Advisory Circular U.S. D epartment of Transportation Federal Aviation Administration Subject: System Design and Analysis This advisory circular (AC) describes acceptable means, but not the only means, for showing compliance with the requirements of Title 14, Code of Federal Regulations (14 CFR) 25.1309, Equipment, systems, and installations. These means are intended to provide guidance to supplement the engineering and operational judgment that form the basis of any showing of compliance.
If you have suggestions for improving this AC, you may use the Advisory Circular Feedback Form at the end of this AC.
Date: 08/30/2024 AC No: 25.1309-1B Initiated By: AIR-600 DANIEL J.
ELGAS Digitally signed by DANIEL J. ELGAS Date: 2024.08.30 14:57:01 -04'00' Daniel Elgas Director, Policy and Standards Division Aircraft Certification Service
AC 25.1309-1B
CONTENTS Paragraph Page
Chapter 1. General Information1-1
1.1 Purpose1-1
1.2 Applicability1-1
1.2.1 Applicability of this AC1-1
1.2.2 Applicability of § 25.13091-1
1.3 Cancellation1-4
1.4 Related Documents1-4
1.5 Definitions1-8
Chapter 2. Background2-1
2.1 General2-1
2.2 Fail-Safe Design Concept2-1
2.3 Highly Integrated Systems2-3
2.4 Use of Both Qualitative and Quantitative Methods2-3
Chapter 3. Failure Condition Classifications and Probability Terms3-1
3.1 Classifications3-1
3.2 Qualitative Probability Terms3-2
3.3 Quantitative Probability Terms3-4
Chapter 4. Safety Objective4-1
4.1 Objectives of § 25.1309(b)4-1
4.2 Relationship between Probability and Severity of Failure Conditions4-1
4.3 Safety Objectives for Catastrophic Failure Conditions4-2
Chapter 5. Compliance with § 25.13095-1
5.1 Overview5-1
5.2 C
ompliance with § 25.1309(a)5-1
5.3 Compliance with § 25.1309(b)5-2
5.3.1 General5-2
5.3.2 Planning5-3
5.3.3 Availability of Industry Standards and Guidance Materials5-3
ii
AC 25.1309-1B
CONTENTS (CONTINUED) Paragraph Page
5.3.4 Acceptable Application of Development Assurance Methods5-4
5.3.5 Crew and Maintenance Actions5-5
5.3.6 Failure Conditions involving Significant Latent Failures5-6
5.4 Compliance with § 25.1309(c)5-8
5.5 Compliance with § 25.1309(e)5-9
Chapter 6. Identification of Failure Conditions and Considerations when Assessing
their Effects6-1
6.1 Identification of Failure Conditions6-1
6.1.1 By Considering Failures of Functions at the Airplane Level.6-1
6.1.2 By Considering Failures of Functions at the System Level6-1
6.1.3 By Considering Failures at the Equipment Level6-1
6.2 Identification of Failure Conditions Using a Functional Hazard Assessment6-2
6.3 Considerations when Assessing Failure Condition Effects6-3
Chapter 7. Assessment of Failure Condition Probabilities and Analysis Considerations7-1
7.1 General7-1
7.2 Assessment of Failure Condition Probabilities7-1
7.3 Single Failure Considerations7-1
7.4 Common Cause Failure Considerations7-2
7.5 Depth of Analysis7-3
7.5.1 No Safety Effect Failure Conditions7-3
7.5.2 Minor Failure Conditions7-3
7.5.3 Major Failure Conditions7-4
7.5.4 Hazardous and Catastrophic Failure Conditions7-4
7.6 Calculation of Average Probability per Flight Hour (Quantitative Analysis)7-5
7.7 Integrated Systems7-6
7.8 Operational or Environmental Conditions7-7
7.9
Justification of Assumptions, Data Sources, and Analytical Techniques7-8
iii
AC 25.1309-1B
CONTENTS Paragraph Page
Chapter 8. Operational and Maintenance Considerations8-1
8.1 Overview8-1
8.2 Flightcrew Action8-1
8.3 Maintenance Action8-1
Chapter 9. Assessment of Modifications to Previously Certificated Airplanes9-1
9.1 Assessment of Modifications9-1
9.2 Reserved9-1
Appendix A. Historical Perspective on the Use of Statistical Probabilities in System
Safety AssessmentA-1
Appendix B. Assessment Methods for Failure ConditionsB-1
Appendix C. Overview of the Safety Assessment ProcessC-1
Appendix D. Example of Limit Latency and Residual Risk Analysis for Compliance
with § 25.1309(b)(5)(ii) and (iii)D-1
Appendix E. Accepted ProbabilitiesE-1
Appendix F. Calculating the “Average Probability per Flight Hour”F-1
Appendix G. AcronymsG-1
Advisory Circular Feedback Form iv
