Advisory U.S. Department of Transportation circu or Federal Aviation Administration Subject: EQUIPMENT, SYSTEMS, AND INSTALLATIONS IN PART 23 Initiated by: ACE-100 Date: 7/28/95 Change: ACNO: 23. 1309-1B
AIRPLANES information for an acceptable means, but not the only means for 1 o PURPOSE. This advisory circular (AC) provides guidance and showing compliance with the requirements of $ 23.1309 (a) and (b) (amendment 23-41) of the Federal Aviation Regulations (FAR), for equipment, systems, and installations in part 23 airplanes.
material is neither mandatory nor regulatory in nature and does not constitute a regulation.
2. CANCELLATION. AC 23.1309-1A, Equipment, Systems, and Installations in Part 23 Airplanes, dated June 3, 1992, and Change 1 to AC 23.1309-1A, dated August 5, 1992, are canceled.
3. RELATED REGULATIONS AND DOCUMENTS.
a. Regulations. Sections 23.1301 and 23.1309 of part 23 of the Federal Aviation Regulations (FAR) (through amendment 23-41).
b. Advisory Circulars and Notices. The AC's listed below can be obtained from the U.S. Department of Transportation, General Services Section, M-443.2, Washington, D.C. 20590:
AC 21-16C Radio Technical Commission for Aeronautics Document DO-160C AC 20-115B RICA, Inc., Document RICA/DO-178B AC 20-136 Protection of Aircraft Electrical/ Electronic Systems Against the Indirect Effects of Lightning AC 25.1309-1A System Design and Analysis N 8110.53 Transition to RICA/DO-178B, "Software Considerations in Airborne Systems and Equipment Certification" FAA Form 1320-15 (4-82) Supersedes WA Form 1320-2
industry Documents.
(2) The RICA documents listed below are available from the RICA, Inc., D.C. 20036-4001: 1140 Connecticut Avenue, N.W., Suite 1020, Washington, RTCA/DO-160C Environmental Conditions and Test Procedures for Airborne Equipment RTCA/DO-178B Software Considerations in Airborne Systems and Equipment Certification
(2) The SAE documents listed below are available from the Society of Automotive Engineers (SAE), Inc., 400 Commonwealth Drive, Warrendale, PA 15096-0001:
ARP 926A Fault/Failure Analysis Procedure ARP 1834 Fault/Failure Analysis for Digital Systems
d. Related Reading Material. A comprehensive discussion on lighting protection, with additional nonregulatory guidance information, is available in the current edition of FAA Report DOT/FAA/CT-89/22, "Aircraft Lightning Protection Handbook," dated September 1989. This document is available to the public by ordering it through the National Technical Information Service, U.S.
Department of Commerce, 5285 Port Royal Road, Springfield, Virginia 22161.
APPLICABILITY.
a . This AC is generally applicable only to the original applicant seeking issuance of type certificate (IC), amended type certificate (ATC), and supplemental type certificate (STC) for the initial approval of the new type design or a change in the type design. This document addresses general applicability, and it should not be utilized to replace any specific guidance intended for individual types of equipment, systems, and installations. Because § 23.1309 is a regulation of general requirements, it should not be used to supersede any specific requirements of part 23.
b. Section 23.1309 does not apply to the performance, flight characteristics, and structural loads and strength requirements of subparts B and C; but it does apply to any system on which compliance with the requirements of subparts B and C is based. For example, it does not apply to an airplane's inherent stall characteristics or their evaluation of § 23.201, but it does apply to a stick pusher (stall barrier) system used to enable compliance with § 23.201.
c. Section 23.1309 is applicable to the installation of all airplane systems and equipment including pneumatic systems, fluid systems, electrical/electronic systems, mechanical systems, and powerplant systems included in the airplane design except for the following:
(1) Systems approved as part of a type-certificated engine or propeller and whose malfunction or failure could have no adverse effect on other airplane systems or equipment.
(2) The flight structure (such as wings, fuselage, empennage, control surfaces, mechanical flight control cables, pushrods, control horns, engine mounts, and structural elements of the landing gear) whose requirements are specified in subparts C and D of part 23.
5. BACKGROUND.
a. Prior to amendment 23-14 to part 23 of the FAR (effective December 20, 1973), neither part 3 of the Civil Air Regulations (CAR) nor part 23 of the FAR contained safety requirements ror equipment, systems, and installations for small airplanes. In 1968, the Federal Aviation Administration (FAA) instituted an extensive review of the airworthiness standards of part 23. Because of the increased use in all weather operations and the increased reliance on systems and equipment in part 23 airplanes, the FAA promulgated § 23.1309 to provide for an acceptable level of reliability for such equipment, systems, and installations in the interest of safety.
