AC 25.1309-1B and thermal runaway or excessive temperatures that could damage adjacent structures or systems.
Note: Identify any necessary mitigation means including, but not limited to, containment of resultant effects; pressure and temperature relief including venting provisions, if present; and indication or fault annunciation, where applicable. The testing necessary to verify the mitigation effectiveness is equally significant and should also be determined.
6.2 Identification of Failure Conditions Using a Functional Hazard Assessment.
6.2.1 Before an applicant proceeds with a detailed safety assessment, an FHA of the airplane and system functions to determine the need for, and scope of, subsequent analysis should be prepared. This assessment may be conducted using service experience;
engineering and operational judgment; and/or a top-down deductive qualitative examination of each function. An FHA is a systematic, comprehensive examination of airplane and system functions to identify potential no safety effect, minor, major, hazardous, and catastrophic failure conditions that may arise as a result of malfunctions or failures to function as intended. The assessment should take into consideration normal system responses to unusual and abnormal external factors. The assessment involves the operational vulnerabilities of systems rather than a detailed analysis of the actual implementation.
6.2.2 Each system function should be examined with respect to the other functions performed by the system, because the loss or malfunction of multiple functions performed by the system could result in a more severe failure condition than the failure of a single function. In addition, each system function should be examined with respect to functions performed by other airplane systems because the loss or malfunction of different but related functions, provided by separate systems, may affect the severity of failure conditions postulated for a particular system.
6.2.3 The FHA should be performed early in the design of the project and updated as necessary as the design develops. It is used to define the airplane-level or system-level safety objectives that must be considered in the proposed airplane or system architectures. Some systems may need only a simple review of the system design to determine the hazard classification. The FHA should also be used to determine the function development assurance levels. An FHA requires experienced engineering judgment to ensure completeness of failure condition identification, and early coordination between the applicant and certification authority.
6.2.4 Depending on the relationship between functions and the systems that perform them, different approaches to an FHA may be taken. Where there is a clear correlation between functions and systems, and where interactions are relatively simple, it may be feasible to conduct separate FHAs for each system, provided that any interface aspects are properly considered and are easily understood. However, where systems and functional relationships are complex or integrated, a top-down approach, from an airplane-level perspective, should be considered when planning and conducting FHAs.
6-2
AC 25.1309-1B With increasing integrated system architectures, this traditional top-down approach should be performed in conjunction with common-cause considerations (e.g., common resources) in order to adequately address the cases where one system contributes to multiple airplane-level functions.
6.3 Considerations whe n Assessing Failure Condition Effects.
6.3.1 The requirements of § 25.1309(b) are intended to ensure an orderly and thorough evaluation of the effects on safety of foreseeable failures or other external events, separately or in combination, involving one or more system functions. The interactions of these factors within a system and among relevant systems should be considered. In assessing the effects of a failure condition, factors that might alleviate or intensify the direct effects of the initial failure condition should be considered. Some of these factors include consequent or related conditions existing within the airplane that might affect the flightcrew’s ability to deal with direct effects, such as the presence of smoke, acceleration effects, interruption of communication, interference with cabin pressurization, and so forth. When assessing the consequences of a given failure condition, the applicant should consider the failure information provided, the complexity of the flightcrew action, and the relevant crew training. The number of overall failure conditions may influence the expected flightcrew performance. Training recommendations may need to be identified in some cases.
6.3.2 The applicant should evaluate the severity of failure conditions according to the following:
6.3.2.1 Effects on the airplane, such as reductions in safety margins, degradation in performance, loss of capability to conduct certain flight operations, reduction in environmental protection, or potential or consequential effects on structural integrity. When the effects of a failure condition are complex, the hazard classification may need to be validated by tests, simulation, or other appropriate analytical techniques.
6.3.2.2 Effects on the flightcrew, such as increases above their normal workload that would affect their ability to cope with adverse operational or environmental conditions or subsequent failures. Consider any other human factors assumptions made about the flightcrew’s ability to detect, diagnose, and respond appropriately to the failure.
