Appendix A 7 AC 23.1309-1C —APPENDIX A. *PARTIAL FUNCTIONAL HAZARD ASSESSMENT (FHA) TO MEET 14 CFR PART 23 REQUIREMENTS FOR IFR CLASS I AIRPLANES Aircraft Function Classification of Failure Conditions Analysis Consideration Total Loss of Function Loss of Primary Means of Providing Function Misleading and/or Malfunction Without Warning Stability augmentation Variable Minor Variable It needs to be evaluated on a case-bycase basis since it depends on aircraft stability and handling characteristics when installed and required to meet minimum performance and flight handling requirements.
Stick pusher If loss is not annunciated, then Hazardous; if failure indication is given, then Minor.
Minor Catastrophic The system is installed to protect against a Hazardous stall characteristic. Assumes dual systems to prevent single-failure modes. Stick pusher malfunction with or without warning can be Catastrophic depending on phase of flight and system attributes. Airplane response to stick pusher may be considered and pilot procedures may mitigate to a lower Failure Condition.
Stick Shakers/ stall warning Minor Minor Major Assumes that a warning system is in place to notify pilot that loss of system function has occurred (for example, stick force changes, buffeting, inherent aerodynamics features, etc.).
*Note: This table is intended to be a guide and not a certification checklist since it may not include all the information necessary for an FHA on Part 23 IFR Class I airplanes with its various functions and its intended use.
This partial FHA does not reflect considerations needed to properly develop an FHA. See Item 9d(1) and its associated subparagraphs for more complete guidance. R = Reserved, intentionally left blank.
Appendix A 8 AC 23.1309-1C —APPENDIX A. *PARTIAL FUNCTIONAL HAZARD ASSESSMENT (FHA) TO MEET 14 CFR PART 23 REQUIREMENTS FOR IFR CLASS I AIRPLANES Aircraft Function Classification of Failure Conditions Analysis Consideration Total Loss of Function Loss of Primary Means of Providing Function Misleading and/or Malfunction Without Warning Trim control Minor Minor Major, if manual trim.
Catastrophic or Hazardous for electrical.
Studies have shown trim runaways are not a significant problem if pilot takes quick corrective action. Major, for trim runaways if there is a trim-inmotion aural alert. Hazardous or Catastrophic, for trim runaways without a failure indication depending on trim authority.
Gear control Major Minor Major R Brake control Major, for airplanes ≥ 6,000#.
Minor, for airplanes < 6,000#.
Major.
Could be Minor, if thrust reversers are installed.
Major Electronic anti-skid and brake systems can cause significant ground handling problems if they malfunction under adverse conditions due to asymmetrical loading. Light airplanes braking loss is not as significant and can be reviewed on a case-by-case basis.
Display of trim indications Minor Minor Variable Each airplane has to be reviewed on a case-by-case basis.
Display of gear indications Minor R Minor R *Note: This table is intended to be a guide and not a certification checklist since it may not include all the information necessary for an FHA on Part 23 IFR Class I airplanes with its various functions and its intended use.
This partial FHA does not reflect considerations needed to properly develop an FHA. See Item 9d(1) and its associated subparagraphs for more complete guidance. R = Reserved, intentionally left blank.
Appendix A 9 AC 23.1309-1C —APPENDIX A. *PARTIAL FUNCTIONAL HAZARD ASSESSMENT (FHA) TO MEET 14 CFR PART 23 REQUIREMENTS FOR IFR CLASS I AIRPLANES Aircraft Function Classification of Failure Conditions Analysis Consideration Total Loss of Function Loss of Primary Means of Providing Function Misleading and/or Malfunction Without Warning Display of fuel level indication Minor Minor Minor Pilot is required to calculate fuel range and endurance during normal flight planning operations.
Display of powerplant indication tachometer Minor Minor Minor Assumes fixed pitch propeller and reciprocating engine; otherwise, a propeller governor will maintain the engine r.p.m. Turbofan and turbojet engines may need r.p.m. data for inflight restart capability. Refer to 14 CFR Part 23, § 23.1311.
Display of powerplant Cylinder Head Temperature (CHT) Minor Minor Minor Assumes a CHT indicator is required.
Refer to 14 CFR Part 23, § 23.1305.
