AC 25.1309-1B TABLE
4-1. RELATIONSHIP BETWEEN PROBABILITY AND SEVERITY OF
FAILURE CONDITIONS Classification of Failure Conditions No Safety Effect Minor Major Hazardous Catastrophic Effect on Airplane No effect on operational capabilities or safety Slight reduction in functional capabilities or safety margins Significant reduction in safety margins or functional capabilities Large reduction in functional capabilities or safety margins Normally with hull loss Effect on Occupants or Other Persons Excluding Flightcrew Inconvenience Physical discomfort Physical distress, possibly including injuries Serious or fatal injury to a small number of persons other than the flightcrew Multiple fatalities Effect on Flightcrew No effect on flightcrew workload Slight increase in workload A physical discomfort or significant increase in workload or in conditions impairing the efficiency of the flightcrew Physical distress or excessive workload such that flightcrew cannot be relied upon to perform their tasks accurately or completely Fatalities or incapacitation Allowable Qualitative Probability No Probability Requirement Probable Remote Extremely remote Extremely improbable Allowable Quantitative Probability range:
Values shown are Average Probability per Flight Hour:
No Probability Requirement
On the order of 10-3 or less, but greater than the order of 10-5 *
On the order of 10-5 or less, but greater than the order of 10-7
On the order of 10-7 or less, but greater than the order of 10-9 On the order of 10-9 or less * An allowable probability range is provided here as a reference. The applicant is not required to perform a quantitative analysis, nor substantiate by such analysis that this numerical criterion has been met for minor failure conditions. Current transport category airplane products are regarded as meeting this standard simply by using current commonly-accepted industry practice.
4-2
AC 25.1309-1B
4.3 Safety Objectives for Catastrophic Failure Conditions.
The safety objectives associated with catastrophic failure conditions are satisfied by showing that:
4.3.1 No single failure results in a catastrophic failure condition;
4.3.2 Each catastrophic failure condition is extremely improbable; and
4.3.3 Significant latent failures are addressed in accordance with § 25.1309(b)(4) and § 25.1309(b)(5).
4-3
AC 25.1309-1B CHA PTER 5. COMPLIANCE WITH § 25.1309
5.1 Overview.
This chapter describes specific means of compliance with § 25.1309. The applicant would benefit from obtaining early agreement from the FAA on its chosen means of compliance.
5.2 Compliance with § 25.1309(a).
5.2.1 Equipment, systems, and installations regulated by § 25.1309(a)(1) must be shown to function properly when installed. The “airplane operating and environmental conditions” that must be considered under that regulation include the full normal operating envelope of the airplane found in the airplane flight manual (AFM) together with any modification to that envelope associated with abnormal or emergency procedures. External environmental conditions that the airplane is reasonably expected to encounter should be considered, such as atmospheric turbulence, high-intensity radiated fields, lightning, and precipitation. The severity of the external environmental conditions that should be considered is limited to those established by certification standards and precedence.
5.2.2 In addition to the external operating and environmental conditions, the effect of the operating and environmental conditions within the airplane should be considered.
Examples of these effects include the following: vibration and acceleration loads, variations in fluid pressure and electrical power, fluid or vapor contamination due to either the normal environment or accidental leaks or spillage and handling by personnel, heat radiated from nearby equipment, and electromagnetic emission from installed equipment. AC 21-16 recognizes RTCA Document DO-160, which defines a series of standard environmental test conditions and procedures that may be used to support compliance. Environmental test procedures contained in technical standard orders (TSOs), or other environmental test standards approved for equipment qualifications, can be used to support compliance. The conditions under which the installed equipment will be operated should be equal to or less severe than the environment for which the equipment is qualified.
5.2.3 The applicant may substantiate the proper functioning of equipment, systems, and installations under the operating and environmental conditions approved for the airplane by test and/or analysis, or reference to comparable service experience on other airplanes if shown to be valid for the proposed installation. For the equipment, systems, and installations covered by § 25.1309(a)(1), the compliance demonstration should also confirm that their normal functioning does not adversely affect the proper functioning of other equipment, systems, or installations covered by § 25.1309(a)(1).
