b. Functional hazard assessment (FHA).
(1) Before an applicant proceeds with a detailed safety assessment, an FHA of the airplane and system functions to determine the need for and the scope of subsequent analysis should be prepared. This assessment may be conducted using service experience, engineering and operational judgment, or service experience and a top-down deductive qualitative examination of each function. An FHA is a systematic, comprehensive examination of airplane and system functions to identify potential no safety effect, minor, major, hazardous, and catastrophic failure conditions that may arise, not only as a result of malfunctions or failure to function but also as a result of normal responses to unusual or abnormal external factors. The FHA concerns the operational vulnerabilities of systems rather than a detailed analysis of the actual implementation.
(2) Each system function should be examined regarding the other functions performed by the system because the loss or malfunction of all functions performed by the system may result in a more severe failure condition than the loss of a single function. In addition, each system function should be examined regarding functions performed by other airplane systems because the loss or malfunction of different but related functions, provided by separate systems, may affect the severity of failure conditions postulated for a particular system.
(3) The FHA is an engineering tool that should be performed early in the design and updated as necessary. It is used to define the high-level airplane or system safety objectives that should be considered in the proposed system architectures. Also, it should be used to assist in determining the DALs for the systems. Many systems may need only a simple review of the system design by the applicant to determine the hazard classification. An FHA requires experienced engineering judgment and early coordination between the applicant and the certification authority.
FIGURE 3. DEPTH OF ANALYSIS FLOW CHART
(4) Depending on the extent of functions to be examined and the relationship between functions and systems, different approaches to FHA may be taken. Where there is a clear correlation between functions and systems, and where system, and hence function, interrelationships are relatively simple, it may be feasible to conduct separate FHA’s for each system providing any interface aspects are properly considered and are easily understood.
However, a top down approach, from an airplane level perspective, should be taken in planning and conducting FHA where system and function interrelationships are more complex.
(5) After each failure condition is classified, refer to figure 2 to identify the failure condition probability and software and complex hardware DALs. For example, the probability requirement for a hazardous failure condition for a Class I airplane should be less than 1 x 10-5.
In addition, the primary system should have software and complex hardware DALs of C and, if required, the secondary system should have software and complex hardware DALs of D.
(6) The classification of failure conditions does not depend on whether a system or function is required by any specific regulation. Some systems required by specific regulations, such as transponders, position lights, and public address systems, may have the potential for only minor failure conditions. Conversely, other systems not required by any specific regulation, such as flight management systems and automatic landing systems, may have the potential for major, hazardous, or catastrophic failure conditions.
(7) The classification of failure conditions should consider all relevant factors.
Examples of factors include the nature of the failure modes, which includes common mode faults, system degradation resulting from failures, flight crew actions, flight crew workload, performance degradation, reduced operational capability, effects on airframe, etc. It is particularly important to consider factors that would alleviate or intensify the severity of a failure condition. An example of an alleviating factor would be the continued performance of identical or operationally similar functions by other systems not affected by a failure condition. Examples of intensifying factors would include unrelated conditions that would reduce the ability of the crew to cope with a failure condition, such as weather or other adverse operational or environmental conditions. The ability of a system to inform the pilot of potential or real failure conditions so that timely corrective action can be taken to reduce the effects of the combination of events is desirable. This approach may reduce the severity of the failure condition.
(8) Because of the large number of combinations of failures, various mitigating factors, airplane characteristic effects, and similar factors, a specific FHA and the related safety assessments may be significantly different for each airplane type and configuration evaluated.
These factors preclude providing a concrete example of a FHA that applies across the board to every installation. However, general examples may be provided that illustrate the concepts involved in an FHA. It is critical to understand that significant engineering judgment and common sense are necessary to provide a practical and acceptable evaluation of the airplane and its systems.
c. Appendix 1 provides a partial list of FHA for consideration for part 23 IFR Class I airplanes with typical functions and, in general, the related failure conditions are at the aircraft level. The criteria at the aircraft level are useful to derive the system FHA. The failure conditions for the examples in Appendix 1 cannot be applied indiscriminately to a particular airplane installation. This table is provided primarily for use to reduce the regulatory burden on applicants who are not familiar with the various methods and procedures generally used in industry to conduct safety assessments. It is only intended to be a guide, and is not a certification checklist, since it does not include all the information necessary for an FHA for a specific airplane with its various functions and its intended use. The functions are listed in the partial FHA as a guide for the classification of failure conditions when the functions are installed. The list of functions is not intended to suggest that the functions are required for the Class I airplanes. Even if there is guidance information in Appendix 1, the applicable regulations provide the requirements of the functions for installations.
