Subject: EQUIPMENT, SYSTEMS, AND INSTALLATIONS IN PART 23 AIRPLANES Date: 3/12/99 Initiated By: ACE-100 AC No: 23.1309-1C Change:
1. PURPOSE. This advisory circular (AC) provides guidance and information for an acceptable means, but not the only means, for showing compliance with the requirements of § 23.1309(a) and
(b) (Amendment 23-49) for equipment, systems, and installations in Title 14 Code of Federal Regulations (14 CFR) Part 23 airplanes. This material is neither mandatory nor regulatory in nature and does not constitute a regulation.
a. Broad Causes of Fatal Accidents:
(1) The primary objective of this revision to the AC is to improve the safety of the airplane fleet by fostering the incorporation of both new technologies that address pilot error and weather related accidents and those technologies that can be certificated affordably under 14 CFR Part 23.
Pilot error accidents, the largest single cause, often are the result of a lack of situational awareness relative to terrain or weather, or to a loss of control due to excess workload. Incorporating technologies that exceed the capability and reliability of the systems found in the current fleet, which primarily have a certification basis prior to Amendment 23-41, should improve safety. This strategy is in concert with the Federal Aviation Administration’s (FAA) safety objective to reduce accidents.
(2) Accident rate is a function of many factors, which include human performance, weather, design, operation, training, maintenance, and airspace system infrastructure. For all airplanes, but particularly General Aviation (GA) airplanes, pilot error causes most accidents. Correct pilot interventions and actions could prevent some of these accidents. A reduction in the frequency or the severity of the effects of errors has the greatest potential for improving aviation safety. An increase in avionics equipage rates and improved pilot situational awareness should have a significant positive impact on the GA accident rate.
b. Installing Affordable Systems:
(1) Enhancing the quantity, quality, and presentation of situational data available to the pilot in the cockpit can improve pilot situational awareness. Many studies have shown that equipping
2 these airplanes with safety devices such as Terrain Awareness Warning Systems and Advanced Weather Display Systems may dramatically reduce a number of accident types. For GA airplanes, the cost of such devices currently is prohibitive. The cost of certifying these systems in airplanes is an added layer to the recurring cost per part and per installation. Lower equipage rates associated with increased costs impede safety benefits.
(2) Appropriate human factors in the design, operation, and use of systems and equipment may contribute to enhancing safety. The safety improvements from the widespread use of this equipment should be much greater than the accidents that might result from failure or malfunction of the equipment. This improvement should occur even if an increase in the number of equipment failures results from a relaxation of the existing certification standards.
(3) The certification standards being changed were incorporated by using the standards developed for transport airplanes. Incorporation of these standards into Part 23 resulted in a significant increase in equipment reliability standards. That is, they required much lower probability values for failure conditions than the existing operational safety history of different airplane classes.
Current data indicates that these probability values were not realistic. Since most aircraft accidents are caused by something other than equipment failures, increasing the reliability of the installed systems to try to improve safety will have little positive effect on reducing aircraft accidents when compared with reducing accidents due to pilot error. If systems are required to meet safety and reliability parameters much greater than the operational environment, the cost of the improved systems are driven to a level that makes them impractical. The aviation industry as a whole is on the threshold of a revolutionary change in communication, navigation, and surveillance of aircraft operations. This complete overhaul of the National Airspace System (NAS) is intended to take advantage of new technology and will likely result in the long-term replacement of nearly all avionics and instrument equipment in the existing fleet as well as in new production aircraft. If general aviation is to operate within a revised NAS system, new technologies must be available and affordable for GA aircraft. Under the existing certification process, new technologies such as digital communications, data buses, satellite-based navigation, and data links would be unaffordable for GA. This situation would result in either incomplete NAS architecture implementation or exclusion of large portions of the GA fleet from the NAS system. Neither situation is desirable or acceptable.
(4) This AC is revised to facilitate the introduction of safety enhancing new technologies for GA airplanes. Overall, facilitating the installation of safety equipment may enhance NAS safety. A multi-tiered certification with different criteria for probability of failure and software development assurance may be acceptable for systems and for enhancing equipment on GA airplanes.
