Advisory U.S. Department of Transportation Circular Federal Aviation Administration Subject: SYSTEM DESIGN AND ANALYSIS Date: 6/21/88 AC No: 25.1309-1A Initiated by: ANM-110 Change:
PURPUSE. This Advisory Circular (AC) describes various acceptable means for showing compliance with the requirements of & 25.1309(b), (c), and (d) of the Federal Aviation Regulations (FAR). These means are intended to provide guidance for the experienced engineering and operational judyment that must form the basis for compliance findings. They are not mandatory. Otner means may be used if they show compliance with this section of the FAR.
2. CANCELLATION. AC 25.1309-1 dated 9/7/82, is hereby cancelled.
3. APPLICABILITY. Section 25.1309(b) provides yeneral requirements for a logical and acceptable inverse relationship between the probability and the severity of each failure condition, and $ 25.1309(d) requires that compliance be shown primarily by analysis. Section 25.1309(c) provides general requirements for system monitoring, failure warning, and capability for appropriate corrective crew action. Because § 25.1309(b) and (c) is a regulation of yeneral applicability, it nay not be used to replace or alter any allowed design practices or specific requirements of Part 25, and each requirement of § 25.1309(b) and (c) applies only if other applicable sections of Part 25 do not provide a specific system requirement that has a similar purpose. While $ 25.1309(b) and (c) does not apply to the performance, flight characteristics, and structural loads and strength requirements of Subparts B and C, it does apply to any system on which compliance with any of those requirements is based. For example, it does not apply to an airplane's inherent stall characteristics or their evaluation, but it does apply to a stall warning system used to enable compliance with § 25.207.
BACKGROUND. The Part 25 airworthiness standards are based on the fail-safe design concept that has evolved over the years. A brief description is provided in Paragraph 5. Section 25.1309(b) and (c) sets forth certain objective safety requirements based on this design concept. Many systems, equipment, and their installations have been successfully evaluated to the applicable requirements of Part 25, including § 25.1309(D), (C), and (d), without usiny structured means for safety assessments. However, in recent years there has been an increase in the degree of system complexity and integration, and in the number of safety-critical functions performed by systems. Difficulties had been experienced in assessing the hazards that could result from failures of such systems, or adverse interactions amony them.
These difficulties led to the use of structured means for showing compliance
with & 25.1309(b). For this and other reasons, guidance was needed on acceptable means of compliance with $ 25.1309(b), (c), and (d).
a. Section 25.1309(b) and (d) specifies required safety levels in qualitative terms, and requires that a safety assessment be made. Various assessment techniques have been developed to assist applicants and the FAA in determining that a logical and acceptable inverse relationship exists between . the probability and the severity of each failure condition. These techniques include the use of service experience data of similar, previously-approved systems, and thorough qualitative analyses.
In addition, difficulties had been experienced in assessing the acceptability of some designs, especially those of systems, or parts of systems, that are complex, that have a high degree of integration, that use new technoloyy or new or different applications of conventional technology, or that perform safety-critical functions. These difficulties led to the selective use of rational analyses to estimate quantitative probabilities, and the development of related criteria based on historical data of accidents and hazardous incidents caused or contributed to by failures. These criterla, expressed as numerical probability ranges associated with the terms used in § 25.1309(b), became commonly-accepted for evaluating the quantitative analyses operational judgment and to supplement qualitative analyses and tests.
5. THE FAA FAIL-SAFE DESIGN CONCEPT. The Part 25 airworthiness standards are based on, and incorporate, the objectives, and principles or techniques, of the fail-safe design concept, which considers the effects of failures and combinations of failures in defining a safe desiyn.
a. The following basic objectives pertaining to failures apply:
In any system or subsystem, the failure of any sinyle element, component, or connection during any one flight (brake release through ground deceleration to stop) snould be assumed, reyardless ot its probability. Such sinyle failures should not prevent continued safe flight and landing, or significantly reduce the capability of the airplane or the ability of the crew to cope with the resulting failure conditions.