When § 23.1309 (amendment 23-14) was adopted, it was not envisioned that systems, which perform critical functions, would be installed in small airplanes; therefore, prior to amendment 23-14, this section did not contain adequate safety standards for evaluating critical functions. When such equipment, systems, and installations 3
AC 23.1309-1B 7/28/95 were included in the airplane design, they were evaluated under special conditions in accordance with the procedures of part 21 of the FAR.
b. With the adoption of amendment 23-34 (effective February 17, 1987), § 23.1309 was expanded to include certification of commuter category airplanes. This expansion added a requirement to ensure that applicable systems and installations are designed to safeguard against hazards and also added requirements for equipment identified as essential loads and affected power sources.
With the adoption of amendment 23-41 (effective November 26, 1990), § 23.1309 retained the existing reliability requirements adopted by amendment 23-14 for airplane equipment, systems, and installations that are not complex and do not perform critical functions. For those cases where the applicant finds it necessary or desirable to include complex systems and/or systems that perform critical functions, amendment 23-41, § 23.1309, provided additional requirements for identifying such equipment, systems, and installations and provided additional requirements needed for their certification. This amendment permitted the approval of more advanced systems having the capability to perform critical functions.
d. Qualitative and quantitative analyses are often used in assessing the acceptability of complex designs that have a high degree of integration, that use new technology or new or different applications of conventional technology, or that perform critical functions. These assessments led to the selective use of quantitative analyses to support experienced engineering and operational judgment and to supplement qualitative analyses and tests. Numerical probability ranges, associated with the terms used in § 23.1309 (b), are accepted for evaluating the quantitative analyses that have a logical and acceptable inverse relationship between the probability and severity of each failure condition.
6. DEFINITIONS.
a. Adverse Effects. A response of a system that results in an undesirable operation of an aircraft system or subsystem.
b. Adverse Operating Conditions. A set of circumstances in which a failure or other emergency situation results in a significant increase in flight crew workload.
Co Attribute. A feature, characteristic, or aspect of a system or a device, or a condition affecting its operation. Some examples would include design, construction, technology, installation, functions, applications, operational uses, environmental and operational stresses, and relationships with other systems, functions, and flight or structural characteristics.
Complex. A system is considered to be complex if it is characterized by a very complicated or involved arrangement of parts, units, etc., and a very methodical and organized method of analysis is needed for a valid safety assessment. Failure modes and effects and fault tree analyses are examples of such methods.
e. Continued Safe Flight and Landing. This phrase means that the airplane is capable of continued controlled flight and landing, possibly using emergency procedures but without requiring exceptional pilot skill or strength. Some airplane damage may occur as a result of the failure condition or upon landing.
f. Conventional. An attribute of a system is considered to be conventional if it is the same as, or closely similar to, that of previously-approved systems that are commonly used. The systems have established adequate service history and the means of compliance for approval are generally accepted.
g. Critical Function. A function whose failures would prevent the continued safe flight and landing of the airplane. See note under definition of failure condition.
h. Equipment Essential to Safe Operation. Equipment installed in order to comply with the applicable certification requirements of part 23 or operational requirements of parts 91 and 135.
i. Equipment Not Essential to Safe Operation. Equipment whose failure or malfunction would not have any appreciable impact on the safe operation of the airplane. The following are typical of this equipment:
(1) Galley and entertainment equipment.
(2) Non-required heating and cooling equipment.
(3) Non-required equipment installed for completion of a specific mission, such as photography, medical evacuation, etc.
AC 23.1309-1B 7/28/95
(4) Any other equipment whose functions have not been approved for fulfilling any airplane certification or operational requirements.
j. Essential Function. Function whose failure would reduce the capability of the airplane or the ability of the crew to cope with adverse operating conditions. See note under definition of failure condition.
k. Essential Load. Equipment essential to safe operation that requires a power source for normal operation.
1. Extremely Improbable. For qualitative assessments, this term describes failures or malfunctions that are so unlikely that they are not anticipated to occur during the entire operational life of all airplanes of one type. For quantitative assessments, this term describes failures or malfunctions having a probability of occurrence on the order of 1 x 10-9 or less.
m. Failure. A loss of function or a malfunction of a system.
n. Failure Condition. The effects on the airplane and its occupants, both direct and consequential, caused or contributed to by one or more failures, considering relevant adverse operational or environmental conditions. Failure conditions may be classified according to their severities as follows:
(1) Minor. Failure conditions which would not significantly reduce airplane safety, and which involve flight crew actions that are well within their capabilities. Minor failure conditions may include, for example, a slight reduction in safety margins or functional capabilities, a slight increase in flight crew workload, such as routine flight plan changes, or some inconvenience to occupants.
