13 product without a commensurate benefit. This determination should come from an experienced engineering judgment based on the criticality of the hazard and the intended kinds of operation.
8. APPLICATION OF § 23.1309(a)(4), AS ADOPTED BY AMENDMENT 23-49.
a. For those commuter airplanes that include the certification basis of Amendments 23-34, 23-41, or 23-49, § 23.1309(a)(4) requires all applicable systems and installations to be designed to safeguard against hazards to the airplane in the event of their failure.
b. Design features should be taken into account to safeguard against hazards either by ensuring that the Failure Condition will not occur or by having redundancy or annunciation with the associated flight crew’s corrective action. The reliability should be such that independent failures of the redundant systems are not probable during the same flight. If a redundant system is required, a probable failure in one system should not adversely affect the other system’s operation. No probable failure should result in a safe indication of an unsafe condition so that the system would be used. When the unsafe condition is annunciated or detected, the Airplane Flight Manual (AFM) should have clear and precise corrective procedures for handling the failure without an excessive increase in workload.
c. Service history for similar installations may be utilized to meet part or all of this requirement if a system or installation has significant and favorable service history in environments similar to the airplane. The claim of similarity should be based on equipment type, function, design and installation similarities, and other relevant attributes.
9. APPLICATION OF § 23.1309(b), AS ADOPTED BY AMENDMENTS 23-41 AND
23-49.
a. If the certification basis is Amendment 23-41 or later, the requirements of § 23.1309(b) are applicable. The installed systems should be evaluated by performing a safety assessment. The depth and scope of the safety assessment depends on the types of functions performed by the systems, the severity of the Failure Conditions, and whether the system is complex. For instance, the safety assessment for a slightly modified single-engine airplane with simple systems might consist only of an FHA with a design and installation appraisal. This FHA will be much less extensive than the FHA for a commuter category or a multiple turbine-engine airplane with more complex systems. The types of analyses selected by an applicant and approved by the certification authority should be based on factors such as the system architecture, complexity, particular design, etc. This is described in more detail in Item 9.d.
14 FIGURE 1. METHOD TO COMPLIANCE DIAGRAM OF § 23.1309(a) Start Assessment Corrective Measures Will Operation of this Equipment have Adverse Effect on Equipment Essential to Safe Operation?
Unacceptable Is there a Means to Inform the Pilot of Effect?
Meets Requirements of § 23.1309a(1) Yes No No Yes Will Any Probable Failure or Malfunction Result in a Hazard?
No Any Adverse Effect On Other Equipment?
Yes Corrective Measures Unacceptable Yes Single or Multiengine?
Multiengine Single Engine Has Hazard Been Minimized?
Meets Requirements of § 23.1309(a)
(2) & (3) Yes No No Yes
b. The safety objective is to ensure an acceptable safety level for equipment and systems installed on the airplane. A logical and acceptable inverse relationship should exist between the Average Probability Per Flight Hour and the severity of Failure Conditions effects (as shown in Figure 2). This figure defines the appropriate airplane systems probability standards for four certification classes of airplanes designed to 14 CFR Part 23 standards. The relationship between probability and severity of Failure Condition Effects is as follows:
• Failure Conditions with No Safety Effect have no probability requirement.
• Minor Failure Conditions may be Probable.
• Major Failure Conditions must be no more frequent than Remote.
• Hazardous Failure Conditions must be no more frequent than Extremely Remote.
• Catastrophic Failure Conditions must be Extremely Improbable.
(1) The four certification classes of airplanes in Figure 2 are as follows: Class I (Typically SRE under 6,000 pounds (#)), Class II (Typically MRE and STE under 6,000 pounds), Class III (Typically SRE, STE, MRE, and MTE equal or over 6,000 pounds), and Class IV (Typically Commuter Category). The acronyms for these airplanes in the four classes of Part 23 airplanes are Single Reciprocating Engine (SRE), Multiple Reciprocating Engine (MRE), Single Turbine Engine (STE), and Multiple Turbine Engine (MTE).
