(3) Major. Failure conditions that would reduce the capability of the airplane or the ability of the crew to cope with adverse operating conditions to the extent that there would be a significant reduction in safety margins or functional capabilities. In addition, the failure condition has a significant increase in crew workload or in conditions impairing crew efficiency;
or a discomfort to the flight crew or physical distress to passengers or cabin crew, possibly including injuries.
(4) Hazardous. Failure conditions that would reduce the capability of the airplane or the ability of the crew to cope with adverse operating conditions to the extent that there would be the following:
(a) A large reduction in safety margins or functional capabilities;
(b) Physical distress or higher workload such that the flight crew cannot be relied upon to perform their tasks accurately or completely; or
(c) Serious or fatal injury to an occupant other than the flight crew.
(5) Catastrophic. Failure conditions that are expected to result in multiple fatalities of the occupants, or incapacitation or fatal injury to a flight crewmember normally with the loss of the airplane.
Notes: (1) The phrase “are expected to result” is not intended to require 100 percent certainty that the effects will always be catastrophic. Conversely, just because the effects of a given failure, or combination of failures, could conceivably be catastrophic in extreme circumstances, it is not intended to imply that the failure condition will necessarily be considered catastrophic. (2) The term “catastrophic” was defined in previous versions of advisory materials as a failure condition that would prevent continued safe flight and landing.
w. Function. The lowest defined level of a specific action of a system, equipment, and flight crew performance aboard the airplane that, by itself, provides a complete recognizable operational capability (for example, an airplane heading is a function). One or more systems may contain a specific function or one system may contain multiple functions.
x. Functional hazard assessment. A systematic, comprehensive examination of airplane and system functions to identify potential minor, major, hazardous, and catastrophic failure conditions that may arise as a result of a malfunction or a failure to function.
y. Hazard. A potentially unsafe condition resulting from failures, malfunctions, external events, errors, or combinations thereof. This term is normally used in regulations and policy that is intended for single malfunctions or failures that are considered probable on the basis of either past service experience or analysis with similar components in comparable airplane applications, or both. There is no quantitative analysis intended in this application.
Note: There is a difference between “hazardous” as used in general policy or regulations and “hazardous failure condition” as used in an FHA. When the term "hazard" or 11
"hazardous" is used in general policy or regulations, it is generally used as shown in this definition. A hazard could be a failure condition that relates to major, hazardous, or catastrophic.
z. Improbable failure conditions. Those failure conditions unlikely to occur in each airplane during its total life, but that may occur several times when considering the total operational life of a number of airplanes of this type. Also, those failure conditions not anticipated to occur to each airplane during its total life but that may occur a few times when considering the total operational life of all airplanes of this type. For quantitative assessments, refer to the probability values shown for major and hazardous failure conditions in figure 2. For more specific guidance, see definitions of “remote failure conditions” and “extremely remote failure conditions.”
aa. Item. One or more hardware and/or software elements treated as a unit.
bb. Installation appraisal. A qualitative appraisal of the integrity and safety of the installation. Any deviations from normal industry-accepted installation practices should be evaluated.
cc. Latent failure. A failure is latent until it is made known to the flight crew or maintenance personnel.
dd. Malfunction. Failure of a system, subsystem, unit, or part to operate in the normal or usual manner. The occurrence of a condition whereby the operation is outside specified limits.
ee. Minimize. To reduce, lessen, or diminish a hazard to the least practical amount with current technology and materials. The least practical amount is that point at which the effort to further reduce a hazard significantly exceeds any benefit in terms of safety derived from that reduction. Additional efforts would not result in any significant improvements to safety and would inappropriately add to the cost of the product without a commensurate benefit.
ff. Power source. A system that provides power to installed equipment. This system would normally include prime mover(s), required power converter(s), energy storage device(s), and required control and interconnection means.
gg. Probable. Probable as defined for section 23.1309(a), as a probable malfunction or failure is any single malfunction or failure that is considered probable on the basis of either past service experience or analysis with similar components in comparable airplane applications, or both.
