AC 25.1309-1B
• RTCA, Inc., Document DO-356, Airworthiness Security Methods and Considerations.
• SAE ARP 4754, Guidelines for Development of Civil Aircraft and Systems.
• SAE ARP 4761, Guidelines and Methods for Conducting the Safety Assessment Process on Civil Airborne Systems and Equipment.
1.5 Definitions.
The following definitions apply to the system design and analysis requirements of § 25.1309 and t he guidance material in this AC. See also § 25.4 for common term definitions used in part 25. Some of the following definitions are specific to the system design and analysis requirements of § 25.1309 and the guidance material in this AC.
Some of the following definitions may have a different meaning when they are used in other regulations or ACs. There are no defined terms within this section for which standard dictionary definitions apply.
1.5.1 Analysis.
The terms “analysis” and “assessment” are used throughout this AC. The two terms are to some extent interchangeable. However, “analysis” generally implies a more specific, more detailed evaluation, while “assessment” may be a more general or broader evaluation but may include one or more types of analysis. In practice, the meaning of each term comes from the specific application, for example, fault tree analysis, Markov analysis, preliminary system safety assessment (PSSA), and so forth.
1.5.2 At Risk Time.
The period of time during which the aircraft may be subject to the failure effect under analysis.
1.5.3 Assessment.
See the definition of “analysis” above.
1.5.4 Average Probability per Flight Hour.
For the purpose of this AC, this term is the quotient of the number of times the subject failure condition is predicted to occur during the entire operating life of all airplanes of the type divided by the anticipated total operating hours of all airplanes of that type.
Please note that the average probability per flight hour is normally calculated as the probability of a failure condition occurring during a typical flight of mean duration divided by that mean duration.
1.5.5 Catastrophic Single Latent Failure Plus One (CSL+1).
A catastrophic failure condition that results from a combination of two failures, either of which could be latent for more than one flight.
1-8
AC 25.1309-1B
1.5.6 Certification Maintenance Requirement (CMR).
A required scheduled maintenance task established during the design certification of the airplane systems as an airworthiness limitation of the type certificate or supplemental type certificate. This term is defined in § 25.4 Definitions.
Note: The CMRs are a subset of the Instructions for Continued Airworthiness (ICA) identified during the certification process.
1.5.7 Complex.
A system is complex when its operation, failure modes, or failure effects are difficult to comprehend without the aid of analytical methods.
1.5.8 Conventional.
A system is conventional if its functionality, the technological means used to implement its functionality, and its intended usage are all the same as, or closely similar to, that of previously approved systems that are commonly used.
1.5.9 Design Appraisal.
A qualitative appraisal of the integrity and safety of the system design.
1.5.10 Development Assurance.
All planned and systematic actions used to substantiate, to an adequate level of confidence, that errors in requirements, design, and implementation have been identified and corrected so that the system satisfies the applicable safety objectives.
1.5.11 Equipment.
A physical object that can be installed and removed from the aircraft and performs one or more specific functions. Equipment contains one or more items.
1.5.12 Error.
An omission or incorrect action by a flightcrew member or maintenance personnel, or a development error (for example, a mistake in requirements, design, or implementation).
1.5.13 Event.
An occurrence or condition that affects airplane safety.
1.5.14 External Event.
An occurrence that has its origin distinct from the airplane, such as atmospheric conditions (e.g., gusts, temperature variations, icing, and lightning strikes); runway conditions; conditions of communication, navigation, and surveillance services;
bird-strike; and cabin and baggage fires (not initiated by features installed on the airplane); etc. The term does not cover sabotage or other similar intentional acts.
1.5.15 Exposure Time .
The time between when an item is known to be operating properly and when it will be known to be operating properly again.
1-9
AC 25.1309-1B
1.5.16 Failure.
An occurrence that affects the operation of a component, part, or element such that it no longer functions as intended. This includes both loss of function and malfunction.
Note: Errors may cause failures or influence their effects but are not considered to be failures.
