U.S. Department of Transportation Federal Aviation Administration
Advisory Circular
Subject: SYSTEM SAFETY ANALYSIS AND ASSESSMENT FOR PART 23
AIRPLANES Date: 1/16/09 Initiated by: ACE-100 AC No: 23.1309-1D
This advisory circular (AC) sets forth an acceptable means of showing compliance with Title 14 of the Code of Federal Regulations (14 CFR) § 23.1309(a) and (b) (Amendment 23-49) for equipment, systems, and installations in 14 CFR part 23 airplanes.
This AC is not mandatory and does not constitute a regulation. It is issued for guidance purposes and to outline a method of compliance with the rules. An applicant may elect to follow an alternative method, provided the FAA finds it to be an acceptable means of complying with the applicable requirements of 14 CFR. However, if the applicant uses the means described in the AC, they must follow it in all important respects.
s/ James E. Jackson Acting Manager, Small Airplane Directorate Aircraft Certification Service
TABLE OF CONTENTS Section Page
1. What is the purpose of this AC?1
4. Related regulations and documents1
5. Applicability3
6. Regulations and AC background4
7. Acronyms7
8. Definitions8
9. Application of § 23.1309(a), (a)(1), (a)(2), and (a)(3), as adopted by Amendments 23-41
and 23-4914
10. Showing compliance with the requirements of § 23.130914
11. Application of § 23.1309(a)(4), as adopted by Amendment 23-4918
12. Application of § 23.1309(b), as adopted by Amendments 23-41 and 23-4919
13. Four certification classes of airplanes19
14. Safety assessments23
15. Failure conditions28
16. Assessment methods29
17. Assessment of failure condition probabilities and analysis considerations31
18. Testing and compliance with the requirements of §§ 23.1301 and 23.130932
19. Operational and maintenance considerations33
21. Software and complex hardware DALs for airborne system and applications34
22. Information only note for future policy35
APPENDIX 1. PARTIAL LIST OF FUNCTIONAL HAZARD ASSESSMENT (FHA) FOR CONSIDERATION TO MEET 14 CFR PART 23 REQUIREMENTS FOR IFR
CLASS I AIRPLANESA1
APPENDIX 2. SAMPLE FUNCTIONAL HAZARD ASSESSMENT (FHA) FORMAT..A2
APPENDIX 3. CALCULATION OF THE AVERAGE PROBABILITY PER FLIGHT
HOURA3
iii (and iv)
1. What is the purpose of this AC?
a. This AC provides guidance and information for an acceptable means, but not the only means, for showing compliance with the requirements of § 23.1309(a) and (b) (Amendment 23-
49) for equipment, systems, and installations in Title 14 Code of Federal Regulations (14 CFR) part 23 airplanes.
b. This material is neither mandatory nor regulatory in nature and does not constitute a regulation. It describes acceptable means, but not the only means, for demonstrating compliance with the applicable regulations. We will consider other methods of demonstrating compliance that an applicant may elect to present. While these guidelines are not mandatory, they are derived from extensive FAA and industry experience in determining compliance with the relevant regulations. Whenever an applicant’s proposed method of compliance differs from this guidance, the proposal should be coordinated with the Small Airplane Directorate Standards Staff, ACE-110. In addition, if an office believes that an applicant’s proposal that meets this guidance should not be approved, that office should coordinate its response with the Small Airplane Directorate Standards Staff, ACE-110.
c. Terms such as “shall” or “must” are used in this AC only in the sense of ensuring applicability of this particular method of compliance when the acceptable method of compliance described herein is used. The word “shall” and “must” is also used in this AC when referring to a specific regulation or guidance that is essential when the applicant uses this AC for the means of compliance. In this case there is no deviation. The word “should” is used to express a recommendation. Deviation from the specified recommendation may require justification.
2. Who does this AC apply to? The guidance provided in this document is directed to airplane manufacturers, modifiers, foreign regulatory authorities, Federal Aviation Administration (FAA) part 23 airplane type certification engineers, and designees.