Note: Normally, there is no quantitative analysis intended in this application. This should not be confused with probable failure condition when used for a safety assessment process.
hh. Probable failure conditions. Those failure conditions anticipated to occur one or more times during the entire operational life of each airplane. These failure conditions may be determined on the basis of past service experience with similar components in comparable 12
airplane applications. For quantitative assessments, refer to the probability values shown for minor failure conditions in figure 2.
ii. Primary function. A function that is installed to comply with the applicable regulations for the required function and that provides the most pertinent controls or information instantly and directly to the pilot. For example, the PFD is a single physical unit that always provides the primary display of all the following: altitude, airspeed, aircraft heading (direction) and attitude located directly in front of the pilot in a fixed layout in accordance with § 23.1321. For controls such as brake or engine controls, the primary may be the backup systems. For example, a mechanical backup brake system could be considered to be the primary with regard to meeting the requirements and the electronic brake system would be the secondary.
jj. Primary system. A system that provides the primary function.
kk. Qualitative. Those analytical processes that assess system and airplane safety in an objective non-numerical manner.
ll. Quantitative. Those analytical processes that apply mathematical methods to assess the system and airplane safety.
mm. Redundancy. The presence of more than one independent means for accomplishing a given function. Each means of accomplishing the function need not be identical.
nn. Reliability. The determination that a system, subsystem, unit, or part will perform its intended function for a specified interval under certain operational and environmental conditions.
oo. Remote failure conditions. Those failure conditions that are unlikely to occur to each airplane during its total life but that may occur several times when considering the total operational life of a number of airplanes of this type. For quantitative assessments, refer to the probability values shown for major failure conditions in figure 2.
pp. Secondary system. A redundancy system that provides the same function as the primary system.
qq. Similarity. The process of showing that the equipment type, form, function, design, and installation is nearly identical to already approved equipment. The safety and operational characteristics and other qualities of the new proposed installation should have no appreciable affects on the airworthiness of the airplane.
rr. Simple. Usually a conventional system that can be evaluated by only qualitative analysis and it is not complex. Functional performance is determined by combination of tests and analyses. See the definitions for “conventional” and “complex” for more information.
ss. Single failure concept. The objective of this design concept is to permit the airplane to continue safe flight and landing after any single failure. Protection from multiple malfunctions or failures should be provided when the first malfunction or failures would not be detected 13
during normal operations of the airplane, which includes preflight checks, or if the first malfunction or failure would inevitably cause other malfunctions or failures.
tt. System. A combination of components, parts, and elements that are interconnected to perform one or more functions.
uu. Warning. A clear and unambiguous indication to the flight crew or pilot of a failure that requires immediate corrective action. An inherent characteristic of the airplane or a device that will give clearly distinguishable indications of malfunction or misleading information may provide this warning.
9. Application of § 23.1309(a), (a)(1), (a)(2), and (a)(3), as adopted by Amendments 23-41 and 23-49.
a. If the certification basis for the airplane is Amendment 23-14, § 23.1309(a) (See NOTE below) is appropriate to use for systems in airplanes approved to fly either VFR or IFR, or both.
With the certification basis at Amendment 23-14, systems that meet the single-fault concept should comply with the requirements of § 23.1309(a) if the guidance in the next section of this AC is used. Under the certification basis at Amendment 23-14, compliance with § 23.1309(b) is not required and a safety assessment is not necessary, but it may be used. For complex systems, the requirements of Amendment 23-14 may not provide an adequate level of safety; then, the certification basis should be Amendment 23-41 or 23-49 as appropriate. In accordance with AC
21.101.1, in cases where no regulatory standards are defined in the existing certification basis for the design change, but applicable regulatory standards exist in a subsequent amendment to the regulations, the subsequent amendment will be made part of the certification basis. Therefore, the change must comply with later appropriate regulations.
Note: All references to regulatory sections in this AC refer to § 23.1309, as amended by Amendment 23-49. The requirements of paragraphs (a), (a)(1), (a)(2), and (a)(3) of § 23.1309, as amended by Amendments 23-41 and 23-49, are the same requirements in paragraphs (a), (b), and (c) of § 23.1309, as amended by Amendment 23-14.
b. Experienced engineering and operational judgment should be applied when determining whether or not a system is complex. Comparison with similar, previously approved systems is sometimes helpful. All relevant systems attributes should be considered. If the system contains software or complex hardware, a system safety assessment will be needed to determine the level of certitude for the processes in RTCA/DO-178B or RTCA/DO-254 or equivalent. For example, the design may be complex, such as a satellite communication system used only by the passenger, but its failure may cause only minor safety effects.