(2) Subsequent failures during the same flight, whether detected or latent, and combinations thereof, should also be assumed, unless their joint probability with the first failure is shown to be extremely improbable.
2 Par 4
b. The fail-safe design concept uses the following design principles or techniques in order to ensure a safe design. The use of only one of these principles or techniques is seldom adequate. A combination of two or more is usually needed to provide a fail-safe design; i.e., to ensure that major failure conditions are improbable and that catastrophic tailure conditions are extremely improbable.
(1) Desiyned Interity and Quality, includiny Life Limits, to ensure intended function and prevent failures.
(¿) Redundancy or Backup Systems to enable continued function after any single (or other defined number of) failure(s); e.g., two or more engines, hydraulic systems, flight control systems, etc.
(3) Isolation of Systems, Components, and Elements so that the failure of one does not cause the failure of another. Isolation is also termed independence.
(4) Proven Reliability so that multiple, independent failures are unlikely to occur during the same flight.
(5) Failure Warniny or Indication to provide detection.
(6) Flightcrew Procedures for use after failure detection, to enable continued safe flight and landing by specifying crew corrective action.
(7) Checkability: the capability to check a component's condition.
(8) Designed Failure Effect Limits, includiny the capability to sustain damage, to limit the safety impact or effects of a failure.
(9) Designed Failure Path to control and direct the effects of a failure in a way that limits its safety impact.
(10) Maryins or Factors of Safety to allow for any undefined or unforeseeable adverse conditions.
(11) Error-Tolerance that considers adverse effects of foreseeable errors during the airplane's design, test, manufacture, operation, and maintenance.
6. DEFINITIUNS. The following definitions apply to the system design and analysis requirements of § 25.1309(b), (c), and (d) and the guidance material provided in this AC. They should not be assumed to apply to the same or Par 5 3
AC 25.1309-1A 6/21/88 similar terms used in other regulations or ACs. Terms for which standard dictionary definitions apply are not defined herein.
a. Attribute: A feature, characteristic, or aspect of a system or a device, or a condition affecting its operation. Some examples would include design, construction, technology, installation, functions, applications, operational uses, environmental and operational stresses, and relationships with other systems, functions, and flight or structural characteristics.
b. Certification Check Requirement (CCR): A recurring flightcrew or groundcrew check that is required by design to help show compliance with § 25.1309(b) and (d) (2) by detecting the presence of, and thereby limiting the exposure time to, a significant latent failure that would, in combination with one or more other specific failures or events identified in a safety analysis, result in a hazardous failure condition.
c. Check: An examination (e.g., an inspection or test) to determine the physical integrity or functional capability of an item.
d. Complex: A system is considered to be complex if structured methods of analysis are needed for a thorough and valid safety assessment. A structured method is very methodical and highly organized. Failure modes and effects, fault tree, and reliability block diagram analyses are examples of structured methods.
e. Continued Safe Flight and Landing: The capability for continued controlled flight and landing at a suitable airport, possibly using emergency procedures, but without requiring exceptional pilot skill or strength. Some airplane damage may be associated with a failure condition, during flight or upon landing.
Conventional: An attribute of a system is considered to be conventional if it is the same as, or closely similar to, that of previouslyapproved systems that are commonly-used.
g. Failure: A loss of function, or a malfunction, of a system or a part thereot.
n. Failure Condition: The effects on the airplane and its occupants, both direct and consequential, caused or contributed to by one or more failures, considering relevant adverse operational or environmental conditions. Failure conditions may be classified according to their severities as follows:
(1) Minor: Failure conditions which would not significantly reduce airplane safety, and which involve crew actions that are well within their capabilities. Minor failure conditions may include, for example, a slight reduction in safety margins or functional capabilities, a slight increase in 4 Par
crew workload, such as routine flight plan chanyes, or some inconvenience to occupants.