Probability of failures and Software Assurance Development Levels that are different from the criteria applicable to transport airplanes are justified.
2. CANCELLATION. AC 23.1309-1B, Equipment, Systems, and Installations in Part 23 Airplanes, dated July 28, 1995, is canceled.
3. RELATED REGULATIONS AND DOCUMENTS.
a. Regulations: Sections 23.1301 and 23.1309 of Part 23 (through Amendment 23-49).
b. Advisory Circulars and Notices: Obtain the AC's listed below from the U.S. Department of Transportation, Subsequent Distribution Office, Ardmore East Business Center, 3341 Q 75th Avenue, Landover, MD 20785:
AC 20-53A Protection of Aircraft Fuel Systems Against Fuel Vapor Ignition Due to Lightning AC 20-115B RTCA, Inc., Document RTCA/DO-178B AC 20-136 Protection of Aircraft Electrical/Electronic Systems Against the Indirect Effects of Lightning AC 21-16D RTCA/DO160D AC 23-15 Small Airplane Certification Compliance Program AC 23.1311-1A Installation of Electronic Displays in Part 23 Airplanes AC 23.1329-2 Automatic Pilot System Installation in Part 23 Airplanes AC 25.1309-1A System Design and Analysis
c. Industry Documents:
(1) Obtain the RTCA documents listed below from the RTCA, Inc., 1140 Connecticut Avenue, NW, Suite 1020, Washington, D.C. 20036-4001:
RTCA/DO-160D Environmental Conditions and Test Procedures for Airborne Equipment RTCA/DO-178A/B Software Considerations in Airborne Systems and Equipment Certification
(2) Obtain the SAE documents listed below from the Society of Automotive Engineers, Inc., 400 Commonwealth Drive, Warrendale, PA 15096-0001:
ARP 926A/B Fault/Failure Analysis Procedure ARP 1834/A Fault/Failure Analysis for Digital Systems and Equipment ARP 4754 Certification Considerations for Highly Integrated or Complex Aircraft Systems ARP 4761 Guidelines and Methods for Conducting the Safety Assessment Process on Civil Airborne Systems and Equipment
4 Note: Historically, Aerospace Recommended Practices (ARP’s) 926A and 1834 provided appropriate guidance for safety assessment of Part 23 airplanes. ARP’s 926B and 1834A revised ARP’s 926A and 1834, respectively. The scope sections of ARP’s 926B and 1834A state that ARP 4761 provides updated methods and processes for use on civil aircraft safety assessments.
When performing civil aircraft safety assessments, ARP-4761 should be used in lieu of ARP’s 926B or 1834A. If ARP’s 926B or 1834A are used, specific processes addressed in ARP 4761, but not in ARP’s 926B or 1834A, should be considered.
ARP’s 4754 and 4761 state that these documents describe guidelines and methods of performing the safety assessment for certification of civil aircraft. They further state that the guidance material in these ARP’s were developed in the context of 14 CFR Part 25 and the Joint Aviation Requirements 25 (JAR 25). They are primarily associated with showing compliance with Part 25, § 25.1309/JAR 25.1309. A subset of this material may be applicable to non-25.1309 equipment, such as other requirements in Parts 23, 25, 27, 29, and 33. However, some of the processes included are not necessary or appropriate for Part 23 airplanes. ARP 4754 contains tutorial information on applying specific engineering methods that an applicant may wish to utilize in whole or in part.
This AC is not intended to constrain the applicant to the use of these documents in the definition of their particular methods of satisfying the objectives of this AC. However, these documents contain material and methods of performing the System Safety Assessment that an applicant may choose to use.
d. Related Reading Material: A comprehensive discussion of lightning protection, with additional nonregulatory guidance information, is available in the current edition of FAA Report DOT/FAA/CT-89/22, “Aircraft Lightning Protection Handbook,” dated September 1989. This document is available to the public through the National Technical Information Service, Springfield, VA 22161.