AC 25.1309-1B
CONTENTS (CONTINUED) F IGURES Number Page
Figure 4-1. Relationship between Probability and Severity of Failure Condition Effects4-1
Figure C-1. Depth of Analysis FlowchartC-3
Figure C-2. Overview of Safety Assessment ProcessC-6
Figure D-1. Example Of Fault Tree For § 25.1309(b)(5) ComplianceD-2
TABLES Number Page
Table 4-1. Relationship between Probability and Severity of Failure Conditions4-2
Table D-1. Example of CSL+1 Identification for § 25.1309(b)(5) ComplianceD-3
Table E-1. Environmental FactorsE-2
Table E-2. Airplane ConfigurationsE-3
Table E-3. Flight ConditionsE-3
Table E-4. Mission DependenciesE-4
Table E-5. Other EventsE-4
v
AC 25.1309-1B CHA PTER 1. GENERAL INFORMATION
1.1 Purpose.
1.1.1 This AC describes acceptable means, but not the only means, for showing compliance with 14 CFR 25.1309, Equipment, systems, and installations. These means are intended to provide guidance to supplement the engineering and operational judgment that form the basis of any showing of compliance. The contents of this document do not have the force and effect of law and are not meant to bind the public in any way. This document is intended only to provide clarity to the public regarding existing requirements under the law or agency policies.
1.1.2 Revision B of this AC contains guidance based on rule changes to § 25.1309. This revision also improves upon the materials published in AC 25.1309-1A by providing more substantive guidance on safety analysis methods. It also implements Congressional instruction1 to emphasize clear applicant documentation of certain technical details and failure modes, and pilot response times to them.
1.2 Applicability.
1.2.1 Applicability of this AC.
1.2.1.1 The guidance in this AC is for airplane manufacturers, modifiers, foreign regulatory authorities, and Federal Aviation Administration (FAA) Aircraft Certification Service engineers and the Administrator’s designees.
1.2.1.2 Using this guidance as a means of compliance with § 25.1309 is voluntary only and not using it will not affect rights and obligations under existing statutes and regulations. The FAA will consider other methods of showing compliance that an applicant may elect to present. Terms such as “should,” “may,” and “must” are used only in the sense of ensuring applicability of this particular method of compliance when the acceptable method of compliance in this document is used. If the FAA becomes aware of circumstances in which following this AC would not result in compliance with the applicable regulations, the agency may require additional substantiation as the basis for finding compliance.
1.2.2 Applicability of § 25.1309.
1.2.2.1 Section 25.1309 is intended as a general requirement to be applied to any equipment or system as installed on the airplane, be it for type certification, operating rules, or optional, in addition to specific systems requirements, except as indicated below.
1 Section 115 of the Aircraft Certification, Safety, and Accountability Act of 202 0.
1-1
AC 25.1309-1B
1.2.2.2 Although the applicant does not need to account for § 25.1309 when showing compliance with the performance and flight characteristics requirements of part 25, subpart B, and the structural requirements of part 25, subparts C and D, § 25.1309 does apply to any system on which compliance with any of those requirements is based. For example, § 25.1309 does not apply to an airplane’s inherent stall characteristics or their evaluation, but it does apply to a stall warning system used for compliance with § 25.207.
1.2.2.3 Some systems and functions already receive an evaluation to show compliance with specific requirements for specific failure conditions.
Such evaluations may also be used to show compliance with § 25.1309 without additional or duplicative analysis for those specific failure conditions. The applicant provides substantiation that the evaluation is an acceptable means of compliance to § 25.1309 and documents it in the certification plans for approval by the certification office.
