• 6/21/88 AC 25.1309-1A inductive or deductive approaches. Descriptions of typical types of analysis and explanations of qualitative probability terms are provided below.
a. Design Appraisal. A qualitative appraisal of the integrity and safety of the design. An effective appraisal requires experienced judgment, and in accordance with Paragraph 7e, should place special emphasis on any failure conditions that are likely to prevent continued safe flight and landing.
b. Installation Appraisal. A qualitative appraisal of the integrity and safety of the installation. An effective appraisal requires experienced judgment, and in accordance with Paragraph 7e, should place special emphasis on any failure conditions that are likely to prevent continued safe flight and landing. Any deviations from normal, industry-accepted installation practices, such as clearances or tolerances, should be evaluated, especially when appraising modifications made after entry into service.
c. Failure Modes and Effects Analysis. A structured, inductive, bottom-up analysis which is used to evaluate the effects on the system and the airplane ot each possible element or component failure. when properly tormatted, it will aid in identifying latent failures, and the possible causes of each failure mode.
d. Fault Tree or Reliability Block Diagram Analysis. Structured, deductive, top-down analyses which are used to identity the conditions, tallures, and events that would cause each defined failure condition. They are graphical methods of identifying the logical relationship between each particular failure condition and the primary element or component failures, effects analysis is usually used as the source document for those primary failures or other events. A fault tree analysis is failure-oriented, and is conducted from the perspective of which failures must occur to cause a defined failure condition. A reliability block diagram analysis is success-oriented, and is conducted from the perspective of which failures must not occur to preclude a defined failure condition.
e. Qualitative Probability Terms. When using qualitative analyses to determine compliance with § 25.1309(b), the following descriptions of the probability terms used in this regulation and this AC have become commonlyaccepted as aids to engineering judgment:
(1) Probable failure conditions are those anticipated to occur one or more times during the entire operational life of each airplane.
(2) Improbable failure conditions are those not anticipated to occur during the entire operational life of a single random airplane. However, they may occur occasionally during the entire operational life of all airplanes of one type.
par 9 13
• AC 25.1309-1A 6/21/88
(3) Extremely Improbable failure conditions are those so unlikely that they are not anticipated to occur during the entire operational life of all airplanes of one type.
10. QUANTITATIVE ASSESSMENT. A quantitative analysis may be used to support experienced engineering and operational judgment and to supplement qualitative analyses. A description of such an analysis, discussion and guidance information, and explanations of quantitative probability terms are provided below. A quantitative analysis is often used for catastrophic or severe major failure conditions of systems that are complex, that have insufficient service experience to help substantiate their safety, or that have attributes that differ significantly from those of conventional systems.
a. Probability Analysis. A failure modes and effects, fault tree, or reliability block diagram analysis which also includes numerical probability intormation. The probabilities of primary failures can be determined from failure rate data and exposure times, using failure rates derived from service experience on identical or similar items, or acceptable industry standards.
The conventional mathematics of probability can then be used to calculate the estimated probability of each tailure condition as a function of the estimated probabilities of its identified contributory failures or other events.
(1) It is recognized that, for various reasons, component failure rate data are not precise enough to enable accurate estimates of the probabilities of failure conditions. This results in some degree of uncertainty, as indicated by the wide line on figure l, Probability vs.
onsequence Graph, and the expression "on the order of" in the descriptions of the quantitative probability terms that are provided in Paragraph 10b. When calculatiny the estimated probability of each failure condition, this uncertainty should be accounted for in a way that does not compromise safety.
(2) Because the improbable range is broad (reference Paragraph 8C), the applicant should obtain early concurrence of the cognizant certificating office on an acceptable probability for each major failure condition. Unless acceptable probability criteria are provided elsewhere, such as in other ACs, acceptable probabilities for failure conditions should be derived from complete event scenarios leading to an inability for continued safe flight and landing.
The considerations described in Paragraphs 7c and 7e should always be taken into account so that the probability requirements are rational and realistically-based. Using experienced engineering and operational judgment, acceptable probabilities should have reasonable tolerances because the uncertainty is accounted for as discussed in Paragraph 10a(1).
b. Quantitative Probability Terms. When using quantitative analyses to help determine compliance with § 25.1309(b), the following descriptions of the probability terms used in this regulation and this AC have become commonlyaccepted as aids to engineering judgment. They are usually expressed in terms 14 Par 9
6/21/88 AC 25.1309-1A of acceptable numerical probability ranges for each flight-hour, based on a flight of mean duration for the airplane type. However, for a function which is used only during a specific flight operation; e.g., takeoff, landiny, etc., the acceptable probability should be based on, and expressed in terms of, the flight operation's actual duration.
