AC 25.1309-1B CHA PTER 8. OPERATIONAL AND MAINTENANCE CONSIDERATIONS
8.1 Overview.
This AC addresses operational and maintenance considerations that are directly related to c ompliance with § 25.1309. Flightcrew and maintenance tasks related to compliance with § 25.1309 should be appropriate and reasonable. However, the FAA does not currently consider quantitative assessments of flightcrew errors to be feasible.
Reasonable tasks are those that can be realistically anticipated to be performed correctly when they are required or scheduled. Paragraph 5.3.5 addresses the expected validation and verification tasks related to flightcrew mitigating actions during a safety assessment. In addition, based on experienced engineering and operational judgment, the discovery of obvious failures during normal operation or maintenance of the airplane may be assumed, even though identification of such failures is not the primary purpose of the operational or maintenance actions. During the safety assessment process associated with § 25.1309 compliance, useful information or instructions associated with the continued airworthiness of the airplane might be identified. This information should be made available to those compiling the ICA covered by § 25.1529.
8.2 Flightcrew Action.
W hen assessing the ability of the flightcrew to cope with a failure condition, the information provided to the crew, the complexity of the required action, and pilot response time should be considered. When considering the information provided to the flightcrew, refer also to the guidance on § 25.1309(c) (paragraph 5.4 of this AC). Credit for flightcrew actions and consideration of flightcrew errors should be consistent with relevant service experience and acceptable human factors evaluations. If the evaluation indicates that a potential failure condition can be alleviated or overcome without jeopardizing other safety related flightcrew tasks and without requiring exceptional pilot skill or strength, credit may be taken for both qualitative and quantitative assessments. Similarly, credit may be taken for correct flightcrew performance of the periodic checks required to show compliance with § 25.1309(b), provided that performing such checks does not require exceptional pilot skill or strength and the overall flightcrew workload is not excessive. Flightcrew actions should be described in the AFM in compliance with § 25.1585. The applicant should provide a means to ensure the AFM contains all the required flightcrew actions used as mitigation in the hazard classification or to limit the exposure time of the failure condition.
8.3 Mai ntenance Action.
The applicant’s safety assessment may take cred it for the correct accomplishment of reasonable maintenance tasks, for both qualitative and quantitative assessments while also taking into consideration the effects of reasonably anticipated maintenance errors.
The maintenance tasks required to show compliance with § 25.1309(b) and (e) should be established. In doing this, the maintenance scenarios in the following paragraphs
8.3.1 a nd 8.3.2 can be used.
8-1
AC 25.1309-1B
8.3.1 Certification Maintenance Requirements.
8.3.1.1 Periodic maintenance or flightcrew checks may be used to help show compliance with § 25.1309(b). These checks are used to (1) detect the presence of, and thereby limit the exposure time to, SLFs, or (2) detect an impending wear-out of an item whose failure is associated with a hazardous or catastrophic failure condition. Where such checks cannot be accepted as basic servicing or reasonably anticipated flightcrew actions, they should be identified as candidate certification maintenance requirements (CCMRs) or required flightcrew actions in the SSA.
Advisory Circular 25-19A details the handling of CCMRs and the selection of CMRs. In compliance with § 25.1309(e), CMRs are included in the ALS of the ICA. Required flightcrew actions must be included in the approved section of the AFM.
8.3.1.2 Quantitative probability analysis of failure conditions, test data, relevant service experience, or other acceptable method should be used to determine check intervals. Because quantitative probability analysis contains inherent uncertainties as discussed in paragraph 7.6.4 of this AC, these uncertainties justify the controlled escalation (in other words, minor adjustments of the task intervals) or exceptional short-term extensions to individual CMRs.
Note: Some latent failures can only be verified by return-to-service tests on the equipment following its removal and repair. The mean time between failures of the equipment can be used to establish the time interval to detect the presence of latent failures if it can be ascertained that the equipment is removed and inspected at a rate more frequent than the safety analysis requires. This credit should be substantiated in the SSA.
The means of detecting the latent failures should be clearly documented.
For example, these means can be the acceptance tests performed before the equipment leaves the shop, or the system integrity and functional tests when the equipment is installed on the airplane.