(2) Numerical values are assigned for use in those cases where the impact of system failures is examined by quantitative methods of analysis. Also, the related new Software Development Assurance Levels for the various Failure Conditions are part of the matrix. The new probability standards are based on historical accident data, systems analyses, and engineering judgment for each class of airplane. For software, the requirements for complying with each Software Development Assurance Level are specified in RTCA DO-178B.
(3) In assessing the acceptability of a design, the FAA recognized the need to establish rational probability values. Historically, failures in GA airplanes that might result in Catastrophic Failure Conditions are predominately associated with the primary flight instruments in Instrument Meteorological Conditions (IMC). Historical evidence indicates that the probability of a fatal accident in restricted visibility due to operational and airframe-related causes is approximately one per ten thousand hours of flight for single-engine airplanes under 6,000 pounds. Furthermore, from accident data bases, it appears that about 10 percent of the total were attributed to Failure Conditions caused by the airplane's systems. It is reasonable to expect that the probability of a fatal accident from all such Failure Conditions would not be greater than one per one hundred thousand flight hours or 1 x 10-5 per flight hour for a newly designed airplane. It is also assumed, arbitrarily, that there are about ten potential Failure Conditions in an airplane that could be catastrophic. The allowable target Average Probability Per Flight Hour of 1 x 10-5 was thus apportioned equally among these Failure Conditions, which resulted in an allocation of not greater than 1 x 10-6 to each. The upper limit for the Average Probability per Flight Hour for Catastrophic Failure Conditions would be 1 x 10-6, which establishes an approximate probability value for the term "Extremely Improbable." Failure
16 FIGURE 2. RELATIONSHIP AMONG AIRPLANE CLASSES, PROBABILITIES,
SEVERITY OF FAILURE CONDITIONS, AND SOFTWARE DEVELOPMENT
ASSURANCE LEVELS Classification of Failure Conditions No Safety Effect <----Minor-----> <----Major----> <--Hazardous---> < Catastrophic> Effect on Airplane No effect on operational capabilities or safety Slight reduction in functional capabilities or safety margins Significant reduction in functional capabilities or safety margins Large reduction in functional capabilities or safety margins Normally with hull loss Effect on Occupants Inconvenience for passengers Physical discomfort for passengers Physical distress to passengers, possibly including injuries Serious or fatal injury to an occupant Multiple fatalities Effect on Flight Crew No effect on flight crew Slight increase in workload or use of emergency procedures Physical discomfort or a significant increase in workload Physical distress or excessive workload impairs ability to perform tasks Fatal Injury or incapacitation Classes of Airplanes:
Allowable Quantitative Probabilities and Software (SW) Development Assurance Levels (Note 2) Class I (Typically SRE under 6,000#) No Probability or SW Development Assurance Levels Requirement <10-3 Note 1 P=D <10-4 Notes 1 & 5 P=C, S=D P=D, S=D(Note 6) <10-5 Notes 4 & 5 P=C, S=D P=D, S=D(Note 6) <10-6 Note 3 P=C, S=C Class II (Typically MRE or STE under 6000#) No Probability or SW Development Assurance Levels Requirement <10-3 Note 1 P=D <10-5 Notes 1 & 5 P=C, S=D P=D, S=D(Note 6) <10-6 Notes 4 & 5 P=C, S=C P=D, S=D(Note 6) <10-7 Note 3 P=C, S=C Class III (Typically SRE,
STE, MRE, & MTE equal or over 6000#) No Probability or SW Development Assurance Levels Requirement <10-3 Note 1 P=D <10-5 Notes 1 & 5 P=C, S=D <10-7 Notes 4 & 5 P=C, S=C <10-8 Note 3 P=B, S=C Class IV (Typically Commuter Category) No Probability or SW Development Assurance Levels Requirement <10-3 Note 1 P=D <10-5 Notes 1 & 5 P=C, S=D <10-7 Notes 4 & 5 P=B, S=C <10-9 Note 3 P=A, S=B Note 1: A numerical probability range is provided here as a reference. The applicant is usually not required to perform a quantitative analysis for Minor and Major Failure Conditions. See Figure 3.