10. Showing compliance with the requirements of § 23.1309.
a. In order to show compliance with the requirements of § 23.1309(a), (a)(1), (a)(2), and
(a)(3), it will be necessary to verify that the installed systems and equipment will cause no unacceptable adverse effects and to verify that the airplane is adequately protected against any hazards that could result from probable malfunctions or failures. Analyze, inspect, and test 14
equipment, systems, and installations to ensure compliance with the requirements of § 23.1309(a), (a)(1), (a)(2), and (a)(3).
b. A step-by-step diagram to comply with § 23.1309(a), (a)(1), (a)(2), and (a)(3) is shown in figure 1, and these steps are listed below.
(1) Evaluate all airplane systems and equipment in order to determine whether they are the following:
(a) Essential to safe operation; or
(b) Not essential to safe operation.
(2) Determine that operation of installed equipment has no unacceptable adverse effects.
Verify this by applicable flight or ground checks, as follows:
(a) If it can be determined that the operation of the installed equipment will not adversely affect equipment essential to safe operation, the requirements of § 23.1309(a)(1)(i) have been satisfied; and
(b) If it is determined that the operation of the installed equipment has an adverse affect on equipment not essential to safe operation and a means exists to inform the pilot of the effect, the requirements of § 23.1309(a)(1)(ii) have been met. An acceptable means to inform the pilot that the affected system is not performing properly would include any visual or aural method (flags, lights, horns, loss of display, etc.).
(3) Determine that failure or malfunction of the installed equipment could not result in unacceptable hazards.
(a) All equipment should be evaluated for general installation hazards. These types of hazards would normally include those hazards that would directly compromise the safety of the airplane or its occupants, such as fire, smoke, explosion, toxic gases, depressurization, etc. A hazard could also result from loss of equipment or systems essential to safe operations when the minimum required functions are lost. Individual failure of redundant equipment would not necessarily be considered a hazard. For example, the single failure of either a communication transceiver or a navigation receiver (but not both) during IFR operation is not considered a hazard; however, a single failure of a common power supply to those systems would be considered a hazard.
FIGURE 1. METHOD TO COMPLIANCE DIAGRAM OF § 23.1309(a)
Start Assessment All Airplanes Corrective Measures Unacceptable Will Operation of this Equipment have Adverse Effect on Equipment Essential to Safe Operation?
Any Adverse Effect on Other Equipment?
Is there a means to Inform the Pilot of Effect?
Meets Requirements of § 23.1309(a)(1) Will Any Probable Failure or Malfunction Result in a Hazard?
Corrective Measures Unacceptable Single or Multiengine?
Has Hazard Been Minimized?
Meets Requirements of § 23.1309(a)(2) & (3) Yes Yes No No No Yes Yes No Yes No Yes Single Engine Multiengine
(b) Systems and equipment essential to safe operation should also be assessed for probability of malfunction or failure. Where the installation is conventional, and where there is a high degree of similarity in installations and a significant amount of service history is available for review, this determination can be an engineering judgment. Service history should show that the past malfunctions or failures have not resulted in hazards and there are no unresolved problems.
(c) Hazards that have been identified and found to result from probable failures are not acceptable in multiengine airplanes. In these situations, a design change may be required to remove the hazard or to reduce the probability of failure, such as increasing redundancy, substitution of more reliable equipment, annunciation, etc.
(d) If it has been determined that a probable failure or malfunction could result in a hazard to a single-engine airplane, that hazard should be minimized. To minimize is to reduce, lessen, or diminish a hazard to the least practical amount with current technology and materials.
The least practical amount is that point at which the effort to further reduce a hazard significantly exceeds any benefit in terms of safety derived from that reduction. Additional efforts would not result in any significant improvements of safety and would inappropriately add to the cost of the product without a commensurate benefit. This determination should come from an experienced engineering judgment based on the criticality of the hazard and the intended kinds of operation.