(2) Major: Failure conditions which would reduce the capability of the airplane or the ability of the crew to cope with adverse operating conditions to the extent that there would be, for example, --
(i) A significant reduction in safety margins or functional capabilities, a significant increase in crew workload or in conditions impairing crew efficiency, or some discomfort to occupants; or In more severe cases, a large reduction in safety margins or functional capabilities, higher workload or physical distress such that the crew could not be relied on to perform its tasks accurately or completely, or adverse effects on occupants.
(3) Catastrophic: Failure conditions which would prevent continued safe flight and landing.
function of fight operation. Each mean need not necessarily be identical.
j. Qualitative: Those analytical processes that assess system and airplane safety in a subjective, nonnumerical manner.
k. Quantitative: Those analytical processes that apply mathematical methods to assess system and airplane safety.
7. DISCUSSION. Section 25.1309(b) and (d) requires substantiation by analysis, and where necessary, by appropriate ground, flight, or simulator tests, that a logical and acceptable inverse relationship exists between the probability and the severity of each failure condition. However, tests are not required to verify failure conditions that are postulated to be catastrophic.
As discussed in Paragraph 3, some systems and some functions must be evaluated for compliance with certain specific system requirements that take precedence over certain requirements of § 25.1309(b) and (c) that have similar purposes.
In either case, however, the goal is to ensure an acceptable overall airplane safety level, considering all failure conditions of all systems.
a. The requirements of § 25.1309(b) and (d) are intended to ensure an orderly and thorough evaluation of the effects on safety of foreseeable failures or other events, such as errors or external circumstances, separately or in combination, involving one or more system functions. The interactions of these factors within a system and among relevant systems should be considered.
Par 6 5
b. The severities of failure conditions may be evaluated according to the following considerations:
(1) Effects-on the airplane, such as reductions in safety margins, degradations in performance, loss of capability to conduct certain flight operations, or potential or consequential effects on structural integrity.
(2) Effects on the crewmembers, such as increases above their normal workload that would affect their ability to cope with adverse operational or environmental conditions or subsequent failures.
(3) Effects on the occupants; i.e., passengers and crewmembers.
c. For convenience in conducting design assessments, failure conditions may be classified according to their severities as minor, major, or catastrophic. Paragraph 6h provides accepted definitions of these terms.
(1) The classification of failure conditions does not depend on whether or not a system or function is required by any specific regulation.
Some systems required by specific regulations, such as transponders, position lights, and public address systems, may have the potential for only minor failure conditions. Conversely, other systems not required by any specific regulation, such as flight management systems and automatic landing systems, may have the potential for major or catastrophic failure conditions.
Regardless of the types of assessment used, the classification of failure conditions should always be accomplished with consideration of all relevant factors; e.g., system, crew, performance, operational, external, etc.
Examples of factors would include the nature of the failure modes, any effects or limitations on performance, and any required or likely crew action. It is particularly important to consider factors that would alleviate or intensity the severity of a failure condition. An example of an alleviating factor would be the continued performance of identical or operationally-similar functions by other systems not affected by a failure condition. Examples of intensifying factors would include unrelated conditions that would reduce the ability of the crew to cope with a failure condition, such as weather or other adverse operational or environmental conditions, or failures of other unrelated systems or functions.
d. The probability that a failure condition would occur may be assessed as probable, improbable, or extremely improbable. These terms are explained in Paragraphs 9e and 1Ub. Each failure condition should have a probability 6 Par 7
€/21/88 AC 25.1309-1A that is inversely-related to its severity. Figure 1, Probability vs.
Consequence Graph, illustrates this relationship.
(1) Minor failure conditions may be probable.
(2) Major failure conditions must be improbable.
(3) Catastrophic failure conditions must be extremely improbable.