6.3.2.3 Effects on the occupants (passengers and cabin crew).
6.3.2.4 Risks to persons other than airplane occupants (such as ground crew or maintenance personnel) should be taken into account when assessing systems failure conditions in compliance with § 25.1309. See also the discussion in paragraph 1.2.2.13 of this AC.
6-3
AC 25.1309-1B
6.3.3 The applicant should classify the severity of each effect as no safety effect, minor, major, hazardous, or catastrophic. These terms are defined in chapter 3 of this AC (and in § 25.4).
6.3.3.1 The classification of failure conditions does not depend on whether a system or function is the subject of a specific requirement or regulation.
Some required systems, such as transponders, position lights, and public address systems, may have the potential for only minor failure conditions.
Conversely, other systems that are not required, such as autoflight systems, may have the potential for major, hazardous, or catastrophic failure conditions.
6.3.3.2 Regardless of the types of assessment used, the classification of failure conditions should always be accomplished with consideration of all relevant factors, internal and external; for example, system, crew, performance, operational, and environmental. It is particularly important to consider factors that would alleviate or intensify the severity of a failure condition. Where flight duration, flight phase, or maximum length diversion time can adversely affect the FHA outcome, they must be considered as intensifying factors. Other intensifying factors include conditions (not related to the failure, such as weather or adverse operational or environmental conditions), which reduce the capability of the airplane, or the ability of the flightcrew to cope with a failure condition. An example of an alleviating factor is the continued performance of identical or operationally similar functions by other systems not affected by the failure condition. Another example of an alleviating factor is the flightcrew’s ability to recognize the failure condition and take action to temper its effects. (Note that such flightcrew action can in some cases be used to alleviate a failure condition, but it should not be used in lieu of appropriate system design, integrity, and availability requirements.) Whenever this is taken into account, attention to the detection means should be given to ensure the flightcrew’s ability (including physical and timeliness) to detect and take corrective action is sufficient. To correlate with the flightcrew’s annunciation requirements in § 25.1309(c), consider the case of the flightcrew taking action and also the effects if they do not act or their response is delayed. If their inaction or delayed response results in a severe effect, it may be considered an unsafe system operating condition that carries certain considerations for flightcrew annunciations and evaluation of flightcrew responses. If flightcrew action is used to alleviate the effects of a failure condition, the associated information provided to the flightcrew should comply with § 25.1309(c). See paragraph 5.4 of this AC for more detailed guidance on those considerations. Combinations of intensifying or alleviating factors only need to be considered if they are anticipated to occur together.
6- 4
AC 25.1309-1B
6.3.3.3 For hazardous conditions that result in a large reduction in safety margins or functional capabilities, or excessive flightcrew workload, the applicant should show that the remaining capabilities of the airplane and flightcrew will be sufficient to ensure the condition does not become catastrophic.
6- 5
AC 25.1309-1B 7-1 CHAPTER 7. ASSESSMENT OF FAILURE CONDITION PROBABILITIES AND
ANALYSIS CONSIDERATIONS
7.1 General.
After the applicant has identified the failure conditions and assessed the severity of the effects of failure conditions, it is the applicant’s responsibility to determine how to show compliance with § 25.1309(b) and obtain a finding of compliance from the FAA.
An applicant may use appropriate combinations of one or more of the following methods to show compliance: design and installation reviews, analyses, flight tests, ground tests, simulator tests, or other approved means.
7.2 Assessment of Failure Condition Probabilities.
7.2.1 The probability that a failure condition would occur may be assessed as probable, remote, extremely remote, or extremely improbable. These terms are defined in chapter 3 of this AC (and in § 25.4). Each failure condition should have a probability that is inversely related to the severity of its effects as described in chapter 4 of this AC.