(1) Probable fallure condigions are those naving a probability greater than on the order of 1 x 10- che order of 1 x 10-9 (2) 1x 10o less, out greater the thothe order off 109y on.
probability on the order of 1 X 10-gailure conditions are those having a (3) Extremely Improbable
11. UPERATIONAL AND MAINTENANCE CONSIDERATIONS. This AC addresses only those operational and maintenance considerations that are directly related to compliance with § 25.1309(D), (c), and (d); other operational and maintenance considerations are not discussed herein. flightcrew and groundcrew tasks related to compliance with this regulation should be appropriate and reasonable. However, as discussed in Paragraph 8g(5), quantitative assessments of the probabilities of crew errors are not considered feasible. Therefore, reasonable tasks are those for which full credit can be taken because the flightcrew or groundcrew can realistically be anticipated to perform them correctly and when they are required or scheduled. In addition, based on experienced engineering and operational judgment, the discovery of obvious failures during normal operation and maintenance of the airplane may be considered, even though such tailures are not the primary purpose or tocus of che operational or maintenance actions.
a. Flightcrew Action. When assessing the ability of the flightcrew to cope with a failure condition, the warning information and the complexity of the required action should be considered (reference Paragraph 8g(5)). If the evaluation indicates that a potential failure condition can be alleviated or overcome during the time available without jeopardizing other safety-related lightcrew tasks and without requiring exceptional pilot sklil or strengin, credit may be taken for correct and appropriate corrective action, for botr qualitative and quantitative assessments. Similarly, credit may be taken for correct flightcrew performance of CCRS if overall flightcrew workload during the time available to perform them is not excessive and if they do not require exceptional pilot skill or strength. Unless flightcrew actions are accepted as normal airmanship, they should be described in the FAA-approved AFM or AFM revision or supplement.
assessments. Such requirements should be provided for use in FAA-approved maintenance programs.
Par 10 15
АС 25.1309-1A 6/21/88 Certification Check Requirements. As discussed in Paragraphs 6b and 8f, CCRS (also referred to as Certification Maintenance Requirements, or CMRS) may be needed to help show compliance with § 25.1309(b) and (d) (2) significant latent failures. Rational methods, which usually involve quantitative analyses or relevant service experience data, should be used to determine CCR intervals. These intervals should have reasonable tolerances so that CCRs can be performed concurrently with other maintenance, inspection, or check procedures not required by design for compliance with § 25.1309(b) and (d) (2). Such tolerances are acceptable because the uncertainty described in Paragraph 10a(1) is accounted for as discussed therein. If CCRs are used, they and their intervals and tolerances, and any post-certification changes, or procedures provided in the type design for an airplane owner or operator to make such changes, should be approved by, or with the concurrence of, the certificating office having cognizance over the type design that relates to the system and its installation.
(1) Any applicant originatiny CCRS that are to be performed by flightcrews should provide all relevant information to owners and operators of the airplane in the FAA-approved AFM or AFM revision or supplement.
(2) Any applicant originating CCRs that are to be performed by groundcrews should provide all relevant information to owners and operators of the airplane early enough for well-planned, timely incorporation into FAA- approved maintenance programs. If appropriate, approved procedures for reasonable adjustments to CCR intervals as a result of knowledge acquired from service experience may be provided for use in FAA-approved maintenance programs.
Any owner or operator of an airplane may request that alternative CCRs or their intervals be allowed and specified in an operator's specification approved under the applicable operating regulation or in accordance with an FAA-approved maintenance program. As discussed in Paragraph 1lc, concurrence of the certificating office having cognizance over the type design that relates to the system and its installation is necessary.
a . rilyht with Equipment or functions inoperative. Any applicant may elect to develop a list of equipment and functions which need not be operative for safe flight and landiny, based on stated compensating precautions that should be taken; e.g., operational or time limitations, or flightcrew or groundcrew checks. The documents used to show compliance with § 25.1309(b), (c), and (d), together with any other relevant information, should be considered in the development of this list, which then becomes the basis for a Master Minimum Equipment List (MMEL). Experienced angineering and operational judyment should be applied during the development of the MMEL.