1.5.17 Failure Condition.
A condition, caused or contributed to by one or more failures or errors, that has either a direct or consequential effect on the airplane, its occupants, or other persons, accounting for—
• Flight phase,
• Relevant adverse operational or environmental conditions, and
• External events.
1.5.18 Failure Mode.
A specific way in which a system, equipment, hardware item, or piece-part may fail.
1.5.19 Ground Crew.
For the purposes of a system safety assessment, ground crew includes aircraft handling, maintenance or servicing personnel operating in or within the vicinity of the aircraft while it is in a ground operating condition.
1.5.20 Installation Appraisal.
This is a qualitative appraisal of the integrity and safety of the installation including the evaluation of any deviations from normal, industry-accepted installation practices, such as clearances or tolerances, especially in the case of modifications made after entry into service.
1.5.21 Latent Failure.
A failure that is not detected or annunciated when it occurs.
1.5.22 Qualitative analytical process.
Those analytical processes that assess system and airplane safety in a non-numerical manner. Engineering judgment or an acceptable rough-order estimate may be used in this process.
1.5.23 Quantitative analytical process.
Those analytical processes that apply numerical methods and statistical analyses to assess system and airplane safety.
1.5.24 Redundancy.
The presence of more than one independent means for accomplishing a given function or flight operation.
1-10
AC 25.1309-1B
1.5.25 Safety Requirement.
A requirement that is necessary to achieve either a safety objective or satisfy a constraint established by the system safety process.
1.5.26 Significant Latent Failure (SLF).
A latent failure that, in combination with one or more specific failures or events, would result in a hazardous or catastrophic failure condition. This term is defined in § 25.4 Definitions.
1.5.27 Single Failure.
Any failure or set of failures that cannot be shown to be independent from each other
(e.g., failures due to a common cause).
1.5.28 System.
A defined combination of subsystems, equipment, items, or elements that perform one or more functions.
1-11
AC 25.1309-1B CHA PTER 2. BACKGROUND
2.1 General.
2.1.1 The FAA is issuing this revision 1B concurrently with a number of rule changes that address system safety, such as §§ 25.302, 25.629, 25.671, 25.901, 25.933, 25.1309, and others. The agency developed these rule changes, and corresponding advisory material, based on recommendations from several working groups under the Aviation Rulemaking Advisory Committee (ARAC).
2.1.2 In 2010, the ARAC Airplane-Level Safety Analysis Working Group (ASAWG) provided recommendations for changes to §§ 25.1301 and 25.1309. The ASAWG also recommended changes to the corresponding advisory material, and the FAA used these recommendations to develop this AC.
2.1.3 In the early years of aviation, airplane systems were evaluated to specific requirements:
to the “single fault” criterion or to the fail-safe design concept, which are explained below. As later-generation airplanes developed, their designers added more safety-critical functions, which generally resulted in an increase in the complexity of the systems designed to perform these functions. A safety-critical function was a function whose failure when required would result in a catastrophic condition. The potential hazards to the airplane and its occupants, in the event of failure of one or more functions provided by a system, had to be considered, as did the interaction between systems performing different functions. To assess the safety of a complex system—and the adequacy of system redundancy to meet the fail-safe criterion—the FAA began assigning statistical probabilities to system failures in AC 25.1309-1, dated September 7, 1982. The agency’s primary objective was to ensure that the proliferation of safety-critical systems would not increase the probability of a catastrophic accident.
The FAA assigned numerical values to the qualitative probabilistic terms in the requirements, for use in those cases where the impact of system failures is examined by quantitative methods of analysis. However, numerical values were intended to supplement, not replace, qualitative methods based on engineering and operational judgment. See appendix A for a historical perspective of the use of statistical probabilities in system safety assessment.
2.2 Fail-Safe Design Concept.
The part 25 airworthiness standards for installations of systems and equipment are based on, and incorporate, the objectives, principles, and techniques of the fail-safe design concept, which instructs the applicant to assume that single failures will happen, and to consider the effects of those failures and combinations of failures in defining an acceptable safe design.