7.2.2 When a system provides protection from events (for example, cargo compartment fire, gusts), its reliability should be compatible with the safety objectives necessary for the failure condition and be associated with the failure of the protection system and the probability of the events. (See additional guidance in paragraph 7.8 and appendix E of this AC.)
7.2.3 An assessment to identify and classify failure conditions is necessarily qualitative. On the other hand, an assessment of the probability of a failure condition may be either qualitative or quantitative. An analysis may range from a report that interprets applicable service data or compares two similar systems to a detailed analysis that may or may not include estimated numerical probabilities. The depth and scope of an analysis depends on the types of functions performed by the system, the severity of failure conditions, and whether the system is complex. Paragraph 7.5, Depth of Analysis, provides more guidance on using a combination of qualitative and quantitative probability assessments of failure conditions.
7.3 Single Failure Considerations.
7.3.1 According to the requirements of § 25.1309(b)(1)(ii), a catastrophic failure condition must not result from the failure of a single component, part, or element of a system. To preclude catastrophic failure conditions, the system design should provide failure containment that limits the propagation of the effects of any single failure. In addition, there must be no common cause failure that could affect both the single component, part, or element, and its failure containment provisions. A single failure includes any set of failures that cannot be shown to be independent from each other. Because errors may cause failures, the implications of errors in requirement specification, design, implementation, installation, flightcrew or ground crew operations, maintenance, and
AC 25.1309-1B 7-2 manufacturing that could result in common mode failures should be assessed.
Appendix B of this AC and SAE ARP 4761 describe types of analysis methods that may be conducted to identify and minimize common mode failures and document that adequate independence exists between multiple failures. Failure containment techniques available to establish independence may include partitioning, separation, and isolation. It should be noted that only the dominant modes of failure are typically identified and evaluated in a bottom-up component FMEA. For example, the dominant mode “loss of command signal” may be caused by one or more failures of components that produce, process, or transmit the command signal. However, identifying only the dominant failure modes may not be sufficient. To show that no failure mode is anticipated to cause a catastrophic event, consideration of less-obvious failure modes may be required. The information available from top-down analyses, such as the fault tree analysis, can help focus the single failure analysis onto areas of the design where an obscure failure mode might be able to violate an otherwise fail-safe design. (One example of an obscure failure mode is intermittent shorting in the monitored signal’s path that allows it to defeat the monitor coverage.)
7.3.2 While single failures must normally be assumed to occur, there are cases where it is obvious that, from a realistic and practical viewpoint, any knowledgeable, experienced person would unequivocally conclude that a failure mode simply would not occur, unless it is associated with a wholly unrelated failure condition that would itself be catastrophic. These types of failures may be considered as not foreseeable. Once identified and accepted, such cases need not be considered failures in the context of § 25.1309. Probabilistic methods may not be used in making this assessment.
7.4 Common Cause Failure Considerations.
An analysis should consider the application of the fail-safe design concept described in paragraph 2.2 of this AC. The analysis should also give special attention to ensuring the effective use of design and installation techniques that would prevent single failures or other events from damaging or otherwise adversely affecting more than one redundant system channel, more than one system performing operationally similar functions, or any system and an associated safeguard.
When considering such common cause failures or other events, consequential or c ascading effects should be taken into account. Cascading effects are the set of effects resulting from the propagation of an initiating condition (e.g., a failure or initiating event).
Some examples of potential sources of common cause failures or other events w ould include the following:
• Rapid release of energy from concentrated sources, such as uncontained failures of rotating parts (other than engines and propellers) or pressure vessels,
• Pressure differentials,
• Non-catastrophic structural failures,
• Loss of environmental conditioning,
AC 25.1309-1B 7-3
• Disconnection of more than one subsystem or component by overtemperature protection devices,
• Contamination by fluids,
• Damage from localized fires,
• Loss of power supply or return (for example, mechanical damage or deterioration of connections),
• Failure of sensors that provide data to multiple systems,
• Excessive voltage,
• Physical or environmental interactions among parts,
• Requirements, design, implementation, installation, flightcrew or ground crew operations, maintenance, and manufacturing errors, or
• Events external to the system or to the airplane.
