failure conditions are severe-major for those airplanes not limited to VFR conditions. These systems should be evaluated by performing a design safety assessment.
Design Safety Assessments. The applicant is responsible for identifying and classifying each failure condition and choosing the methods of safety assessment. The applicant should then obtain early concurrence of the cognizant certificating office on the failure conditions, their classifications, and the choice of an acceptable means of compliance. Figure 2 provides an overview of the information flow to conduct a design safety assessment. This figure is a guide and it does not include all information provided in this AC.
(1) A functional hazard assessment (FHA) is a useful preliminary step to identify and classify potentially-hazardous failure conditions, and to describe them in functional and operational terms. An FHA is qualitative and is conducted using service experience, experienced engineering, and operational judgment. All applicable engineering disciplines, such as systems, identification and classification of failure conditions. propulsion, and flight test, should be involved in the An FHA is often used by applicants as a preliminary engineering tool to help determine the acceptability of a design concept, to identify potential problem areas or desirable design changes, or to determine the need for and scope of any additional analyses.
An assessment to identify and classify failure conditions is generally qualitative. On the other hand, an assessment of the probability of a failure condition may be either qualitative or quantitative. An analysis may range from a simple report that interprets test results or compares two similar systems to a detailed analysis that may (or may not) include estimated numerical probabilities. The depth and scope of an analysis depends on the types of functions performed by the system, the severity of system failure conditions, and whether or not the system is complex.
Failure conditions should be classified according to their severities as minor, major, or catastrophic as defined in paragraph The classification of failure conditions does not depend on whether or not a system or function is required by any specific regulation. Some systems required by specific regulations, such as transponders, position lights, and public address systems, 13
AC 23.1309-1B 7/28/95 Conduct functional hazard assessment. Reference paragraphs 6p and 9b.
conditions minor? Are the failure Yes Show that the failure conditions are Reference paragraph 6n. minor and isolated. May be probable.
Reference paragraph 9b(2).
No Yes Is the system compiex? Reference paragraph 6d.
NO Is the system similar to those used in other airplanes in its relevant attributes? Reference paragraphs Yes Justify similarity. Reference paragraphs 6z and 9b(2).
60 & 6z.
No Is the system its relevant attributes? conventional in Yes sometimes quantitative analysis. Show Conduct qualitative analysis and Reference paragraphs to be improbable. Service experience 6c & 6f. may be acceptable. Reference paragraphs 6q, 9b(2), 9b(3), and 9b(4) No Failure condition classification:
Reference paragraphs 6n and 9b(2). Conduct qualitative analysis and quantitative analysis as appropriate.
Major Show to be extremely improbable.
Service experience usually not accept- Catastrophic able. Reference paragraphs 61, 9b(2), 9b (3), and 9b(4).
FIGURE 2 - DESIGN SAFETY ASSESSMENT FLOWCHART 14
may have the potential for only minor failure conditions.
conversely, other systems not required by any specific regulation, such as flight management systems and automatic landing systems, may have the potential for major or catastrophic failure conditions.
(ii) The classification of failure conditions should consider all relevant factors. Examples of factors would include the nature of the failure modes, system degradation, flight crew actions, flight crew workload, performance degradation, reduced operational capability, effects on airframe, etc. It is particularly important to consider factors that would alleviate or intensify the severity of a failure condition. An example of an alleviating factor would be the continued performance of identical or operationally-similar functions by other systems not affected by a failure condition. Examples of intensifying factors would include unrelated conditions that would reduce the ability of the crew to cope with a failure condition, such as weather or other adverse operational or environmental conditions, or failures of other unrelated systems or functions.
(iii) Analysis of Minor Failure Conditions. Minor failure conditions may be probable. An analysis should consider the effects of system failures on other systems or their functions. The analysis is complete if it shows that system failures would cause only minor failure conditions. In general, the system does not perform airworthiness-related functions, and the common design practice provides physical and functional isolation from airworthiness-related components.
(iv) Analysis of Major Failure Conditions. Major failure conditions should be shown to be improbable.
