex system (i.e., one component failure latent, the other detected), this method results in an "average probability per flight," which equals the product of both failure rates multiplied by the "average flight" duration TF multiplied by one-half (50 percent) of the relevant exposure time.

d. Calculation of the “average probability per flight hour” of a failure condition: Once the "average probability per flight" is calculated, it should be normalized by dividing it by the "average flight" duration TF in “flight hours” to obtain the "average probability per flight hour."

This quantitative value should be used in conjunction with the hazard category/effect established by the FHA to determine if it is compliant for the failure condition being analyzed.

PAverage per Flight failure condition PAverage per FH failure condition TF A3-3