8.3.2 Flight with Equipment or Functions Known to be Inoperative.
An applicant may elect to develop a list of equipment and functions that can be inoperative for flight, based on stated compensating precautions that should be taken (for example, operational or time limitations, flightcrew procedures, or ground crew checks). The documents used to show compliance with § 25.1309, together with any other relevant information, should be considered when developing this list. Also, experienced engineering and operational judgment should be applied when developing this list. If more than one flight is made with equipment known to be inoperative and that equipment affects the probabilities associated with hazardous and/or catastrophic failure conditions, then time limits might be needed for the number of flights or allowed operation time in that airplane configuration. The applicant should propose these time limits to the FAA Flight Standards Service for approval.
8- 2
AC 25.1309-1B
CHA PTER 9. ASSESSMENT OF MODIFICATIONS TO PREVIOUSLY
CERTIFICATED AIRPLANES
9.1 Assessment of Modifications.
The means to ensure continuing compliance with § 25.1309 for modifications to previously certificated airplanes should be determined on a case-by-case basis and depend on the applicable airplane certification basis and the extent of the change, in accordance with § 21.101. The change could be a simple modification affecting only one system or a major redesign of many systems, possibly incorporating new technologies. For any modification, the minimal effort for showing compliance with § 25.1309 is an assessment of the impact on the SSA, and the associated development assurance data. The result of this assessment may range from a simple statement that the existing SSA (and any associated development assurance data) still applies to the modified system in accordance with the original means of compliance, to the need for new means of compliance encompassing the plan referred to in paragraph 5.3.2 of this AC.
(If the type certificate holder is unwilling to release or transfer proprietary data in this regard, then a supplemental type certificate applicant might need to create the SSA and the development assurance data covering the relevant changed parts, and parts affected by those changes, of the type design. SAE ARP 4754 guidelines may be used when making a modification to an aircraft, equipment, or item or when reusing a system, equipment, or item.) The FAA recommends that the applicant contact the appropriate certification office early to obtain agreement on the means of compliance in accordance with the latest policies (see PS-AIR-21.15-01).
9.2 Reserved.
9-1
AC 25.1309-1B Appendix A A PPENDIX A. HISTORICAL PERSPECTIVE ON THE USE OF STATISTICAL
PROBABILITIES IN SYSTEM SAFETY ASSESSMENT A.1 Concorde Transport Supersonique Standard.
The British Civil Aviation Authority (BCAA) applied the concept of proportionally assigning statistical rate goals to categories of accident causes during the design and certification of the Concorde in the Concorde Transport Supersonique Standard in the 1960s. At that time, the BCAA considered the probability of a severe accident to be on the order of one per one million hours of flight (1 x 10-6 per flight hour). The BCAA roughly estimated that 10 percent of those accidents were the result of design systemsrelated hazards. Based on those assumptions for the Concorde, the BCAA reasoned that probability of a severe accident from design systems-related hazards should be less than 1 in 10 million flight hours, or 1 x 10-7 per flight hour. The BCAA standard defined hazard categories as minor, major, hazardous, and catastrophic, and it assigned qualitatively allowable probability for each category, e.g., probable, remote, and extremely remote. The BCAA also apportioned statistical probabilities to the categories (except the catastrophic category) for use in controlling “statistically controllable” hazards. The standard did not establish a numerical probability for catastrophic failure conditions because, per the overriding fail-safe philosophy, no single failure regardless of probability should foreseeably be allowed to result in a catastrophic failure condition. However, the cumulative probability of all catastrophic failure conditions should be no greater than 1 x 10-7.
A.2 British Civil Airworthiness Requirements.
The British Civil Aviation Authority replicated the Concorde airworthiness requirements in the British Civil Airworthiness Requirements (BCAR). During certification of the Concorde, the BCAA recognized that analyzing every hazard for the purpose of assuring that the probabilities collectively were less than 1 x 10-7 was an onerous and somewhat impractical task. To address this problem, the BCAA assumed that there were no more than one hundred systems-related, catastrophic failure conditions and that a direct allotment would be sufficient for certification. Therefore, the BCCA apportioned the allowable average probability per flight hour of 1 x 10-7 equally among the theoretical, one hundred catastrophic failure conditions, resulting in 1 x 10-9 per flight hour as the upper limit average probability per flight hour of a statistically controllable catastrophic failure condition. The 1 x 10-9 per flight hour probability was not applicable for single failure conditions that could lead to a catastrophic outcome.
A.3 FAA AC 25.1309-1.
