25 analysis may range from a simple report that interprets test results or compares two similar systems to a detailed analysis that may or may not include estimated numerical probabilities. The depth and scope of an analysis depends on the type of functions performed by the system, the severity of Failure Conditions, and whether the system is complex. A quantitative analysis is intended to supplement, but not replace, qualitative methods based on engineering and operational judgment.
A quantitative analysis is often used for Catastrophic or Hazardous Failure Conditions of systems that are complex, that have insufficient service experience to help substantiate their safety, or that have attributes that differ significantly from those of conventional systems.
(i) A probability analysis may be either an FMEA or an FTA, which also includes numerical probability information. Numerical values are assigned to the probabilistic terms included in the requirements for use in those cases where the impact of system failures is examined by quantitative methods of analyses.
(ii) The probabilities of primary failures can be determined from failure rate data and exposure times using failure rates derived from either service experience on identical or similar items or from acceptable industry standards. Conventional mathematics of probability can then be used to calculate the estimated probability of each Failure Condition as a function of the estimated probabilities of the various identified contributory failures or other events.
(A) When calculating the estimated probability of each Failure Condition, a margin may be necessary to account for uncertainty. A margin is not normally required for an analysis that is based on proven data or from operational experience and tests. Where data has limited background for substantiation, a margin may be required depending on the available justification.
(B) The applicant should obtain early concurrence of the cognizant certification authority of an acceptable probability for each Major, Hazardous, and Catastrophic Failure Condition. Unless acceptable probability criteria are provided elsewhere, such as in other AC's, acceptable probabilities for Failure Conditions should be derived.
(C) The details on how to calculate the “Average Probability Per Flight Hour” for a Failure Condition are given in Appendix C of this AC. The “Average Probability Per Flight Hour” is the probability of occurrence, normalized by the flight time of a Failure Condition during a single flight. If the probability of a subject Failure Condition occurring during a typical flight of mean duration for the airplane type, divided by the flight’s mean duration in hours, is likely to be significantly different from the predicted average rate of occurrence of that Failure Condition during the entire operational life of all airplanes of that type, then a risk model that better reflects the Failure Condition should be used. The single flight is analyzed to be representative of an average over all possible flights of the fleet of airplanes to be certified. The calculation of the “Average Probability Per Flight Hour” for a Failure Condition should consider the following:
(1) The average flight duration and the average flight profile for the airplane type to be certified. A common assumption for 14 CFR Part 23 airplanes is that the average flight duration is 1 hour,
(2) All combinations of failures and events that contribute to the Failure Condition,
(3) The conditional probability if a sequence of events is necessary to produce the Failure Condition,
(4) The relevant "at risk" time if an event is only relevant during certain flight phases, and
(5) The average exposure time if the failure can persist for multiple flights.
10. OPERATIONAL AND MAINTENANCE CONSIDERATIONS.
a. Flight Crew and Maintenance Tasks: These tasks, which are related to compliance, should be appropriate and reasonable. Quantitative assessments of the probabilities of flight crew and maintenance errors are not considered feasible. Reasonable tasks are those for which full credit can be taken because the flight crew or ground crew can realistically be anticipated to perform them correctly when they are required or scheduled. For the purposes of quantitative analysis, a probability of one can be assumed for flight crew and maintenance tasks that have been evaluated and found to be reasonable. In addition, based on experienced engineering and operational judgment, the discovery of obvious failures during normal operation and maintenance of the airplane may be considered, even though such failures are not the primary purpose of focus of the operational or maintenance actions.
b. Flight Crew Action: When assessing the ability of the flight crew to cope with a Failure Condition, the information provided to the crew and the complexity of the required action should be considered.
(1) If the evaluation indicates that a potential Failure Condition can be alleviated or overcome in a timely manner without jeopardizing other safety related flight crew tasks and without requiring exceptional pilot skill or strength, correct crew action may be assumed in both qualitative and quantitative assessments.
(2) Annunciation that requires flight crew actions should be evaluated to determine if the required actions can be accomplished in a timely manner without exceptional pilot skills. If the evaluation indicates that a potential Failure Condition can be alleviated or overcome during the time available without jeopardizing other safety related flight crew tasks and without requiring exceptional pilot skill or strength, credit may be taken for correct and appropriate corrective action for both qualitative and quantitative assessments. Similarly, credit may be taken for correct flight crew performance if overall flight crew workload during the time available is not excessive and if the tasks do not require exceptional pilot skill or strength.
(3) Unless flight crew actions are accepted as normal airmanship, the appropriate procedures should be included in the FAA approved AFM or in the AFM revision or supplement.