(1) The applicant should use Appendix 1 and the appropriate certification authority as a point of departure for the assessment of the specific system or airplane in question. It can be used to arrive at the appropriate failure conditions for this specific system by similarity to or by interpolating between the example systems. It does not, by itself, necessarily provide an answer for an applicant’s system unless that system is exactly as described. Its sole purpose is to assist applicants by illustrating typical functions and the related failure conditions. This appendix addresses general applicability, which is valuable for determining software and complex hardware DALs, and it should not be utilized to replace any specific guidance intended for individual types of equipment, systems, and installations. The FHA results are airplane characteristic and system architecture dependent. The examples in this appendix are based on the traditional airplane and traditional architectures. Because § 23.1309 is a regulation of general requirements, it should not be used to supersede any specific requirements of part 23.
(2) In addition to the general technical guidance provided in Appendix 1, a sample of one suggested format is provided in Appendix 2 for documenting the results of an FHA. This format illustrates how factors other than those directly illustrated in Appendix 1 are pertinent. It also illustrates that failure conditions are not limited to only the three general types shown in Appendix 1. The actual data shown in Appendix 2 is only used to illustrate the typical approach and should not be viewed as technically representative of any particular airplane. A complete FHA could be comprised of the layout shown in Appendix 2 by utilizing pertinent technical considerations identified in Appendix 1, which are modified and expanded to reflect the specific proposed airplane design under consideration.
d. Part 23 airplanes cover a wide range of airplane sizes and capabilities. These airplanes range from single-engine, single-seat, low-performance airplanes to complex multiengine, highspeed, high-performance airplanes. At the bottom end of these part 23 airplane types, there are several compensating characteristics that mitigate many of the effects of a failure. Docile handling characteristics, low stall speeds, spin resistant designs, lower probability of operation in extreme weather conditions, and the inherent design philosophies used to design single-engine airplanes are specific examples of characteristics that may be considered in an FHA for systems installed in this class of airplane. Usually, support from Air Traffic Control is not considered as a mitigating factor.
15. Failure conditions.
a. Failure conditions with no safety effect. An FHA with a design and installation appraisal to establish independence from other functions is necessary for the safety assessment of these failure conditions. In general, common design practice provides physical and functional isolation from related components, which are essential to safe operation. If the applicant chooses not to do the FHA, the safety effects may be derived from the design and installation appraisal performed by the applicant.
b. Analysis of minor failure conditions. An analysis should consider the effects of system failures on other systems or their functions. An FHA with a design and installation appraisal to establish independence from other functions is necessary for the safety assessment of these failure conditions. In general, common design practice provides physical and functional isolation from components that are essential to safe operation. If the applicant chooses not to do an FHA, the safety effects may be derived from the design and installation appraisal performed by the applicant.
c. Analysis of major failure conditions. An assessment based on engineering judgment is a qualitative assessment, as are several of the methods described below:
(1) Similarity allows validation of a requirement by comparison to the requirements of similar certified systems. The similarity argument gains strength as the period of experience with the system increases. If the system is similar in its relevant attributes to those used in other airplanes and if the functions and effects of failure would be the same, then a design and installation appraisal and satisfactory service history of either the equipment being analyzed or of a similar design is usually acceptable for showing compliance. It is the applicant’s responsibility to provide data that is accepted, approved, or both, and that supports any claims of similarity to a previous installation.
(2) For systems that are not complex, where similarity cannot be used as the basis for compliance, then compliance may be shown by means of a qualitative assessment that shows that the major failure conditions of the system as installed are consistent with the FHA (for example, redundant systems).