5.2.4 The equipment, systems, and installations addressed by § 25.1309(a)(2) are not required to meet § 25.1309(a)(1). These equipment, systems, and installations are those associated with miscellaneous systems intended for convenience, such as passenger 5-1
AC 25.1309-1B amenities, passenger entertainment systems, in-flight telephones, and so forth, whose failure or improper functioning should not affect the safety of the airplane. In other words, the types of systems addressed by § 25.1309(a)(2) should be designed so that the severity of their functional failures has “no safety effect.” (See paragraph 3.1.1 of this AC for the definition of “no safety effect.”) Therefore, the qualification requirements for such equipment, systems, and installations can be reduced to the necessary tests for showing that their normal or abnormal functioning does not adversely affect the proper functioning of the equipment, systems, or installations covered by § 25.1309(a)(1), or the safety of the airplane or its occupants. Examples of adverse effects include fire, explosion, exposing passengers to high voltages, and so forth. The FAA expects normal installation practices to result in sufficiently obvious isolation of the impacts of such equipment on safety that substantiation can be based on a relatively simple qualitative installation evaluation. If the possible failure effects and their evaluation are questionable, or isolation between systems is provided by complex means, then more formal structured evaluation methods or a design change may be necessary.
5.3 Compliance with § 25.1309(b).
Section 25.1309(b)(1) requires that the airplane’s systems and associated components, as installed, and considered both separately and in relation to other systems, must be designed so that any catastrophic failure condition is extremely improbable and does not result from a single failure. Section 25.1309(b)(2) requires that any hazardous failure condition is extremely remote, and § 25.1309(b)(3) requires that any major failure condition is remote. An analysis should consider the application of the fail-safe design concept described in paragraph 2.2 of this AC. The analysis should give special attention to ensuring the effective use of design techniques that would prevent single failures or other events from damaging or otherwise adversely affecting more than one redundant system channel or more than one system performing operationally similar functions. Additionally, § 25.1309(b)(4) requires the applicant to eliminate significant latent failures (SLFs) (see definition in paragraph 1.5.26 of this AC) to the extent practical, and provides criteria for accepting those SLFs that cannot be practically eliminated. Section 25.1309(b)(5) applies to the catastrophic failure conditions that result from two failures, either of which could be latent for more than one flight. The failure conditions addressed by § 25.1309(b)(5) are a subset of the failure conditions addressed in § 25.1309(b)(4).
5.3.1 General.
Appendix C of this AC provides an overview of the typical safety assessment process.
Compliance with the requirements of § 25.1309(b) should be shown by safety analyses.
Where necessary, the failure effects should be substantiated by appropriate ground, flight, or simulator tests. Failure conditions should be identified, and their effects assessed. The maximum allowable probability of the occurrence of each failure condition is determined from the failure condition’s effects. When assessing failure conditions, appropriate analysis considerations should be accounted for. Any analysis should consider the following:
5-2
AC 25.1309-1B
5.3.1.1 Possible failure conditions and their causes, modes of failure, and damage from sources external to the system.
5.3.1.2 The possibility of multiple failures due to a common cause, multiple independent failures, and undetected failures.
5.3.1.3 The possibility of requirement, design, and implementation errors.
5.3.1.4 The effect of flightcrew errors reasonably expected in service after the occurrence of a failure or failure condition. (See AC 25.1302-1.)
5.3.1.5 The effect of reasonably anticipated errors when performing maintenance actions.
5.3.1.6 The flightcrew alerting cues, corrective action required, and the flightcrew capability of detecting faults.
5.3.1.7 The resulting effects on the airplane and its occupants, or other persons (such as ground crew or maintenance personnel), considering the stage of flight, the operational sequences (sequence of system responses or expected flightcrew actions following a failure(s)), and operating and environmental conditions.
5.3.2 Planning.
This AC provides guidance on methods of accomplishing the safety objective. The detailed methodology needed to achieve this safety objective depends on many factors, particularly, the degree of system complexity and integration. For proposed airplane designs that will contain many complex or integrated systems, it is likely that the applicant will need to propose and develop a plan to describe the intended process. In general, the extent and structure of the analyses to show compliance with § 25.1309 will be greater when the system is more complex, and the effects of the failure conditions are more severe. Industry standards such as those listed in paragraph 1.4.5 of this AC provide further information on the planning activity. This plan should include consideration of all of the following aspects:
5.3.2.1 Functional and physical interrelationships of systems.
5.3.2.2 Determination of detailed means of compliance, which may include the use of development assurance techniques.
5.3.2.3 Means for establishing the accomplishment of the plan, including how the plan is followed throughout the project to ensure completion.
