U.S. Department Advisory of Transportation Circular Federal Aviation Administration Subject: SYSTEM SAFETY Date: 11/17/2011 AC No: 23.1309-1E ANALYSIS AND ASSESSMENT FOR Initiated by: ACE-100 PART 23 AIRPLANES This advisory circular (AC) sets forth an acceptable means of showing compliance with Title 14 of the Code of Federal Regulations (14 CFR), § 23.1309, through Amendment 23-62 for equipment, systems, and installations in 14 CFR part 23 airplanes.
This AC is not mandatory and does not constitute a regulation. It is issued for guidance purposes and to outline a method of compliance with the rules. An applicant may elect to follow an alternate method, provided the FAA finds it to be an acceptable means of complying with the applicable requirements of 14 CFR. However, if the applicant uses the means described in the AC, they must follow it in all important respects.
Noony FoR Earl Lawrence Manager, Small Airplane Directorate Aircraft Certification Service
CONTENTS Paragraph Page
1. What is the purpose of this AC?1
2. Who does this AC apply to?1
3. Cancellation1
4. Related regulations and documents1
5. Applicability3
6. Regulations and AC background4
7. Acronyms6
8. Definitions8
9. Application of § 23.1309(a), (a)(1), (a)(2), and (a)(3), as adopted by Amendments 23-41 and
23-4914
10. Showing compliance with the requirements of § 23.1309 (a) through Amendment 23-49... 14
11. Application of § 23.1309(a)(4), as adopted by Amendment 23-4918
12. Application of § 23.1309(a)(1) and (a)(2), as adopted by Amendments 23-6218
13. Application of § 23.1309(b), as adopted by Amendment 23-6220
14. Application of § 23.1309(b), as adopted by Amendments 23-41 and 23-49 and § 23.1309(c),
as adopted by Amendment 23-6221
15. Four certification classes of airplanes22
16. Safety assessments25
17. Failure conditions29
18. Assessment methods30
19. Assessment of failure condition probabilities and analysis considerations32
20. Operational and maintenance considerations33
21. Software and complex hardware DALs for airborne system and applications34
APPENDIX 1. PARTIAL LIST OF FUNCTIONAL HAZARD ASSESSMENT (FHA) FOR CONSIDERATION TO MEET 14 CFR PART 23 REQUIREMENTS FOR IFR CLASS I
AIRPLANESA1
APPENDIX 2. SAMPLE FUNCTIONAL HAZARD ASSESSMENT (FHA) FORMATA2
APPENDIX 3. CALCULATION OF THE AVERAGE PROBABILITY PER FLIGHT HOUR
.A3
iii (and iv)
1. What is the purpose of this AC?
a. This AC provides guidance and information for an acceptable means, but not the only means, for showing compliance with the requirements of § 23.1309 (Amendment 23-62) for equipment, systems, and installations in 14 CFR part 23 airplanes.
b. This material is neither mandatory nor regulatory in nature and does not constitute a regulation. It describes acceptable means, but not the only means, for demonstrating compliance with the applicable regulations. We will consider other methods of demonstrating compliance that an applicant may elect to present. While these guidelines are not mandatory, they are derived from extensive FAA and industry experience in determining compliance with the relevant regulations. Whenever an applicant’s proposed method of compliance differs from this guidance, the proposal should be coordinated with the Small Airplane Directorate Standards Staff, ACE-110. In addition, if an office believes that an applicant’s proposal that meets this guidance should not be approved, that office should coordinate its response with the Small Airplane Directorate Standards Staff, ACE-110.
c. Terms such as “must” are used in this AC only in the sense of ensuring applicability of this particular method of compliance when the acceptable method of compliance described herein is used. The word “must” is also used in this AC when referring to a specific regulation or guidance that is essential when the applicant uses this AC for the means of compliance. In this case there is no deviation. The word “should” is used to express a recommendation.
Deviation from the specified recommendation may require justification.