(2) Major. Failure conditions which would reduce the capability of the airplane or the ability of the flight crew to cope with adverse operating conditions to the extent that there would be, for example:
(i) Major. A significant reduction in safety margins or functional capabilities, a significant increase in flight crew workload or in conditions impairing flight crew efficiency, or some discomfort to occupants; or 6
Severe-Major. In more severe cases, a large reduction in safety margins or functional capabilities, higher workload or physical distress such that the flight crew could not be relied on to perform its tasks accurately or completely, or adverse effects on occupants.
(3) Catastrophic. Failure conditions which would prevent continued safe flight and landing.
NOTE: For information, these terms may have the following relationships to the terms used in other documents that classify failure conditions: failure conditions adversely affecting nonessential functions could be minor; failure conditions adversely affecting essential functions could be major; and failure conditions adversely affecting critical functions could be catastrophic.
o. Hazard. Any condition which compromises the overall safety of the airplane or which significantly reduces the ability of the flight crew to cope with adverse operating conditions.
Hazard Assessment. The logical systematic examination of a system to identify and classify potentially hazardous failure conditions and to describe them in functional and operational terms.
q. Improbable. For qualitative assessments, this term describes failures or malfunctions that are not anticipated to occur during the entire operational life of a single random airplane of one type. However, they may occur occasionally during the entire operational life of all airplanes. For quantitatıve assessments, his term is descriptive of a probability on the order of 1 x 10-!
or less, but greater than a probability on the order of 1 x 10-9.
r. Malfunction. Failure of a system, subsystem, unit, or part to operate in the normal or usual manner.
s. Minimize. To reduce, lessen, or diminish a hazard to the least practical amount with current technology and materials. The least practical amount is that point at which the effort to further reduce a hazard significantly exceeds any benefit, in terms of safety, derived from that reduction. Additional efforts would not result in any significant improvements of reliability.
t. Power Source. A system that provides power to installed equipment. This system would normally include prime mover (s), 7
AC 23.1309-1B 7/28/95 required power converter (s), energy storage device(s), and required control and interconnection means.
malfunction or failure is any single malfunction or failure which is u. Probable. For qualitative assessments, a probable expected to occur one or more times during the entire operational life of any single airplane of a specific type. This may be determined on the basis of past service experience with similar components in comparable airplane applications. For quantitative greater than 1 × 10-5. assessments, this term describes a probability on the order of and airplane safety in a subjective, non-numerical manner. qualitative. Those analytical processes that assess system
w. Quantitative. Those analytical processes that apply mathematical methods to assess system and airplane safety.
x. Redundancy. The existence of more than one independent means for accomplishing a given function. Each means of accomplishing the function need not necessarily be identical.
y. Reliability. The determination that a system, subsystem, unit, or part will perform its intended function for a specified interval under stated operational and environmental conditions.
Similarity. The process of claiming that the equipment type, form, function, design, and installation are nearly identical to already approved equipment. characteristics and other qualities should have no appreciable The reliability and operational affects on the airworthiness of the installation.
APPLICATION OF $ 23.1309 AS ADOPTED BY AMENDMENT 23-14.
41, are derived from paragraphs (a), (b), and (c) of § 23.1309, as on service-proven designs and engineering judgment. Paragraphs (a), are based on single-fault or fail-safe concepts and experience based amendment 23-41 were originally adopted by amendment 23-14, and they (a) (1), (a) (2), and (a) (3) of $ 23.1309, as amended by amendment 23- a. The airworthiness standards in § 23.1309 (a) as amended by amended by amendment 23-14. The requirements in § 23.1309 (a) are generally used for equipment systems and installation that are not complex and/or whose failure conditions are not classified as systems used for airplanes approved to fly VER and/or IFR, and for catastrophic or severe-major. Section 23.1309(a) is appropriate for 8
systems where analysis by single-fault or fail-safe concepts and experience based on service-proven designs and engineering judgments. A design safety assessment is not necessary, but it may be used.
In order to show compliance with the requirements of § 23.1309 (a) (améndment 23-41), it will be necessary to verify that the installed systems and equipment will cause no unacceptable.
adverse effects and also verify that the airplane is adequately protected against any hazards that could result from probable malfunctions or failures. A probable malfunction or failure is any single malfunction or failure that is considered probable on the basis of past service experience and/or analysis with similar components in comparable airpiane applications. Multiple malfunctions or failures should be considered probable when the first malfunction or failure would not be detected during normal operation of the system, including preflight checks, or if the first malfunction or failure would inevitably lead to other malfunctions or failures. Equipment, systems, and installations should be analyzed, inspected, and tested to ensure compliance with the requirements of § 23.1309. A step-by-step diagram to comply with § 23.1309(a) is shown in figure 1 and these steps are listed below:
(1) Evaluate all airplane systems and equipment in order to determine whether they are:
(i) Essential to safe operation; or
(ii) Not essential to safe operation.