11. Application of § 23.1309(a)(4), as adopted by Amendment 23-49.
a. For those commuter airplanes that include the certification basis of Amendments 23-34, 23-41, or 23-49, § 23.1309(a)(4) requires all applicable systems and installations to be designed to safeguard against hazards to the airplane in the event of their failure. This requirement in § 23.1309(a)(4) for commuter airplanes was introduced into Title 14 Code of Federal Regulations (14 CFR) part 23 airplanes by Amendment 23-34 before the safety assessment process was included by Amendment 23-41.
b. Design features should be taken into account to safeguard against hazards either by ensuring that the failure condition will not occur or by having redundancy or annunciation with the associated flight crew’s corrective action. The reliability should be such that independent failures of the redundant systems are not probable during the same flight. If a redundant system is required, a probable failure in one system should not adversely affect the other system’s operation. No probable failure should result in a “safe” indication of an “unsafe” condition so that the flight crew would incorrectly assume the system is available or functional. When the unsafe condition is annunciated or detected, the airplane flight manual (AFM) should have clear and precise corrective procedures for handling the failure without an excessive increase in workload.
c. Service history for similar installations may be utilized to meet part or all of this requirement if a system or installation has significant and favorable service history in environments similar to the airplane. The claim of similarity should be based on equipment type, function, design and installation similarities, and other relevant attributes. It is the applicant’s 18
responsibility to provide accepted/approved data that supports any claims of similarity to a previous installation. More information is available in Order 8110.4C.
12. Application of § 23.1309(b), as adopted by Amendments 23-41 and 23-49.
a. If the certification basis is Amendment 23-41 or later, the requirements of § 23.1309(b) are applicable. The installed systems should be evaluated by performing a safety assessment as shown in this AC. The depth and scope of the safety assessment depends on the types of functions performed by the systems, the severity of the failure conditions, and whether the system is complex. For instance, the safety assessment for a slightly modified single-engine airplane with simple systems might consist only of an FHA with a design and installation appraisal. This FHA will be much less extensive than the FHA for a commuter category or a multiple turbine-engine airplane with more complex systems. The types of analyses selected by an applicant and approved by the certification authority should be based on factors such as the system architecture, complexity, particular design, etc.
b. The safety objective is to ensure an acceptable safety level for equipment and systems installed on the airplane. A logical and acceptable inverse relationship should exist between the average probability per flight hour and the severity of failure conditions effects (as shown in figure 2). This figure defines the appropriate airplane systems probability standards for four certification classes of airplanes designed to 14 CFR part 23 standards. The relationship between probability and severity of failure condition effects is as follows:
(1) Failure conditions with no safety effect have no probability requirement.
(2) Minor failure conditions may be probable.
(3) Major failure conditions must be no more frequent than remote.
(4) Hazardous failure conditions must be no more frequent than extremely remote.
(5) Catastrophic failure conditions must be extremely improbable.
13. Four certification classes of airplanes.
a. The four-certification classes of airplanes for this AC are shown in figure 2. They are as follows: Class I (Typically SRE under 6,000 pounds (lbs.) (Maximum Certificated Gross Takeoff Weight)), Class II (Typically MRE, MTE and STE, under 6,000 pounds), Class III (Typically SRE, STE, MRE, and MTE equal or over 6,000 pounds), and Class IV (Typically Commuter Category). The acronyms for these airplanes in the four classes of part 23 airplanes are Single Reciprocating Engine (SRE), Multiple Reciprocating Engine (MRE), Single Turbine Engine (STE), and Multiple Turbine Engine (MTE).
b. Numerical values are assigned for use in those cases where the impact of system failures is examined by quantitative methods of analysis. Also, the related software and complex hardware DALs for the various failure conditions are part of the matrix in figure 2 for most systems. These levels should be used unless there are some unique architecture considerations.
For these unusual situations there should be specific policy, guidance, or approval by the Small Airplane Directorate. See paragraph 21 for more information. The new probability standards 19
are based on historical accident data, systems analyses, and engineering judgment for each class of airplane.