5.3.3 Availability of Industry Standards and Guidance Materials.
There are a variety of acceptable techniques used currently in industry, some of which are reflected in SAE ARP 4754 and ARP 4761. This AC is not intended to constrain the applicant to the use of these documents in defining their particular methods for 5- 3
AC 25.1309-1B satisfying the objectives of this AC. However, these documents contain material and methods that an applicant may choose to use for performing the safety assessment. The FAA recognizes these methods, when correctly applied, as valid for showing compliance with § 25.1309(b). In addition, SAE ARP 4761 contains tutorial information on applying specific engineering methods (for example, Markov analysis and fault tree analysis) that an applicant may wish to use in whole or in part.
5.3.4 Acceptable Application of Development Assurance Methods.
5.3.4.1 Paragraph 5.3.1.3 of this AC states that any analysis necessary to show compliance with § 25.1309(b) should consider the possibility of errors in requirement, design, and implementation. Errors made during the design and development of systems have traditionally been detected and corrected by exhaustive tests conducted on the system and its components, by direct inspection, and by other direct verification methods capable of completely characterizing the performance of the system. These direct techniques may still be appropriate for simple systems, which perform a limited number of functions and are not highly integrated with other airplane systems.
5.3.4.2 For integrated systems, or systems that perform complex functions, exhaustive testing might be either impossible because all of the system states (within a particular system and within the interfacing systems) cannot be determined, or impractical because of the number of tests that must be accomplished. For these types of systems, the applicant may use development assurance techniques to minimize errors. The rigor of development assurance should be determined by the severity of potential effects on the airplane in case of system malfunctions or loss of functions.
Acceptable guidelines for development assurance are described in—
• AC 20-174, which recognizes SAE ARP 4754 for aircraft and systems,
• AC 20-115D, which addresses the software aspects of certification, including the use of RTCA Document DO-178, supplements to DO- 178, and tool qualification, and
• AC 20-152A, which addresses airborne electronic hardware aspects of certification, including the use of RTCA Document DO-254.
5.3.4.3 Development assurance activities should define and identify all requirements, including any derived safety requirements needed to manage the many interactions between the systems. The activities should also validate that these requirements are complete and correct and verify that the system design meets those requirements. The development assurance activities should verify that the design provides for fault containment, so that the integrated systems are shown to be fail-safe.
5-4
AC 25.1309-1B
5.3.5 Crew and Maintenance Actions.
5.3.5.1 Where the applicant’s analysis identifies recognition and response, and/or action by the flightcrew, cabin crew, or maintenance personnel that is necessary to show that the design complies with § 25.1309(b), the applicant should accomplish all of the activities in paragraphs 5.3.5.1.1 through 5.3.5.1.3. For these verification activities, it is acceptable to assume a fully available indication function (except for the system failures being indicated).
5.3.5.1.1 Verify that any identified indications are actually provided by the system.
This includes verification that the sensor coverage and logic that detects the situations and triggers the indicator are sufficient to always detect the situations considering various causes, flight phases, operating conditions, operational sequences, and environments.
5.3.5.1.2 Verify that any identified indications will, in fact, be recognized.
5.3.5.1.3 Verify that any actions required have a reasonable expectation of being accomplished successfully and in a timely manner.
5.3.5.2 The applicant should accomplish the verification activities described in paragraph 5.3.5.1 by consulting with engineers, pilots, flight attendants, ma intenance personnel, and human factors specialists, as appropriate, taking due consideration of any relevant service experience and the consequences if the assumed action is performed improperly or not performed. In the case where the flightcrew may not recognize and respond as expected within constraints on the time available, consider the impacts at the system and aircraft level, accounting for circumstances, the phase of flight, and the complexity of the situation, to determine the tasks and/or the systems that need to be modified.