The AFM should include procedures for operation of complex systems such as integrated flight guidance and control systems. These procedures should include proper pilot response to cockpit
27 indications, diagnosis of system failures, discussion of possible pilot-induced flight control system problems, and use of the system in a safe manner.
c. Maintenance Actions: Credit may be taken for correct accomplishment of maintenance tasks in both qualitative and quantitative assessments if the tasks are evaluated and found to be reasonable. Required maintenance tasks, which mitigate hazards, should be provided for use in the FAA approved maintenance programs. Annunciated failures will be corrected before the next flight or a maximum time period will be established before a maintenance action is required. If the latter is acceptable, the analysis should establish the maximum allowable interval before the maintenance action is required. A scheduled maintenance task may detect latent failures. If this approach is taken, and the Failure Condition is Hazardous or Catastrophic, then a maintenance task should be established. Some Latent Failures can be assumed to be identified based upon a return to service test on the equipment following its removal and repair (component Mean Time Between Failures (MTBF) should be the basis for the check interval time).
11. ELECTROMAGNETIC PROTECTION FOR ELECTRICAL/ELECTRONIC SYSTEMS.
a. Background: Current trends indicate increasing reliance on electrical/electronic systems for safe operations. For systems that perform flight, propulsion, navigation, and instrumentation functions, electromagnetic effects should be considered.
b. High Intensity Radiated Fields (HIRF):
(1) The words "radio frequency energy" in § 23.1309(e) are not intended to include HIRF;
therefore, special conditions must be issued until the HIRF requirements are incorporated into Part 23 in a final rule. These special conditions are applicable for systems that perform functions whose failure to provide that function correctly could lead to a Catastrophic Failure Condition. A notice provides guidance material relevant to certification of airplanes for HIRF. Airplanes are exposed to the HIRF environment, which results from high-power radio frequency transmitters such as radio and television broadcast stations, radar, and satellite ground-earth stations. This notice provides a standard and uniform set of requirements for an airplane certification until a final rule can be issued.
Airplane electrical and electronic systems, or equipment addressed by this notice, may include new designs, significant modifications of existing designs, applications of existing systems, or equipment that has not been previously certified for HIRF.
(2) The FAA/Joint Aviation Authorities (JAA) Electromagnetic Effects Harmonization Working Group of the Aviation Rulemaking Advisory Committee (ARAC) developed a Notice of Proposed Rulemaking (NPRM). This NPRM received the participation of international airworthiness authorities, industry, and industry groups in developing the proposed international standards. The NPRM is now in the rulemaking process. Special conditions will be necessary until this rule is issued.
c. Lightning Protection:
(1) Section 23.1309(e) contains the regulatory requirements for the protection of airplane electrical/electronic systems against the indirect effects of lightning. These requirements are applicable for electrical/electronic functions whose Failure Conditions are classified as Catastrophic, Hazardous, or Major. For guidance, AC 20-136 and Section 22 of RTCA/DO-160D, or subsequent revisions, provide acceptable methods and procedures for determining compliance with the indirect effects of lightning requirements. AC 20-136 provides guidance to verify the protection of systems installed in an aircraft. Section 22 of RTCA/DO-160D provides methods to qualify equipment prior to installation in an airplane.
(2) For those airplanes intended for operation under IFR, a more detailed assessment will need to be made concerning the vulnerability to lightning related hazards. The need for lightning protection for systems on airplanes limited to VFR operations is determined on a case-by-case basis. The depth of the verification should be commensurate with the degree of hazard. Airplanes that employ proven conventional construction and systems (that is, all-aluminum airplanes with gyroflight instruments, magneto-type engine ignition systems, mechanical fuel systems, etc.) have demonstrated excellent inherent lightning protection qualities over many millions of flight hours.
Similar designs may only need a qualitative engineering assessment that all hazards have been reasonably minimized. DOT/FAA/CT-89/22 may be used as a guide to make this assessment.
Other designs (that is, all composite construction, or installation of electronic flight instrument displays, electronic ignition, or electronic fuel systems, etc.) are generally more susceptible to lightning threats; therefore, these designs will need further evaluation. The methods outlined in AC’s 20-53A, 20-136, and 23-15, and RTCA DO-160D provide acceptable means of compliance with the requirements, as applicable.