Note 2: The alphabets denote the typical Software (SW) Development Assurance Levels as described in ARP 4754 for Primary System (P) and Secondary System (S). For example, SW Development Assurance Level A on Primary System is noted by P=A.
Note 3: At airplane function level, no single failure will result in a Catastrophic Failure Condition.
Note 4: At airplane function level, no single failure will result in the loss of a function that causes a Hazardous Failure Condition.
Note 5: Secondary System (S) may not be required to meet probability goals. If installed, S must meet stated criteria.
Note 6: A reduction of Software Development Assurance Levels applies only for Navigation, Communication, and Surveillance Systems if an altitude encoding altimeter transponder is installed. This option does not apply to CAT II/III operations.
17 Conditions having less severe effects could be relatively more likely to occur. Similarly, airplanes over 6,000 pounds have a lower fatal accident rate; therefore, they have a lower probability value for Catastrophic Failure Conditions.
c. Acceptable criteria for Software Development Assurance Levels of Part 23 airplanes are shown in Figure 2. Note 6 allows an additional reduction of Software Development Assurance Levels for Navigation, Communication, and Surveillance Systems if an altitude encoding altimeter transponder is installed. This option does not apply to CAT II/III operations. Software Development Assurance Levels in Figure 2, under Note 6, have been determined if an altitude encoding altimeter transponder is installed so that failure of navigation and communication systems used for IFR operations do not affect other airplanes. If the transponder is based on software, the software should be developed to at least Level C. If this option is used, the AFM must include a limitation such as, “A transponder with a valid altitude reporting mode must be operating for IFR operations unless otherwise instructed by ATC.” Proper separation is provided by the Air Traffic Control (ATC) surveillance system and Traffic Collision Avoidance System (TCAS) equipped airplanes in IFR operations in the NAS or other equivalent airspace systems.
(1) The criteria shown in Figure 2 directly reflect the historical accident and equipment probability of failure data in the Civil Air Regulations (CAR) 3 and 14 CFR Part 23 airplane fleet.
Characteristics of the airplane, such as stall speed, handling characteristics, cruise altitude, ease of recognizing system failures, recognition of entry into stall, pilot workload, and other factors (which include pilot training and experience) affect the ability of the pilot to safely handle various types of system failures in small airplanes. The criteria considered over all airplanes’ Failure Conditions is based on service experience, operational exposure rates, and total airplane system reliability. The values for individual system probability of failure could be higher than probability values shown in Figure 2 for specific Failure Conditions since it considers the installed airplane systems, events, and factors.
(2) These classes were defined based on the way accident and safety statistics are currently collected. Generally, the classes deal with airplanes of historically equivalent levels of system complexity, type of use, system reliability, and historical divisions of airplanes according to these characteristics. However, these classes could change because of new technologies and the placement of a specific airplane in a class must be done in reference to all the airplane’s missions and performance characteristics. The applicant should have the cognizant certification authority concurrence on the applicable airplane class early in the program. When unusual situations develop, consult the Small Airplane Directorate to obtain specific policy guidance or approval.
(3) For example, turbine-engine airplanes traditionally have been subject to more stringent requirements than a single-engine turbine airplane, with the fuel consumption of a reciprocating engine, which permits a wider stall-cruise speed ratio than traditional turbine-engine airplanes.
Such an airplane with a stall speed under 61 knots with simple systems, and with otherwise similar characteristics to a traditional single-engine reciprocating airplane (except for a higher cruise speed and a more reliable engine that is simpler to operate), can be treated as a Class I airplane under this analysis. Conversely, if a single-engine reciprocating airplane has the performance, mission capability, and system complexity of a higher class (such as cabin pressurization, high cruise
18 altitude, and extended range), then that type of airplane design may align itself with the safety requirements of a higher class (for example, Class II airplane). These determinations should be made during the development of the certification basis.