1.2.2.4 Jams of flight control surfaces or pilot controls covered by § 25.671(c)(3) are excepted from the requirements of § 25.1309(b).
1.2.2.5 Si ngle failures covered by § 25.735(b)(1) are excepted from the requirements of § 25.1309(b) because § 25.735(b)(1) limits the effect of a single failure in the brake system to doubling the brake roll stopping distance. This requirement provides a satisfactory level of safety without the need to analyze the particular circumstances and conditions under which the single failure occurs. In addition, the diverse circumstances under which such a failure could occur make any structured determination of its outcome or frequency indeterminate. However, § 25.1309(b) does apply to failures in the brake systems that are not related to the intended braked roll stopping distance or if the failures affect functions other than braking. For example, if a hydraulic brake line failure in the brake system also affects ground spoiler deployment, then § 25.1309(b) applies to that failure.
1.2.2.6 The failure effects covered by §§ 25.810(a)(1)(v) and 25.812 are excepted from the requirements of § 25.1309(b). The failure conditions associated with these cabin safety equipment installations are associated with varied evacuation scenarios for which the probability cannot be determined due to the multitude of factors that can lead to an evacuation. For these types of equipment, the FAA has not been able to define appropriate scenarios under which an applicant could demonstrate compliance with § 25.1309(b). Therefore, the FAA considers it acceptable in terms of safety to require particular design features or specific reliability demonstrations for these types of equipment, and to exclude these equipment items from the requirements of § 25.1309(b). Traditionally, the FAA has found this approach acceptable.
1-2
AC 25.1309-1B
1.2.2.7 The requirements of § 25.1309 are applicable to powerplant installations.
The specific applicability and exceptions are stated in § 25.901(c). Section
25.901(c) states that § 25.1309(b) does not apply to propeller debris release failures; those failures are addressed by § 25.905(d) and 14 CFR part 35. Section 25.1309(b) does not apply to uncontained engine rotor failure, engine case rupture, or engine case burn-through failures addressed by §§ 25.903(d)(1) and 25.1193 and 14 CFR part 33.
1.2.2.8 In accordance with § 25.901(d), the requirements of § 25.901(c) and hence § 25.1309 are applicable to auxiliary power unit installations.
1.2.2.9 The fuel system is part of the powerplant installation and therefore must comply with § 25.1309. In addition, fuel systems must comply with § 25.954, Fuel system lightning protection, and § 25.981, Fuel tank explosion prevention. Section 25.954 provides a standard for lightning protection of both fuel tank structure and fuel tank systems. Refer to AC 25.954-1, Transport Airplane Fuel System Lightning Protection, for guidance on the safety assessment of fuel tank lightning protection.
Section 25.981 provides standards for the prevention of ignition sources, other than lightning, within the fuel tanks of transport category airplanes.
Refer to AC 25.981-1D, Fuel Tank Ignition Source Prevention Guidelines, for guidance on the safety assessment of fuel system ignition sources, other than lightning.
1.2.2.10 Sec tion 25.1309, including the no-single-failure requirement, applies to structural elements in systems, even though those structural elements may also be required to meet the fatigue and damage tolerance criteria of § 25.571. For structural elements in systems, (with the exception of the main structural elements in landing gear, the horizontal stabilizer surface, and other control surfaces, including high lift surfaces), meeting the damage tolerance requirement of § 25.571 by itself is not sufficient to justify the assumption that a single failure will not occur. This is because single failure of structural elements can occur due to causes other than those addressed by § 25.571. For specific guidance related to structural elements in flight control systems, refer to Policy Statement No. PS- ANM-25-12 or the most recent FAA policy.
1.2.2.11 Section 25.1309 requirements are applicable to the electrical and electronic systems covered under § 25.1316, Electrical and electronic system lightning protection, and § 25.1317, High-Intensity Radiated Fields (HIRF) Protection. Sections 25.1316 and 25.1317 provide standards for those systems that are considered critical for continued safe flight and landing. Refer to AC 20-136, Aircraft Electrical and Electronic System Lightning Protection, and AC 20-158, The Certification of Aircraft Electrical and Electronic Systems for Operation in the HIRF Environment, for guidance on the safety assessment of electrical and electronic systems for lightning and HIRF environments, respectively.