3. Cancellation. This AC cancels AC 23.1309-1C, Equipment, Systems, and Installations in Part 23 Airplanes, dated March 12, 1999.
It also cancels PS-ACE100-2005-50001, Applying AC 20-152, “RTCA, Inc., Document RTCA/DO-254, Design Assurance Guidance for Airborne Electronic Hardware,” to Title 14 Code of Federal Regulations, Part 23 Aircraft; dated January 26, 2007
4. Related regulations and documents.
a. Regulations. Sections 23.1301 and 23.1309 of part 23 (through Amendment 23-49).
b. ACs, orders, and policy. You may access the ACs, notices, orders, and policy on the FAA website: www.faa.gov. You may obtain copies of current editions of the following publications free from the U.S. Department of Transportation, Subsequent Distribution Office, M-30, Ardmore East Business Center, 3341 Q 75th Avenue, Landover, MD 20785.
AC 20-115B RTCA, Inc., Document RTCA/DO-178B
AC 20-152 RTCA, Inc., Document RTCA/DO-254, Design Assurance Guidance for Airborne Electronic Hardware
AC 21-16E RTCA, Inc. Document RTCA/DO-160E, Environmental Conditions and Test Procedures for Airborne Equipment
AC 23-17B Systems and Equipment Guide for Certification of Part 23 Airplanes and Airships
AC 23.1311-1B Installation of Electronic Displays in Part 23 Airplanes
AC 20-136A Protection of Aircraft Elect rical/Electronic Systems Against the Indirect Effects of Lightning
AC 20-158 The Certification of Aircraft Electrical and Electronic Systems for Operation in the High-Intensity Radiated Fields (HIRF) Environment
AC 21.101.1 Establishing the Certification Basis of Changed Aeronautical Products
AC 20-138A Airworthiness Approval of Global Navigation Satellite System (GNSS) Equipment
AC 25.1309-1A System Design and Analysis
AC 33.75-1 Guidance material for 14 CFR section 33.75, Safety Analysis
Order 8110.4C Type Certification
Policy Statement ACE100-2004-10024; Installation of Electronic Engine Control for Reciprocating Engine
c. Industry documents. You may obtain copies of current editions of the following publications as follows. These documents are excellent resource materials.
(1) RTCA documents. The following RTCA documents are available from RTCA, Inc., Suite 805, 1828 L Street NW, Washington, DC 20036-4001 or at their website at www.rtca.org.
RTCA/DO-160E Environmental Conditions and Test Procedures for Airborne Equipment
RTCA/DO-178A/B Software Considera tions in Airborne Systems and Equipment Certification
RTCA/DO-254 Design Assurance Guidance for Airborne Electronic Hardware
(2) Society of Automotive Engineers (SAE), Inc. The following Society of Automotive Engineers (SAE), Inc., documents are available from SAE, 400 Commonwealth Drive, Warrendale, PA 15096-0001 or from their website at www.sae.org.
ARP 4754 Certification Considerations for Highly Integrated or Complex Aircraft Systems
ARP 4761 Guidelines and Methods for Conducting the Safety Assessment Process on Civil Airborne Systems and Equipment Note: ARP’s 4754 and 4761 state that these documents describe guidelines and methods of performing the safety assessment for certification of civil aircraft. They further state that the guidance material in these ARP’s were developed in the context of 14 CFR part 25 and the Joint Aviation Requirements 25 (JAR 25). They are primarily associated with showing compliance with part 25, § 25.1309/JAR 25.1309. A subset of this material may be applicable to non-25.1309 equipment, such as other requirements in parts 23, 25, 27, 29, and 33. However, some of the processes included are not necessary or appropriate for part 23 airplanes. ARP 4754 contains information on applying specific engineering methods that an applicant may wish to utilize in whole or in part.
This AC is not intended to constrain the applicant to the use of these documents in the definition of their particular methods of satisfying the objectives of this AC. However, these documents contain material and methods of performing the System Safety Assessment (SSA) that an applicant may choose to use. The guidance in this AC takes precedence over the recommended practices in these ARP’s if there is a conflict. Contact the Small Airplane Directorate if there are conflicts with other guidance or ACs and this AC.