(3) Functions performed by systems whose Failure Conditions are classified as Hazardous or Major would require protection to the extent that the function should recover in a timely manner after the airplane has been exposed to lightning. Testing and analysis are directed toward a component damage (that is, a damage tolerance test). Multiple stroke and multiple burst testing should not be required; therefore, the laboratory test procedures in RTCA/DO-160D are acceptable. Multiple stroke and multiple burst testing should not be required for systems that perform functions whose Failure Conditions are classified as Hazardous or Major if an analysis shows that the equipment is not susceptible to upset or that the equipment may be susceptible to upset but a reset capability exists that will recover the function in a timely manner. A specific category or level of testing as defined in RTCA/DO-160D is not being given, but a simple analysis method by experienced engineering judgment is normally sufficient to determine the appropriate testing level. Systems that have been previously approved may be approved by similarity provided there has been no unresolved in-service history of problems relating to lightning strikes to the aircraft.
(4) Functions whose Failure Conditions are classified as Catastrophic would require protection to the extent that the function should not be adversely affected when the airplane is exposed to lightning. These functions should continue to be provided during and after exposure to lightning. If the function is provided by multiple systems, then loss of a system or systems during exposure of the airplane to lightning should not result in the loss of the function. After the airplane
29 is exposed to lightning, each affected system that performs these functions should automatically recover normal operation, unless this conflicts with other operational or functional requirements of that system. Neither multiple stroke and multiple burst testing nor analysis should be required for damage assessment, but these can be the primary factors in a system functional upset.
(5) Appendix 3 of AC 20-136 defines total lightning environment, including the multiple stroke and multiple burst lightning environment to be used for test and analysis purposes in qualifying systems and equipment for lightning protection. AC 20-136 is proposed as a basis to use in demonstrating compliance with the lightning protection requirements, except for the multiple burst lightning environment that has been changed to agree with recommendations from the Society of Automotive Engineers (SAE) AE4L Committee, dated July 6, 1992. The multiple burst lightning environment that is defined in AC 20-136 has been changed from 24 bursts to 3 bursts and it is used mainly for test and analysis of system functional upset.
12. DEVELOPMENT ASSURANCE FOR AIRBORNE SYSTEM AND APPLICATIONS.
a. Background: AC 20-115B discusses how RTCA/DO-178B provides an acceptable means for showing that software complies with pertinent airworthiness requirements.
b. Acceptable Application of Software Development Assurance Levels: It is necessary to consider the possibility of requirement, design, and implementation errors in order to comply with the requirements of § 23.1309(b). Errors made during the design and development of systems have traditionally been detected and corrected by exhaustive tests conducted on the system and its components by direct inspection and by other direct verification methods capable of completely characterizing the performance of the system. These direct techniques may still be appropriate for simple systems, which perform a limited number of functions and which are not highly integrated with other airplane systems.
(1) For more complex or integrated systems, exhaustive testing may either be impossible because all of the systems states cannot be determined or it may be impractical due to the number of tests that must be accomplished. For these types of systems, compliance may be shown by the use of Software Development Assurance Levels. The Software Development Assurance Levels should be determined by the severity of potential effects on the airplane in case of system malfunctions or loss of functions.
(2) Criteria for Software Development Assurance Levels of Part 23 airplanes are shown in Figure 2. The levels in Figure 2 are considered acceptable instead of the Software Development Assurance Levels defined in paragraph 2.2.2 in RTCA/DO-178B. Additional guidelines, which may be used for determining Software Development Assurance Levels, are described in ARP 4754 and RTCA/DO-178B. Because these documents were not developed simultaneously, there are differences in the guidelines and terminology.
(3) There is a significant difference in the guidance provided on the use of system architecture for determination of the appropriate Software Development Assurance Levels. The FAA recognizes that consideration of system architecture for this purpose is appropriate. Where
30 apparent differences exist between these two documents on this subject, then the guidance contained in ARP 4754 should be used if additional credit for architecture is requested for Hazardous or Catastrophic Failure Conditions in commuter category airplanes.
(4) Equipment installed in Part 23 airplanes that performs functions addressed by TSO standards should meet applicable TSO standards, but the equipment is not required to have TSO authorization. Some TSO equipment specifies minimum Software Development Assurance Levels.