(3) To show that malfunctions are indeed remote in systems of high complexity without redundancy (for example, a system with a self-monitoring microprocessor), it is sometimes necessary to conduct a qualitative functional FMEA supported by failure rate data and fault detection coverage analysis.
(4) An analysis of a redundant system in the airplane is usually complete if it shows isolation between redundant system channels and satisfactory reliability for each channel. For complex systems, where functional redundancy is required, a qualitative FMEA and FTA may be necessary to determine that redundancy actually exists (for example, no single failure affects all functional channels).
d. Analysis of hazardous and catastrophic failure conditions. For these failure conditions, a thorough safety assessment is necessary. The assessment usually consists of an appropriate combination of qualitative and quantitative analyses. Except as specified in the next paragraphs below, a detailed safety analysis shall be completed for each hazardous and catastrophic failure condition identified by an FHA. The analysis will usually be a combination of qualitative and quantitative assessments of the design.
(1) For simple and conventional installations (that is, low complexity and similarity in relevant attributes), it may be possible to assess a hazardous or catastrophic failure condition as being extremely remote or extremely improbable, respectively, on the basis of experienced engineering judgment using only qualitative analysis. The basis for the assessment will be the degree of redundancy, the established independence and isolation of the channels, and the reliability record of the technology involved. Satisfactory service experience on similar systems commonly used in many airplanes may be sufficient when a close similarity is established regarding both the system design and operating conditions.
(2) For complex systems where true similarity in all relevant attributes, including installation attributes, can be rigorously established, it may also be possible to assess a hazardous or catastrophic failure condition as being extremely remote or extremely improbable, respectively, on the basis of experienced engineering judgment using only qualitative analysis.
A high degree of similarity in both design and application is required.
(3) No catastrophic failure condition (Note 3 in figure 2) should result from the failure of a single component, part, or element of a system. Experienced engineering judgment and service history should show that a catastrophic failure condition by a single failure mode is not a practical possibility. The logic and rationale used in the assessment should be so straightforward and obvious that the failure mode simply would not occur unless it is associated with an unrelated failure condition that would, in itself, be catastrophic.
16. Assessment methods.
a. Assessment methods. Methods for qualitatively and quantitatively assessing the causes, severity, and likelihood of potential failure conditions are available to support experienced engineering and operational judgment. Some of these methods are structured. The various types of analyses are based on either inductive or deductive approaches. The applicant should select analyses to validate the safety of a particular design based on factors such as the system architecture, complexity, criticality of the function, etc. ARP 4761 has more details of the various methods. Descriptions of typical types of analyses that might be used are provided below.
(1) Design appraisal. A qualitative appraisal of the integrity and safety of the system design. An effective appraisal requires experienced judgment.
(2) Installation appraisal. This is a qualitative appraisal of the integrity and safety of the installation. Any deviations from normal, industry-accepted installation practices should be evaluated. An effective appraisal requires experienced judgment.
(3) FMEA. A structured, inductive, and bottom-up analysis that is used to evaluate the effects on the system and the airplane of each possible element or component failure. When properly formatted, it should aid in identifying latent failures and the possible causes of each failure mode. ARP 4761 provides methodology and detailed guidelines that may be used to perform this type of analysis. An FMEA could be a piece-part FMEA or a functional FMEA.
For modern microcircuit-based line replaceable units and systems, an exhaustive piece-part FMEA is not practically feasible with the present state of the art. In that context, an FMEA may be more functional than piece-part oriented. A functional-oriented FMEA can lead to uncertainties in the qualitative and quantitative aspects, which can be compensated for by more conservative assessments, such as the following: Assuming all failure modes result in failure conditions of interest, carefully choosing system architecture, and using lessons learned from similar technology.
(4) FTA. A structured, deductive, and top-down analysis that is used to identify the conditions, failures, and events that would cause each defined failure condition. These are graphical methods of identifying the logical relationship between each particular failure condition and the primary element or component failures, other events, or combinations thereof that can cause it. The fault tree should be developed to the lowest level for which failure rates can be substantiated. Rates derived from applicable service experience, acceptable industry wide sources, manufacturer’s accelerating testing data, or from FMEA may be used as inputs to the lowest level events.