(2) Determine that operation of installed equipment has no unacceptable adverse effects. This can be verified by applicable flight or ground checks as follows:
(i) If it can be determined that the operation of the installed equipment will not adversely affect equipment essential to safe operation, the requirements of § 23.1309(a) (1) (i) have been satisfied
(ii) If it is determined that the operation of the installed equipment has an adverse effect on equipment not essential to safe operation and a means exists to inform the pilot of the effect, the requirements of § 23.1309 (a) (1) (ii) have been met. An acceptable means to inform the pilot would include any visual or
Start Assessment Corrective Measures Will Operation of this Equipment have Yes Adverse Effect on Equipment Essential to Safe Unacceptable Operation?
NO Effect on Other Any Adverse Yes Is there a Means No Equipment? to Inform the Pilot of Effect?
No Yes Meets Requirements of §23.1309a(1) Will Any Probable Failure or No Malfunction Result in a Hazard?
Yes Corrective Measures Multi- Unacceptable Engine Single or Multi-engine?
Single Engine Meets No Has Hazard Yes Requirements Been Minimized? of §23.1309(a)
(2) & (3) FIGURE 1 - METHOD TO COMPLIANCE DIAGRAM OF §23.1309(a)
aural method (flags, lights, horns, loss of display, etc.) that will indicate to the pilot that the affected system is not performing properly.
(3) Determine that failure or malfunction of the installed equipment could not result in unacceptable hazards.
(i) All equipment should be evaluated for general those hazards that would directly compromise the safety of the installation hazards. hazardits occupants e su These types of hazards would normally include airplane or its occupants, such as fire, smoke, explosion, toxic gases, depressurization, etc. A hazard could also result from loss of essential equipment or systems when minimum required functions are lost. Individual failure of redundant equipment would not necessarily be considered a hazard. For example, the single failure of either communication transceiver or a navigation receiver (but not both) during IFR operation is not considered a hazard; however, a single failure of a common power supply to those systems would be considered a hazard.
Systems and equipment essential to safe operation should also be assessed for probability of malfunction or failure if loss of required functions could result in a hazard. Where the installation is conventional and where there is a high degree of similarity in installations and a significant amount of service history is available for review, this determination can be an engineering judgment. If the installation is not similar in its in paragraph 9o Setail by a relevant attributes, it should be evaluated in more detail by a qualitative assessment as described in paragraph 9b(3).
(iii) Hazards that have been identified and found to result from probable failures are not acceptable in multiengine airplanes. In these situations, some design changes may be required to remove the hazard or reduce the probability of failure, such as increasing redundancy, substitution of more reliable equipment, annunciation, etc.
(iV) If it has been determined that a probable failure or malfunction could result in a hazard to a single engine airplane, that hazard should be minimized. To sufficiently minimize a hazard, all appropriate means to reduce the hazard should be exhausted with current technology and materials. The means to minimize the hazard should provide the level of safety intended by the applicable airworthiness requirements of the certification basis.
AC 23.1309-1B 7/28/95 Safety, similarity, conventionality, technical feasibility, and benefits should be taken into account. These efforts may become impractical; that is, additional effort may not result in any significant improvement of reliability. This determination should be an experienced engineering judgment, based on the criticality of the hazard and the intended kinds of operation.
8. APPLICATION OF $ 23.1309 (d) AS ADOPTED BY AMENDMENT 23-34.
The commuter category requirements of ≤ 23.1309 (d) as adopted by amendment 23-34 for commuter airplanes were inadvertently not incorporated in $ 23.1309 as adopted by amendment 23-41.
However, these requirements are still applicable for those commuter airplanes that include the certification basis of amendment 23-34 (which requires all applicable systems and installations to be of their failure). designed to safeguard against hazards to the airplane in the event
b. Design features should be taken into account to safeguard against hazards by ensuring the failure condition will not occur or by having redundancy or annunciation with the associated flight crew corrective action. The reliability is such that independent failures of the redundant systems are not likely to occur during the same flight. If a redundant system is required, a probable failure in one system should not adversely affect the other system operation. No probable failure in a system should result in a safe indication of an unsafe condition of flight so the system would be used or inadvertently put into operation. When the unsafe condition is annunciated or detected, the Airplane Flight Manual (AFM) should have clear and precise corrective procedures for handling the failure without an excessive increase in workload.
c. Service history for similar installation may be utilized to meet part or all of this requirement if a system or installation has been previously approved and has significant and favorable service history in similar aircraft environments. The claim of similarity should be based on equipment type, function, design, and installation similarities and other relevant attributes.
9. APPLICATION OF § 23.1309 (b) AS ADOPTED BY AMENDMENT 23-41.
installation that are complex and/or whose failure conditions are a. Application of § 23.1309 (b) is for equipment, systems, and catastrophic for all types of airplanes and, generally, whose 12