*Note: This table is intended to be a guide and not a certification checklist since it may not include all the information necessary for an FHA on Part 23 IFR Class I airplanes with its various functions and its intended use.
This partial FHA does not reflect considerations needed to properly develop an FHA. See Item 9d(1) and its associated subparagraphs for more complete guidance. R = Reserved, intentionally left blank.
Appendix A 10 AC 23.1309-1C —APPENDIX A. *PARTIAL FUNCTIONAL HAZARD ASSESSMENT (FHA) TO MEET 14 CFR PART 23 REQUIREMENTS FOR IFR CLASS I AIRPLANES Aircraft Function Classification of Failure Conditions Analysis Consideration Total Loss of Function Loss of Primary Means of Providing Function Misleading and/or Malfunction Without Warning Display of powerplant indication coolant temperature Minor Minor Minor Refer to 14 CFR Part 23, § 23.1305.
Display of powerplant indication oil pressure Minor Minor Minor Assumes oil temperature is used as a backup.
Display of powerplant indication oil temperature Minor Minor Minor Assumes oil pressure is used as a backup.
Display of powerplant indication manifold pressure Minor Minor Minor Assumes backup use of CHT, Engine Gas Temperature (EGT), and possible fuel flow readings if installed.
Display of powerplant air inlet temperature Minor Minor Minor R *Note: This table is intended to be a guide and not a certification checklist since it may not include all the information necessary for an FHA on Part 23 IFR Class I airplanes with its various functions and its intended use.
This partial FHA does not reflect considerations needed to properly develop an FHA. See Item 9d(1) and its associated subparagraphs for more complete guidance. R = Reserved, intentionally left blank.
Appendix A 11 AC 23.1309-1C —APPENDIX A. *PARTIAL FUNCTIONAL HAZARD ASSESSMENT (FHA) TO MEET 14 CFR PART 23 REQUIREMENTS FOR IFR CLASS I AIRPLANES Aircraft Function Classification of Failure Conditions Analysis Consideration Total Loss of Function Loss of Primary Means of Providing Function Misleading and/or Malfunction Without Warning Display of powerplant indication fuel pressure Minor Minor Minor R Display of powerplant indication gas temperature for turbine engine Minor Minor Major Torque indication can be used as an emergency backup indicator to control the engine to a safe landing.
Display of powerplant indication fuel flow Minor Minor Major Manifold pressure and r.p.m. or torque indications can be used as an emergency backup to control power until a safe landing can be made.
Display of powerplant fire warning Major Major Hazardous Required for commuter category and Part 23 turbojet powered airplanes using special conditions. Part 23 airplanes usually have one fire warning system on board.
Display of powerplant indication thrust Minor Minor Hazardous System is not normally used in Part 23 airplanes. Torque, Engine Pressure Ratio (EPR), EGT, or Turbine Inlet Temperature (TIT), fuel flow, and r.p.m. are the parameters normally displayed.
*Note: This table is intended to be a guide and not a certification checklist since it may not include all the information necessary for an FHA on Part 23 IFR Class I airplanes with its various functions and its intended use.
This partial FHA does not reflect considerations needed to properly develop an FHA. See Item 9d(1) and its associated subparagraphs for more complete guidance. R = Reserved, intentionally left blank.
Appendix A 12 AC 23.1309-1C —APPENDIX A. *PARTIAL FUNCTIONAL HAZARD ASSESSMENT (FHA) TO MEET 14 CFR PART 23 REQUIREMENTS FOR IFR CLASS I AIRPLANES Aircraft Function Classification of Failure Conditions Analysis Consideration Total Loss of Function Loss of Primary Means of Providing Function Misleading and/or Malfunction Without Warning Display of powerplant thrust reverser position No effect No effect Major No certification credit is given for enhanced performance when a thrust reverser is installed.
Thrust reversal Minor Minor Variable (inadvertent deployment) No certification credit is given for enhanced performance when a thrust reverser is installed. No credit can be given for a warning.
Display of powerplant torque Minor Minor Major Misleading torque could affect takeoff performance.
Display of powerplant propeller blade angle No safety effect No safety effect No safety effect System is not normally used in Part 23 airplanes. Propeller governor would control r.p.m.