(5) Common cause analysis. The acceptance of adequate probability of failure conditions is often derived from the assessment of multiple systems based on the assumption that failures are independent. Therefore, it is necessary to recognize that such independence may not exist in the practical sense, and specific studies are necessary to ensure that independence can either be assured or deemed acceptable. The “common cause analysis” is divided into three areas of study:
(a) Zonal safety analysis. This analysis has the objective of ensuring that the equipment installations within each zone of the airplane are at an adequate safety standard regarding design and installation standards, interference between systems, and maintenance errors.
(b) Particular risk analysis. Particular risks are defined as those events or influences outside the systems concerned (for example, fire, leaking fluids, bird strike, tire burst, HIRF exposure, lightning, uncontained failure of high energy rotating machines, etc.). Each risk should be the subject of a specific study to examine and document the simultaneous or cascading effects, or influences, that may violate independence.
(c) Common mode analysis. This analysis is performed to confirm the assumed independence of the events that were considered in combination for a given failure condition.
The effects of specification, design, implementation, installation, maintenance errors, manufacturing errors, environmental factors other than those already considered in the particular risk analysis, and failures of system components should be considered.
17. Assessment of failure condition probabilities and analysis considerations.
a. An assessment of the probability of a failure condition may be either qualitative or quantitative. An analysis may range from a simple report that interprets test results or compares two similar systems to a detailed analysis that may or may not include estimated numerical probabilities. The depth and scope of an analysis depends on the type of functions performed by the system, the severity of failure conditions, and whether the system is complex. A quantitative analysis is intended to supplement, but not replace, qualitative methods based on engineering and operational judgment. A quantitative analysis is often used for catastrophic or hazardous failure conditions of systems that are complex, that have insufficient service experience to help substantiate their safety, or that have attributes that differ significantly from those of conventional systems.
b. A probability analysis may be either an FMEA or an FTA, which also includes numerical probability information. Numerical values are assigned to the probabilistic terms included in the requirements for use in those cases where the impact of system failures is examined by quantitative methods of analyses.
c. The probabilities of primary failures can be determined from failure rate data and exposure times using failure rates derived from either service experience on identical or similar items, manufacturer’s accelerating testing data, or from acceptable industry standards.
Conventional mathematics of probability can then be used to calculate the estimated probability of each failure condition as a function of the estimated probabilities of the various identified contributory failures or other events. See Appendix D of ARP 4761 for more information.
d. When calculating the estimated probability of each failure condition, a margin may be necessary to account for uncertainty. A margin is not normally required for an analysis that is based on proven data or from operational experience and tests. Where data has limited background for substantiation, a margin may be required depending on the available justification.
e. The applicant should obtain early concurrence of the certification authority of an acceptable classification of the failure conditions and probability for each major, hazardous, and catastrophic failure condition. Early concurrence on the classification of the failure conditions may reduce the applicant’s efforts in determining the probabilities in case there are changes.
f. The details on how to calculate the “average probability per flight hour” for a failure condition are given in Appendix 3 of this AC. The “average probability per flight hour” is the probability of occurrence, normalized by the flight time of a failure condition during a single flight. If the probability of a subject failure condition occurring during a typical flight of mean duration for the airplane type, divided by the flight’s mean duration in hours, is likely to be significantly different from the predicted average rate of occurrence of that failure condition during the entire operational life of all airplanes of that type, then a risk model that better reflects the failure condition should be used. The single flight is analyzed to be representative of an average over all possible flights of the fleet of airplanes to be certified. The calculation of the “average probability per flight hour” for a failure condition should consider the following:
(1) The average flight duration and the average flight profile for the airplane type to be certified. A common assumption for 14 CFR part 23 airplanes is that the average flight duration is 1 hour;
(2) All combinations of failures and events that contribute to the failure condition;
(3) The conditional probability if a sequence of events is necessary to produce the failure condition;
(4) The relevant "at risk" time if an event is only relevant during certain flight phases;
and
(5) The average exposure time if the failure can persist for multiple flights.