Software for non-TSO equipment installed in Part 23 airplanes may use the Software Development Assurance Levels of Figure 2 in lieu of the levels specified in the TSO.
c. Acceptable Application of Hardware Development Assurance Levels: There are currently no agreed standards for hardware development assurance levels. The RTCA Special Committee (SC) 180 is developing more details on methods for substantiating hardware development assurance levels.
s/ Michael Gallagher Manager, Small Airplane Directorate Aircraft Certification Service
Appendix A 1 AC 23.1309-1C —APPENDIX A. *PARTIAL FUNCTIONAL HAZARD ASSESSMENT (FHA) TO MEET 14 CFR PART 23 REQUIREMENTS FOR IFR CLASS I AIRPLANES Aircraft Function Classification of Failure Conditions Analysis Consideration Total Loss of Function Loss of Primary Means of Providing Function Misleading and/or Malfunction Without Warning Display of attitude information to control roll and pitch Catastrophic Major Catastrophic For electronic displays, dual independent attitude systems generally meet requirements for 14 CFR Part 23, § 23.1311 and for conventional mechanical or analog electromechanical systems, a single attitude display meets requirements to operate under Instrument Flight Rules (IFR) for Part 91. If the certification basis includes Amendment 23-43 or later, two independent power sources are required. Partial panel techniques may be used in some cases where it has been historically shown to be acceptable. Credit (mitigation) may be given for automatic flight control systems if the system can maintain stable attitude independent of the primary attitude display.
Display of directional heading information Major Minor Major Assumes installation of a single stabilized heading system and only a non-stabilized magnetic compass to operate under Instrument Flight Rules (IFR) for Part 91. If the certification basis includes Amendment 23-43 or later, two independent power sources are required. Navigation assumed to be operating.
*Note: This table is intended to be a guide and not a certification checklist since it may not include all the information necessary for an FHA on Part 23 IFR Class I airplanes with its various functions and its intended use.
This partial FHA does not reflect considerations needed to properly develop an FHA. See Item 9d(1) and its associated subparagraphs for more complete guidance. R = Reserved, intentionally left blank.
Appendix A 2 AC 23.1309-1C —APPENDIX A. *PARTIAL FUNCTIONAL HAZARD ASSESSMENT (FHA) TO MEET 14 CFR PART 23 REQUIREMENTS FOR IFR CLASS I AIRPLANES Aircraft Function Classification of Failure Conditions Analysis Consideration Total Loss of Function Loss of Primary Means of Providing Function Misleading and/or Malfunction Without Warning Display of altitude information Hazardous Minor Catastrophic For electronic displays, dual independent altitude systems generally meet requirements for 14 CFR Part 23, § 23.1311 and for conventional mechanical or analog electromechanical systems, a single altitude display meets requirements to operate under Instrument Flight Rules (IFR) for Part 91. If the certification basis includes Amendment 23-43 or later, two independent power sources are required. Existing single static systems that are heated have been historically acceptable based on similarity and may be used for programs that have certification basis prior to Amendment 23-42. If a single or dual air data computer is used, it must meet the requirements of this AC with respect to safety and Software Development Assurance.
*Note: This table is intended to be a guide and not a certification checklist since it may not include all the information necessary for an FHA on Part 23 IFR Class I airplanes with its various functions and its intended use.
This partial FHA does not reflect considerations needed to properly develop an FHA. See Item 9d(1) and its associated subparagraphs for more complete guidance. R = Reserved, intentionally left blank.
Appendix A 3 AC 23.1309-1C —APPENDIX A. *PARTIAL FUNCTIONAL HAZARD ASSESSMENT (FHA) TO MEET 14 CFR PART 23 REQUIREMENTS FOR IFR CLASS I AIRPLANES Aircraft Function Classification of Failure Conditions Analysis Consideration Total Loss of Function Loss of Primary Means of Providing Function Misleading and/or Malfunction Without Warning Display of airspeed information Major.
May be Hazardous for higher performance airplanes.
Minor Major.
May be Hazardous for higher performance airplanes.
For electronic displays, dual independent airspeed systems generally meet requirements for 14 CFR Part 23, § 23.1311 and for conventional mechanical or analog electromechanical systems, a single airspeed display meets requirements to operate under Instrument Flight Rules (IFR) for Part 91. If the certification basis includes Amendment 23-43 or later, two independent power sources are required. Classification as Major, if overspeed and underspeed airspeed alerting is acceptable (alerting may be provided by inherent aerodynamic qualities or independent alerting system);
otherwise, loss of function, malfunction, or misleading of information is Hazardous. Assumes no vertical speed indicator. Existing single pitot static systems that are heated have been historically acceptable based on similarity and may be used for programs that have certification basis prior to Amendment
23-42. If a single or dual air data computer is used, it must meet the requirements of this AC with respect to safety and Software Development Assurance Levels.
*Note: This table is intended to be a guide and not a certification checklist since it may not include all the information necessary for an FHA on Part 23 IFR Class I airplanes with its various functions and its intended use.