2. Who does this AC apply to?
The guidance provided in this document is directed to airplane manufacturers, modifiers, foreign regulatory authorities, and Federal Aviation Administration (FAA) personnel. This AC is applicable only to the original applicant seeking issuance of a Type Certificate (TC), an Amended Type Certificate (ATC), a Supplemental Type Certificate (STC), or a Parts Manufacturer Approval (PMA) for the initial approval of the new type design or a change in the approved type design.
3. Cancellation.
This AC cancels AC 23.1309-1D, System Safety Analysis and Assessment for Part 23 Airplanes, dated January 16, 2009.
This AC supersedes PS-ACE100-2005-50001, “Applying AC 20-152, ‘RTCA, Inc., Document RTCA/DO-254, Design Assurance Guidance for Airborne Electronic Hardware,’ to Title 14 Code of Federal Regulations, Part 23 Aircraft”; dated January 26, 2007
4. Related regulations and documents.
a. Regulations. Sections 23.1301 and 23.1309 of part 23 (through Amendment 23-62).
b. ACs, orders, and policy. You may access the latest version of ACs, notices, orders, and policy on the FAA website: www.faa.gov.
AC 20-115B RTCA, Inc., Document RTCA/DO-178B AC 20-136A Protection of Aircraft Electrical/Electronic Systems Against the Indirect Effects of Lightning AC 20-138B Airworthiness Approval of Positioning and Navigation Systems AC 20-152 RTCA, Inc., Document RTCA/DO-254, “Design Assurance Guidance for Airborne Electronic Hardware” AC 20-158 The Certification of Aircraft Electrical and Electronic Systems for Operation in the High-Intensity Radiated Fields (HIRF) Environment AC 21-16F RTCA, Document DO-160 version D, E, and F , “Environmental Conditions and Test Procedures for Airborne Equipment” AC 21.101-1A Establishing the Certification Basis of Changed Aeronautical Products AC 23-17C Systems and Equipment Guide for Certification of Part 23 Airplanes and Airships AC 23.1311-1C Installation of Electronic Displays in Part 23 Airplanes AC 25.1309-1A System Design and Analysis AC 33.75-1A Guidance Material for 14 CFR 33.75, Safety Analysis Order 8110.4C Type Certification Order 8110.105 Simple and Complex Electronic Hardware Approval Guidance
c. Industry documents. You may obtain copies of current editions of the following publications as listed. These documents are excellent resource materials.
(1) RTCA documents. The following RTCA documents are available from RTCA, Inc., Suite 805, 1828 L Street NW, Washington, DC 20036-4001 or at their website at www.rtca.org.
RTCA/DO-160G Environmental Conditions and Test Procedures for Airborne Equipment 2
RTCA/DO-178B Software Considerations in Airborne Systems and Equipment Certification RTCA/DO-254 Design Assurance Guidance for Airborne Electronic Hardware
(2) Society of Automotive Engineers (SAE), Inc. The following SAE, Inc., Aerospace Recommended Practice (ARP) documents are available from SAE, 400 Commonwealth Drive, Warrendale, PA 15096-0001 or from their website at www.sae.org.
ARP 4754A Guidelines for Development of Civil Aircraft and Systems ARP 4761 Guidelines and Methods for Conducting the Safety Assessment Process on Civil Airborne Systems and Equipment Note: ARPs 4754A and 4761 provide guidelines and methods of performing the safety assessment for certification of civil aircraft. The guidelines in ARP 4754A were developed in the context of 14 CFR part 25. It may be applicable to other 14 CFRs, such as parts 23, 27, 29, 33, and 35.
This AC is not intended to constrain the applicant to the use of these documents in the definition of their particular methods of satisfying the objectives of this AC. However, these documents contain material and methods of performing the System Safety Assessment (SSA) that an applicant may choose to use. The guidance in this AC takes precedence over the recommended practices in these ARPs if there is a conflict. (See paragraph 21 for more guidance) Contact the Small Airplane Directorate if there are conflicts with other guidance or ACs and this AC.