(4) This AC uses terminology similar to AC 25.1309-1A. However, the specific means of compliance for § 25.1309 of Part 25 are defined differently due to the higher level of safety required for transport category airplanes.
d. Safety Assessments: The applicant is responsible for identifying and classifying each Failure Condition and for choosing the methods for safety assessment. The applicant should then obtain early concurrence of the cognizant certificating authority on the identification of Failure Conditions, their classifications, and the choice of an acceptable means of compliance. Figure 3 provides an overview of the information flow to conduct a safety assessment. This figure is a guide and it does not include all information provided in this AC or the documents referenced in Item 3 of this AC.
(1) Functional Hazard Assessment (FHA).
(i) Before an applicant proceeds with a detailed safety assessment, an FHA of the airplane and system functions to determine the need for and the scope of subsequent analysis should be prepared. This assessment may be conducted using service experience, engineering and operational judgment, or service experience and a top-down deductive qualitative examination of each function. An FHA is a systematic, comprehensive examination of airplane and system functions to identify potential No Safety Effect, Minor, Major, Hazardous, and Catastrophic Failure Conditions that may arise, not only as a result of malfunctions or failure to function but also as a result of normal responses to unusual or abnormal external factors. The FHA concerns the operational vulnerabilities of systems rather than a detailed analysis of the actual implementation.
(ii) Each system function should be examined regarding the other functions performed by the system because the loss or malfunction of all functions performed by the system may result in a more severe failure condition than the loss of a single function. In addition, each system function should be examined regarding functions performed by other airplane systems because the loss or malfunction of different but related functions, provided by separate systems, may affect the severity of Failure Conditions postulated for a particular system.
(iii) The FHA is an engineering tool that should be performed early in the design and updated as necessary. It is used to define the high-level airplane or system safety objectives that must be considered in the proposed system architectures. Also, it should be used to assist in determining the development assurance levels for the systems. Many systems may need only a simple review of the system design by the applicant to determine the hazard classification. An FHA requires experienced engineering judgment and early coordination between the applicant and the certification authority.
FIGURE 3. DEPTH OF ANALYSIS FLOW CHART Conduct Functional • Note: FHA may be based on Hazard Assessment : a design and installation (9d(1)) appraisal for these, systems.
NO there a safety effect?
YES Is the YES Verify by design Failure Condition and installation Minor? appraisal (9d(4)) NO Is the YES system and Verify similarity installation similar to a (9d(4) or 9d(5)) previous design?
NO Is the Is the Failure Condition YES system YES Major? simple?
Is the YES Conduct qualitative system assessment redundant? (9d(4)) NO Conduct qualitative and quantitative assessments (9d(4)) Is the YES Conduct qualitative system simple and assessments conventional? (9d(5)) NO Conduct qualitative and quantitative assessments (9d(5)) 19
(iv) Depending on the extent of functions to be examined and the relationship between functions and systems, different approaches to FHA may be taken. Where there is a clear correlation between functions and systems, and where system, and hence function, interrelationships are relatively simple, it may be feasible to conduct separate FHA’s for each system providing any interface aspects are properly considered and are easily understood.
However, a top down approach, from an airplane level perspective, should be taken in planning and conducting FHA where system and function interrelationships are more complex.
(v) After each Failure Condition is classified, refer to Figure 2 to identify the Failure Condition probability and Software Development Assurance Levels. For example, the probability requirement for a Hazardous Failure Condition for a Class I airplane should be less than 1 x 10-5. In addition, the Primary System should have a Software Development Assurance Level of C and, if required, the Secondary System should have a Software Development Assurance Level of D. However, if the airplane is equipped with an altitude encoding altimeter transponder for navigation, communication, and surveillance systems, the Primary System should have a Software Development Assurance Level of D and, if required, the Secondary System should have a Software Development Assurance Level of D.