18. Testing and compliance with the requirements of §§ 23.1301 and 23.1309.
a. Testing is an important aspect of the overall compliance processes with §§ 23.1301 and
23.1309. The applicant should conduct bench, ground and flight testing necessary to validate hazard classifications, acceptability of crew procedures, human factors, and other assumptions made during the safety analysis processes. The applicant must also discuss with the project ACO what aspects of this testing will need to be included in the FAA certification testing. Those aspects required for formal certification testing must be included in the appropriate FAA approved test plans and conducted on an FAA conformed test article in the presence of the delegated FAA witness in accordance with Order 8110.4C, Type Certification. Prior to entry into TIA, the applicant should be able to show at least qualitatively that the proposed design change will meet the requirements of section 23.1309.
b. The FAA will typically conduct some level of function and reliability testing during certification to ensure required functions to demonstrate an acceptable level of functional reliability in addition to other required certification tests and analyses. These tests are meant to 32
verify availability, accuracy, and reliability of the system. The FAA expects the applicant to show that the system does not exhibit unintended or undesirable functionality for required flight critical functions that have failure conditions that are major, hazardous, or catastrophic. The FAA also expects that failures, malfunctions, and design errors that would have a potential safety hazard will only occur at a frequency appropriate for the associated failure condition and classification.
19. Operational and maintenance considerations.
a. Flight crew and maintenance task. These tasks, which are related to compliance, should be appropriate and reasonable. Quantitative assessments of the probabilities of flight crew and maintenance errors are not considered feasible. Reasonable tasks are those for which full credit can be taken because the flight crew or ground crew can realistically be anticipated to perform them correctly when they are required or scheduled. For the purposes of quantitative analysis, a probability of one can be assumed for flight crew and maintenance tasks that have been evaluated and found to be reasonable. In addition, based on experienced engineering and operational judgment, the discovery of obvious failures during normal operation and maintenance of the airplane may be considered, even though such failures are not the primary purpose or focus of the operational or maintenance actions.
b. Flight crew action. When assessing the ability of the flight crew to cope with a failure condition, the information provided to the crew and the complexity of the required action should be considered.
(1) If the evaluation indicates that a potential failure condition can be alleviated or overcome in a timely manner without jeopardizing other safety related flight crew tasks and without requiring exceptional pilot skill or strength, correct crew action may be assumed in both qualitative and quantitative assessments.
(2) Annunciation that requires flight crew actions should be evaluated to determine if the required actions can be accomplished in a timely manner without exceptional pilot skills. If the evaluation indicates that a potential failure condition can be alleviated or overcome during the time available without jeopardizing other safety related flight crew tasks and without requiring exceptional pilot skill or strength, credit may be taken for correct and appropriate corrective action for both qualitative and quantitative assessments. Similarly, credit may be taken for correct flight crew performance if overall flight crew workload during the time available is not excessive and if the tasks do not require exceptional pilot skill or strength.
(3) Unless flight crew actions are accepted as normal airmanship, the appropriate procedures should be included in the FAA approved AFM or in the AFM revision or supplement. The AFM should include procedures for operation of complex systems such as integrated flight guidance and control systems. These procedures should include proper pilot response to cockpit indications, diagnosis of system failures, discussion of possible pilot-induced flight control system problems, and use of the system in a safe manner.
c. Maintenance actions. Credit may be taken for correct accomplishment of maintenance tasks in both qualitative and quantitative assessments if the tasks are evaluated and found to be reasonable. Required maintenance tasks, which mitigate hazards, should be provided for use in the FAA approved maintenance programs such as the ICA. Annunciated failures will be corrected before the next flight or a maximum time period will be established before a maintenance action is required. If the latter is acceptable, the analysis should establish the maximum allowable interval before the maintenance action is required. A scheduled maintenance task may detect latent failures. If this approach is taken, and the failure condition is hazardous or catastrophic, then a maintenance task should be established. Some latent failures can be assumed to be identified based upon a return to service test on the equipment following its removal and repair (component MTBF should be the basis for the check interval time).
20. Electromagnetic protection for electrical/electronic systems. Current trends indicate increasing reliance on electrical/electronic systems for safe operations. For systems that perform flight, propulsion, navigation, and instrumentation functions, electromagnetic effects, environmental effects, and environmental qualifications should be considered. The software and complex hardware DALs shown in figure 2 are not applicable for HIRF and Lightning protection levels. For guidance for the protection against these effects, refer to the latest version of AC 23- 17, AC 20-136, and AC 20-158.