7.5 Depth of Analysis.
The following identifies the depth of analysis expected based on the classification of a failure condition. In all cases discussed below, the applicant should consider the combinations of failure condition effects, as noted in chapter 6 of this AC.
7.5.1 N o Safety Effect Failure Conditions.
An FHA with a design and installation appraisal to establish independence from other functions is necessary for the safety assessment of these failure conditions. If it is apparent that an FHA is not necessary for a simple function (for example, the loss of an in-flight entertainment function) and the applicant chooses not to do an FHA, then the safety effects may be derived from the design and installation appraisal performed by the applicant.
7.5.2 M inor Failure Conditions.
An FHA with a design and installation appraisal to establish independence from other functions is necessary for the safety assessment of these failure conditions. If the applicant chooses not to do an FHA, then the safety effects may be derived from the design and installation appraisal performed by the applicant. The applicant should document the result of the appraisal. If system complexity or integration is such that a design or installation appraisal alone cannot establish such isolation or functional independence, then more formal methods as described in SAE ARP 4754/4761 should be applied.
AC 25.1309-1B 7-4
7.5.3 Major Failure Conditions.
Major failure conditions must be remote, per § 25.1309(b)(3).
7.5.3.1 If the system is similar in its relevant attributes to those used in other airplanes and the effects of failure would be the same, then design and installation appraisals (as described in Appendix B of this AC) and satisfactory service history of the equipment being analyzed, or of similar design, is usually acceptable for showing compliance. The applicant should substantiate similarity claims by identifying the differences between the system/equipment being certified and other system/equipment to which similarity is claimed. The applicant should also provide the rationale for why the service history of the other system/equipment is applicable.
7.5.3.2 For systems that are not complex, where similarity cannot be used as the basis for compliance, then compliance may be shown with a qualitative assessment showing that the system-level major failure conditions of the system, as installed, are consistent with the FHA and are remote (for example, redundant systems).
7.5.3.3 For complex systems without redundancy, compliance may be shown as in paragraph 7.5.3.2 above. To show that malfunctions are remote in systems of high complexity without redundancy (for example, a system with a self-monitoring microprocessor), it is sometimes necessary to conduct a qualitative functional FMEA supported by failure rate data and fault detection coverage analysis.
7.5.3.4 An analysis of a redundant system is usually complete if it shows isolation between redundant system channels and satisfactory reliability for each channel. For complex systems where functional redundancy is required, a qualitative FMEA and qualitative fault tree analysis may be necessary to determine whether redundancy actually exists (for example, no single failure affects all functional channels).
7.5.4 H azardous and Catastrophic Failure Conditions.
Hazardous failure conditions must be extremely remote, per § 25.1309(b)(2), and catastrophic failure conditions must be extremely improbable, per § 25.1309(b)(1).
7.5.4.1 Except as specified in paragraph 7.5.4.2 below, a detailed safety analysis is necessary for each hazardous and catastrophic failure condition identified by the FHA. The analysis is usually a combination of qualitative and quantitative assessment of the design.
7.5.4.2 For very simple and conventional installations—that is, low complexity and similarity in relevant attributes—it may be possible to assess a hazardous or catastrophic failure condition as extremely remote or
AC 25.1309-1B 7-5 extremely improbable, respectively, based on experienced engineering judgment using only qualitative analysis. The basis for the assessment is the degree of redundancy, the established independence, isolation of the channels, and the reliability record of the technology involved.
Satisfactory service experience on similar systems commonly used in many airplanes may be sufficient when a close similarity is established in respect to both the system design and operating conditions.