4. APPLICABILITY.
a. This AC is generally applicable only to the original applicant seeking issuance of a type certificate (TC), amended type certificate (ATC), and supplemental type certificate (STC) for the initial approval of the new type design or a change in the type design. This document addresses general applicability, and it should not be utilized to replace any specific guidance intended for individual types of equipment, systems, and installations. Because § 23.1309 is a regulation of general requirements, it should not be used to supersede any specific requirements of Part 23.
However, since software is not addressed elsewhere in Part 23, the software development assurance criteria of this AC are applicable. For example, § 23.1311, Electronic display instrument systems, has specific requirements on the number of electronic displays required for attitude, airspeed, and altitude; therefore, § 23.1309 should not be used to increase or decrease the requirements (except for determining the Software Development Assurance Level). For either mechanical or analog electromechanical systems, or both, where the installation is not complex, the single-fault concept and experience that are based on service-proven designs and engineering judgment are appropriate. In this case, a Functional Hazard Assessment (FHA), a design appraisal, and an installation appraisal, in accordance with Item 9.d.(6), may satisfy § 23.1309(b).
b. Section 23.1309 does not apply to the performance, flight characteristics, and structural loads and strength requirements of Subparts C and D, but it does apply to any system on which compliance with the requirements of Subparts B, C, and D is based. For example, it does not apply to an airplane's inherent stall characteristics or their evaluation of § 23.201, but it does apply to a stick pusher (stall barrier) system installed to attain compliance with § 23.201.
c. Section 23.1309 is applicable to the installation of all airplane systems and equipment, which includes pneumatic systems, fluid systems, electrical/electronic systems, mechanical systems, and powerplant systems included in the airplane design, except for the following:
(1) Systems and installations approved only as part of a type-certificated engine or propeller, and
(2) The flight structure (such as wings, fuselage, empennage, control surfaces, mechanical flight control cables, pushrods, control horns, engine mounts, and structural elements of the landing gear) requirements are specified in Subparts C and D of Part 23.
5. BACKGROUND.
a. Amendment 23-14 adopted the original airworthiness standards in § 23.1309(a). Prior to Amendment 23-14 to Part 23 (effective December 20, l973), neither Part 3 of the Civil Air Regulations (CAR) nor 14 CFR Part 23 contained safety requirements in § 23.1309 for equipment, systems, and installations for small airplanes. In 1968, the FAA instituted an extensive review of the airworthiness standards of Part 23. Because of the increased use of Part 23 airplanes in all weather operations and the pilot’s increased reliance on installed systems and equipment, the FAA promulgated § 23.1309 to provide for an acceptable level of safety for such equipment, systems, and installations. When the FAA adopted § 23.1309 (Amendment 23-14), it did not envision that systems that perform critical functions would be installed in small airplanes; therefore, prior to Amendment 23-41, this section did not contain safety standards for evaluating critical functions.
When such equipment, systems, and installations were included in the airplane design, they were evaluated under special conditions in accordance with the procedures of 14 CFR Part 21.
b. With the adoption of Amendment 23-34 (effective February 17, 1987), § 23.1309 was expanded to include certification of commuter category airplanes. This expansion added a requirement to ensure that applicable systems and installations are designed to safeguard against hazards. It also added requirements for equipment identified as essential loads and the affected power sources.
c. With the adoption of Amendment 23-41 (effective November 26, 1990), § 23.1309 retained the existing safety requirements adopted by Amendment 23-14 for airplane equipment, systems, and installations that are not complex and that do not perform critical functions. For those cases where the applicant finds it necessary or desirable to include complex systems, or systems that perform critical functions, Amendment 23-41, § 23.1309, provides additional requirements for identifying such equipment, systems, and installations. It also provides additional requirements needed for certification. This amendment permitted the approval of more advanced systems having the capability to perform critical functions.
d. With the adoption of Amendment 23-49 (effective March 11, 1996), § 23.1309(a)(4) was amended to correct the error in Amendment 23-42, which inadvertently removed the commuter category requirement. Amendment 23-34 originally added the commuter category requirements of § 23.1309(a)(4) to Part 23 as § 23.1309(d), but the requirements were inadvertently not incorporated into § 23.1309 as adopted by Amendment 23-41. Amendment 23-49 corrected this error by again adding the requirements to Part 23 as § 23.1309(a)(4).