FIGURE 2. RELATIONSHIP AMONG AIRPLANE CLASSES, PROBABILITIES,
SEVERITY OF FAILURE CONDITIONS, AND SOFTWARE AND COMPLEX HARDWARE DALs
Classification of Failure Conditions No Safety Effect <----Minor-----> <----Major----> <--Hazardous--->
< Catastrophic> Allowable Qualitative Probability No Probability Requirement Probable Remote Extremely Remote Extremely Improbable Effect on Airplane No effect on operational capabilities or safety Slight reduction in functional capabilities or safety margins Significant reduction in functional capabilities or safety margins Large reduction in functional capabilities or safety margins Normally with hull loss
Effect on Occupants Inconvenience for passengers
Physical discomfort for passengers
Physical distress to passengers, possibly including injuries Serious or fatal injury to an occupant Multiple fatalities Effect on Flight Crew No effect on flight crew Slight increase in workload or use of emergency procedures Physical discomfort or a significant increase in workload Physical distress or excessive workload impairs ability to perform tasks Fatal Injury or incapacitation Classes of Airplanes:
Allowable Quantitative Probabilities and Software (SW) and Complex Hardware (HW) DALs (Note
2)
<10-3 Note 1 & 4 P=D, S=D
<10-4 Notes 1 & 4 P=C, S=D P=D, S=D(Note 5)
<10-5 Notes 4 P=C, S=D P=D, S=D(Note 5)
<10-6 Note 3 P=C, S=C
Class I No Probability or SW & HW DALs Requirement (Typically SRE under 6,000 lbs.)
<10-3 Note 1 & 4 P=D, S=D
<10-5 Notes 1 & 4 P=C, S=D P=D, S=D(Note 5)
<10-6 Notes 4 P=C, S=C P=D, S=D(Note 5)
<10-7 Note 3 P=C, S=C
Class II (Typically MRE, STE, or MTE under 6000 lbs.)
No Probability or SW & HW DALs Requirement
No Probability or SW & HW DALs Requirement
<10-3 Note 1 & 4 P=D, S=D
<10-5 Notes 1 & 4 P=C, S=D
<10-7 Notes 4 P=C, S=C
Class III (Typically SRE,
STE, MRE, & MTE equal or over 6000 lbs.)
<10-8 Note 3 P=B, S=C
Class IV (Typically Commuter Category)
No Probability or SW & HW DALs Requirement
<10-3 Note 1 & 4 P=D, S=D
<10-5 Notes 1 & 4 P=C, S=D
<10-7 <10-9 Notes 4 Note 3 P=B, S=C P=A, S=B
Note 1: Numerical values indicate an order of probability range and are provided here as a reference. The applicant is usually not required to perform a quantitative analysis for minor and major failure conditions. See figure 3.
Note 2: The alphabets denote the typical SW and HW DALs for most primary system (P) and secondary system (S). For example, HW or SW DALs Level A on primary system is noted by P=A. See paragraphs 13 & 21 for more guidance.
Note 3: At airplane function level, no single failure will result in a catastrophic failure condition.
Note 4. Secondary system (S) may not be required to meet probability goals. If installed, S should meet stated criteria.
Note 5. A reduction of DALs applies only for navigation, communication, and surveillance systems if an altitude encoding altimeter transponder is installed and it provides the appropriate mitigations. See paragraphs 13 & 21 for more information.
c. In assessing the acceptability of a design, the FAA recognized the need to establish rational probability values. Historically, failures in GA airplanes that might result in catastrophic failure conditions are predominately associated with the primary flight instruments in IMC. Historical evidence indicates that the probability of a fatal accident in restricted visibility due to operational and airframe-related causes is approximately one per ten thousand flight hours or 1 x 10-4 per flight hour for single-engine airplanes under 6,000 pounds.
Furthermore, from accident data bases, it appears that about 10 percent of the total was attributed to failure conditions caused by the airplane's systems. It is reasonable to expect that the probability of a fatal accident from all such failure conditions would not be greater than one per one hundred thousand flight hours or 1 x 10-5 per flight hour for a newly designed airplane. From past service history, it is also assumed, that there are about ten potential failure conditions in an airplane that could be catastrophic. The allowable target average probability per flight hour of 1 x 10-5 was thus apportioned equally among these failure conditions, which resulted in an allocation of not greater than 1 x 10-6 to each. The upper limit for the average probability per flight hour for catastrophic failure conditions would be 1 x 10-6, which establishes an approximate probability value for the term "extremely improbable."