16 Par 11
12. STEP-BY-STEP GUIDE. This guide and Figure 2, Depth of Analysis Flowchart, are provided primarily for the use of applicants who are not familiar with the various methods and procedures generally used by industry to conduct design safety assessments.
Conduct functional Figure 2:
hazard assessment. Depth of Analysis Flowchart (Reference Paragraph 8a) Are the failure Yes Show that the failure conditions are minor.
conditions minor? (Reference Paragraph 8b) NO Yes Is the system complex? (Reference Paragraph 6d) No Is the system similar to those used in other airplanes Yes Justily similarity.
in its relevant attributes? (Reference Paragraphs (Reference Paragraph 6a) 71, and 8c (1) or 8d (2)) , No is the system conventional in its relevant attributes? Yes Conduct qualitative assessments.
(Reference Paragraphs 6а and bru (Reference Paragraphs 8c or 8d, and 9) No Failure condition classification:
Conduct qualitative assessments, Major and quantitative assessments as appropriate. (Reference Severe Major, or Catastrophic Paragraphs 8c or 8d, 9, and 10) This guide and Figure 2 are not certification checklists, and they do not include all the information provided in this AC. There is no necessity for an applicant to use them or for the FAA to accept them, in whole or in part, to Par 12 17
show compliance with any regulation. Their sole purposes are to assist applicants by illustrating a systematic approach to design safety assessments, to enhance understandiny and communication by summariziny some of the information provided in this AC, and to provide some suggestions on documentation.
a. Define the system and its interfaces, and identify the functions that the system is to perform. Determine whether or not the system is complex, similar to systems used on other airplanes, and conventional.
b. Identify and classify the significant (i.e., non-trivial) failure conditions. All relevant applicant engineeriny organizations, such as systems, structures, propulsion, and flight test, should be involved in this process.
This identitication and classification may be done by conductiny an FHA, which is usually based on one of the following methods, as appropriate:
(1) If the system is not complex, and if its relevant attributes are similar to those of systems used on other airplanes, this identification and classification may be derived from design and installation appraisals and the service experience of the comparable, previously-approved systems.
(2) If the system is complex, it is necessary to systematically postulate the effects on the safety of the airplane and its occupants resulting from any possible failures, considered both individually and in combination with other failures or events.
Choose the means to be used to determine compliance with § 25.1309(b), (c), and (d). The depth and scope of the analysis depends on the types of functions performed by the system, the severities of system failure conditions, and whether or not the system is complex. For major failure conditions, experienced engineering and operational judgment, design and installation appraisals, and comparative service experience data on similar systems may be acceptable, either on their own or in conjunction with qualitative analyses or selectively-used quantitative analyses. For catastrophic failure conditions, a very thorough safety assessment is necessary. The applicant should obtain early concurrence of the cognizant certificatiny office on the failure conditions, their classifications, and the choice of an acceptable means of compliance.
d. Implement the design and produce the data which are agreed with the certificating office as being acceptable to show compliance. To the extent feasible, an analysis should be self-contained; however, if it is not, all other documents needed should be referenced. A typical analysis should include the following information to the extent necessary to show compliance:
(1) A statement of the functions, boundaries, and interfaces of the system.
18 Par 12
:5/21/88 AC 25.1309-1A
(2) A list of the component parts and equipment of which the system is comprised, and their design standards. This list may reference other documents; e.g., Technical Standard Orders (TSOs), manufacturer's or military specifications, etc.
$ 25.350516), (cl, and priatel, that show copience and their classifications and probabilities (expressed qualitatively or (3) The conclusions, including a statement of the failure conditions quantitatively, as appropriate), that show compliance with the requirements of
(4) A description that establishes correctness and completeness and traces the work leading to the conclusions. This description should include the basis for the classification of each failure condition (e.g., analysis or ground, flight, or simulator tests.) It should also include a description of precautions taken against common-mode or common-cause failures, provide any data such as component failure rates and their sources and applicability, support any assumptions made, and identify any required flightcrew or groundcrew actions, including any CCRS.
Donell HeRetensan LEROY A. KEITH Manager, Aircraft Certification Division Par 12 19