The intent of the BCAR systems guidance was first adopted by the FAA in AC 25.1309-1, System Design Analysis, dated September 7, 1982. The BCAR and previous Concorde standards defined four hazard categories in terms of specific airplane level hazards and the effect of those hazards on the airworthiness of the airplane. AC 25.1309-1 defined three functional hazard categories. The AC defined the A-1
AC 25.1309-1B Appendix A functional categories as non-essential, essential, and critical. However, for all practical purposes, the non-essential category was synonymous with the minor category in the BCAR; the essential category spanned the BCAR major and hazardous categories; and critical was the same as catastrophic in the BCAR. The qualitative and quantitative probabilities that were defined in AC 25.1309-1, and the described application of those probabilities, were, for the most part, the same as the BCAR.
A.4 FAA AC 25.1309-1A.
In the 1980s, the FAA and the Joint Aviation Authorities (JAA) of Europe harmonized SSA requirements in § 25.1309 and Joint Airworthiness Requirement 25.1309, and the guidance in AC 25.1309-1A and its counterpart JAA Advisory Material Joint (AMJ)
25.1309. The only substantive difference between the AC and AMJ was that the JAA retained the “hazardous” category and its associated probability definitions from the BCAR; whereas the FAA did not but implied an intermediate “severe major” hazard category similar to “hazardous.” Otherwise, the definitions and probability values in the AC and AMJ were the same as those in the BCAR and Concorde standard. Both the AC and AMJ also contained a continuing strong emphasis on fail-safe design as the basic intent of the requirements.
A.5 This AC.
In revising § 25.1309 at amendment 25-152 (89 FR 68706, August 27, 2024), the FAA added the “hazardous” category. In this AC, the FAA addresses five failure condition classifications (no safety effect, minor, major, hazardous, and catastrophic) and their associated qualitative and quantitative probabilities. These terms are harmonized with European Union Aviation Safety Agency (EASA) Acceptable Means of Compliance (AMC) 25.1309.
A.6 Quantitative Probability Terms.
The quantitative probability values contained in this AC should not be applied independently of the qualitative guidance. For example, meeting the 1 x 10-9 per flight hour quantitative probability guidance alone is not sufficient to show compliance with the intent of the “extremely improbable” requirement of § 25.1309(b) if relevant experience indicates the failure condition can occur. The FAA’s guidance for using quantitative probability values to meet airworthiness standards has been unchanged since the 1970s. The probability numbers contained in this AC are provided solely for use in evaluating “statistically controllable” hazard contributors within the context of the analysis methodology described. The quantitative values in this AC do not represent FAA accident-rate goals or expectations. The values are unchanged from those derived for the Concorde program because it has been shown in service that the actual system safety achieved using fail-safe design techniques and the combination of qualitative and quantitative guidance in this AC continues to be acceptable.
A-2
AC 25.1309-1B Appendix B A PPENDIX B. ASSESSMENT METHODS FOR FAILURE CONDITIONS B.1 Assessment Methods.
Various methods for assessing the causes, severity, and probability of failure conditions are available to support experienced engineering and operational judgment. Some of these methods are structured. The various types of analysis are based on either inductive or deductive approaches. Probability assessments may be qualitative or quantitative. Descriptions of some types of analysis are provided below and in SAE ARP 4761.
B.1.1 Design Appraisal.
This is a qualitative appraisal of the integrity and safety of the system design.
B.1.2 Installation Appraisal.
This is a qualitative appraisal of the integrity and safety of the installation including the evaluation of any deviations from normal, industry-accepted installation practices, such as clearances or tolerances, especially in the case of modifications made after entry into service.
B.1.3 Failure Modes and Effects Analysis.
This is a structured, inductive, bottom-up analysis that is used to evaluate the effects on the system and airplane of each foreseeable element or component failure. When properly formatted, the FMEA should aid in identifying latent failures and possible causes of each failure mode. SAE ARP 4761 provides methodology and detailed guidelines, which may be used to perform this type of analysis. In SAE ARP 4761, an FMEA could be a “piece-part” FMEA or a “functional” FMEA. For modern microcircuit-based line replaceable units and systems, an exhaustive piece-part FMEA is not practically feasible with the present state of the art. In that context, an FMEA may be more functional than piece-part oriented. A functional FMEA can lead to uncertainties in the qualitative and quantitative aspects, which can be compensated for by a more conservative assessment such as—
• Assuming all failure modes result in the failure conditions of interest,
• Careful choice of system architecture, or
• Taking into account the experience lessons learned on the use of similar technology.