5.3.5.3 In complex situations, the results of the review by specialists may need to be confirmed by inspection, simulator, ground tests, or flight tests.
However, quantitative assessments of the probabilities of crew or maintenance errors are not currently considered feasible. If the failure indications are considered to be recognizable and the required actions do not cause an excessive workload, then for the purposes of the analysis, such corrective actions can be considered to be satisfactorily accomplished. If the necessary actions cannot be satisfactorily accomplished, the tasks and/or the systems need to be modified.
5-5
AC 25.1309-1B
5.3.6 Failure Conditions involving Significant Latent Failures.
5.3.6.1 Eliminating all significant latent failures may be impractical in some designs, as it is not always possible to detect any and all failures that may occur during flight. Paragraphs (b)(4) and (b)(5) of § 25.1309 are intended to ensure the minimization of SLFs where it is not possible to completely eliminate them.
5.3.6.2 The elimination and minimization requirement of § 25.1309(b)(4) does not apply to SLFs where the system failure condition meets the safety objectives of § 25.1309(b)(1) or (b)(2) with the assumption that the latent failure has occurred.
5.3.6.3 Where § 25.1309(b)(4) does apply, a hierarchy of safety objectives for managing exposure to SLFs needs to be shown.
1. To meet § 25.1309(b)(4), limiting exposure to SLFs should be an integral part of the applicants' normal design practice. The applicant must first eliminate SLFs to the maximum practical extent. To do so, the applicant should utilize the current state-of-the-art technology, e.g., by implementing practical and reliable failure monitoring and flight crew indication systems to detect failures that would otherwise be latent.
2. For each significant latent failure that cannot reasonably be eliminated, the applicant must minimize the exposure time by design. To do so, the applicant should utilize current state-of-the-art technology rather than relying on scheduled maintenance tasks at lengthy intervals, i.e., implementing pilot-initiated checks, or self-initiated checks (e.g., first flight of the day check, power-up built-in tests, or other system automated checks).
5.3.6.4 An acceptable means of compliance to minimization is to limit the latency of the SLF by minimizing the time the failure is allowed to be present such that the product of this exposure time and the average failure rate of the SLF does not exceed 1/1000. Another acceptable means of compliance to minimization is to show that the failure would not be latent for more than one flight.
5.3.6.5 There can be situations where it is not practical to meet the 1/1000 criterion. For example, if meeting it would result in performing complex or invasive maintenance tasks on the flight line, thereby increasing the risk of incorrect maintenance and associated cost. In such situations, safety is better served when the latent failure is serviced at a suitable maintenance facility. In cases where the applicant can demonstrate that meeting the 1/1000 criterion is not practical, the applicant must minimize the time the failure is expected to be present.
5-6
AC 25.1309-1B
5.3.6.6 In those situations where the significant latent failure is assumed to be latent for the life of the airplane, the applicant should include a qualitative assessment to determine whether a periodic maintenance task is necessary to avoid undue risk due to the exposure to catastrophic or hazardous failure conditions.
5.3.6.7 For a catastrophic failure condition that involves two failures, either of which could be latent for more than one flight, compliance with § 25.1309(b)(5) is required. These failure conditions are denoted as CSL+1. The applicant must first show that it is impractical to design the system with additional fault tolerance, such as adding failure monitors.
The assessment should explain why avoidance is not practical and provide supporting rationale for the acceptability. The rationale should be based on the proposed design being state-of-the-art, experience, sound engineering judgment, or other arguments, which led to the decision not to implement additional fault tolerance (e.g., adding failure monitors to eliminate the significant latent failure or adding redundancy to avoid the CSL+1 condition).
5.3.6.8 Once an applicant has shown that CSL+1 conditions are eliminated to the extent practical, the applicant must then apply the criteria in § 25.1309(b)(5)(ii) and (iii) to limit the residual risk in the presence of a latent failure and limit the probability of occurrence of the latent failure itself. These requirements are applied in addition to the requirement of § 25.1309(b)(1) where catastrophic failure conditions must be shown to be extremely improbable and do not result from a single failure.