1-3
AC 25.1309-1B However, these ACs may not provide complete guidance for compliance with § 25.1309.
1.2.2.12 Al though § 25.1309 is always applicable to approved operating conditions (on ground and in flight) of the airplane or system, it is only applicable to ground operating conditions when the airplane is in service. While ground operating conditions include conditions associated with line maintenance, dispatch determinations, embarkation and disembarkation, taxi, and the like, they do not include periods of shop maintenance, storage, or other out-of-service activities.
1.2.2.13 Wher e relevant, applicants should also account for risks to persons other than airplane occupants, such as ground crew, when assessing systems failure conditions for compliance with § 25.1309. For this assessment, ground crew persons are aircraft handling, maintenance, or servicing personnel adjacent to the aircraft while it is in a ground operating condition. The risks include threats to people on the ground or adjacent to the airplane during ground operations, electric shock threats to mechanics, atmospheric threats to mechanics, unwanted door or thrust reverser movement, and other similar situations.
1.3 Cancellation.
T his AC cancels AC 25.1309-1A, dated June 21, 1988.
1.4 Related Documents.
The following regulatory and advisory materials are related to this AC:
1.4.1 Related Regulations.
The following 14 CFR part 25 regulations are related to this AC. You can download the full text of these regulations from the Federal Register website at Electronic Code of Federal Regulations, jointly administered by the Office of the Federal Register (OFR) of the National Archives and Records Administration (NARA) and the U.S.
Government Publishing Office (GPO). You can order a paper copy from the U.S.
Superintendent of Documents, U.S. Government Publishing Office, Washington, D.C.
20401; at Government Publishing Office, by calling telephone number (202) 512-1800;
or by sending a fax to (202) 512-2250.
• Section 25.4, Definitions.
• Section 25.302, Interaction of systems and structures.
• Section 25.305, Strength and deformation.
• Section 25.365, Pressurized compartment loads.
• Section 25.571, Damage-tolerance and fatigue evaluation of structure.
• Section 25.629, Aeroelastic stability requirements.
1-4
AC 25.1309-1B
• Section 25.671, Control Systems—General.
• Section 25.735, Brakes and braking systems.
• Section 25.773, Pilot compartment view.
• Section 25.783, Fuselage doors.
• Section 25.810, Emergency egress assist means and escape routes.
• Section 25.812, Emergency lighting.
• Section 25.841, Pressurized cabins.
• Section 25.863, Flammable fluid fire protection.
• Section 25.901, Installation.
• Section 25.933, Reversing systems.
• Section 25.981, Fuel tank explosion prevention.
• Section 25.1301, Function and installation.
• Section 25.1302, Installed systems and equipment for use by the flightcrew.
• Section 25.1322, Flightcrew alerting.
• Section 25.1329, Flight guidance system.
• Section 25.1333, Instrument systems.
• Section 25.1351, Electrical Systems and Equipment—General.
• Section 25.1365, Electrical appliances, motors, and transformers.
• Section 25.1431, Electronic equipment.
• Section 25.1447, Equipment standards for oxygen dispensing units.
• Section 25.1529, Instructions for Continued Airworthiness.
• Section 25.1585, Operating Procedures.
• Section 25.1709, System safety: EWIS.
• Section H25.4, Airworthiness limitations Section, of Appendix H, Instructions for Continued Airworthiness.
• Section I 25.3, Performance and system reliability requirements, of Appendix I, Installation of an Automatic Takeoff Thrust Control System (ATTCS).
• Section K25.1, Design requirements, of Appendix K, Extended Operations (ETOPS).
• Section M25.3, Reliability indications and maintenance access, of Appendix M, Fuel Tank System Flammability Reduction Means.
• Section M25.4, Airworthiness limitations and procedures, of Appendix M, Fuel Tank System Flammability Reduction Means.
1-5
AC 25.1309-1B
1.4.2 Advisory Circulars.
The following ACs are related to the guidance in this AC. Please see the latest version of each AC referenced in this document; they are available on the FAA website at FAA Regulations and Policies and in the Dynamic Regulatory System (DRS).
• AC 20-115D, Airborne Software Development Assurance Using EUROCAE ED-12 and RTCA DO-178.