e. Qualitative and quantitative analyses are often used in assessing the acceptability of complex designs that have a high degree of integration, that use new technology, that are new or different applications of conventional technology, or are designs that perform critical functions. These assessments lead to the selective use of quantitative analyses both to support experienced engineering and operational judgment and to supplement qualitative analyses and tests. Numerical probability ranges, associated with the terms used in § 23.1309(b), are accepted for evaluating quantitative analyses that have a logical and acceptable inverse relationship between the probability and severity of each Failure Condition.
6. DEFINITIONS.
a. Adverse Effects: A response of a system that results in an undesirable operation of an airplane system, or subsystem.
b. Analysis and Assessment: The terms "analysis" and "assessment" are used throughout.
Each has a broad definition and the two terms are, to some extent, interchangeable. However, the term “analysis” generally implies a more specific and more detailed evaluation, while the term “assessment” may be a more general or broader evaluation but may include one or more types of analysis. In practice, the meaning comes from the specific application (for example, Fault Tree Analysis (FTA), Markov Analysis, Preliminary System Safety Assessment (PSSA), etc.).
c. Adverse Operating Condition: A set of environmental or operational circumstances applicable to the airplane, combined with a failure or other emergency situation that results in a significant increase in normal flight crew workload.
d. Attribute: A feature, characteristic, or aspect of a system or a device, or a condition affecting its operation. Some examples would include design, construction, technology, installation, functions, applications, operational uses, and environmental and operational stresses. It would also include relationships with other systems, functions, and flight or structural characteristics.
e. Average Probability Per Flight Hour: This term is defined for this AC as a representation of the number of times the subject Failure Condition is predicted to occur during the entire operating life of all airplanes of a type divided by the anticipated total operating hours of all airplanes of that type. (Note: The Average Probability Per Flight Hour is normally calculated as the probability of a failure condition occurring during a typical flight of mean duration divided by that mean duration.) See Appendix C.
f. Complex: A system is “Complex“ when its operation, failure modes, or failure effects are difficult to comprehend without the aid of analytical methods. Failure Modes and Effects Analysis (FMEA) and FTA are examples of such methods.
g. Continued Safe Flight and Landing: This phrase means that the airplane is capable of continued controlled flight and landing, possibly using emergency procedures, without requiring exceptional pilot skill or strength. Upon landing, some airplane damage may occur as a result of a Failure Condition.
h. Conventional: A system is considered “Conventional” if its function, the technological means to implement its function, and its intended usage are all the same as, or closely similar to, that of previously approved systems that are commonly used. The systems that have established an adequate service history and the means of compliance for approval are generally accepted as "Conventional."
i. Critical Function: A function whose loss would prevent the continued safe flight and landing of the airplane. Note: The term “Critical Function” is associated with a Catastrophic Failure Condition. Newer documents may not refer specifically to the term “Critical Function.”
j. Design Appraisal: A qualitative appraisal of the integrity and safety of the system design, such as the effective use of design techniques to verify that failures of a system do not adversely affect other systems. An effective appraisal requires experienced judgment.
k. Development Assurance: All those planned and systematic actions used to substantiate, to an adequate level of confidence, that errors in requirements, design, and implementation have been identified and corrected such that the system satisfies the applicable certification basis.
l. Equipment Essential to Safe Operation: Equipment installed in order to comply with the applicable certification requirements of Part 23 or operational requirements of Parts 91 and 135.
m. Error: An omission or incorrect action by a crewmember or maintenance personnel, or a mistake in requirements, design, or implementation.
n. Essential Function: A function whose loss would reduce the capability of the airplane or the ability of the crew to cope with adverse operating conditions. Note: The term “Essential Function” is associated with Failure Conditions between Major and Hazardous. Newer documents may not refer specifically to the term “Essential Function.”
