AC 25.1309-1B Appendix C C.2.8.2 System Functional Hazard Assessment (FHA).
A systematic, comprehensive evaluation of system functions to identify and classify failure conditions of those functions according to their severity. Because there are many systems on an airplane, the figure depicts multiple system FHAs.
C.2.8.3 Analyses.
Analyses of the preliminary or proposed system designs. These analyses include Fault Tree Analysis (FTA), Failure Mode and Effects Analysis (FMEA), Zonal Safety Analysis (ZSA), Particular Risk Analysis (PRA), Cascading Effects Analysis (CEA) and Common Mode Analysis (CMA).
C.2.8.4 System Safety Assessments (SSAs).
A systematic, comprehensive evaluation of the design implementation to verify it meets all applicable requirements. There are multiple SSAs, and typically one SSA for each system. The SSA may be preceded by a Preliminary System Safety Assessment (PSSA), which is used to evaluate the preliminary design and validate its safety requirements.
C.2.8.5 Aircraft Safety Assessment (ASA).
The Aircraft Safety Assessment (ASA) is a systematic, integrated evaluation of the SSAs taken together, to verify that the airplane as a whole meets all applicable requirements. This assessment corresponds to the requirement in § 25.1309(b) that specifies systems be evaluated in relation to other systems.
C.2.9 The applicant documents the results, together with any maintenance requirements
(e.g., CMRs) and required flight crew procedures (e.g., flightcrew actions in response to flight deck alerts).
C-5
AC 25.1309-1B Appendix C
Figure C-2. Overview of Safety Assessment Process
C-6
AC 25.1309-1B Appendix D APPEN DIX D. EXAMPLE OF LIMIT LATENCY AND RESIDUAL RISK ANALYSIS FOR COMPLIANCE WITH § 25.1309(b)(5)(ii) and (iii) D.1 Implementing Quantitative Criteria for a CSL+1 Failure Condition.
The following example illustrates how the criteria of § 25.1309(b)(5)(ii) and (iii) may be applied quantitatively. This example uses the fault tree analysis technique described in SAE ARP 4761. Assume a fault tree as shown in figure D-1.
D.1.1 CSL+1 Conditions.
Note: The term minimal cutset (MCS) refers to the smallest set of basic events in the fault tree whose occurrence is sufficient to cause the CSL+1 failure condition.
Table D-1 lists all the cutsets in this example.
D.1.1.1 Identify the CSL+1 conditions. The CSL+1 condition is shown as a dual order MCS which contains a basic event that is considered as latent for more than one flight.
D.1.1.2 Group the dual order minimal cutsets.
(a) Group those CSL+1 conditions that contain the same latent failure. For eac h group, assume that latent failure has occurred, and sum the remaining active failures probabilities. For each group, the sum of the active failure probabilities should be on the order of 1 x 10-5 per flight hour or less. This is intended to show the residual risk safety objective of § 25.1309(b)(5)(ii).
(b) Group those CSL+1 that contain the same active basic event. For each group, sum the remaining latent failure probabilities. For each group, the sum of the latent basic events probability should not exceed 1/1000. This is intended to show the limit latency risk safety objective of § 25.1309(b)(5)(iii).
D.1.1.3 The sum of all the MCS should be on the order of 1 x 10-9 per flight hour or less in order to show § 25.1309(b)(1) compliance.
D.1.2 Alternative Method for Step D.1.1.2(a).
An alternative but more conservative method is to assume a latent failure has occurred and perform step D.1.1.2(a) for each combination and show that the top event average probability is on the order of 1 x 10-5 per flight hour or less. Run the calculations for each and every latent failure.
D.1.3 Results.
The results of the limit latency and residual risk analysis are provided in table D-1.
D-1
AC 25.1309-1B Appendix D F IG URE D-1. Example Of Fault Tree For § 25.1309(b)(5) Compliance
D-2
AC 25.1309-1B Appendix D TABLE D-1. EXAMPLE OF CSL+1 IDENTIFICATION FOR § 25.1309(B)(5) COMPLIANCE MCS No.