5. Applicability.
a. In addition to specific part 23 design requirements, § 23.1309 requirements, except as identified below, are applicable to any equipment or system installed in the airplane. This section addresses general requirements and does not supersede any specific requirements contained in other part 23 sections. New a dvance technology in electrical, electronic, and mechanical systems designs that include complex electronics with software, complex hardware, HIRF, and/or lightning requires a § 23.1309 analysis. An SSA is required to determine the level of certitude for the processes in standard and guidance documents such as RTCA/DO-178B, RTCA/DO-254, AC 20-136A, and AC 20-158 or equivalent. Section 23.1309 should be used to determine failure condition, probability of failure condition, software Development Assurance Level (DAL), and complex hardware DALs shown in Figure 2. The safety assessment process is used to determine the failure condition classification, which determines the HIRF and lightning protection levels (reduced DALs in Figure 2 are not used). For simple and conventional mechanical or analog electromechanical systems, or both, with well-established design and certification processes (where the installation is not complex), safety analysis may be satisfied by a qualitative assessment such as the single-failure concept and experience based on serviceproven designs and engineering judgment. In this case, a FHA, a design appraisal, and an installation appraisal addressed in this AC may satisfy § 23.1309 as shown in Figure 3.
b. Section 23.1309 does not apply to the performance, flight characteristics requirements of subpart B, and structural loads and strength requirements of subparts C and D. However, except as noted below, § 23.1309 does apply to systems that comply with subparts B, C, D, and E requirements. The flight structure such as wing, empennage, control surfaces and their simple systems; the fuselage, engine mounting, and landing gear and their related primary attachments are excluded. For example, § 23.1309 does not apply to an airplane's inherent stall characteristics or their evaluation of § 23.201, but does apply to a stick pusher (stall barrier) system installed to attain compliance with § 23.201. We will determine additional exceptions in the future. Until then, contact the Small Airplane Directorate for determination and approval of proposed exceptions not included in this AC.
c. Experienced engineering and operational judgment should be applied when determining whether or not a system is complex. Comparison with similar, previously approved systems is sometimes helpful. All relevant systems attributes should be considered. For example, the design may be complex, such as a satellite communication system used only by the passenger, but its failure may cause only minor safety effects.
6. Regulations and AC background.
a. Regulation.
(1) Amendment 23-14 (effective December 20, l973) adopted the original airworthiness standards in § 23.1309(a). Before amendment 23-14, neither the Civil Air Regulations (CAR) part 3, nor 14 CFR part 23, contained safety requirements in § 23.1309 for equipment, systems, and installations in small airplanes. In 1968, the FAA instituted an extensive review of the airworthiness standards of part 23. Because of the increased use of part 23 airplanes in all weather operations and the pilot’s increased reliance on installed systems and equipment, the FAA issued § 23.1309 to provide an acceptable level of safety for such equipment, systems, and installations. When the FAA adopted § 23.1309 (Amendment 23-14), it did not envision installation of systems that perform critical functions in small airplanes; therefore, before Amendment 23-41, this section did not contain safety standards for evaluating critical functions.
When such equipment, systems, and installations were included in the airplane design, they were evaluated under special conditions in accordance with the procedures of 14 CFR part 21.
(2) Amendment 23-34 (effective February 17, 1987) expanded § 23.1309 to include certification of commuter category airplanes. This expansion added a requirement to ensure applicable systems and installations are designed to safeguard against hazards. It also added requirements for equipment identified as essential loads and the affected power sources.
(3) Amendment 23-41 (effective November 26, 1990) retained in § 23.1309 the existing safety requirements adopted by amendment 23-14 for airplane equipment, systems, and installations that are not complex and that do not perform critical functions. For those cases where the applicant includes complex systems, or systems that perform critical functions, Amendment 23-41, § 23.1309, provides additional requirements for certification and identifying such equipment, systems, and installations. This amendment permitted the approval of more advanced systems having the capability to perform critical functions.
(4) Amendment 23-49 (effective March 11, 1996), amended § 23.1309(a)(4) to correct Amendment 23-41, which inadvertently removed the commuter category requirement originally added by Amendment 23-34 as § 23.1309(d).
(5) Amendment 23-62 consolidated and revised the existing requirements to reduce the certification burden. The FAA removed § 23.1301(d) and clarified the requirement in § 23.1309(a) to improve standardization for systems and equipment certification, particularly for non-required equipment and non-essential functions embedded within complex avionic systems.