Figure 1:. Probability vs. Consequence Graph Catastrophic Accident Consequence of Failure Condition Adverse Effects on Unacceptable Occupants Airpiane Damage Emergency Procedures Abnormal Procedures Acceptable Nuisance Normal Probable Improbable Extremely Improbable Probability of Failure Condition
e. An assessment to identify and classify failure conditions is necessarily qualitative. On the other hand, an assessment of the probability of a failure condition may be either qualitative or quantitative. An analysis may range from a simple report that interprets test results or compares two similar systems to a detailed analysis that may (or may not) include estimated numerical probabilities. The depth and scope of an analysis depends on the types of functions performed by the system, the severities of system failure conditions, and whether or not the system is complex. Regardless of its type, an analysis should show that the system and its installation can tolerate failures to the extent that major failure conditions are improbable and catastrophic failure conditions are extremely improbable.
(1) Experienced engineering and operational judgment should be applied when determining whether or not a system is complex. Comparison with similar, previously-approved systems is sometimes helpful. All relevant system Par 7 7
attributes should be considered; however, the complexity of the software used to program a digital computer-based system should not be considered because the software is assessed and controlled by other means, as described in Paragraph 7i.
(2) An analysis should always consider the application of the failsafe design concept described in Paragraph 5, and give special attention to ensuring the effective use of design techniques that would prevent single failures or other events from damaging or otherwise adversely affecting more than one redundant system channel or more than one system performing operationally-similar functions. When considering such common-cause failures or other events, consequential or cascading effects should be taken into account if they would be inevitable or reasonably likely.
(3) Some examples of such potential common-cause failures or other events would include rapid release of energy from concentrated sources such as uncontained failures of rotating parts or pressure vessels, pressure differentials, noncatastrophic structural failures, loss of environmental conditioniny, disconnection of more than one subsystem or component by overtemperature protection devices, contamination by fluids, damage from localized fires, loss of power, excessive voltage, physical or environmental interactions among parts, use of incorrect, faulty, or bogus parts, human or machine errors, and foreseeable adverse operational conditions, environmental conditions, or events external to the system or to the airplane.
f. As discussed in Paragraphs 8c(1) and 8d(2), compliance for a system or part thereof that is not complex may sometimes be shown by design and installation appraisals and evidence of satisfactory service experience on other airplanes using the same or other systems that are similar in their relevant attributes.
g. In general, a failure condition resulting from a single failure mode of a device cannot be accepted as being extremely improbable. In very unusual cases, however, experienced engineering judyment may enable an assessment that such a failure mode is not a practical possibility. when making such an assessment, al! possible and relevant considerations should be taken into account, includiny all relevant attributes of the device. Service experience showing that the failure mode has not yet occurred may be extensive, but it can never be enough. Furthermore, flightcrew or groundcrew checks have no value if a catastrophic failure mode would occur suddenly and without any prior indication or warning. The assessment's logic and rationale should be so straignttorward and readily-obvious that, trom a realistic and practical viewpoint, any knowledgeable, experienced person would unequivocally conclude that the failure mode simply would not occur, unless it is associated with a wholly-unrelated failure condition that would itself be catastrophic.
8 Par 7
h. Section 25.1309(c) provides requirements for system monitoring, failure s provide in Paragra action stone sure warning, and capability for appropriate corrective crew action. Guidance on acceptable means of compliance is provided in Paragraph 8g.
i. In general, the means of compliance described in this AC are not directly applicable to software assessments because it is not feasible to assess the number or kinds of software errors, if any, that may remain after the completion of system design, development, and test. Advisory Circular 20-115A dated August 12, 1986, "Radio Technical Commission for Aeronautics Document RTCA/DO-178A," or later revisions thereto, provides acceptable means for assessing and controlling the software used to program digital computer-based systems. Document RTCA/D0-178A dated March 22, 1985, "Software Considerations in Airborne Systems and Equipment Certification," defines and uses certain terms to classify the criticalities of functions. For information, these terms have the following relationships to the terms used in this AC to classify failure conditions: failure conditions adversely affecting non-essential functions would be minor, failure conditions adversely affecting essential functions would be major, and failure conditions adversely affecting critical functions would be catastrophic.