5.3.6.9 Co mpliance with § 25.1309(b)(1), (b)(4), and (b)(5) together achieves a balance between the residual risk and latency exposure. For example, in a simple CSL+1 condition, the residual risk would need to be on the order of 1 x 10-6 per flight hour (or better) when the latency is 1/1000 to satisfy the requirement is extremely improbable (1 x 10-9 per flight hour).
Conversely, if the failure rate of the residual component is 1 x 10-5 per flight hour, then latency is limited to a probability of 1 x 10-4. Appendix D of this AC gives a more comprehensive example of how an applicant may conduct limit latency and residual risk analysis to show compliance with § 25.1309(b)(5)(ii) and (iii).
5.3.6.10 Although exposure to latency time is normally expressed in terms of flight hours, if the relevant failures depend on flight cycles, then their exposure times should be evaluated in terms of flight cycles when showing compliance. (See paragraph 7.6.1.4.)
5-7
AC 25.1309-1B
5.4 Compliance with § 25.1309(c).
5.4.1 Section 25.1309(c) requires that information concerning unsafe system operating conditions be provided to the flightcrew to enable them to take appropriate corrective action in a timely manner, thereby mitigating the effects of the condition to an acceptable level. Any system operating condition that, if not detected and properly accommodated by flightcrew action, would significantly contribute to, or result in, a hazardous or catastrophic condition, should be considered an unsafe system operating condition. Compliance with this requirement usually relies on the analysis identified in paragraph 5.3.1 of this AC, which also includes consideration of crew alerting cues, required corrective action, and the capability of detecting faults. Section 25.1309(c) further requires that the applicant design the systems and controls, including indication and annunciation, to minimize crew errors that could create additional hazards (in compliance with § 25.1302). The required information may be provided by an indication and/or annunciation whose forms and functions meet the requirements of § 25.1322 or may be provided by other dedicated means of information,2 or may be made apparent by the inherent airplane responses. The required information also depends on the degree of urgency for recognition and corrective action by the crew.
5.4.2 When a system provides failure monitoring and indication, the system reliability should be compatible with the safety objectives associated with the system function for which it provides that indication. For example, if the effects of having a system failure and not annunciating that failure are catastrophic, the combination of the system failure with the failure of its annunciation must be extremely improbable. The loss of annunciation should be considered a failure condition in and of itself, due to its impact on the ability of the flightcrew to cope with the subject failure. The subject failure condition should be classified as major unless the applicant can show otherwise. In addition, the applicant should assess unwanted operation (for example, nuisance alerts). The failure monitoring and indication should be reliable, technologically feasible, and economically practicable. Reliable failure monitoring and indication should use current state-of-the-art technology to maximize the probability of detecting and indicating genuine failures, while minimizing the probability of falsely detecting and indicating non-existent failures. Any indication to the flightcrew should be timely, obvious, clear, and unambiguous.
5.4.3 In the case of airplane conditions requiring immediate flightcrew action, a suitable warning indication must be provided to the flightcrew in accordance with § 25.1322, if not provided by inherent airplane characteristics (for example, buffeting). In either case, any warning should be rousing and should occur at a point in a potentially catastrophic sequence where the airplane’s capability and the flightcrew’s ability still remain sufficient for effective crew action to prevent the catastrophic outcome. For
2 The terms alert, annunciation and indication are used interchangeably throughout this AC. Thes e terms have been defined and used in different ways, and their definitions may change in the future. Refer to AC 25.1322 and other relevant ACs for the definitions of these terms and their specific application.
5- 8
AC 25.1309-1B other cases that require a flight crew alert, refer to § 25.1322 and other applicable system regulations.
5.4.4 Procedures for the flightcrew to follow after the occurrence of failures must be described in the FAA-approved AFM in accordance with §§ 25.1581 and 25.1585, or AFM revision or supplement.
5.4.5 To meet § 25.1309(c), even if operation or performance is unaffected or insignificantly af fected at the time of failure, the applicant should ensure that the design provides any information necessary for the flightcrew to take any action or observe any precautions.