2-1
AC 25.1309-1B
2.2.1 In fail-safe design, the following basic objectives pertaining to failures apply:
2.2.1.1 In any system or subsystem, the failure of any single element, component, or connection during any one flight must be assumed, regardless of its probability. Such single failures must not be catastrophic. See definition of “catastrophic” in paragraph 3.1.5 of this AC.
2.2.1.2 Subsequent failures during the same flight, whether detected or latent, and combinations thereof, should also be considered.
2.2.2 The fail-safe design concept uses the following design principles or techniques in order to ensure an acceptable safe design. The use of only one of these principles or techniques is seldom adequate. A combination of two or more is usually needed to provide a fail-safe design, in other words, to ensure that major failure conditions are remote, hazardous failure conditions are extremely remote, and catastrophic failure conditions are extremely improbable.
2.2.2.1 De signed Integrity and Quality, including Life Limits, to ensure intended function and prevent failures.
2.2.2.2 Redunda ncy or Backup Systems to enable continued function after any single (or other defined number of) failure(s), for example, two or more engines, hydraulic systems, and so forth.
2.2.2.3 Isol ation and/or Segregation of Systems, Components, and Elements so that the failure of one does not cause the failure of another.
2.2.2.4 Prove n Reliability so that multiple, independent failures are unlikely to occur during the same flight.
2.2.2.5 Fail ure Annunciation or Indication to provide awareness in case of detected failures.
2.2.2.6 Fligh tcrew Procedures specifying corrective action for use after failure detection.
2.2.2.7 Che ckability, which is the capability to check a component’s condition.
2.2.2.8 Designed Failure Effect Limits, including the capability to sustain damage to limit the safety impact or effects of a failure.
2.2.2.9 Des igned Failure Path to control and direct the effects of a failure in a way that limits its safety impact.
2.2.2.10 Mar gins or Factors of Safety to allow for any undefined or unforeseeable adverse conditions.
2-2
AC 25.1309-1B
2.2.2.11 Error Tolerance that considers adverse effects of foreseeable errors during the airplane’s design, test, manufacture, operation, and maintenance.
2.3 Highly Integrated Systems.
I n 1998, the ARAC System Design and Analysis Working Group raised a concern regarding the efficiency and coverage of the techniques used for assessing safety aspects of highly integrated systems that perform complex and interrelated functions, particularly through the use of electronic technology and software-based techniques.
The concern was that design and analysis techniques applied to deterministic risks or to conventional, non-complex systems might not provide adequate safety coverage for more complex systems. Thus, other assurance techniques have also been applied by the FAA and applicants to these more complex systems. These techniques included development assurance using a combination of process assurance; validation and implementation verification techniques; and structured analysis or assessment techniques conducted at the airplane level if necessary or across integrated or interacting systems. The systematic use of these techniques increases confidence that errors in requirements, designs, or implementation, and integration or interaction effects have been adequately identified and corrected. Applicants should continue to emphasize the fail-safe design concept discussed in paragraph 2.2 of this AC in the development and assurance of highly integrated systems.
2.4 Use of Both Qualitative and Quantitative Methods.
Considering the above developments, as well as revisions made to § 25.1309, this AC includes additional approaches, both qualitative and quantitative, which may be used to assist applicants in their 14 CFR 21.20 obligations to show compliance with system safety regulations, considering the whole airplane and its systems. This AC also provides guidance to assist applicants in determining when, or if, particular analyses or development assurance activities should be conducted in the frame of the development and safety assessment processes. See AC 20-174 and the industry documents listed in paragraph 1.4.5 of this AC for additional guidance. In summary, both qualitative and quantitative methods are used in practice, and both may be necessary to some degree to support a compliance finding. The analytical tools used in determining numerical values are intended to complement, but not replace, qualitative methods based on engineering and operational judgment. See appendix B of this AC for guidance on available qualitative and quantitative methods for assessment of failure conditions.
2-3
AC 25.1309-1B CHA PTER 3. FAILURE CONDITION CLASSIFICATIONS AND PROBABILITY TERMS
3.1 Classifications.
The FAA classifies failure conditions according to the severity of their effects as defined in paragraphs 3.1.1 through 3.1.5 below.