This partial FHA does not reflect considerations needed to properly develop an FHA. See Item 9d(1) and its associated subparagraphs for more complete guidance. R = Reserved, intentionally left blank.
Appendix A 4 AC 23.1309-1C —APPENDIX A. *PARTIAL FUNCTIONAL HAZARD ASSESSMENT (FHA) TO MEET 14 CFR PART 23 REQUIREMENTS FOR IFR CLASS I AIRPLANES Aircraft Function Classification of Failure Conditions Analysis Consideration Total Loss of Function Loss of Primary Means of Providing Function Misleading and/or Malfunction Without Warning Display of rate-of-turn information Minor Minor Minor Rate-of-turn display is generally required to operate under Instrument Flight Rules (IFR) for Part 91 unless a third attitude is installed. If the certification basis includes Amendment 23-43 or later, two independent power sources are required. In Instrument Meteorological Conditions (IMC) misleading rate-of-turn information is consider to be Minor if there is a functional attitude display.
Display of slip-skid information Minor Minor Minor R Display of time information Minor Minor Minor R Display of navigation information Major Major.
Minor, if two navigation systems are installed.
Major. May be Hazardous for precision approaches.
Two navigation systems are generally installed to support navigation, but two are not required for 14 CFR Part 91 operations. May use the combination of all data in pilot's eye scan. Dual Instrument Landing Systems (ILS) receivers below Category I limits are required with single antenna for Part 91 operations.
*Note: This table is intended to be a guide and not a certification checklist since it may not include all the information necessary for an FHA on Part 23 IFR Class I airplanes with its various functions and its intended use.
This partial FHA does not reflect considerations needed to properly develop an FHA. See Item 9d(1) and its associated subparagraphs for more complete guidance. R = Reserved, intentionally left blank.
Appendix A 5 AC 23.1309-1C —APPENDIX A. *PARTIAL FUNCTIONAL HAZARD ASSESSMENT (FHA) TO MEET 14 CFR PART 23 REQUIREMENTS FOR IFR CLASS I AIRPLANES Aircraft Function Classification of Failure Conditions Analysis Consideration Total Loss of Function Loss of Primary Means of Providing Function Misleading and/or Malfunction Without Warning Communication Minor.
Total loss of navigation and communication is Hazardous Minor Major, if data link.
Otherwise, Minor.
Future installations may use data link for primary functions and voice for secondary.
Display of radio altitude information Minor R Minor Not required for 14 CFR Part 91 operations, Category I ILS. Loss of function may affect other equipment that depends upon radio altimeter, such as GPWS, etc.
Display of vertical speed information Minor R Minor Not required for 14 CFR Part 91 operations.
Display of flight guidance commands (Category I operation) Minor R Minor Not required for 14 CFR Part 91 operations, Category I ILS. For Category II ILS, an autopilot or flight director is required.
*Note: This table is intended to be a guide and not a certification checklist since it may not include all the information necessary for an FHA on Part 23 IFR Class I airplanes with its various functions and its intended use.
This partial FHA does not reflect considerations needed to properly develop an FHA. See Item 9d(1) and its associated subparagraphs for more complete guidance. R = Reserved, intentionally left blank.
Appendix A 6 AC 23.1309-1C —APPENDIX A. *PARTIAL FUNCTIONAL HAZARD ASSESSMENT (FHA) TO MEET 14 CFR PART 23 REQUIREMENTS FOR IFR CLASS I AIRPLANES Aircraft Function Classification of Failure Conditions Analysis Consideration Total Loss of Function Loss of Primary Means of Providing Function Misleading and/or Malfunction Without Warning Autopilot Minor, with warning.
Major, without warning.
R Major, single axis and limited authority.
Hazardous, multi-axis and limited authority.
Catastrophic, if authority is unlimited.
Maximum inputs (hardovers) or (slowovers) to aircraft primary control surfaces should not exceed aircraft structural limits. Refer to AC
23.1329-2, “Automatic Pilot System Installation in Part 23 Airplanes.”
Electrical- Electronic primary powered flight controls Catastrophic.
Hazardous for loss of one lateral axis.
Minor Catastrophic Assumes redundant electrical/electronic primary flight control systems with no manual reversion that provide independent control for each axis.
*Note: This table is intended to be a guide and not a certification checklist since it may not include all the information necessary for an FHA on Part 23 IFR Class I airplanes with its various functions and its intended use.
This partial FHA does not reflect considerations needed to properly develop an FHA. See Item 9d(1) and its associated subparagraphs for more complete guidance. R = Reserved, intentionally left blank.