• AC 20-136B, Aircraft Electrical and Electronic System Lightning Protection.
• AC 20-152A, RTCA, Inc., Document RTCA/DO-254, Design Assurance Guidance f or Airborne Electronic Hardware.
• AC 20-170, Integrated Modular Avionics Development.
• AC 20-174, Development of Civil Aircraft and Systems.
• AC 20-189, Management of Open Problem Reports (OPRs).
• AC 21-16G, RTCA Document DO-160 versions D, E and F, “Environmental Conditions and Test Procedures for Airborne Equipment.”
• AC 25-11B, Electronic Flight Displays.
• AC 25-19A, Certification Maintenance Requirements.
• AC 25-22, Certification of Transport Airplane Mechanical Systems.
• AC 25-28, Compliance of Transport Category Airplanes with Certification Requirements for Flight in Icing Conditions.
• AC 25.671-1, Control Systems—General.
• AC 25.783-1A, Fuselage Doors and Hatches.
• AC 25.901-1, Safety Assessment of Powerplant Installations.
• AC 25.933-1, Unwanted In-flight Thrust Reversal of Turbojet Thrust Reversers.
• AC 25.954-1, Transport Airplane Fuel System Lightning Protection.
• AC 25.981-1D, Fuel Tank Ignition Source Prevention Guidelines.
• AC 25.1302-1, Installed Systems and Equipment for Use by the Flightcrew.
• AC 25.1322-1, Flightcrew Alerting.
• AC 25.1329-1C, Approval of Flight Guidance Systems.
• AC 25.1701-1, Certification of Electrical Wiring Interconnection Systems on Transport Category Airplanes.
• AC 120-28D, Criteria for Approval of Category III Weather Minima for Takeoff, Landing, and Rollout.
1-6
AC 25.1309-1B
1.4.3 Policy Statements.
The following policy statements are available on the FAA website at FAA Regulations and Policies and in the Dynamic Regulatory System (D RS).
• PS-ANM-25-11, Guidance for Hazard Classifications of Failure Conditions that Lead to Runway Excursions.
• PS-ANM- 25-12, Certification of Structural Elements in Flight Control Systems.
• PS-AIR-21.15-01, Submission of Outline of New and Changed Systems at the Beginning of the Type Certificate Amendment Process for Transport Category Aircraft.
1.4.4 FAA-sponsored research Netherlands Aerospace Centre (NLR) reports.
These reports support AC 25.1309 accepted probabilities. Copies of the referenced Netherlands Aerospace Centre reports can be obtained by sending an email to:
‘9-AVS-AIR-SSADocs@faa.gov’.
• NLR-CR-2002-601, November 2002. Assessment of standard probabilities in support of FAA AC 25.1309, Phase one.
• NLR-CR-2003-554, September 2003. Assessment of standard probabilities in support of FAA AC 25.1309, Phase two.
• NLR-CR-2005-015, January 2005. Assessment of standard probabilities in support of FAA AC 25.1309, Phase three.
• NLR-CR-2016-601, February 2017. Update of standard probabilities in support of FAA AC 25.1309.
1.4.5 Industry Documents.
The following RTCA documents are available from RTCA Inc., 1150 18th Street NW, Suite 910, Washington, DC 20036; by completing the Document Order Form and faxing it to (202) 833-9434; or at RTCA. The following SAE International Aerospace Recommended Practice (ARP) documents are available from SAE Customer Service, 400 Commonwealth Drive, Warrendale, PA, 15096; or at SAE. Please use the latest version of the referenced document.
• RTCA, Inc., Document DO -160, Environmental Conditions and Test Procedures for Airborne Equipment.
• RTCA, Inc., Document DO-178, Software Considerations in Airborne Systems and Equipment Certification.
• RTCA, Inc., Document DO-254, Design Assurance Guidance for Airborne Electronic Hardware.
• RTCA, Inc., Document DO-297, Integrated Modular Avionics (IMA) Development Guidance and Certification Considerations.
• RTCA, Inc., Document DO-326, Airworthiness Security Process Specification.
• RTCA, Inc., Document DO-355, Information Security Guidance for Continued Airworthiness Global Specification.
1-7