Note: The description of the terms provided for major, hazardous, and catastrophic failure conditions are the same as those found in § 25.4.
3.1.1 No Safety Effect.
Failure conditions that would have no effect on safety. For example, failure conditions that would not affect the operational capability of the airplane or increase flightcrew workload but may cause inconvenience to passengers or cabin crew.
3.1.2 Minor.
A failure condition that would not significantly reduce airplane safety and would only involve flightcrew actions that are well within their capabilities. Minor failure conditions may result in, for example—
• A slight reduction in safety margins or functional capabilities,
• A slight increase in flightcrew workload, such as routine flight plan changes,
• Some physical discomfort to passengers or cabin crew, or
• An effect of similar severity.
3.1.3 Major.
A failure condition that would reduce the capability of the airplane or the ability of the flightcrew to cope with adverse operating conditions, to the extent that there would be:
• A significant reduction in safety margins or functional capabilities,
• A physical discomfort or significant increase in flightcrew workload or in conditions impairing the efficiency of the flightcrew,
• Physical distress to passengers or cabin crew, possibly including injuries, or
• An effect of similar severity.
3.1.4 Hazardous.
A failure condition that would reduce the capability of the airplane or the ability of the flightcrew to cope with adverse operating conditions, to the extent that there would be:
• A large reduction in safety margins or functional capabilities,
• Physical distress or excessive workload such that the flightcrew cannot be relied upon to perform their tasks accurately or completely, or
• Serious or fatal injuries to a relatively small number of persons other than the flightcrew.
3-1
AC 25.1309-1B
3.1.5 Catastrophic.
A failure condition that would result in multiple fatalities, usually with the loss of the airplane.
Note 1: A failure condition that would prevent continued safe flight and landing should be classified as catastrophic unless otherwise defined in other specific ACs.
Note 2: For the purpose of performing a safety assessment, “multiple fatalities” means tw o or more fatalities.
3.2 Qualitative Probability Terms.
The probability terms used in § 25.1309 and in this AC are defined in paragraphs 3.2.1 through 3.2.4 below. These terms and definitions have become commonly accepted as aids to engineering judgment when using qualitative analyses to determine compliance with § 25.1309(b).
Note: The definitions provided for probable, remote, extremely remote, and extremely improbable failure conditions are the same as those found in § 25.4.
3.2.1 Probable Fai lure Condition.
A failure condition that is anticipated to occur one or more times during the entire operational life of each airplane of a given type.
3.2.2 Remote Fai lure Condition.
A failure condition that is not anticipated to occur to each airplane of a given type during its entire operational life, but which may occur several times during the total operational life of a number of airplanes of a given type.
3.2.3 Extremely Rem ote Failure Condition.
A failure condition that is not anticipated to occur to each airplane of a given type during its entire operational life, but which may occur a few times during the total operational life of all airplanes of a given type.
3.2.4 Extremely I mprobable Failure Condition.
A failure condition that is not anticipated to occur during the total operational life of all airplanes of a given type.
3-2
AC 25.1309-1B
3.2.4.1 Intent of the Term “Extremely Improbable.”
3.2.4.1.1 The FAA’s objective of using this term in the system safety regulations has been to describe a condition (usually a failure condition) that has a probability of occurrence so low that it is not anticipated to occur in service on any transport category airplane to which the standard applies.
However, while a rule sets a minimum standard for all the airplanes to which it applies, the FAA’s compliance determinations are limited to applications for individual type certificates. Consequently, in practice, the applicant should provide a sufficiently conservative showing that a condition is not anticipated to occur in service during the entire operational life of all airplanes under a type certificate application being assessed.
3.2.4.1.2 The means of showing that the occurrence of a failure condition is extremely improbable varies widely, depending on the type of system, component, or element that must be assessed. The FAA does not consider failure conditions arising from a single failure to be extremely improbable, unless the operational or environmental conditions under which the failure must occur to produce a catastrophic event are in and of themselves extremely remote, or the physics of a theoretical failure is so implausible that the FAA can agree it is not anticipated to ever actually occur.