Combined Probability Basic Event CSL+1? Failure Rate Exposure time Event Probability Section 25.1309(b)(5)(ii) and (iii) Applicability and Compliance 1 1.0 x 10-9 A001 Yes 1 x 10-7 2.5 h 2.5 x 10-7 Not compliant with limit latency criterion since L001 probability is more frequent than 1 x 10-3.
L001 4 x 10-6 1000 h 4 x 10-3 2 5.000x 10-10 A002 Yes 2 x 10-5 2.5 h 5 x 10-5 Not compliant with residual risk criterion since A002 probability is more frequent than 1 x 10-5/FH L003 1 x 106 10 h 1 x 10-5 3 2.500 x 10- 10 A004 Yes 1 x 10-5 2.5 h 2.5x 10-5 Note: MCS no. #2 and #3 are grouped due to common L003.
Although A004 probability is equal to 1 x 10-5/FH, the residual risk criterion is not met because the combined probability of A004 and A002
(2.5 x 10-5 + 5 x 10-5)/FH is more frequent than 1 x 10-5/FH.
L003 1 x 10-6 10 h 1 x 10-5 4 2.500 x 10- 10 A004 Yes 1 x 10-5 2.5 h 2.5 x 10-5 Compliant with both limit latency and residual risk criteria.
Note: MCS no. #3 and #4 are grouped due to common A004.
Combined L003 and L005 ((1 x 10-5 + 1 x 10-5) is less than 1 x 10-3 L005 1 x 106 10 h 1 x 10-5 5 1.250 x 10- 10 A002 No 2 x 10-5 2.5 h 5 x 10-5 Section 25.1309(b)(5) does not apply since this dual failure combination does not contain any latent failure.
A005 1 x 10-6 2.5 h 2.5 x 10-6 6 1.625 x 10- 12 A003 Yes
6.5 x 10- 7
2.5 h 1.625 x 10-6 Compliant with both limit latency and residual risk criteria.
A003 = 1.625x10-6/FH is less than 1.0x10-5/FH L004=1x10-6 less than 1x10-3 L004 1 x 10-7 10.0 h 1 x 10-6 7 1.000 x 10- 10 A002 No 2 x 10-5 2.5 h 5 x 10-5 Section 25.1309(b)(5) does not apply since this is a triple-failure combination. L001 4 x 10-6 1000 h 4 x 10-3 L002 5 x 10-6 100 h 5 x 10-4 MCS: Minimal Cut Set: the smallest set of events whose occurrence is sufficient to cause the Top event or failure condition.
A: Active failure; L: Latent failure Flight time = 2.5 hour of flight P[LAT i] ~ FR * T D-3
AC 25.1309-1B Appendix E
APPENDI X E. ACCEPTED PROBABILITIES E.1 Probabilities.
The probabilities in tables E-1 through E-5 may be used for environmental conditions and operational factors in quantitative safety analyses to show compliance with § 25.1309. If “No accepted standard data” appears in the tables below, the applicant must provide a justified value if a probability of less than 1 is used in the analysis.
Note: The accepted probabilities may not always be appropriate for use in the context of showing compliance to other regulations.
E-1
AC 25.1309-1B Appendix E TABLE E-1.
ENVIRO NMENTAL FACTORS Condition Model or Other Justification Probability 14 CFR part 25, Appendix C, “Flight in Atmospheric Icing.”
AC 25-28 1
14 CFR part 25, Appendix O, “Flight in Supercooled Large Drop Icing Conditions” AC 25-28 10-2 per flight hour Flight into icing conditions that exceed those the airplane has been certified to operate in.
No accepted standard data Probability of specific icing conditions (largest water droplet, temperature, and so forth) within a given flight.
No accepted standard data Head wind greater than 25 knots during takeoff and landing.
AC 120-28D / CS-AWO
NLR-CR-2016-601 10-2 per flight
5 x 10-3 per flight Tail wind greater than 10 knots during takeoff and landing.
AC 120-28D / CS-AWO
NLR-CR-2016-601 10-2 per flight
3 x 10-3 per flight Cross wind greater than 20 knots during takeoff and landing.