Section 23.1309(b) requires minor, major, hazardous, or catastrophic failure condition(s) that occur during certification testing have a root cause analysis and corrective action. Section
23.1309(c) updates the safety assessment process terminology. Amendment 23-62 also made § 23.1309(d) compatible with § 23.1322 (Warning, caution, and advisory lights) for the design of systems and controls, including indications and annunciations. The power source capacity and distribution requirements, which are not directly related to the other safety and analysis requirements from § 23.1309, Amendment 23-49, were moved to a new section in § 23.1310 with clarification.
(6) Qualitative and quantitative analyses are often used in assessing the acceptability of complex designs that have a high degree of integration, use new technology, are new or different applications of conventional technology, or are designs that perform critical functions. These assessments lead to the selective use of quantitative analyses to support experienced engineering and operational judgment and to supplement qualitative analyses and tests. Numerical probability ranges associated with the terms used in § 23.1309 are accepted for evaluating quantitative analyses that have a logical and acceptable inverse relationship between the probability and severity of each failure condition.
b. AC.
(1) AC Revisions.
(a) The revision from AC 23.1309-1B to AC 23.1309-1C on March 12, 1999, provided the four-tier certification classes with different criteria for probability of failures and software levels for systems. The purpose of this certification approach is to increase safety by enhancing equipment on General Aviation (GA) airplanes that facilitate new technologies.
(b) Since the issuance of AC 23.1309-1C, there has been a large number of electronic displays and electronic systems installed on part 23 airplanes, especially Primary Flight Displays (PFD), Multifunction Flight Displays (MFD), Integrated Flight Systems, and Synthetic Vision Systems (SVS). A study of the FAA Alaska Capstone demonstration program for new avionics systems technology determined that four-tier certification classes demonstrated significant operational safety benefit and reduced accident rates. These installations, especially on Class I and II airplanes, would have been too costly without the establishment of the four-tier certification classes of airplanes as shown in paragraph 15.
(2) Broad causes of fatal accidents. Accident rate is a function of many factors. These factors include human performance, weather, design, operation, training, maintenance, and 5
airspace system infrastructure. For all airplanes, but particularly GA airplanes, pilot decisionmaking causes most accidents. Pilot decision-making accidents are often the result of a lack of situational awareness relative to terrain or weather, or to a loss of control due to excess workload. Correct pilot interventions and actions have prevented some of these accidents.
Increases in avionics equipage rates that improve pilot situational awareness or simplify the task have a significant positive impact on the GA accident rate. The Aircraft Owners and Pilots Association, Air Safety Foundation, conducted a study of safety effects of glass cockpits and concluded that technologically advanced aircraft provide added situational awareness tools that have dramatically improved aspects of GA safety. Technologically advanced aircraft deliver multiple safety benefits to GA pilots, but pilot training tied to experience has to evolve with it.
(3) Installing affordable systems.
(a) Enhancing the quantity, quality, and presentation of situational data in the cockpit can improve pilot situational awareness, efficiency, and safety. Many studies have shown that equipping these airplanes with safety devices such as Terrain Awareness Warning Systems (TAWS), Graphical Weather Displays, Map Displays, Integrated Flight Systems, SVS, and Enhanced Vision Systems may dramatically reduce a number of accident types. Pilots have reported that integrated flight displays help reduce workload, improve situational awareness, and increase safety.
(b) The aviation industry as a whole is on the threshold of a revolutionary change in communication, navigation, and surveillance of aircraft operations. The Next Generation Air Transportation System will overhaul the National Airspace System (NAS) to take advantage of new technology. It will also likely result in the long-term replacement of many avionics and instrument equipment in the existing fleet as well as in new production aircraft. Facilitating safety equipment installation should enhance the NAS efficiency and safety. If GA is to operate within a revised NAS, new technologies should be available and affordable for GA aircraft.