7.5.4.3 For complex systems where true similarity in all relevant attributes, including installation attributes, can be rigorously established, it may also be possible to assess a hazardous or catastrophic failure condition as extremely remote or extremely improbable, respectively, based on experienced engineering judgment using only qualitative analysis. A high degree of similarity in both design and application is required to be substantiated. Further, the applicant must be able to demonstrate that the baseline design complies. This typically requires that the applicant has access to all the type design data for the baseline against which the comparison is being made.
7.6 Calculation of Average Probability per Flight Hour (Quantitative Analysis).
7.6.1 The average probability per flight hour is the probability of occurrence, normalized by the flight time, of a failure condition during a flight representing the average “at risk” time of the overall possible flights of the airplane fleet to be certified. The calculation of the average probability per flight hour for a failure condition should consider all of the following:
7.6.1.1 The average flight duration and average flight profile for the airplane type to be certified. Note that this assumption may be affected when showing compliance with section K25.1 ETOPS requirements.
7.6.1.2 All combinations of failures and events that contribute to the failure condition.
7.6.1.3 The conditional probability if a sequence of events is necessary to produce the failure condition.
7.6.1.4 T he relevant “at risk” time if a failure condition or event is only relevant during certain flight phases. If the failure condition occurs during specific flight operations or certain flight phases, it should meet the average risk criteria under those specific conditions rather than allowing the risk to be averaged out over a flight of mean duration. In these cases, the probability requirement is applied as a probability per flight or per flight cycle. To convert to per flight hour, divide the per flight probability by one hour.
7.6.1.5 T he total exposure time if the failure can persist for multiple flights.
AC 25.1309-1B 7-6
7.6.2 The details of how to calculate the average probability per flight hour for a failure condition are given in appendix F of this AC and in SAE ARP 4761.
7.6.3 If the probability of a subject failure condition occurring during a typical flight of mean duration for the airplane type divided by the flight’s mean duration in hours is likely to be significantly different from the predicted average rate of occurrence of that failure condition during the entire operational life of all airplanes of that type, then a better model of the flight of average risk must be used. For example, the loss of consumable material (for example, fluid leakage) may become a critical failure condition for a flight that is longer than the flight of mean duration.
7.6.4 For various reasons, component failure rate data are not typically precise enough to enable accurate estimates of the probabilities of failure conditions. This results in some degree of uncertainty, as indicated by the wide line in figure 4-1 of this AC, and the expression “on the order of” in the descriptions of the quantitative probability terms that are provided above. (See paragraph 3.3 of this AC.) When calculating the estimated probability of each failure condition, this uncertainty should be accounted for in a conservative way that does not compromise safety.
7.7 Integrated Systems.
7.7.1 Both physical and functional interconnections between systems have been a feature of airplane design for many years. Section 25.1309(b) accounts for this in requiring systems to be considered in relation to other systems. Provided the interfaces between systems are relatively few and simple, and hence readily understandable, compliance may often be shown through a series of system safety assessments (SSA). Each SSA deals with a particular failure condition (or more likely a group of failure conditions) associated with a system and, where necessary, accounts for failures arising at the interface with other systems. However, where the systems and their interfaces become more complex and extensive, the task of showing compliance may become more complex. It is therefore essential that the means of compliance are considered early in the design phase to ensure that the design can be supported by a viable safety assessment strategy. Aspects of the guidance material that should be given particular consideration are as follows:
7.7.1.1 Planning the proposed means of compliance. This should include development assurance activities to mitigate the occurrence and effects of errors in the design.
7.7.1.2 Considering the importance of architectural design in limiting the impact and propagation of failures.
7.7.1.3 The potential for common cause failures and cascading failure effects and the possible need to assess combinations of multiple lower level failure conditions. (For example, multiple minor and/or major failure conditions can lead up to a hazardous or catastrophic failure condition).
AC 25.1309-1B 7-7
7.7.1.4 The importance of multi-disciplinary teams in identifying and classifying failure conditions.
7.7.1.5 Effect of flightcrew and maintenance procedures in limiting the impact and propagation of failures. However, the effects of overreliance on flightcrew and maintenance actions are also a part of this consideration.