Visual warnings, cautions, and alerts R R R Failure Conditions depend on the criticality of systems being monitored and pilot action required.
Display of air temperature Minor R Minor R *Note: This table is intended to be a guide and not a certification checklist since it may not include all the information necessary for an FHA on Part 23 IFR Class I airplanes with its various functions and its intended use.
This partial FHA does not reflect considerations needed to properly develop an FHA. See Item 9d(1) and its associated subparagraphs for more complete guidance. R = Reserved, intentionally left blank.
Appendix A 13 AC 23.1309-1C —APPENDIX A. *PARTIAL FUNCTIONAL HAZARD ASSESSMENT (FHA) TO MEET 14 CFR PART 23 REQUIREMENTS FOR IFR CLASS I AIRPLANES Aircraft Function Classification of Failure Conditions Analysis Consideration Total Loss of Function Loss of Primary Means of Providing Function Misleading and/or Malfunction Without Warning Overspeed warning Minor Minor Minor Airspeed may be used as a backup to the overspeed warning for continued safe flight and landing.
Aural warnings R R R Aural alerts tend to be reserved for required flight crew’s immediate corrective action. Failure Conditions depend on the criticality of the system.
Electrical system indication Minor Minor Major Depends on crew reference and analysis.
Vacuum/pr essure indication Minor Minor Major Provides an indication that flight instruments are operating within power source limits.
Electrical power Catastrophic, if primary flight instruments require electrical power.
Hazardous for IFR.
Depends upon capability of secondary power system.
Installation dependent Depends on electrical system loads and the criticality of the functions.
*Note: This table is intended to be a guide and not a certification checklist since it may not include all the information necessary for an FHA on Part 23 IFR Class I airplanes with its various functions and its intended use.
This partial FHA does not reflect considerations needed to properly develop an FHA. See Item 9d(1) and its associated subparagraphs for more complete guidance. R = Reserved, intentionally left blank.
Appendix B 1 AC 23.1309-1C —APPENDIX B. *SAMPLE FUNCTIONAL HAZARD ASSESSMENT (FHA) FORMAT Function Failure Condition Hazard Description Phase Effect of Failure Condi-tion on Aircraft/Crew Classification Reference to Supporting Material Verification Display of attitude information to control roll and pitch Annunciated loss of primary means (but not all) of attitude information used for control in roll and pitch.
All Crew would not be able to use primary means of attitude information, and would have to resort to backup means. As long as it is clear that the primary means cannot be relied upon, then backup means would create an increase in crew workload, but doubtful anything more severe.
Hypothetical cases where it is not clear as to the integrity of the information may come under the “Misleading attitude information” case below.
Major Aircraft fault tree Loss of all means of attitude information.
All Assuming IFR conditions, the crew would unknowingly follow incorrect attitude information, and inadvertently exceed attitude limits, which could result in the loss of control of the aircraft.
Catastrophic Aircraft fault tree *Note: This sample FHA is intended to be a guide for format purposes only to illustrate what items should be considered when performing an FHA. Since other pertinent information regarding the type of airplane and its features is not provided, the technical content may not be appropriate for other airplanes. See Item 9(d)(1) and its associated subparagraphs for more complete guidance.
Appendix B 2 AC 23.1309-1C —APPENDIX B. *SAMPLE FUNCTIONAL HAZARD ASSESSMENT (FHA) FORMAT Function Failure Condition Hazard Description Phase Effect of Failure Condi-tion on Aircraft/Crew Classification Reference to Supporting Material Verification Display of attitude information to control roll and pitch Incorrect attitude information on some display, but not on all displays (not misleading in nature).
All Generally, this condition would be the loss of one means of attitude information. For this condition, the crew would realize that this information was incorrect. If there is any chance this would not be clear, the scenario would have to be considered “Misleading attitude information” as described below.
Major Aircraft fault tree Misleading attitude information.
Note: If misleading data could be provided to the autopilot, that is handled under the autopilot failure conditions.
All Assuming IFR conditions, the crew would unknowingly follow incorrect attitude information, and inadvertently exceed attitude limits which could result in the loss of control of the aircraft.