o. Event: An occurrence that has its origin distinct from the airplane, such as atmospheric conditions (for example, gusts, temperature variations, icing, and lightning strikes), runway conditions, conditions of communication, navigation, and surveillance services, bird-strike, cabin and baggage fires. The term is not intended to cover sabotage.
p. Essential Load: Equipment essential to safe operation that requires a power source for normal operation.
q. Extremely Remote Failure Conditions: Those Failure Conditions not anticipated to occur to each airplane during its total life but which may occur a few times when considering the total operational life of all airplanes of this type. For quantitative assessments, refer to the probability values shown for Hazardous Failure Conditions in Figure 2.
r. Extremely Improbable Failure Conditions: For commuter category airplanes, those Failure Conditions so unlikely that they are not anticipated to occur during the entire operational life of all airplanes of one type. For other classes of airplanes, the likelihood of occurrence may be greater. For quantitative assessments, refer to the probability values shown for Catastrophic Failure Conditions in Figure 2.
s. Failure: An occurrence that affects the operation of a component, part, or element such that it can no longer function as intended (this includes both loss of function and malfunction).
Note: Errors may cause failures but are not considered failures.
t. Failure Conditions: A condition having an effect on either the airplane or its occupants, or both, either direct or consequential, which is caused or contributed to by one or more failures or errors considering flight phase and relevant adverse operational or environmental conditions or external events. Failure Conditions may be classified according to their severity as follows:
(1) No Safety Effect: Failure Conditions that would have no affect on safety (that is, Failure Conditions that would not affect the operational capability of the airplane or increase crew workload).
(2) Minor: Failure Conditions that would not significantly reduce airplane safety and involve crew actions that are well within their capabilities. Minor Failure Conditions may include a slight reduction in safety margins or functional capabilities, a slight increase in crew workload (such as routine flight plan changes), or some physical discomfort to passengers or cabin crew.
(3) Major: Failure Conditions that would reduce the capability of the airplane or the ability of the crew to cope with adverse operating conditions to the extent that there would be a significant reduction in safety margins or functional capabilities; a significant increase in crew workload or in conditions impairing crew efficiency; or a discomfort to the flight crew or physical distress to passengers or cabin crew, possibly including injuries.
(4) Hazardous: Failure Conditions that would reduce the capability of the airplane or the ability of the crew to cope with adverse operating conditions to the extent that there would be the following:
(i) A large reduction in safety margins or functional capabilities;
(ii) Physical distress or higher workload such that the flight crew cannot be relied upon to perform their tasks accurately or completely; or
(iii) Serious or fatal injury to an occupant other than the flight crew.
(5) Catastrophic: Failure Conditions that are expected to result in multiple fatalities of the occupants, or incapacitation or fatal injury to a flight crewmember normally with the loss of the airplane. Notes: (1) The phrase “are expected to result” is not intended to require 100 percent certainty that the effects will always be catastrophic. Conversely, just because the effects of a given failure, or combination of failures, could conceivably be catastrophic in extreme circumstances, it is not intended to imply that the failure condition will necessarily be considered catastrophic. (2) The term “Catastrophic” was defined in previous versions of the rule and the advisory material as a Failure Condition that would prevent continued safe flight and landing.
u. Function: The lowest defined level of a specific action of a system, equipment, and flight crew performance aboard the airplane that, by itself, provides a complete recognizable operational capability (for example, an airplane heading is a function). One or more systems may contain a specific function or one system may contain multiple functions.
v. Functional Hazard Assessment: A systematic, comprehensive examination of airplane and system functions to identify potential Minor, Major, Hazardous, and Catastrophic Failure Conditions that may arise as a result of a malfunction or a failure to function.
w. Hazard: Any condition that compromises the overall safety of the airplane or that significantly reduces the ability of the flight crew to cope with adverse operating conditions.
x. Improbable Failure Conditions: Those Failure Conditions unlikely to occur in each airplane during its total life but that may occur several times when considering the total operational life of a number of airplanes of this type. Also, those Failure Conditions not anticipated to occur to each airplane during its total life but that may occur a few times when considering the total operational life of all airplanes of this type. For quantitative assessments, refer to the probability values shown for Major and Hazardous Failure Conditions in Figure 2. For more specific guidance, see definitions of “Remote Failure Conditions” and “Extremely Remote Failure Conditions.”
y. Installation Appraisal: A qualitative appraisal of the integrity and safety of the installation.