8. ACCEPTABLE TECHNIQUES. The applicant is responsible for applying reasonable criteria and experienced engineering and operational judgment to identify and classify each failure condition and to choose the methods of assessment to be used to determine compliance with § 25.1309(b), (c), and (d).
All relevant applicant engineering organizations, such as systems, structures, propulsion, and flight test, should be involved in the identification and classification of failure conditions. The applicant should then obtain early concurrence of the cognizant certificating office on the failure conditions, their classifications, and the choice of an acceptable means of compliance.
This paragraph describes acceptable techniques, but not the only techniques, for determining compliance. (Paragraph 12 briefly and partially summarizes these techniques.) Regardless of the techniques used, the considerations described in Paragraphs 7c and 7e should always be taken into account.
Functional Hazard Assessment. A useful preliminary step is to conduct a functional hazard assessment (FHA) to identify and classify potentlallyhazardous failure conditions, and to describe them in functional and operational terms. An FHA is qualitative and is conducted usiny experienced engineering and operational judgment. The criteria described in Paragraph 7f are sometimes sufficient for systems as described therein. For other systems, an FHA tends to be structured because it involves a comprehensive, systematic, deductive, high-level examination of system functional failures to identify and classify the resulting failure conditions. An FHA is often used by applicants as a preliminary engineering tool to help determine the acceptability of a design concept, to identify potential problem areas or desirable design changes, or to determine the need for and scope of any additional analyses. At the applicant's option, an FHA may be included in the certification documentation. In some cases, it may show that additional documentation is not Par 7 9
b. Analysis of Minor Failure Conditions. An analysis, which could be an FHA, should consider the effects of system failures on other systems or their functions. It is complete if it shows that system failures would cause only minor failure conditions. If the system, in itself, has the potential for only minor failure conditions, and the common design practice of providing physical and functional isolation between it and other systems is used, an analysis that shows such isolation is usually sufficient.
c. Analysis of Major Failure Conditions. Major failure conditions must be shown to be improbable. Those that are more severe (reference Paragraph 6h(2) (ii)) should have smaller probabilities than those that are less severe (reference Paragraph 6h(2)(i)). The considerations described in Paragraphs 7c and 7e should always be taken into account.
(1) Using experienced enyineering and operational judgment, an assessment as described in Paragraph 7f is often sufficient. Compliance may also be shown qualitatively by a failure modes and effects analysis, or by a fault tree or reliability block diagram analysis. A quantitative analysis is sometimes used to support experienced judyment and to supplement qualitative analysis for the more severe major failure conditions.
(2) An analysis of a redundant system is usually complete if it shows isolation between redundant system channels and satisfactory reliability for each channel. For complex systems, a failure modes and effects analysis or a fault tree or reliability block diagram analysis is often used to show that isolation actually exists (i.e., that any single failure would not affect more than one redundant system channel), and to show that the failure modes of the system do not have any adverse effects on safety-related functions performed by other systems.
d. Analysis of Catastrophic Failure Conditions. Catastrophic failure conditions must be shown to be extremely improbable. A very thorough safety assessment is necessary. The considerations described in Parayraphs /c and 7e should always be taken into account.
(1) The assessment usually consists of an appropriate combination of qualitative and quantitative analyses, such as those described in Paragraphs 9 and 10.
(2) Using experienced engineeriny and operational judgment, an assessment as described in Paragraph 7f is sometimes sufficient, provided that the service experience data, which should be based on commonly-used systems that are identical or have a very close similarity in their relevant 10 Par 8
attributes, show that no potentially-catastrophic defects have been discovered in the identical or similar systems or their installations.