With the four-tier certification class criteria, new technologies are affordable for GA. If GA had only one class for certification, due to the cost of equipment for the NAS architecture, implementation would be incomplete or exclude large portions of the GA fleet from the NAS system. Neither situation is desirable or acceptable.
7. Acronyms.
14 CFR Title 14 Code of Federal Regulation AC Advisory Circular ACO Aircraft Certification Office AFM Airplane Flight Manual AFMS Airplane Flight Manual Supplement ARP Aerospace Recommended Practice ATC Amended Type Certificate CAR Civil Air Regulations CFR Code of Federal Regulations CHT Cylinder Head Temperature DAL Development Assurance Level 6
EEC Electronic Engine Control EGT Engine Gas Temperature EPR Engine Pressure Ratio FAA Federal Aviation Administration FHA Functional Hazard Assessment FMEA Failure Modes and Effects Analysis FTA Fault Tree Analysis GA General Aviation GNSS Global Navigation Satellite System HW Hardware HIRF High Intensity Radiated Fields ICA Instructions for Continued Airworthiness ICAO International Civil Aviation Organization IFR Instrument Flight Rules ILS Instrument Landing System IMC Instrument Meteorological Conditions MFD Multifunction Flight Display MRE Multiple Reciprocating Engine MTE Multiple Turbine Engine MTBF Mean Time Between Failures NAS National Airspace System P Primary System PFD Primary Flight Display PMA Parts Manufacturer Approval PSSA Preliminary System Safety Assessment R Reserved S Secondary System SAE Society of Automotive Engineers SRE Single Reciprocating Engine SSA System Safety Assessment STE Single Turbine Engine STC Supplemental Type Certificate SVS Synthetic Vision Systems SW Software TCAS Traffic Collision Avoidance System TIA Type Inspection Authorization TAWS Terrain Awareness Warning System TC Type Certificate TIT Turbine Inlet Temperature TSO Technical Standard Order VFR Visual Flight Rules WAAS Wide Area Augmentation System 7
8. Definitions.
a. Adverse effect. A response of a system that results in an undesirable operation of an airplane system, or subsystem.
b. Analysis. An evaluation based on decomposition into simple elements.
c. Adverse operating condition. A set of environmental or operational circumstances applicable to the airplane, combined with a failure or other emergency situation that results in a significant increase in normal flight crew workload.
d. Assessment. An evaluation based upon engineering judgment.
e. Attribute. A feature, characteristic, or aspect of a system or a device, or a condition affecting its operation. Some examples would include design, construction, technology, installation, functions, applications, operational uses, and environmental and operational stresses. It would also include relationships with other systems, functions, and flight or structural characteristics.
f. Average probability per flight hour. A representation of the number of times the subject failure condition is predicted to occur during the entire operating life of all airplanes of a type, divided by the anticipated total operating hours of all airplanes of that type.
Note: The average probability per flight hour is normally calculated as the probability of a failure condition occurring during a typical flight of mean duration divided by that mean duration. See Appendix 3.
g. Caution. A clear and unambiguous indication to the flight crew or pilot of a failure that requires subsequent crew action. An inherent characteristic of the airplane or a device that will give clearly distinguishable indications of malfunction or misleading information may provide this caution.
h. Complex hardware item. All items that are not simple are considered to be complex.
See definition of simple hardware item. Source: RTCA/DO-254, Appendix C and Order 8110.105.
i. Complex system. A system is “complex” when its operation, failure modes, or failure effects are difficult to comprehend without the aid of analytical methods or structured assessment methods. FMEA and FTA are examples of such structured assessment methods. Increased system complexity is often caused by such items as sophisticated components and multiple interrelationships. For example, for these types of systems, a portion of the compliance may be shown by the use of DALs such as by processes in RTCA/DO-178B or RTCA/DO-254 or equivalent. See the definitions for “conventional” and “simple” for more information.
j. Continued safe flight and landing. This phrase means that the airplane is capable of continued controlled flight and landing, possibly using emergency procedures, without requiring 8
exceptional pilot skill or strength. Upon landing, some airplane damage may occur as a result of a failure condition.
k. Conventional system. A system is considered “conventional” if its function, the technological means to implement its function, and its intended usage are all the same as, or closely similar to, that of previously approved systems that are commonly used. The systems that have established an adequate service history and the means of compliance for approval are generally accepted as "conventional." Normally conventional and simple systems may be analyzed by qualitative assessments as shown in Figure 3. See the definitions for complex and simple systems for more information.
l. Critical function. A function whose loss would prevent the continued safe flight and landing of the airplane.