(A) An assessment using experienced engineering and operational judgment is often sufficient. Compliance may also be shown by qualitative analysis. A quantitative analysis is sometimes used to support experienced judgment and to supplement qualitative analysis for the more severe-major failure conditions.
(B) If the installation is not complex but similar in its relevant attributes, a design and installation appraisal with satisfactory service experience will usually be acceptable for showing compliance. If the installation is not complex and similar, but the system is conventional in its relevant attributes, compliance may be shown by a qualitative assessment.
AC 23.1309-1B 7/28/95 An analysis of a redundant system is usually complete if it shows isolation between redundant system channels and satisfactory reliability for each channel. For complex systems, a failure modes and effects analysis or a fault tree analysis is often used to show that isolation actually exists (that is, any single failure would not cause the failure of a function in more than one redundant system channel) and to show that the failure modes of the system do nọt have any adverse effects on safety-related functions performed by other systems.
Catabao: failure co (v) Analysis of Catastrophic Failure Conditions.
Catastrophic failure conditions should be shown to be extremely improbable. A very thorough safety assessment is necessary.
(A) The assessment usually consists of an appropriate combination of qualitative and quantitative analyses.
(B) In limited cases, using experienced engineering and operational judgment could be sufficient for conventional systems that have similar attributes and are not complex when service experience data shows no potentially catastrophic failure.
(C) In general, a failure condition resulting from a single failure mode of a device cannot be accepted as being extremely improbable. In very unusual cases, however, experienced engineering judgment may enable an assessment that such a failure mode is not a practical possibility. The assessment's logic and rationale should be so straightforward and obvious that the failure mode simply would not occur unless it is associated with an unrelated failure condition that would itself be catastrophic.
(3) Methods for qualitatively assessing the causes, severity, and likelihood of potential failure conditions are available to support experienced engineering and operational judgment. Some of these methods are structured. The various types of analysis are based on either inductive or deductive approaches.
Descriptions of typical types of analysis are provided below:
(i) Design Appraisal. A qualitative appraisal of the integrity and safety of the design, such as, the effective use of design techniques that would prevent single failures from adversely affecting redundant systems. An effective appraisal requires experienced judgment.
(ii) Installation Appraisal. A qualitative appraisal of the integrity and safety of the installation. Any deviations from normal, industry-accepted installation practices, such as clearances or tolerances, should be evaluated, especially when appraising modifications made after entry into service.
(iii) Failure Modes and Effects Analysis (FMEA). A structured, inductive, bottom-up analysis, which is used to evaluate the effects on the system and the airplane of each possible element or component failure. when properly formatted, it should aid in identifying latent failures, and the possible causes of each failure mode. For some equipment that has an enormous number of failure modes, a thorough, accurate, and dependable analysis by IMEA may not be feasible.
(iv) Fault Tree Analysis. Structured, deductive, topdown analyses, which are used to identify the conditions, failures, and events that would cause each defined failure condition. They are graphical methods of identifying the logical relationship between each particular failure condition and the primary element or component failures, other events, or combinations thereof that can cause it. An FMEA is usually used as the source document for those primary failures or other events. A fault tree analysis is failureoriented and is conducted from the perspective of which failures would occur to cause a defined failure condition.
(4) A quantitative analysis may be used to support experienced engineering and operational judgment and to supplement qualitative analyses. A quantitative analysis is often used for catastrophic or severe-major failure conditions of systems that are complex, that have insufficient service experience to help substantiate their safety, or that have attributes that differ significantly from those of conventional systems.
(i) Probability Analysis may be a failure modes and effects analysis or fault tree analysis, which also includes numerical probability information. The probabilities of primary failures can be determined from failure rate data and exposure times, using failure rates derived from service experience on identical or similar items, or acceptable industry standaras.
Conventional mathematics of probability can then be used to calculate the estimated probability of each failure condition as a function of the estimated probabilities of its identified contributory failures or other events.
AC 23.1309-1B 7/ 28/95 each failure condition, a margin may be necessary to account for uncertainty. A margin is not normally required for an analysis that is based on proven data or from operational experience and tests.
Where data has limited background for substantiation, a margin may be required depending on the available justification.