5. Applicability.
a. This AC is generally applicable only to the original applicant seeking issuance of a type certificate (TC), amended type certificate (ATC), and supplemental type certificate (STC) for the initial approval of the new type design or a change in the type design. This document addresses general applicability, and it should not be utilized to replace any specific guidance intended for individual types of equipment, systems, and installations. For simple and conventional mechanical or analog electromechanical systems, or both, with well established design and 3
certification processes and where the installation is not complex, the single-fault concept and experience that are based on service-proven designs and engineering judgment are appropriate.
In this case, a Functional Hazard Assessment (FHA), a design appraisal, and an installation appraisal addressed in this AC may satisfy § 23.1309(b).
b. Section 23.1309 does not apply to the performance, flight characteristics, and structural loads and strength requirements of subparts B, C and D, but it does apply to systems on which compliance with the requirements of subparts B, C, and D is based. For example, it does not apply to an airplane's inherent stall characteristics or their evaluation of § 23.201, but it does apply to a stick pusher (stall barrier) system installed to attain compliance with § 23.201.
c. Section 23.1309 is applicable to the installation of all airplane systems and equipment, which includes pneumatic systems, fluid systems, electrical/electronic systems, mechanical systems, and powerplant systems included in the airplane design, except for the following:
(1) Systems and installations approved only as part of a type-certificated engine or propeller, and
(2) The flight structure (such as wings, fuselage, empennage, control surfaces, mechanical flight control cables, pushrods, control horns, engine mounts, and structural elements of the landing gear) requirements are specified in subparts C and D of part 23.
Note: The current Small Airplane Directorate Standards Office policy on electronic engine control (EEC) installation in small airplanes, under § 23.1309, has been to issue two special conditions. The first special condition applies § 23.1309(a) through (e) to the propulsion system installation since § 23.1309(f)(1) may exclude the requirements that should apply. The second special condition is protection of the EEC from exposure to High Intensity Radiated Fields (HIRF). The § 23.1309 certification evaluation should be limited to the interfaces of the engine/control system and verification that none of the assumptions made for part 33 certification of the engine are invalidated by the installation.
The analysis should not extend into data submitted and approved as part of the engine certification program. See policy statement, Installation of Electronic Engine Control for Reciprocating Engine; PS-ACE100-2004-10024, for more information.
6. Regulations and AC background.
a. Regulation.
(1) Amendment 23-14 adopted the original airworthiness standards in § 23.1309(a).
Before Amendment 23-14 to part 23 (effective December 20, l973), neither Part 3 of the Civil Air Regulations (CAR) nor 14 CFR part 23 contained safety requirements in § 23.1309 for equipment, systems, and installations for small airplanes. In 1968, the FAA instituted an extensive review of the airworthiness standards of part 23. Because of the increased use of part 23 airplanes in all weather operations and the pilot’s increased reliance on installed systems and equipment, the Federal Aviation Administration (FAA) issued § 23.1309 to provide for an acceptable level of safety for such equipment, systems, and installations. When the FAA adopted § 23.1309 (Amendment 23-14), it did not envision that systems that perform critical 4
functions would be installed in small airplanes; therefore, before Amendment 23-41, this section did not contain safety standards for evaluating critical functions. When such equipment, systems, and installations were included in the airplane design, they were evaluated under special conditions in accordance with the procedures of 14 CFR part 21.
(2) With the adoption of Amendment 23-34 (effective February 17, 1987), § 23.1309 was expanded to include certification of commuter category airplanes. This expansion added a requirement to ensure that applicable systems and installations are designed to safeguard against hazards. It also added requirements for equipment identified as essential loads and the affected power sources.
(3) With the adoption of Amendment 23-41 (effective November 26, 1990), § 23.1309 retained the existing safety requirements adopted by Amendment 23-14 for airplane equipment, systems, and installations that are not complex and that do not perform critical functions. For those cases where the applicant finds it necessary or desirable to include complex systems, or systems that perform critical functions, Amendment 23-41, § 23.1309, provides additional requirements for identifying such equipment, systems, and installations. It also provides additional requirements needed for certification. This amendment permitted the approval of more advanced systems having the capability to perform critical functions.