Note: The term “critical function” is associated with a catastrophic failure condition. Newer documents may not refer specifically to the term “critical function.”
m. Design appraisal. A qualitative appraisal of the integrity and safety of the system design. An effective appraisal requires experienced judgment.
n. Design assurance level. All of those planned and systematic actions used to substantiate, at an adequate level of confidence, that design errors have been identified and corrected such that the items (hardware, software) satisfy the applicable certification basis. This term may be used in some SAE and RTCA documents, but in this AC it is intended that design assurance levels will correlate to the same levels as the DALs for the safety assessment process. See section 21 for more information.
o. Development Assurance Level (DAL). All those planned and systematic actions used to substantiate, to an adequate level of confidence, that errors in requirements, design, and implementation have been identified and corrected such that the system satisfies the applicable certification basis.
Note: For this AC, DALs in figure 2 and throughout this AC are also intended to correlate to software levels in RTCA/DO-178B and complex hardware design assurance levels in RTCA/DO-254 for the system or item. See section 21 for more information.
p. Equipment essential to safe operation. Equipment installed in order to comply with the applicable certification requirements of part 23 or operational requirements of parts 91, 121, and
135.
q. Error. An omission or incorrect action by a crewmember or maintenance personnel, or a mistake in requirements, design, or implementation.
r. Essential function. A function whose loss would reduce the capability of the airplane or the ability of the crew to cope with adverse operating conditions.
Note: The term “essential function” is associated with failure conditions between major and hazardous. Newer documents may not refer specifically to the term “essential function.”
s. Event. An internal or external occurrence that has its origin distinct from the airplane, such as atmospheric conditions (for example, gusts, temperature variations, icing, and, runway conditions, conditions of communication, navigation, and surveillance services, bird-strike, fire, leaking fluids, tire burst, HIRF exposure, lightning, uncontained failure of high energy rotating machines, etc.). The term is not intended to cover sabotage.
t. Essential load. Equipment essential to safe operation that requires a power source for normal operation.
u. Extremely remote failure conditions. Those failure conditions not anticipated to occur to each airplane during its total life but which may occur a few times when considering the total operational life of all airplanes of this type. For quantitative assessments, refer to the probability values shown for hazardous failure conditions in figure 2.
v. Extremely improbable failure condition. For commuter category airplanes, those failure conditions so unlikely that they are not anticipated to occur during the entire operational life of all airplanes of one type. For other classes of airplanes, the likelihood of occurrence may be greater. For quantitative assessments, refer to the probability values shown for catastrophic failure conditions in figure 2.
w. Failure. An occurrence that affects the operation of a component, part, or element such that it can no longer function as intended (this includes both loss of function and malfunction).
Note: Errors may cause failures but are not considered failures.
x. Failure conditions. A condition having an effect on either the airplane or its occupants, or both, either direct or consequential, which is caused or contributed to by one or more failures or errors considering flight phase and relevant adverse operational or environmental conditions or external events. Failure conditions may be classified according to their severity as follows:
(1) No safety effect. Failure conditions that would have no effect on safety (that is, failure conditions that would not affect the operational capability of the airplane or increase crew workload).
(2) Minor. Failure conditions that would not significantly reduce airplane safety and involve crew actions that are within their capabilities. Minor failure conditions may include a slight reduction in safety margins or functional capabilities, a slight increase in crew workload (such as routine flight plan changes), or some physical discomfort to passengers or cabin crew.
(3) Major. Failure conditions that would reduce the capability of the airplane or the ability of the crew to cope with adverse operating conditions to the extent that there would be a significant reduction in safety margins or functional capabilities. In addition, the failure condition has a significant increase in crew workload or in conditions impairing crew efficiency;