(B) Because the improbable range is broad, the applicant should obtain early concurrence of the cognizant certificating office of an acceptable probability for each major provided elsewhere, such as in other AC's, acceptable probabilities failure condition. Unless acceptable probability criteria are for failure conditions should be derived from complete event landing. scenarios leading to an inability for continued safe flight and
10. OPERATIONAL AND MAINTENANCE CONSIDERATIONS. Flight crew and ground crew tasks related to compliance should be appropriate and reasonable. Quantitative assessments of the probabilities of flight crew errors are not considered feasible. Reasonable tasks are those for which full credit can be taken because the flight crew or ground crew can realistically be anticipated to perform them correctly when they are required or scheduled. In addition, based on experienced engineering and operational judgment, the discovery of obvious failures during normal operation and maintenance of the airplane may be considered, even though such failures are not the primary purpose of focus of the operational or maintenance actions.
a. Flight Crew Action. When assessing the ability of the flight crew to cope with a failure condition, the warning information, the crew capability of determining the faults, and the complexity of the required action should be considered.
be evaluated to determine if the required actions can be accomplished in a timely manner without exceptional pilot skills.
If the evaluation indicates that a potential failure condition can be alleviated or overcome during the time available without jeopardizing other safety related flight crew tasks, and without requiring exceptional pilot skill or strength, credit may be taken for correct and appropriate corrective action, for both qualitative and quantitative assessments. Similarly, credit may be taken for 18
correct flight crew performance if overall flight crew workload during the time available is not excessive, and if the tasks do not require exceptional pilot skill, or strength.
Unless flight crew actions are accepted as normal airmanship, the appropriate procedures should be included in the FAA-approved AFM, or AFM revision, or supplement. The AFM should include procedures for operation of complex systems such as integrated flight guidance and control systems. These procedures should include proper pilot response to cockpit warnings, diagnosis of system failures, discussion of possible pilot-induced flight control system problems, and use of the system in a safe manner.
b. Ground Crew Action. Credit may be taken for correct ground crew accomplishments for both qualitative and quantitative assessments. Such requirements should be provided for use in FAA- approved maintenance programs.
11. ELECTROMAGNETIC PROTECTION FOR ELECTRICAL/ELECTRONIC SYSTEMS.
Current trends indicate increasing reliance on electrical/electronic systems for safe operations. For systems that perform flight, propulsion, navigation, and instrumentation functions, electromagnetic effects should be considered.
a. High Intensity Radiated Fields (HIRF). The words "radio frequency energyi in $ 23.1309 (e) are not intended to include HIRF;
therefore, special conditions must be issued until the HIRF requirements in a final rule are incorporated in part 23 of the FAR's. These special conditions are applicable for systems that perform functions whose failure to provide that function correctly could lead to a catastrophic failure condition.
b. Lightning Protection.
requirements for the protection of aircraft electrical/electronic (1) Section 23.1309 (e) contains the regulatory te of traitonde functions systems against the indirect effects of lightning. These requirements are applicable for electrical/electronic functions whose failure conditions are classified as catastrophic, severemajor, or major effect. For guidance, AC 20-136, 'Protection of Aircraft Electrical/Electronic Systems Against the Indirect Effects of Lightning," dated March 5, 1990, and RICA/DO-160C, section 22, "Lightning Induced Transient Susceptibility," Change No. 2, dated June 19, 1992, or subsequent revisions, provide acceptable methods 19
and procedures for determining compliance with the indirect effects of lightning requirements. AC 20-136 provides guidance to verify the protection of systems installed in an aircraft, while section 22 of RTCA/DO-160C provides methods to qualify equipment prior to installation in an aircraft.
(2) Functions performed by systems whose failure conditions are classified as severe-major or major would require protection to the extent that the function should recover in a timely manner after the airplane has been exposed to the lightning.
Testing and analysis are directed toward a component damage, that is, a damage tolerance test. Multiple stroke and multiple burst testing should not be required; therefore, the laboratory test procedures in RICA/DO-160C are acceptable. A specific category or level of testing as defined in RICA/DO-160C is not being given, but a simple analysis method by experienced engineering judgment is normally sufficient to determine the appropriate testing level.