Catastrophic Aircraft fault tree (Next Function) (First Related Failure Condition) (Next Related Failure Condition, and so on) *Note: This sample FHA is intended to be a guide for format purposes only to illustrate what items should be considered when performing an FHA. Since other pertinent information regarding the type of airplane and its features is not provided, the technical content may not be appropriate for other airplanes. See Item 9(d)(1) and its associated subparagraphs for more complete guidance.
Appendix C 1 APPENDIX C. CALCULATION OF THE
AVERAGE PROBABILITY PER FLIGHT HOUR The purpose of this material is to provide guidance for calculating the "Average Probability Per Flight Hour" for a Failure Condition so that it can be compared with the quantitative requirements of 14 CFR Part 23, § 23.1309.
The process of calculating the "Average Probability Per Flight Hour" for a Failure Condition will be described as a four-step process and is based on the assumption that the life of an aircraft is a sequence of "Average Flights."
Step 1: Determination of the "Average Flight;"
Step 2: Calculation of the probability of a Failure Condition for a certain "Average Flight;"
Step 3: Calculation of the "Average Probability Per Flight" of a Failure Condition; and Step 4: Calculation of the "Average Probability Per Flight Hour" of a Failure Condition.
a. Determination of the "Average Flight:” The "Average Probability Per Flight Hour" is to be based on an "Average Flight." The applicant should estimate the average flight duration and average flight profile for the fleet of aircraft to be certified. The average flight duration should be estimated based on the applicant’s expectations and historical experience for similar types. The average flight duration should reflect the applicant’s best estimate of the cumulative flight hours divided by the cumulative aircraft flights for the service life of the aircraft. The average flight profile should be based on the operating weight and performance expectations for the average aircraft when flying a flight of average duration in an International Civil Aviation Organization (ICAO) standard atmosphere. The duration of each flight phase (for example, takeoff, climb, cruise, descent, approach and landing) in the “Average Flight” should be based on the average flight profile. Average taxi times for departure and arrival at an average airport should be considered where appropriate and added to the average flight time to obtain "Average Flight-- Block Time." The average flight duration and profile should be used as the basis for determining the "Average Probability Per Flight Hour" for quantitative safety assessment on compliance with the requirements of this AC.
b. Calculation of the Probability of a Failure Condition for a certain "Average Flight:"
The probability of a Failure Condition occurring on an "Average Flight" should be determined by structured methods (see ARP 4761 for various methods) and should consider all elements (for example, combinations of failures and events) that contribute to a Failure Condition. If there is only an effect when failures occur in a certain order, the calculation should account for the conditional probability that the failures occur in the sequence necessary to produce a Failure Condition. The probabilities of the basic events (component or part level failures) that contribute to the probability of a Failure Condition should consider the following:
Appendix C 2
(1) The individual part, component, and assembly failure rates utilized in calculating the "Average Probability Per Flight Hour" should be estimates of the mature constant failure rates after infant mortality and prior to wear out, and should be based on all causes of failure (operational, environmental, etc.). Where available, service history of same or similar components in the same or in a similar environment should be used.
(2) If the failure is only relevant during certain flight phases, the calculation should be based on the probability of failure during the relevant "at risk" time for the "Average Flight."
(3) If one or more failed elements in the system can persist for multiple flights (latent, dormant, or hidden failures), the calculation has to consider the relevant exposure times (for example, time intervals between maintenance checks/ inspections). In such cases, the probability of the Failure Condition increases with the number of flights during the latency period.
(4) If the failure rate of one element varies during different flight phases, the calculation should consider the failure rate and related time increments in such a manner as to establish the probability of the Failure Condition occurring on an "Average Flight." It is assumed that the "Average Flight" can be divided into n phases (phase 1, ... , phase n). Let TF the "Average Flight" duration, Tj the duration of phase j and tj the transition point between Tj and Tj+1, j = 1, ... , n . I.e.
Let λj(t) the failure rate function during phase j, i.e. for t ∈ [tj-1,tj].
Remark: λj(t) may be equal 0 for all t ∈ [tj-1,tj] for a specific phase j.
Let PFlight (Failure) the probability that the element fails during one certain flight (including non-flying time) and PPhase j (Failure) the probability that the element fails in phase j.
Two cases are possible:
F j=1 n j j j-1 jT T and t - t T ; j = 1, ... , n = = ∑