7.7.2 Rigorous and well-structured design and development procedures play an essential role in facilitating a methodical safety assessment process and providing visibility to the means of compliance. SAE ARP 4754 is recognized as the industry standard of practice for certification of highly integrated or complex airplane systems.
7.7.3 Experienced engineering and operational judgment should be applied when determining whether a system is complex. Comparison with similar, previously approved systems is sometimes helpful. All relevant systems attributes should be considered; however, the complexity of software and hardware do not need to be a dominant factor in determining complexity at the system level. The design of a system may be very complex, but predicting its potential malfunctions may be straightforward.
For example, the software and interfaces of a predictive windshear system might be considered complex, but the potential failures of the system could be summarized as false alerts, misleading information, and the loss of ability to predict windshear.
7.8 O perational or Environmental Conditions.
7.8.1 A probability of 1 should usually be used for encountering a discrete condition for which the airplane is designed, such as instrument meteorological conditions or Category III weather operations, or landing distance field length provided in the AFM.
However, appendix E of this AC contains allowable probabilities that may be assigned to various operational and environmental conditions for use in computing the average probability per flight hour of failure conditions without further justification. The FAA has provided appendix E for guidance and does not intend it to be exhaustive or prescriptive. Currently, a few items do not have accepted standard statistical data from which to derive a probability figure. However, these items are included either for future consideration, or as items for which the applicant may propose a probability figure supported by statistically valid data or supporting service experience. The applicant may propose additional conditions or different probabilities from those in appendix E of this AC, provided they are based on statistically valid data or supporting service experience. The applicant should provide justification for the data and obtain early agreement from the certification authority when such conditions will be included in an analysis. When combining the probability of such a random condition with that of a system failure(s), care should be taken to ensure that the condition and the system failure(s) are independent of one another, or that any dependencies are properly accounted for.
AC 25.1309-1B
7.8.2 Single failures in combination with operational or environmental conditions leading to catastrophic failure conditions are in general not acceptable. However, single failures do not need to be assumed in combination with operational events or environmental conditions that are extremely remote or that occur outside the normal flight envelope defined in AC 25.671-1. Other cases that are properly justified may be accepted on a case-by-case basis by the certifying authority. In limited cases where a non-redundant system provides protection against an operational or environmental condition (for example, a fire protection system in the cargo compartment comprised of detection and suppression functions) any single failure that results in the loss of the protection function should meet the criteria associated with the major failure condition classification, to ensure adequate system reliability and development assurance.
7.9 Justification of Assumptions, Data Sources, and Analytical Techniques.
7.9.1 A ny analysis is only as accurate as the assumptions, data, and analytical techniques it uses. Therefore, to show compliance with the requirements, the underlying assumptions, data, and analytic techniques should be identified and justified to assure that the conclusions of the analysis are valid. Variability may be inherent in elements such as failure modes, failure effects, failure rates, failure probability distribution functions, failure exposure times, failure detection methods, fault independence, limitation of analytical methods, processes, and assumptions. The justification of the assumptions made with respect to the above items should be an integral part of the analysis and summarized in the safety analysis. Assumptions can be validated by using experience with identical or similar systems or components with due allowance made for differences of design, duty cycle, and environment. Where it is not possible to validate a safety analysis in which data or assumptions are critical to the acceptability of the failure condition, extra conservatism should be built into either the analysis or the design. Alternatively, any uncertainty in the data and assumptions should be evaluated to the degree necessary to show that the analysis conclusions are insensitive to that uncertainty.
7.9.2 Where adequate validation data is not available (for example, new or novel systems) and extra conservatism is built into the analysis, then the normal post-certification in-service follow-up may be performed to obtain the data necessary to alleviate any consequence of the extra conservatism. This data may be used, for example, to extend system check intervals.
7- 8