(See paragraph 7.3.2.) Thus, probability assessments for catastrophic outcomes normally involve conditions arising from multiple failures. Both qualitative and quantitative assessments are used in practice, and both are often necessary, to some degree, to support a conclusion that a failure condition is extremely improbable. Generally, performing only a quantitative analysis to show that a failure condition is extremely improbable is insufficient, due to the variability and uncertainty in the analytical process. Any analysis used as evidence that a failure condition is extremely improbable should include justification of any assumptions made, data sources, and analytical techniques to account for the variability and uncertainty in the analytical process.
3.2.4.1.3 Wherever part 25 requires that a condition be extremely improbable, the compliance method—whether qualitative, quantitative, or a combination of the two—along with engineering judgment, should provide convincing evidence that the condition is not anticipated to occur in service when the airplane is produced in accordance with the approved type design, is operated in accordance with approved operating procedures, and is maintained in accordance with approved maintenance procedures.
3-3
AC 25.1309-1B
3.3 Quantitative Probability Terms.
3.3.1 When using quantitative analyses to help determine compliance with § 25.1309(b), the following descriptions of the probability terms used in this requirement and AC have become commonly accepted as aids to engineering judgment. They are expressed in terms of acceptable ranges for the average probability per flight hour. Those probability terms and ranges are as follows:
3.3.1.1 Probable Failure Condition.
A failure condition having an average probability per flight hour on the order of 1 x 10-3 or less, but greater than the order of 1 x 10-5.
3.3.1.2 Rem ote Failure Condition.
A failure condition having an average probability per flight hour on the order of 1 x 10-5 or less, but greater than the order of 1 x 10-7.
3.3.1.3 Extremely Remote Failure Condition.
A failure condition having an average probability per flight hour on the order of 1 x 10-7 or less, but greater than the order of 1 x 10-9.
3.3.1.4 Extremely Improbable Failure Condition.
A failure condition having an average probability per flight hour on the order of 1 x 10-9 or less.
In a quantitative assessment of a remote failure condition a factor of two could be considered as ‘on the order of’ to show compliance. For an extremely remote or extremely improbable failure condition, a factor of three could be considered as ‘on the order of’ to show compliance. Note that at the low end of the probability value, there may be many factors in the analysis methods that influence the top undesired event probability calculations, therefore a higher factor may be acceptable on a case-by-case basis. (See paragraph 7.6.4 of this AC.)
Note: When using quantitative analysis to show compliance with § 25.1309(b), a calculated probability lower than the specified range in this section is considered as compliant.
3.3.2 The above numerical values associated with the probabilistic terms in § 25.1309(b) are gui delines for acceptable risk when applicants use quantitative probability methods of analysis to examine the effect of system failures. A design that meets these guidelines provides some, but not necessarily sufficient, evidence to support a finding by the FAA as to whether the design complies with the rule.
3-4
AC 25.1309-1B CHA PTER 4. SAFETY OBJECTIVE
4.1 Objectives of § 25.1309(b).
The objective of § 25.1309(b)(1), (b)(2), and (b)(3) is graphically presented in figure 4-1 as an inverse relationship between the probability and the severity of failure condition effects, such that:
4.1.1 Failure conditions with no safety effect have no probability requirement.
4.1.2 Minor failure conditions may be probable.
4.1.3 Major failure conditions must be no more frequent than remote.
4.1.4 Hazardous failure conditions must be no more frequent than extremely remote.
4.1.5 Catastrophic failure conditions must be extremely improbable.
Figure 4-1. Relationship between Probability and Severity of Failure Condition Effects Unacceptable Acceptable Probable Remote Extremely Remote Extremely Improbable Minor Major Hazardous Catastrophic Severity of Failure Condition Effects Probability of Failure Condition
4.2 Relationship between Probability and Severity of Failure Conditions.
The relationship between probability and severity of the effects associated with failure conditions are described in table 4-1.
4-1