(vi) The classification of Failure Conditions does not depend on whether a system or function is required by any specific regulation. Some systems required by specific regulations, such as transponders, position lights, and public address systems, may have the potential for only Minor Failure Conditions. Conversely, other systems not required by any specific regulation, such as flight management systems and automatic landing systems, may have the potential for Major, Hazardous, or Catastrophic Failure Conditions.
(vii) The classification of Failure Conditions should consider all relevant factors.
Examples of factors include the nature of the failure modes, which includes common mode faults, system degradation resulting from failures, flight crew actions, flight crew workload, performance degradation, reduced operational capability, effects on airframe, etc. It is particularly important to consider factors that would alleviate or intensify the severity of a Failure Condition. An example of an alleviating factor would be the continued performance of identical or operationally similar functions by other systems not affected by a Failure Condition. Examples of intensifying factors would include unrelated conditions that would reduce the ability of the crew to cope with a Failure Condition, such as weather or other adverse operational or environmental conditions. The ability of a system to inform the pilot of potential or real Failure Conditions so that timely corrective action can be taken to reduce the effects of the combination of events is desirable. This approach may reduce the severity of the Failure Condition.
(A) Because of the large number of combinations of failures, various mitigating factors, airplane characteristic effects, and similar factors, a specific FHA and the related safety assessments may be significantly different for each airplane type and configuration evaluated.
These factors preclude providing a concrete example of an FHA that applies across the board to every installation. However, general examples may be provided that illustrate the concepts involved in an FHA. It is critical to understand that significant engineering judgment and common sense are necessary to provide a practical and acceptable evaluation of the airplane and its systems.
Appendix A provides a table that illustrates the criteria that may be applied to a system FHA
21 derived from the results of an aircraft FHA. Appendix A functional allocation examples CANNOT be applied indiscriminately to a particular airplane installation.
(B) Appendix A provides a partial FHA for Part 23 IFR Class I airplanes with typical functions and, in general, the related Failure Conditions. This table is provided primarily for use to reduce the regulatory burden on applicants who are not familiar with the various methods and procedures generally used in industry to conduct safety assessments. It is intended to be a guide and not a certification checklist, since it does not include all the information necessary for an FHA for a specific airplane with its various functions and its intended use. The functions are listed in the partial FHA as a guide for the classification of failure conditions when the functions are installed. The list of functions is not intended to suggest that the functions are required for the Class I airplanes. Even if there is guidance information in Appendix A, the applicable regulations provide the requirements of the functions for installations.
(1) The applicant should use Appendix A and certification authority as a point of departure for the assessment of the specific system or airplane in question. It can be used to arrive at the appropriate Failure Conditions for this specific system by similarity to or by interpolating between the example systems. It does not, by itself, necessarily provide an answer for an applicant’s system unless that system is exactly as described. Its sole purpose is to assist applicants by illustrating typical functions and the related Failure Conditions. This appendix addresses general applicability, which is a value for determining Software Development Assurance Levels, and it should not be utilized to replace any specific guidance intended for individual types of equipment, systems, and installations. The FHA results are airplane characteristic and system architecture dependent. The examples in this appendix are based on the traditional airplane and traditional architectures. Because § 23.1309 is a regulation of general requirements, it should not be used to supersede any specific requirements of Part 23.
(2) In addition to the general technical guidance provided in Appendix A, Appendix B provides a sample of one suggested format for documenting the results of an FHA.
This format illustrates how factors other than those directly illustrated in Appendix A are pertinent.
It also illustrates that Failure Conditions are not limited to only the three general types shown in Appendix A. The actual data shown in Appendix B is only used to illustrate the typical approach and should not be viewed as technically representative of any particular airplane. A complete FHA could be comprised of the layout shown in Appendix B by utilizing pertinent technical considerations identified in Appendix A, which are modified and expanded to reflect the specific proposed airplane design under consideration.