AC 120-28D / CS-AWO
NLR-CR-2016-601 10-2 per flight
3 x 10-3 per flight Limit design gust and turbulence.
§ 25.341 10-5 per flight hour Air temperature less than -70 °C. No accepted standard data E-2
AC 25.1309-1B Appendix E
TABLE E-
2. AIRPLANE CO NFIGURATIONS Condition Model or Other Justification Probability Center of gravity Standard industry practice 1 (uniform over approved range) Landing and takeoff weights/masses Standard industry practice 1 (uniform over approved range) TABLE E-3. FLIGHT CONDITIONS Condition Model or Other Justification Probability Flight condition requiring stall warning In-service observation
NLR-CR-2016-601 10-2 per flight
4 x 10-6 per flight
2.5 x 10-6 per flight hour Flight condition resulting in a stall In-service observation
NLR-CR-2016-601 10-5 per flight
5 x 10-8 per flight 3 x 10-8 per flight hour Exceedance of VMO/MMO Note: Refer to other regulations with specific requirements that supersede the guidance for this condition.
In-service observation
NLR-CR-2003-554 10-2 per flight
2 x 10-3 per flight 3 x 10-4 per flight hour Flight condition greater than or equal to 1.5g due to gusts NLR-CR-2003-554 7 x 10 -3 per flight Flight condition less than or equal to 0g NLR-CR-2005-015 1 x 10 -6 per flight 4 x 10-7 per flight hour
E-3
AC 25.1309-1B Appendix E
TABLE E -4. MISSION DEPENDENCIES Condition Model or Other Justification Probability Any rejected takeoff
NLR-CR-2016-601 1.5 x 10 -4 per flight High energy (near V1) rejected takeoff NLR-CR-2016-601 7 x 10 -6 per flight Need to jettison fuel NLR-CR-2016-601 1.5 x 10 -4 per flight
2.5 x 10-4 per flight hour Go-around Note: Should be considered as within the normal operating envelope.
NLR-CR-2016-601 7 x 10 -4 per flight TABLE E-5. OTHER EVENTS Condition Model or Other Justification Probability Fire in a lavatory NLR-CR-2016-601 2.5 x 10 -7 per flight
1.5 x 10-7 per flight hour Fire in a cargo compartment NLR-CR-2016-601 4 x 10 -8 per flight
3.5 x 10-8 per flight hour E-4
AC 25.1309-1B Appendix F
APPENDI X F. CALCULATING THE “AVERAGE PROBABILITY PER FLIGHT HOUR” F.1 Purpose.
This appendix provides applicants with guidance for calculating the “average probability per flight hour” for a failure condition, so it can be compared with the quantitative criteria in this AC. (As discussed in paragraph 7.6.1.4, for failure conditions and associated classifications that are only relevant during a specific flight phase, evaluate the average risk under those specific conditions rather than allowing the risk to be averaged out over a flight of mean duration. For these cases, the probability is calculated as an average probability per flight. To convert to “average probability per flight hour”, divide the per flight probability by one hour.) The process of calculating the “average probability per flight hour” for a failure condition is described here as a four step process and is based on the assumption that the life of an airplane is a sequence of average flights:
• Step 1: Determine the average flight.
• Ste p 2: Calculate the probability of a failure condition for a certain average flight.
• Step 3: Calculate the average probability per flight of a failure condition.
• Step 4: Calculate the average probability per flight hour of a failure condition.
F.2 Determining the “Average Flight.”
The “average probability per flight hour” is based on an average flight. The applicant should estimate the average flight duration and average flight profile for the airplane fleet to be certified. The average flight duration should be estimated based on the applicant’s expectations and historical experience for similar types. The average flight duration should reflect the applicant’s best and latest estimate of the cumulative flight hours divided by the cumulative airplane flights for the service life of the airplane. The average flight profile should be based on the operating weight and performance expectations for the average airplane when flying a flight of average duration in an International Civil Aviation Organization standard atmosphere. The duration of each flight phase (for example, takeoff, climb, cruise, descent, approach, and landing) in the average flight should be based on the average flight profile. Average taxi times for departure and arrival at an airport should be considered where appropriate and added to the average flight time. The average flight duration and profile should be used as the basis for determining the average probability per flight hour for a quantitative safety assessment. Note that to meet 14 CFR Appendix K to Part 25, K25.1 ETOPS design requirements, the consideration for maximum flight duration with the longest diversion time should be used when showing compliance with § 25.1309(b).