B.1.4 Fault Tree or Dependence Diagram Analysis.
These are structured, deductive, top-down analyses used to identify the conditions, failures, and events that would cause each defined failure condition. They are graphical methods of identifying the logical relationship between each particular failure condition and the primary element or component failures, other events, or combinations thereof that can cause it. An FMEA may be used as the source document for those primary failures or other events.
B-1
AC 25.1309-1B Appendix B B.1.5 Markov Analysis.
A Markov model represents various system states and the relationships among them.
The states can be either operational or non-operational. The transitions from one state to another are a function of the failure and repair rates. Markov analysis can be used as a replacement for fault tree or dependence diagram analysis, but it often leads to more complex representation, especially when the system has many states. The FAA recommends using Markov analysis when fault tree or dependence diagrams are not easily usable, namely to account for complex transition states of systems that are difficult to represent and handle with classic fault tree or dependence diagram analysis.
B.1.6 Zonal Safety, Particular Risk, and Common Mode Analyses.
The acceptance of adequate probability of failure conditions is often derived from the assessment of multiple systems based on the assumption that failures are independent.
Therefore, it is necessary to recognize that such independence may not exist in the practical sense, and specific studies are necessary to ensure that independence can either be assured or deemed acceptable. These analyses might also identify failure modes and effects that otherwise would not be foreseen. The evaluation of independence is sub-divided into three areas of study:
B.1.6.1 Zonal Safety Analysis (ZSA).
The objective of zonal safety analysis is to ensure that equipment installations within each zone of the airplane meet an adequate safety standard with respect to design and installation standards, interference between systems, and maintenance errors. The analysis also needs to consider the risk that various installers may make with decisions regarding routing, supporting a harness, clearances, etc. In those areas of the airplane where multiple systems and components are installed in close proximity, it should be ensured that the zonal safety analysis identifies any failure or malfunction, which by itself is considered sustainable, but could have more severe effects by adversely affecting other adjacent systems or components.
B.1.6.2 Particular Risk Analysis (PRA).
Particular risks are defined as those events or influences that are outside the systems concerned. Examples are fire, leaking fluids, bird strike, tire burst, high intensity radiated fields exposure, lightning, uncontained failure of high energy rotating machines, etc. Each risk should be studied to examine and document the simultaneous or cascading effects or influences that may violate independence.
B-2
AC 25.1309-1B Appendix B B.1.6.3 Common Mode Analysis (CMA).
Common mode analysis is performed to confirm the assumed independence of the events that were considered in combination for a given failure condition. This analysis should consider the effects of specification, design, implementation, installation, maintenance, and manufacturing errors; environmental factors other than those already considered in the particular risk analysis; and failures of system components.
B-3
AC 25.1309-1B Appendix C APPEND IX C. OVERVIEW OF THE SAFETY ASSESSMENT PROCESS C.1 Purpose.
In showing compliance with § 25.1309(b), the applicant should address the considerations covered in this AC in a methodical and systematic manner, which ensures that the process and its findings are visible and readily assimilated into compliance-showing documents. The FAA has provided this appendix primarily for applicants who are unfamiliar with the various methods and procedures typically used in the industry to conduct safety assessments. This guide and figures C-1 and C-2 are not certification checklists, and they do not include all the information provided in this AC. There is no necessity for an applicant to use them or for the FAA to accept them, in whole or in part, to show compliance with any regulation. The sole purpose of this guidance is to assist applicants by illustrating a systematic approach to safety assessments, to enhance understanding and communication by summarizing some of the information provided in this AC, and to provide some suggestions on documentation. You can find more detailed guidance in SAE ARP 4761. SAE ARP 4754 includes additional guidance on how the safety assessment process relates to the system development process.
C.2 Safety Assessment Process.
C.2.1 Define the system and its interfaces and identify the functions that the system is to perform. The safety assessment process may identify additional safety requirements for the functions during the system development life cycle.
C.2.2 Determine whether the system is complex, similar to systems used on other airplanes, or conventional. Where multiple systems and functions should be evaluated, consider the relationships between multiple safety assessments.
C.2.3 Identify and classify failure conditions. All relevant applicant engineering organizations, such as systems, structures, propulsion, and flight test, should be involved in this process. This identification and classification may be done by conducting an FHA, which is usually based on one of the following methods, as appropriate:
C.2.3.1 If the system is not complex and its relevant attributes are similar to those of systems used on other airplanes, the identification and classification may be derived from design and installation appraisals and the service experience of the comparable, previously approved systems.