21. Software and complex hardware DALs for airborne system and applications.
a. Background. AC 20-115B discusses how RTCA/DO-178B provides an acceptable means for showing that software complies with pertinent airworthiness requirements. AC 20- 152 provides acceptable means for showing that complex hardware complies with the pertinent airworthiness requirements.
b. Acceptable application of software and complex hardware DALs. It is necessary to consider the possibility of requirement, design, and implementation errors in order to comply with the requirements of § 23.1309(b). Errors made during the design and development of systems have traditionally been detected and corrected by exhaustive tests conducted on the system and its components by direct inspection and by other direct verification methods capable of completely characterizing the performance of the system. These direct techniques may still be appropriate for simple systems, which perform a limited number of functions and which are not highly integrated with other airplane systems.
(1) For more complex or integrated systems, exhaustive testing may either be impossible because all of the systems states cannot be determined or it may be impractical due to the number of tests that must be accomplished. For these types of systems, compliance may be shown by the use of software and complex hardware DALs. The software and complex hardware DALs should be determined by the severity of potential effects on the airplane in case of system malfunctions or loss of functions.
c. Criteria for software DALs of part 23 airplanes. The DALs in figure 2 and throughout this AC are also intended to correlate to the software level in RTCA/DO-178B and the complex design assurance level in RTCA/DO-254 documents. The classification of the failure condition 34
and airplane class must be determined before figure 2 is used to determine these levels. These levels in figure 2 are considered acceptable for part 23 airplanes instead of software levels in paragraph 2.2.2 in RTCA/DO-178B and of the complex hardware design assurance levels defined in paragraph 2.2 in RTCA/DO-254.
d. Complex hardware level D. AC 20-152 provides an exclusion from FAA review for complex hardware design assurance level “D” developed under DO-254. The exclusion from FAA review of life cycle data, granted to complex hardware DALs D in AC 20-152, will only apply for minor failure conditions and it will not apply to level D for the reduced levels shown for major and hazardous failure conditions identified in figure 2.
e. System architecture for determination of the appropriate DALs. There may be significant difference in the guidance provided on the use of system architecture for determination of the appropriate DALs. The FAA recognizes that consideration of system architecture for this purpose is appropriate in some cases. This AC, in figure 2, already allows reduction of software and complex hardware DALs for Class I, II, and III airplanes; therefore, no additional reductions from these levels are permitted without the Small Airplane Directorate approval. These levels should be used unless there are some unique architecture considerations and there is specific policy, guidance, or approval by the Small Airplane Directorate. If the Small Airplane Directorate has established specific guidance or policy for these levels, then the approval can made by the Aircraft Certification Office. Where apparent differences exist between these two documents on this subject, then the guidance contained in ARP 4754 should only be used if additional credit for architecture is requested for hazardous or catastrophic failure conditions in Class IV, commuter category airplanes. For commuter category airplanes, the guidance in ARP 4754 is more likely to be appropriate since its DALs are higher.
f. Equipment installed in part 23 airplanes that performs functions addressed by TSO standards should meet applicable TSO standards, but the equipment is not required to have TSO authorization. The TSO data should include the equipment complex hardware and software DALs. For both TSO and non-TSO equipment, the complex hardware and software DALs should be checked against the installation requirements by the safety assessment and figure 2.
22. Information only note for future policy.
a. At the time this AC was being developed for issuance, SAE S-18, Airplane Safety Assessment Committee, was revising ARP 4754 and ARP 4761. The committee is planning new concepts for (DAL)and Design Assurance Levels. These SAE documents are preliminary draft guidelines for assigning the DALs that start from the aircraft/system level and end at the item/component level. The DAL assignments for the aircraft and system function are determined during the airplane and system safety assessment processes, specifically the FHA.
b. The committee considerations for the DAL assignment depend on the failure condition classification, the number of independent failure paths and their associated independence attributes. The independence attributes are the functional independence, design independence, and physical independence. In essence, functional independence ensures that the functional requirements that are implemented in the design are different, whereas design independence 35