(4) With the adoption of Amendment 23-49 (effective March 11, 1996), § 23.1309(a)(4) was amended to correct the error in Amendment 23-41, which inadvertently removed the commuter category requirement. Amendment 23-34 originally added the commuter category requirements of § 23.1309(a)(4) to part 23 as § 23.1309(d), but the requirements were inadvertently not incorporated into § 23.1309 as adopted by Amendment 23-41. Amendment 23- 49 corrected this error by again adding the requirements to part 23 as § 23.1309(a)(4).
(5) Qualitative and quantitative analyses are often used in assessing the acceptability of complex designs that have a high degree of integration, that use new technology, that are new or different applications of conventional technology, or are designs that perform critical functions.
These assessments lead to the selective use of quantitative analyses both to support experienced engineering and operational judgment and to supplement qualitative analyses and tests.
Numerical probability ranges, associated with the terms used in § 23.1309(b), are accepted for evaluating quantitative analyses that have a logical and acceptable inverse relationship between the probability and severity of each failure condition.
b. AC.
(1) Revision to AC.
(a) The revision from AC 23.1309-1B to AC 23.1309-1C on March 12, 1999, provided the four-tier certification classes with different criteria for probability of failures and software levels for systems. The purpose of this certification approach is to increase safety by enhancing equipment on General Aviation (GA) airplanes that facilitate new technologies for GA airplanes.
(b) Since the issuance of AC 23.1309-1C, there has been a large number of electronic displays and electronic systems installed on part 23 airplanes, especially Primary Flight Displays (PFD), Multifunction Flight Displays (MFD), Integrated Flight Systems, and Synthetic Vision Systems (SVS). These installations, especially on the Class I and II airplanes, would have been too costly for these airplanes without the establishment of the four-tier certification classes of airplanes as shown in paragraph 13. In a study of the Capstone program, it was determined that the four-tier certification classes has demonstrated significant operational safety benefit and reduced accident rates.
(2) Broad causes of fatal accidents. Accident rate is a function of many factors. These factors include human performance, weather, design, operation, training, maintenance, and airspace system infrastructure. For all airplanes, but particularly GA airplanes, pilot decisionmaking causes most accidents. Pilot decision-making accidents, the largest single cause, often are the result of a lack of situational awareness relative to terrain or weather, or to a loss of control due to excess workload. Correct pilot interventions and actions have prevented some of these accidents. An increase in avionics equipage rates that improved pilot situational awareness or simplify the task had a significant positive impact on the GA accident rate. The Air Safety Foundation of the Aircraft Owners and Pilots Association conducted a study of safety effects of glass cockpits and they concluded that technologically advanced aircraft provide added situational awareness tools that have dramatically improved aspects of GA safety.
Technologically advanced aircraft has delivered multiple safety benefits to GA pilots, but pilot training tied to experience has to evolve with it.
(3) Installing affordable systems.
(a) Enhancing the quantity, quality, and presentation of situational data available to the pilot in the cockpit can improve pilot situational awareness, efficiency, and safety. Many studies have shown that equipping these airplanes with safety devices such as Terrain Awareness Warning Systems, Graphical Weather Displays, Map Displays, Integrated Flight Systems, SVS, and Enhanced Vision Systems may dramatically reduce a number of accident types. Pilots have reported that integrated flight displays help reduce workload, improve situational awareness, and safety.
(b) The aviation industry as a whole is on the threshold of a revolutionary change in communication, navigation, and surveillance of aircraft operations. The Next Generation Air Transportation System will overhaul the National Airspace System (NAS) to take advantage of new technology and will likely result in the long-term replacement of nearly all avionics and instrument equipment in the existing fleet as well as in new production aircraft. Facilitating the installation of safety equipment should enhance NAS efficiency and safety. If GA is to operate within a revised NAS system, new technologies should be available and affordable for GA aircraft. With the four-class certification criteria, new technologies are affordable for GA. If GA had only one class for certification, due to the cost of equipment for the NAS architecture, implementation would be incomplete or exclude large portions of the GA fleet from the NAS system. Neither situation is desirable or acceptable.