C.2.3.2 If the system is complex, it is necessary to postulate systematically the effects on the safety of the airplane and its occupants resulting from any possible failures, considered both individually and in combination with other failures or events.
C-1
AC 25.1309-1B Appendix C C.2.3.3 In order to identify the failures that could result in intermittent behaviors, erroneous behaviors, or otherwise unintended behavior, testing should be used where necessary to aid the analytical process.
C.2.4 Choose the means to be used to determine compliance with § 25.1309. The depth and scope of the analysis depends on the types of functions performed by the system, the severity of system failure conditions, and whether or not the system is simple and conventional (see figure C-1). For major failure conditions, experienced engineering and operational judgment, design and installation appraisals, and comparative service experience data on similar systems may be acceptable, either on their own or in conjunction with qualitative analyses or selectively used quantitative analyses. For hazardous or catastrophic failure conditions, the safety assessment should be very thorough. The applicant should obtain early concurrence from the FAA on the choice of an acceptable means of compliance.
C-2
AC 25.1309-1B Appendix C Figure C-1. Depth of Analysis Flowchart Conduct Functional Hazard Assessment.
(See paragraph 6.2 of this AC.)
Is the system & installation similar to a previous design?
Is there a safety effect?
Is the failure condition minor?
Is the failure condition major?
Is the system simple & conventional?
Is the system redundant?
Is the system simple?
Verify by Design and Installation Appraisal.
(See paragraphs 7.5.1, 7.5.2 and 7.7.1.3 of this AC.)
Verify Similarity.
(See paragraphs 7.5.3.1 and 7.5.4.3 of this AC.)
And ARP4754 Conduct Qualitative Assessment.
(See paragraphs 7.5.3.2 and 7.5.3.4 of this AC.)
Conduct Qualitative Assessment.
(See paragraph 7.5.4.2 of this AC.)
Conduct Qualitative and Quantitative Assessment.
(See paragraph 7.5.4.1 of this AC.)
Conduct Qualitative and Quantitative Assessments.
(See paragraph 7.5.3.3 of this AC.)
NO YES YES YES YES YES NO NO NO NO YES NO NO YES Note: A functional hazard assessment may be based on a design and installation appraisal for these systems.
C-3
AC 25.1309-1B Appendix C C.2.5 Conduct the analysis and produce the data, which have been agreed with by the FAA as being acceptable to show compliance. Refer to SAE ARP 4761 for analysis techniques such as FHA, PSSA, FMEA, CMA, PRA, and ZSA. A typical analysis should include the following information to the extent necessary to show compliance:
C.2.5.1 A statement of the functions, boundaries, and interfaces of the system.
C.2.5.2 A list of the parts and equipment that compose the system, including their performance specifications or design standards and development assurance levels if applicable. This list may reference other documents, for example, TSOs, manufacturer’s or military specifications, and so forth.
C.2.5.3 The conclusions, including a statement of the failure conditions and their classifications and probabilities (expressed qualitatively or quantitatively, as appropriate) that show compliance with the requirements of § 25.1309.
C.2.5.4 A description that establishes correctness and completeness and traces the work leading to the conclusions. This description should include the basis for the classification of each failure condition (for example, analysis or ground, flight, or simulator tests). It should also include a description of precautions taken against common cause failures, provide any data such as component failure rates and their sources and applicability, support any assumptions made, and identify any required flightcrew or ground crew actions including any CCMRs.
C.2.6 Assess the analyses and conclusions of multiple safety assessments to ensure compliance with the requirements for all airplane level failure conditions.
C.2.7 Prepare compliance statements, maintenance requirements, flight manual requirements, and any other relevant ICA.
C.2.8 Figure C-2 depicts an overview of a typical safety assessment process starting from the requirements of § 25.1309(b) and (c). For the purpose of this appendix, this figure only shows the principal activities of a safety assessment process. Applicants may refer to SAE ARP 4761 for details of a complete process. Consistent with the system engineering practice in SAE ARP 4754 and ARP 4761, the process is presented in a “V” shape. On the left side of the “V” are the activities to evaluate the preliminary systems designs. On the right side are the activities to evaluate the final designs.
C.2.8.1 Airplane-Level Functional Hazard Assessment (Airplane FHA).
A systematic, comprehensive evaluation of aircraft functions to identify and classify failure conditions of those functions according to their severity.
C-4