Any deviations from normal industry-accepted installation practices, such as clearances or tolerances, should be evaluated, especially when appraising modifications that are made after entry into service.
z. Latent Failure: A failure is latent until it is made known to the flight crew or maintenance personnel. A significant latent failure is one that would, in combination with one or more specific failures or events, result in a Hazardous or Catastrophic Failure Condition.
aa. Malfunction: Failure of a system, subsystem, unit, or part to operate in the normal or usual manner. The occurrence of a condition whereby the operation is outside specified limits.
bb. Minimize: To reduce, lessen, or diminish a hazard to the least practical amount with current technology and materials. The least practical amount is that point at which the effort to further reduce a hazard significantly exceeds any benefit in terms of safety derived from that reduction. Additional efforts would not result in any significant improvements to safety and would inappropriately add to the cost of the product without a commensurate benefit.
10 cc. Power Source: A system that provides power to installed equipment. This system would normally include prime mover(s), required power converter(s), energy storage device(s), and required control and interconnection means.
dd. Probable Failure Conditions: Those Failure Conditions anticipated to occur one or more times during the entire operational life of each airplane. These Failure Conditions may be determined on the basis of past service experience with similar components in comparable airplane applications.
ee. Primary Function: A function that is installed to comply with the applicable regulations for the required function and that provides the most pertinent controls or information instantly and directly to the pilot.
ff. Qualitative: Those analytical processes that assess system and airplane safety in an objective non-numerical manner.
gg. Quantitative: Those analytical processes that apply mathematical methods to assess the system and airplane safety.
hh. Redundancy: The presence of more than one independent means for accomplishing a given function. Each means of accomplishing the function need not necessarily be identical.
ii. Reliability: The determination that a system, subsystem, unit, or part will perform its intended function for a specified interval under certain operational and environmental conditions.
jj. Remote Failure Conditions: Those Failure Conditions that are unlikely to occur to each airplane during its total life but that may occur several times when considering the total operational life of a number of airplanes of this type. For quantitative assessments, refer to the probability values shown for Major Failure Conditions in Figure 2.
kk. Similarity: The process of showing that the equipment type, form, function, design, and installation is nearly identical to already approved equipment. The safety and operational characteristics and other qualities should have no appreciable affects on the airworthiness of the installation.
ll. Single Failure Concept. The objective of this design concept is to permit the airplane to continue safe flight and landing after any single failure. Protection from multiple malfunctions or failures should be provided when the first malfunction or failures would not be detected during normal operations of the airplane, which includes preflight checks, or if the first malfunction or failure would inevitably cause other malfunctions or failures.
mm. System: A combination of components, parts, and elements that are interconnected to perform one or more functions.
nn. Warning: A clear and unambiguous indication to the flight crew or pilot of a failure that requires immediate corrective action. An inherent characteristic of the airplane or a device that will give clearly distinguishable indications of malfunction or misleading information may provide this
11 warning. Note: The requirements of §§ 23.1309(b)(3) and 23.1322 are incompatible. Until such time as a rule change can resolve this discrepancy, if immediate crew recognition and corrective or compensatory action by the crew is required, a warning must be provided. If immediate crew awareness is required and subsequent crew action will be required, a caution should be provided.
7. APPLICATION OF § 23.1309(a), (a)(1), (a)(2), AND (a)(3), AS ADOPTED BY AMENDMENTS 23-41 AND 23-49.
a. If the certification basis for the airplane is Amendment 23-14, § 23.1309(a) (See NOTE) is appropriate to use for systems in airplanes approved to fly either Visual Flight Rules (VFR) or Instrument Flight Rules (IFR), or both. Systems that meet the single-fault concept comply with the requirements of § 23.1309(a). Compliance with § 23.1309(b) is not required and a safety assessment is not necessary, but it may be used. For complex systems, the requirements of Amendment 23-14 may not provide an adequate level of safety.