F-1
AC 25.1309-1B Appendix F F.3 Calculating the Probability of a Failure Condition for a Certain Average Flight.
The probability of a failure condition occurring on an average flight Pflight(failure condition in a flight) should be determined by structured methods (see SAE ARP 4761 for example methods) and should consider all significant elements
(e.g., combinations of failures and events) that contribute to the failure condition. The following should be considered:
F.3.1 The component failure rates used to calculate the “average probability per flight hour” should be estimates of the mature constant failure rates after infant mortality and prior to wear out. For components whose probability of failure may be associated with non-constant failure rates within the operational life of the airplane, reliability analysis may be used to determine component replacement times. In either case, the failure rate should be based on all causes of failure (operational, environmental, and so forth). The failure rate is for the type design hardware that is operated and maintained through servicing plans or ICA requirements. Where available, service history of same or similar components in the same or similar environment should be used.
F.3.1.1 Aging and wear of similarly constructed and similarly loaded redundant components that could directly, or when in combination with one other failure, lead to a catastrophic or hazardous failure condition should be assessed when determining scheduled maintenance tasks for such components.
F.3.1.2 Replacement times—necessary to mitigate the risk due to aging and wear of those components whose failures could directly, or in combination with one other failure, lead to a catastrophic or hazardous failure condition within the operational life of the airplane—should be assessed through the same methodology as other scheduled maintenance tasks required to satisfy § 25.1309 (for example, AC 25-19A) and documented in the ALS as appropriate.
F.3.2 If one failed element in the system can persist for multiple flights (latent, dormant, or hidden failures), the calculation should consider the relevant exposure times (for example, time intervals between maintenance and operational checks/inspections). In such cases, the total probability of the failure condition increases with the number of flights during the latency period.
F-2
AC 25.1309-1B Appendix F F.3.3 If the failure rate of one element varies during different flight phases, the calculation should consider the failure rate and related time increments in such a manner as to establish the probability of the failure occurring on an average flight. It is assumed that the average flight can be divided into n phases (phase 1, ... , phase n). Let TF be the average flight duration, Tj be the duration of phase j, and tj be the transition point between Tj and Tj+1, j = 1, ... , n:
𝑛𝑛 𝑇𝑇𝐹𝐹 = � 𝑇𝑇𝑗𝑗 and 𝑡𝑡𝑗𝑗 − 𝑡𝑡𝑗𝑗−1 = 𝑇𝑇𝑗𝑗 𝑗𝑗=1 Let λj(t) be the failure rate function during phase j, i.e., for t ∈ [tj-1,tj]. λj(t) may be equal to 0 for all t ∈ [tj-1,tj] for a specific phase j.
Let Pphase j(failure) be the probability that the element fails in phase j.
Two cases are possible:
F .3.3.1 The element is checked operative at the beginning of the certain flight.
Let the Pflight(failure) be the probability that the element fails during one certain flight (including non-flying time).
Then:
𝑛𝑛 𝑛𝑛 𝑃𝑃𝑓𝑓𝑓𝑓𝑓𝑓𝑓𝑓ℎ𝑡𝑡 (𝑓𝑓𝑓𝑓𝑓𝑓𝑓𝑓𝑓𝑓𝑓𝑓𝑓𝑓) = � 𝑃𝑃𝑝𝑝ℎ𝑎𝑎𝑎𝑎𝑎𝑎 𝑗𝑗(𝑓𝑓𝑓𝑓𝑓𝑓𝑓𝑓𝑓𝑓𝑓𝑓𝑓𝑓) = � 𝑃𝑃 �𝑓𝑓𝑓𝑓𝑓𝑓𝑒𝑒𝑓𝑓𝑒𝑒𝑡𝑡 𝑓𝑓𝑓𝑓𝑓𝑓𝑓𝑓𝑓𝑓𝑓𝑓𝑓𝑓�𝑡𝑡 ∈ �𝑡𝑡 𝑗𝑗−1, 𝑡𝑡𝑗𝑗�� 𝑗𝑗=1 𝑗𝑗=1 𝑡𝑡𝑛𝑛 𝑖𝑖 = 1 − � 𝑓𝑓𝑒𝑒𝑒𝑒 �− � 𝜆𝜆 𝑓𝑓(𝑒𝑒)𝑑𝑑𝑒𝑒� 𝑓𝑓=1 𝑡𝑡𝑖𝑖−1 F.3.3.2 The state of the element is unknown at the beginning of the certain flight.