7. Acronyms.
14 CFR Code of Federal Regulations for the Federal Aviation Regulation AC Advisory Circular AFM Airplane Flight Manual AFMS Airplane Flight Manual Supplement ARP Aerospace Recommended Practice ATC Amended Type Certificate CAR Civil Air Regulations CFR Code of Federal Regulations CHT Cylinder Head Temperature DAL Development Assurance Level EEC Electronic Engine Control EGT Engine Gas Temperature EPR Engine Pressure Ratio FAA Federal Aviation Administration FHA Functional Hazard Assessment FMEA Failure Modes and Effects Analysis FTA Fault Tree Analysis GA General Aviation GNSS Global Navigation Satellite System HW Hardware HIRF High Intensity Radiated Fields ICA Instructions for Continued Airworthiness ICAO International Civil Aviation Organization IFR Instrument Flight Rules ILS Instrument Landing System IMC Instrument Meteorological Conditions JAR Joint Aviation Requirements MFD Multifunction Flight Display MRE Multiple Reciprocating Engine MTE Multiple Turbine Engine MTBF Mean Time Between Failures NAS National Airspace System P Primary System PFD Primary Flight Display PSSA Preliminary System Safety Assessment R Reserved S Secondary System SAE Society of Automotive Engineers SRE Single Reciprocating Engine SSA System Safety Assessment STE Single Turbine Engine STC Supplemental Type Certificate SVS Synthetic Vision Systems SW Software 7
TCAS Traffic Collision Avoidance System TIA Type Inspection Authorization TAWS Terrain Awareness Warning System TC Type Certificate TIT Turbine Inlet Temperature TSO Technical Standard Order VFR Visual Flight Rules WAAS Wide Area Augmentation System
8. Definitions.
a. Adverse effect. A response of a system that results in an undesirable operation of an airplane system, or subsystem.
b. Analysis and assessment. The terms "analysis" and "assessment" are used throughout.
Each has a broad definition and the two terms are, to some extent, interchangeable. However, the term “analysis” generally implies a more specific and more detailed evaluation, while the term “assessment” may be a more general or broader evaluation but may include one or more types of analysis. In practice, the meaning comes from the specific application (for example, FTA, Markov analysis, PSSA, etc.).
c. Adverse operating condition. A set of environmental or operational circumstances applicable to the airplane, combined with a failure or other emergency situation that results in a significant increase in normal flight crew workload.
d. Attribute. A feature, characteristic, or aspect of a system or a device, or a condition affecting its operation. Some examples would include design, construction, technology, installation, functions, applications, operational uses, and environmental and operational stresses. It would also include relationships with other systems, functions, and flight or structural characteristics.
e. Average probability per flight hour. A representation of the number of times the subject failure condition is predicted to occur during the entire operating life of all airplanes of a type divided by the anticipated total operating hours of all airplanes of that type.
Note: The average probability per flight hour is normally calculated as the probability of a failure condition occurring during a typical flight of mean duration divided by that mean duration. See Appendix 3.
f. Caution. A clear and unambiguous indication to the flight crew or pilot of a failure that requires subsequent crew action. An inherent characteristic of the airplane or a device that will give clearly distinguishable indications of malfunction or misleading information may provide this caution.
g. Complex. A system is “complex” when its operation, failure modes, or failure effects are difficult to comprehend without the aid of analytical methods or structured assessment methods.