Examples include reconfiguring a system, flightcrew awareness of a reduction in safety margins if flightcrew action is necessary, changing the flight plan or regime, making an unscheduled landing to reduce exposure to a more severe failure condition that would result from subsequent failures, or operational or environmental conditions. The applicant should also ensure that the design provides any information concerning unsafe system operating conditions if a failure must be corrected before a subsequent flight. Information and alerting indications may be inhibited during specific phases of flight where awareness or corrective action by the crew is considered more hazardous than no awareness or corrective action; for example, during critical flight phases like takeoff, or if operation or performance is unaffected or insignificantly affected.
5.4.6 The use of periodic maintenance or flightcrew checks to detect SLFs after they occur is undesirable and should not be used in place of practical and reliable failure monitoring and indications. Where such monitoring and indications cannot be accomplished, see paragraph 5.3.6 of this AC for guidance. Chapter 8 of this AC provides further guida nce on the use of periodic maintenance or flightcrew checks. Comparison with similar, previously approved systems is sometimes helpful. However, if a new design solution allows practical and reliable failure monitoring and indications, this should be preferred in lieu of periodic maintenance or flightcrew checks.
5.4.7 Applicants should give pa rticular attention to the placement of switches or other control devices, relative to one another, to minimize the potential for inadvertent incorrect flightcrew action, especially during emergencies or periods of high workload. Extra protection, such as the use of guarded switches, may sometimes be needed. See AC 25.1302-1 and other relevant ACs for additional guidance on these and other design attributes related to the avoidance and management of flightcrew error.
5.5 Compliance with § 25.1309(e).
Section 25.1309(e) requires that certification maintenance requirements be established, as necessary, to prevent development of failure conditions described in § 25.1309(b), and that these requirements be included in the Airworthiness Limitations section (ALS) of the ICA required by § 25.1529. See chapter 8 of this AC for detailed guidance on establishing the required scheduled maintenance tasks. Once these tasks are established, they must be included in the ALS in accordance with paragraph (a)(6) of section H25.4 to appendix H, part 25.
5-9
AC 25.1309-1B CHA PTER 6. IDENTIFICATION OF FAILURE CONDITIONS AND CONSIDERATIONS
WHEN ASSESSING THEIR EFFECTS
6.1 Identification of Failure Conditions.
In order to identify the failure conditions regulated by § 25.1309, applicants should consider the potential effects of failures on the airplane and occupants. The applicant may also need to consider failure conditions that could present threats to persons on the ground, such as ground crew, or adjacent to the airplane during ground operations.
Threats include electric shock threats to mechanics, atmospheric events, unwanted door or thrust reverser movement, and other similar situations. These should be considered from the following perspectives:
6.1.1 By Considering Fai lures of Functions at the Airplane Level.
Failure conditions identified at this level are not dependent on the way the functions are implemented and the systems’ architectures.
6.1.2 By Considering Fai lures of Functions at the System Level.
These failure conditions are identified through examination of the way the functions are implemented and the systems’ architectures. Part of this examination is a systematic method, such as failure mode and effects analysis (FMEA), to look for failures within the systems’ architectures that could result in their loss or partial loss, or malfunctions that are not limited by the failure condition evaluations (for example, to discover system behaviors that have unintended safety consequences when those systems fail).
Note: The analysis of complex, highly integrated systems, in particular, should be conducted in a methodical and structured manner to ensure all significant failure conditions that arise from multiple failures and combinations of failure conditions are properly identified and accounted for. The relevant combinations of failures and failure conditions should be determined by the whole safety assessment process that encompasses the airplane and system-level functional hazard assessments (FHAs), Particular Risk (PRA), Zonal Safety (ZSA), and Common Mode (CMA) analyses. The overall effect on the airplane due to a combination of individual system failure conditions occurring as a result of a common or cascade failure may be more severe than the effect of each individual system failure. For example, failure conditions classified individually as minor or major may have hazardous or catastrophic effects at the airplane level when considered in combination.
6.1.3 By Considering Failures at the Equipment Level.
These failures may not affect a system’s functionality, but they could compromise safe operations or injure persons. These may include individual equipment with intrinsic hazards such as energy supply devices, chemical storage containers, or pressure storage bottles that are part of a system. The analysis should address the equipment’s normal operating conditions and failure conditions that could endanger the airplane or its occupants. Examples of intrinsic hazards to be evaluated include, but are not limited to, fires; explosions; release of toxic gases or fluids corrosive to surrounding structures;
6-1