Let the Pflight(failure) be the probability that the element is failed by the end of one certain flight (including non-flying time).
Then:
𝑃𝑃𝑓𝑓𝑓𝑓𝑓𝑓𝑓𝑓ℎ𝑡𝑡(𝑓𝑓𝑓𝑓𝑓𝑓𝑓𝑓𝑓𝑓𝑓𝑓𝑓𝑓 𝑏𝑏𝑏𝑏 𝑓𝑓𝑒𝑒𝑑𝑑 𝑜𝑜𝑓𝑓 𝑓𝑓𝑓𝑓𝑓𝑓𝑓𝑓ℎ𝑡𝑡) = 𝑃𝑃𝑝𝑝𝑝𝑝𝑓𝑓𝑝𝑝𝑝𝑝 (𝑓𝑓𝑓𝑓𝑓𝑓𝑓𝑓𝑓𝑓𝑓𝑓𝑓𝑓 𝑒𝑒𝑓𝑓𝑓𝑓𝑜𝑜𝑓𝑓 𝑡𝑡𝑜𝑜 𝑓𝑓𝑓𝑓𝑓𝑓𝑓𝑓ℎ𝑡𝑡) + 𝑃𝑃𝑓𝑓𝑓𝑓𝑓𝑓𝑓𝑓ℎ𝑡𝑡(𝑓𝑓𝑓𝑓𝑓𝑓𝑓𝑓𝑓𝑓𝑓𝑓𝑓𝑓 𝑓𝑓𝑒𝑒 𝑓𝑓𝑓𝑓𝑓𝑓𝑓𝑓ℎ𝑡𝑡) = 𝑃𝑃𝑝𝑝𝑝𝑝𝑓𝑓𝑝𝑝𝑝𝑝 (𝑓𝑓𝑓𝑓𝑓𝑓𝑓𝑓𝑓𝑓𝑓𝑓𝑓𝑓 𝑒𝑒𝑓𝑓𝑓𝑓𝑜𝑜𝑓𝑓 𝑡𝑡𝑜𝑜 𝑓𝑓𝑓𝑓𝑓𝑓𝑓𝑓ℎ𝑡𝑡) + �1 − 𝑃𝑃𝑝𝑝𝑝𝑝𝑓𝑓𝑝𝑝𝑝𝑝 (𝑓𝑓𝑓𝑓𝑓𝑓𝑓𝑓𝑓𝑓𝑓𝑓𝑓𝑓 𝑒𝑒𝑓𝑓𝑓𝑓𝑜𝑜𝑓𝑓 𝑡𝑡𝑜𝑜 𝑓𝑓𝑓𝑓𝑓𝑓𝑓𝑓ℎ𝑡𝑡)� 𝑛𝑛 𝑡𝑡𝑖𝑖 ∗ �1 − � 𝑓𝑓𝑒𝑒𝑒𝑒 �− � 𝜆𝜆 𝑓𝑓(𝑒𝑒)𝑑𝑑𝑒𝑒�� 𝑡𝑡𝑓𝑓=1 𝑖𝑖−1 Where Pprior(failure) is the probability that the failure of the element has occurred prior to the certain flight.
F.3.4 If there is only an effect when failures occur in a certain order, the calculation should account for the conditional probability that the failures occur in the sequence necessary to produce the failure condition.
F-3