FMEA and FTA are examples of such structured assessment methods. Increased system 8
complexity is often caused by such items as sophisticated components and multiple interrelationships. For these types of systems, portion of the compliance may be shown by the use of DALs such as by processes in RTCA/DO-178B or RTCA/DO-254 or equivalent. See the definitions for “conventional” and “simple” for more information.
h. Continued safe flight and landing. This phrase means that the airplane is capable of continued controlled flight and landing, possibly using emergency procedures, without requiring exceptional pilot skill or strength. Upon landing, some airplane damage may occur as a result of a failure condition.
i. Conventional. A system is considered “conventional” if its function, the technological means to implement its function, and its intended usage are all the same as, or closely similar to, that of previously approved systems that are commonly used. The systems that have established an adequate service history and the means of compliance for approval are generally accepted as "conventional." Normally conventional and simple systems may be analyzed by qualitative assessments and usually do not contain software or complex hardware that require compliance by detailed processes. See the definitions for complex and simple for more information.
j. Critical function. A function whose loss would prevent the continued safe flight and landing of the airplane.
Note: The term “critical function” is associated with a catastrophic failure condition. Newer documents may not refer specifically to the term “critical function.”
k. Design appraisal. A qualitative appraisal of the integrity and safety of the system design. An effective appraisal requires experienced judgment.
l. Design assurance level. All of those planned and systematic actions used to substantiate, at an adequate level of confidence, that design errors have been identified and corrected such that the items (hardware, software) satisfy the applicable certification basis. This term may be used in some SAE and RTCA documents, but in this AC it is intended that design assurance levels will correlate to same levels as the DALs for the safety assessment process. See section 22 for more information.
m. DAL. All those planned and systematic actions used to substantiate, to an adequate level of confidence, that errors in requirements, design, and implementation have been identified and corrected such that the system satisfies the applicable certification basis.
Note: For this AC, DALs in figure 2 and throughout this AC are also intended to correlate to software levels in RTCA/DO-178B and complex hardware design assurance levels in RTCA/DO-254 for the system or item. See section 21 for more information.
n. Equipment essential to safe operation. Equipment installed in order to comply with the applicable certification requirements of part 23 or operational requirements of parts 91, 121, and
135.
o. Error. An omission or incorrect action by a crewmember or maintenance personnel, or a mistake in requirements, design, or implementation.
p. Essential function. A function whose loss would reduce the capability of the airplane or the ability of the crew to cope with adverse operating conditions.
Note: The term “essential function” is associated with failure conditions between major and hazardous. Newer documents may not refer specifically to the term “essential function.”
q. Event. An internal or external occurrence that has its origin distinct from the airplane, such as atmospheric conditions (for example, gusts, temperature variations, icing, and lightning strikes, runway conditions, conditions of communication, navigation, and surveillance services, bird-strike, fire, leaking fluids, tire burst, HIRF exposure, lightning, uncontained failure of high energy rotating machines, etc.). The term is not intended to cover sabotage.
r. Essential load. Equipment essential to safe operation that requires a power source for normal operation.
s. Extremely remote failure conditions. Those failure conditions not anticipated to occur to each airplane during its total life but which may occur a few times when considering the total operational life of all airplanes of this type. For quantitative assessments, refer to the probability values shown for hazardous failure conditions in figure 2.
t. Extremely improbable failure condition. For commuter category airplanes, those failure conditions so unlikely that they are not anticipated to occur during the entire operational life of all airplanes of one type. For other classes of airplanes, the likelihood of occurrence may be greater. For quantitative assessments, refer to the probability values shown for catastrophic failure conditions in figure 2.
u. Failure. An occurrence that affects the operation of a component, part, or element such that it can no longer function as intended (this includes both loss of function and malfunction).
Note: Errors may cause failures but are not considered failures.
v. Failure conditions. A condition having an affect on either the airplane or its occupants, or both, either direct or consequential, which is caused or contributed to by one or more failures or errors considering flight phase and relevant adverse operational or environmental conditions or external events. Failure conditions may be classified according to their severity as follows:
(1) No safety effect. Failure conditions that would have no affect on safety (that is, failure conditions that would not affect the operational capability of the airplane or increase crew workload).
(2) Minor. Failure conditions that would not significantly reduce airplane safety and involve crew actions that are well within their capabilities. Minor failure conditions may include a slight reduction in safety margins or functional capabilities, a slight increase in crew workload (such as routine flight plan changes), or some physical discomfort to passengers or cabin crew.