Systems that have been previously approved may be approved by similarity provided there has been no unresolved in-service history of problems relating to lightning strikes to the aircraft. The need for lightning protection for systems on aircraft limited to VFR operations is determined on a case-by-case study.
(3) Functions whose failure conditions are classified as catastrophic would require protection to the extent that the function should not be adversely affected when the airplane is exposed to lightning. These functions should continue to be provided during and after exposure to lightning. If the function is provided by multiple systems, then loss of a system or systems, during exposure of the airplane to lightning, should not result in the loss of the function. After the airplane is exposed to lightning, each affected system that performs these functions should automatically recover normal operation, unless this conflicts with other operational or functional requirements of that system.
Multiple stroke and multiple burst testing and/or analysis usually should not be required for damage assessment, but they can be the primary factor in a system functional upset.
_ Appendix 3 of AC 20-136, #Protection of Aircraft Electrical/Electronic Systems Against the Indirect Effects of Lightning, defines total lightning environment, including the multiple stroke and multiple burst lightning environment to be used for test and analysis purposes in qualifying systems and equipment for lightning protection. AC 20-136 is proposed as a basis to use in demonstrating compliance with the lightning protection 20
requirements except for the multiple burst lightning environment, which has been changed to agree with recommendations from the Society of Automotive Engineers (SAE) AF4L Committee dated July 6, The multiple burst lightning environment that is defined in AC 20-136 has been changed from 24 bursts to 3 bursts and it is mainly used for test and analysis of system functional upset.
SOFTWARE QUALIFICATION FOR AIRBORNE SYSTEM AND APPLICATIONS.
AC 20-115B, "RICA, Inc., Document RICA/DO-178B," dated January 11, 1993, discusses how RICA/DO-178B, #Software Considerations in Airborne Systems and Equipment Certification,i dated December 1, 1992, provides an acceptable means for showing that software complies with pertinent airworthiness requirements. N 8110.53, Transition to RICA/DO-178B, "Software Considerations in Airborne Systems and Equipment Certification, dated September 29, 1994, provides guidelines in applying RICA/DO-178B.
a . Software Assessment. The applicant should perform the safety assessment process to determine the software levels as defined in RTCA/DO-178B. RTCA/DO-178B defines five software levels which are based upon the contribution of software to potential failure conditions as determined by the system safety assessment process. The classification of failure conditions and the software levels are related as shown below:
Failure Conditions Software Levels Catastrophic Severe-Major Major Minor No Effect E Compliance to a software level provides assurance that software errors have been eliminated to a degree of confidence appropriate for the failure condition. It does not imply a numerical probability of errors remaining, nor numerical failure rate for the software.
b. Use of RTCA/DO-178.
RICA/DO-178A as a means of compliance for software modifications on (2) set at on, pa cente may contine to lone on the same aircraft installation. Applicants may continue to use 21
RTCA/DO-178 or RTCA/DO-178A for software modifications to an appliance that will be installed on a different aircraft if the guidelines of RICA/DO-178B, section 12, are satisfied. For software developed prior to the availability of RICA/DO-178B, section 12.1.4 of RTCA/DO-178B provides applicants with a method for upgrading a baseline for software development so that changes can be made in accordance with the criteria contained in RICA/DO-178B.
If software was developed using RTCA/DO-178A procedures, the applicant may need to further evaluate some features of the software. RTCA/DO-178A does not address some applications of digital technology commonly found in airborne systems and applications, for example, user-modifiable software; optionselectable software; software development and verification tools; or In these cases where RICA/DO-178A does not provide adequate procedures, the applicant should include in the software aspects of a certification plan the means for showing that these features comply with pertinent airworthiness requirements. One acceptable means for demonstrating such features comply with the pertinent airworthiness requirements is to comply with pertinent portions of the criteria contained in RICA/DO-178B, which would supplement the basic criteria contained in RICA/DO-178A.
GERALD W. PIERCE Acting Manager, Small Airplane Directorate Aircraft Certification Service 22