Failure conditions having less severe effects could be relatively more likely to occur. Similarly, airplanes over 6,000 pounds have a lower fatal accident rate; therefore, they have a lower probability value for catastrophic failure conditions.
d. Acceptable criteria for DALs levels of part 23 airplanes are shown in figure 2. Note 5 allows an additional reduction of DALs for navigation, communication, and surveillance systems if an altitude encoding altimeter transponder is installed and it provides the appropriate mitigations. This option does not apply to CAT II/III operations. DALs in figure 2, under Note 5, have been determined if an altitude encoding altimeter transponder is installed and provides the appropriate mitigations so that failure of navigation and communication systems used for IFR operations do not affect other airplanes. If the transponder is based on DAL, the DAL should be developed to at least Level C. If this option is used, the AFM must include a limitation such as, “A transponder with a valid altitude reporting mode must be operating for IFR operations unless otherwise instructed by ATC.” Proper separation is provided by the Air Traffic Control (ATC) surveillance system and Traffic Collision Avoidance System (TCAS) equipped airplanes in IFR operations in the NAS or other equivalent airspace systems.
e. The criteria shown in figure 2 directly reflect the historical accident and equipment probability of failure data in the Civil Air Regulations (CAR) 3 and 14 CFR part 23 airplane fleet. Characteristics of the airplane, such as stall speed, handling characteristics, cruise altitude, ease of recognizing system failures, recognition of entry into stall, pilot workload, and other factors (which include pilot training and experience) affect the ability of the pilot to safely handle various types of system failures in small airplanes. The criteria considered over all airplanes’ failure conditions is based on service experience, operational exposure rates, and total airplane system reliability. The values for individual system probability of failure could be higher than probability values shown in figure 2 for specific failure conditions since it considers the installed airplane systems, events, and factors.
f. These classes were defined based on the way accident and safety statistics are currently collected. Generally, the classes deal with airplanes of historically equivalent levels of system 22
complexity, type of use, system reliability, and historical divisions of airplanes according to these characteristics. However, these classes could change because of new technologies. The placement of a specific airplane in a class should be done in reference to all of the airplane’s missions and performance characteristics. The applicant should have the concurrence of the certification authority that is knowledgeable about the applicable airplane class early in the program. When unusual situations develop, consult the Small Airplane Directorate to obtain specific policy guidance or approval.
g. For example, airplanes with considerably more than 10 catastrophic failure conditions, that have greater performance characteristics and incorporate many complex systems and advance technologies may have lower probability values and higher DALs. These airplanes probability values and DALs may fall between the classes of the airplanes. For example, the performance characteristics of a complex airplane including airplane handling qualities and stall speed may be similar to existing Class II airplanes. However, this airplane’s mission and other performance characteristics including high speed, high altitude, and extended range operations may be similar to existing Class III airplanes. The major difference between the DALs for Class II and Class III airplanes is for primary systems whose failure would result in a catastrophic failure condition for the airplane. Since this complex airplane falls between these two classes, it is reasonable to choose the higher DAL and a lower probability level.
h. For example, in part 23, turbine-engine airplanes traditionally have been subject to more stringent requirements than a single-engine reciprocating airplane. A single-engine reciprocating airplane generally has a wider stall-cruise speed ratio than traditional turbine-engine airplanes.
Such an airplane with a stall speed under 61 knots with simple systems, and with otherwise similar characteristics to a traditional single-engine reciprocating airplane (except for a higher cruise speed and a more reliable engine that is simpler to operate), can be treated as a Class I airplane under this analysis. Conversely, if a single-engine reciprocating airplane has the performance, mission capability, and system complexity of a higher class (such as cabin pressurization, high cruise altitude, and extended range), then that type of airplane design may align itself with the safety requirements of a higher class (for example, Class II airplane). These determinations should be made during the development of the certification basis.
i. This AC uses terminology similar to AC 25.1309-1A. However, the specific means of compliance for § 25.1309 of part 25 are defined differently due to the higher level of safety required for transport category airplanes.
14. Safety assessments.
a. The applicant is responsible for identifying and classifying each failure condition and for choosing the methods for safety assessment. The applicant should then obtain early concurrence of the cognizant certificating authority on the identification of failure conditions, their classifications, and the choice of an acceptable means of compliance. Figure 3 provides an overview of the information flow to conduct a safety assessment. This figure is a guide and it does not include all information provided in this AC or the documents referenced in section 4 of this AC.