(C) Part 23 airplanes cover a wide range of airplane sizes and capabilities. These airplanes range from single-engine, single-seat, low-performance airplanes to complex multiengine, high-speed, high-performance airplanes. At the bottom end of these Part 23 airplane types, there are several compensating characteristics that mitigate many of the effects of a failure. Docile handling characteristics, low stall speeds, spin resistant designs, lower probability of operation in extreme weather conditions, and the inherent design philosophies used to design single-engine airplanes are specific examples of characteristics that may be considered in an FHA for systems installed in this class of airplane. Usually, support from ATC is not considered as a mitigating factor.
(2) Failure Conditions With No Safety Effect. An FHA with a design and installation appraisal to establish independence from other functions is necessary for the safety assessment of these Failure Conditions. In general, common design practice provides physical and functional isolation from related components, which are essential to safe operation. If the applicant chooses not to do the FHA, the safety effects may be derived from the design and installation appraisal performed by the applicant.
(3) Analysis of Minor Failure Conditions. An analysis should consider the effects of system failures on other systems or their functions. An FHA with a design and installation appraisal to establish independence from other functions is necessary for the safety assessment of these Failure Conditions. In general, common design practice provides physical and functional isolation from components that are essential to safe operation. If the applicant chooses not to do an FHA, the safety effects may be derived from the design and installation appraisal performed by the applicant.
(4) Analysis of Major Failure Conditions. An assessment based on engineering judgment is a qualitative assessment, as are several of the methods described below:
(i) If the system is similar in its relevant attributes to those used in other airplanes and if the effects of failure would be the same, then a design and installation appraisal and satisfactory service history of either the equipment being analyzed or of a similar design is usually acceptable for showing compliance. It is the applicant’s responsibility to provide accepted/approved data that supports any claims of similarity to a previous installation.
(ii) For systems that are not complex, where similarity cannot be used as the basis for compliance, then compliance may be shown by means of a qualitative assessment that shows that the Major Failure Conditions of the system as installed are consistent with the FHA (for example, redundant systems).
(iii) To show that malfunctions are indeed remote in systems of high complexity without redundancy (for example, a system with a self-monitoring microprocessor), it is sometimes necessary to conduct a qualitative functional FMEA supported by failure rate data and fault detection coverage analysis.
(iv) An analysis of a redundant system is usually complete if it shows isolation between redundant system channels and satisfactory reliability for each channel. For complex systems, where functional redundancy is required, a qualitative FMEA and FTA may be necessary to determine that redundancy actually exists (for example, no single failure affects all functional channels).
(5) Analysis of Hazardous and Catastrophic Failure Conditions. For these failure conditions, a thorough safety assessment is necessary. The assessment usually consists of an appropriate combination of qualitative and quantitative analyses. Except as specified in Item
9.d.(5)(i) below, a detailed safety analysis will be necessary for each Hazardous and Catastrophic Failure Condition identified by an FHA. The analysis will usually be a combination of qualitative and quantitative assessments of the design.
(i) For simple and conventional installations (that is, low complexity and similarity in relevant attributes), it may be possible to assess a Hazardous or Catastrophic Failure Condition as being Extremely Remote or Extremely Improbable, respectively, on the basis of experienced engineering judgment using only qualitative analysis. The basis for the assessment will be the degree of redundancy, the established independence and isolation of the channels, and the reliability record of the technology involved. Satisfactory service experience on similar systems commonly used in many airplanes may be sufficient when a close similarity is established regarding both the system design and operating conditions.
(ii) For complex systems where true similarity in all relevant attributes, including installation attributes, can be rigorously established, it may also be possible to assess a Hazardous or Catastrophic Failure Condition as being Extremely Remote or Extremely Improbable, respectively, on the basis of experienced engineering judgment using only qualitative analysis. A high degree of similarity in both design and application is required.
(iii) No Catastrophic Failure Condition (Note 3 in Figure 2) should result from the failure of a single component, part, or element of a system. Also, no single failure should result in the loss of a function that causes a Hazardous Failure Condition (Note 4 in Figure 2). In other words, it is acceptable to have a single failure for malfunction for a Hazardous Failure Condition if the probability values are met. Therefore, no single failure will result in any Catastrophic Failure Conditions or loss of a function for Hazardous Failure Condition. However, in unusual cases, experienced engineering judgment may enable an assessment that such a failure mode is not a practical possibility. The logic and rationale used in the assessment should be so straight forward and obvious that the failure mode simply would not occur unless it is associated with an unrelated Failure Condition that would, in itself, be Catastrophic.