e. Operational or Environmental Conditions. A probability of one should usually be used for encountering a discrete condition for which the airplane is desiyned, such as instrument meteorological conditions or Category III weather operations. On the other hand, reasonable and rational consideration of the statistically-derived probability of a random condition may usually be included in an analysis, provided it is based on an applicable supporting data base and its statistical distribution. When combining the probability of such a random condition with that of a system failure, care should be taken to ensure that the condition and the system failure are independent of one another, or that any dependencies are properly accounted for. Two examples of the reasonable and rational use of such random conditions are the encountering of hazardous turbulence or gust levels after the failure of a structural load alleviation system, and the availability of a suitable alternate airport having a crosswind lower than that at the intended destination airport after a system failure that results in a loss of high rudder authority. The applicant should obtain early concurrence of the cognizant certificating office when such conditions are to Latent. Failures. A latent failure is one which is inherently undetected when it occurs. A significant latent failure is one which would, in combination with one or more other specific failures or events, result in a hazardous failure condition. Because the frequency at which a device is checked directly affects the probability that any latent failure of that device exists, CCRS (reference Paragraph 6b) may be used to help show compliance with § 25.1309(b) and (d)(2) tor signiticant latent tallures. however, the use of CCRs or other checks in lieu of practical and reliable failure monitoring and warning systems to detect siynificant latent failures when they occur does not comply with § 25.1309(c) and (d)(4). A practical failure monitoring and warniny system is one which is considered to be within the state-of-the-art.
reliable failure monitoring and warning system is one which would not result in either excessive failures of a yenuine warning, or excessive or untimely false varnings which can sometimes be more hazardous than lack of provision for, or rallures of, genuine but infrequent warnings. Experienced judgment should be applied when determining whether or not a failure monitoring and warning system systems is sometimes here paragra g) a sini provide further quidance on the use of CCRS.
g• Acceptable means or compilance with s 251309(C)• section 25 1309(c) requires that warning information must be provided to alert the crew to unsate system operating conditions, and to enable them to take appropriate corrective action. It also requires that systems, controls, and associated monitoring Par 8 11
АС 25.1309-1A 6/21/88 and warniny means must be designed to minimize crew errors which could create additional hazards. Compliance with this section is shown qualitatively.
(1) Failure warning or indication may either be natural (inherent) or designed into a system. In either case, it should be timely, rousing, obvious, clear, and unambiguous. It should occur at a point in a potentiallycatastrophic sequence of failures where the airplane's capability and the crew's ability still remain sufficient for appropriate corrective crew action.
(2) Unless they are accepted as normal airmanship, procedures for the crew to follow after the occurrence of failure warning should be described in the FAA-approved Airplane Flight Manual (AFM) or AFM revision or supplement.
(3) Even if operation or perturmance is unaffected or insignificantly affected at the time of failure, warning is required if it is considered necessary for the crew to take any action or observe any precautions. Some examples would include reconfiguring a system, being aware of a reduction in satety maryins, changiny the flight plan or regime, or making an unscheduled landing to reduce exposure to a more hazardous failure condition that would result from subsequent failures or operational or environmental conditions.
Warning is also required if a failure must be corrected before a subsequent flight. It operation or performance is unaffected or insignificantly affected, warning may be inhibited during specific phases of flight where corrective action by the crew is considered more hazardous than no action.
(4) The use of CCRS or other checks in lieu of practical and reliable failure monitoring and warniny systems to detect siynificant latent failures when they occur does not comply with § 25.1309(c) and (d)(4). Paragraphs 8f and Il provide further guidance on the use of CCRS.
(5) The assumptions of Paragraph lla that the flightcrew will take appropriate corrective action and perform required checks correctly are based on compliance with the requirement for a design that minimizes the potential for hazardous crew errors; however, quantitative assessments of the probabilities of crew errors are not considered feasible. Particular attention should be given to the placement of switches or other control devices, relative to one another, so as to minimize the potential for inadvertent incorrect crew action, especially during emergencies or periods of high workload. Extra protection, such as the use of guarded switches, may sometimes be needed.
9. QUALITATIVE ASSESSMENT. Various methods for assessing the causes, severities, and likelihood of potential failure conditions are available to support experienced engineering and operational judgment. • Some of these methods are structured. The various types of analysis are based on either 12 Par 8