NOTE: All references to regulatory sections in this paragraph refer to § 23.1309, as amended by Amendment 23-49. The requirements of paragraphs (a), (a)(1), (a)(2), and (a)(3) of § 23.1309, as amended by Amendments 23-41 and 23-49, are the same requirements in paragraphs (a), (b), and
(c) of § 23.1309, as amended by Amendment 23-14.
b. Experienced engineering and operational judgment should be applied when determining whether or not a system is complex. Comparison with similar, previously approved systems is sometimes helpful. All relevant systems attributes should be considered; however, the complexity of the software and hardware need not be a dominant factor in the determination of the need to conduct a system safety assessment. For example, the design may be complex, such as a satellite communication system used only by the passenger, but its failure may cause only minor safety effects.
c. In order to show compliance with the requirements of § 23.1309(a), (a)(1), (a)(2), and (a)(3), it will be necessary to verify that the installed systems and equipment will cause no unacceptable adverse effects and to verify that the airplane is adequately protected against any hazards that could result from probable malfunctions or failures. A probable malfunction or failure is any single malfunction or failure that is considered probable on the basis of either past service experience or analysis with similar components in comparable airplane applications, or both. Multiple malfunctions or failures should be considered probable if either the first malfunction or failure would not be detected during normal operation of the system, which includes preflight checks, or if the first malfunction or failure would inevitably lead to other malfunctions or failures. Analyze, inspect, and test equipment, systems, and installations to ensure compliance with the requirements of § 23.1309(a), (a)(1), (a)(2), and (a)(3). A step-by-step diagram to comply with § 23.1309(a),
(a)(1), (a)(2), and (a)(3) is shown in Figure 1, and these steps are listed below.
(1) Evaluate all airplane systems and equipment in order to determine whether they are the following:
(i) Essential to safe operation; or
(ii) Not essential to safe operation.
(2) Determine that operation of installed equipment has no unacceptable adverse effects.
Verify this by applicable flight or ground checks, as follows:
(i) If it can be determined that the operation of the installed equipment will not adversely affect equipment essential to safe operation, the requirements of § 23.1309(a)(1)(i) have been satisfied; and
(ii) If it is determined that the operation of the installed equipment has an adverse affect on equipment not essential to safe operation and a means exists to inform the pilot of the effect, the requirements of § 23.1309(a)(1)(ii) have been met. An acceptable means to inform the pilot that the affected system is not performing properly would include any visual or aural method (flags, lights, horns, loss of display, etc.).
(3) Determine that failure or malfunction of the installed equipment could not result in unacceptable hazards.
(i) All equipment should be evaluated for general installation hazards. These types of hazards would normally include those hazards that would directly compromise the safety of the airplane or its occupants, such as fire, smoke, explosion, toxic gases, depressurization, etc. A hazard could also result from loss of equipment or systems essential to safe operations when the minimum required functions are lost. Individual failure of redundant equipment would not necessarily be considered a hazard. For example, the single failure of either a communication transceiver or a navigation receiver (but not both) during IFR operation is not considered a hazard;
however, a single failure of a common power supply to those systems would be considered a hazard.
(ii) Systems and equipment essential to safe operation should also be assessed for probability of malfunction or failure if loss of required functions could result in a hazard. Where the installation is conventional, and where there is a high degree of similarity in installations and a significant amount of service history is available for review, this determination can be an engineering judgment.
(iii) Hazards that have been identified and found to result from probable failures are not acceptable in multiengine airplanes. In these situations, a design change may be required to remove the hazard or to reduce the probability of failure, such as increasing redundancy, substitution of more reliable equipment, annunciation, etc.
(iv) If it has been determined that a probable failure or malfunction could result in a hazard to a single-engine airplane, that hazard should be minimized. To minimize is to reduce, lessen, or diminish a hazard to the least practical amount with current technology and materials.
The least practical amount is that point at which the effort to further reduce a hazard significantly exceeds any benefit in terms of safety derived from that reduction. Additional efforts would not result in any significant improvements of safety and would inappropriately add to the cost of the