(6) Assessment Methods. Methods for qualitatively and quantitatively assessing the causes, severity, and likelihood of potential Failure Conditions are available to support experienced engineering and operational judgment. Some of these methods are structured. The various types of analyses are based on either inductive or deductive approaches. The applicant should select analyses to validate the safety of a particular design based on factors such as the system architecture, complexity, criticality of the function, etc. ARP 4761 has more details of the various methods. Descriptions of typical types of analyses that might be used are provided below.
(i) Design Appraisal: A qualitative appraisal of the integrity and safety of the system design, such as the effective use of design techniques to verify that failures of a system do not adversely affect other systems. An effective appraisal requires experienced judgment.
(ii) Installation Appraisal: A qualitative appraisal of the integrity and safety of the installation. Any deviations from normal, industry-accepted installation practices, such as clearances or tolerances, should be evaluated, especially when appraising modifications are made after entry into service.
(iii) Failure Modes and Effects Analysis (FMEA): A structured, inductive, bottomup analysis that is used to evaluate the effects on the system and the airplane of each possible element or component failure. When properly formatted, it should aid in identifying latent failures
24 and the possible causes of each failure mode. ARP 4761 provides methodology and detailed guidelines that may be used to perform this type of analysis. An FMEA could be a piece-part FMEA or a functional FMEA. For modern microcircuit-based Line Replaceable Units (LRU) and systems, an exhaustive piece-part FMEA is not practically feasible with the present state of the art.
In that context, an FMEA may be more functional than piece-part oriented. A functional-oriented FMEA can lead to uncertainties in the qualitative and quantitative aspects, which can be compensated for by more conservative assessments, such as the following:
(A) Assuming all failure modes result in Failure Conditions of interest, (B) Carefully choosing system architecture, and (C) Using lessons learned from similar technology.
(iv) Fault Tree Analysis (FTA): A structured, deductive, top-down analysis that is used to identify the conditions, failures, and events that would cause each defined Failure Condition. These are graphical methods of identifying the logical relationship between each particular Failure Condition and the primary element or component failures, other events, or combinations thereof that can cause it. After the fault tree is developed starting at the top and continuing on down to the most primary event at the bottom, an FMEA is usually used as the source document to verify the primary failures or other events.
(v) Common Cause Analysis: The acceptance of adequate probability of Failure Conditions is often derived from the assessment of multiple systems based on the assumption that failures are independent. Therefore, it is necessary to recognize that such independence may not exist in the practical sense, and specific studies are necessary to ensure that independence can either be assured or deemed acceptable. The “Common Cause Analysis” is divided into three areas of study:
(A) Zonal Safety Analysis: This analysis has the objective of ensuring that the equipment installations within each zone of the airplane are at an adequate safety standard regarding design and installation standards, interference between systems, and maintenance errors.
(B) Particular Risk Analysis: Particular risks are defined as those events or influences outside the systems concerned (for example, fire, leaking fluids, bird strike, tire burst, High Intensity Radiated Fields (HIRF) exposure, lightning, uncontained failure of high energy rotating machines, etc.). Each risk should be the subject of a specific study to examine and document the simultaneous or cascading effects, or influences, that may violate independence.
(C) Common Mode Analysis: This analysis is performed to confirm the assumed independence of the events that were considered in combination for a given Failure Condition. The effects of specification, design, implementation, installation, maintenance errors, manufacturing errors, environmental factors other than those already considered in the particular risk analysis, and failures of system components should be considered.
(7) Assessment Of Failure Condition Probabilities And Analysis Considerations. An assessment of the probability of a Failure Condition may be either qualitative or quantitative. An