components. As in § 25.1309, the fail-safe design concept applies. Any single failure condition, such as an arc fault, should be assumed to occur regardless of probability.
(2) Inadequacies of § 25.1309 in relation to EWIS safety assessments.
Section 25.1309 requires the applicant to perform system safety assessments. But current § 25.1309 practice has not led to the type of analysis that fully ensures all EWIS failure conditions affecting airplane level safety are considered. This is because the current § 25.1309(a) only covers systems and equipment that are “required by this subchapter,” and wiring for nonrequired systems is sometimes ignored. Even for systems covered by § 25.1309(b) and (d), the safety analysis requirements have not always been applied to the associated wire. When they are, there is evidence of inadequate and inconsistent application. Traditional thinking about nonrequired systems, such as in-flight entertainment systems, has been that, since they are not required, and the function they provide is not necessary for the safety of the airplane, their failure could not affect the safety of the airplane. This is not a valid assumption.
Failure of an electrical wire, regardless of the system it is associated with, can cause serious physical and functional damage to the airplane, resulting in hazardous or even catastrophic failure conditions. An example of this is arcing from a shorted wire cutting through and damaging flight control cables. There are more failure modes than have been addressed with traditional analyses. Some further examples are arcing events that occur without tripping circuit breakers, resulting in complete wire bundle failures and fire, or wire bundle failures that lead to structural damage.
(3) Integrated nature of EWIS. The integrated nature of wiring and the potential severity of failures demand a more structured safety analysis approach than that traditionally used in showing compliance with § 25.1309. Section 25.1309 system safety assessments typically evaluate effects of wire failures on system functions. But they have not considered physical wire failure as a cause of the failure of other wires within the EWIS. Traditional assessments look at external factors like rotor burst, lightning, and hydraulic line rupture, but not at internal factors, like a single wire chafing or arcing event, as the cause of the failure of functions supported by the EWIS.
Compliance with § 25.1709 requires addressing those failure modes at the airplane level. This means that EWIS failures need to be analyzed to determine what effect they could have on the safe operation of the airplane.
(4) Compliance summary. As specified above, the analysis required for compliance with § 25.1709 is based on a qualitative approach to assessing EWIS safety as opposed to numerical, probability-based quantitative analysis. The intent is not to examine each individual wire and its relation to other wires. Rather, it is to ensure that there are no hazardous combinations. However, in case the “top down” analysis process described in this AC determines that a failure in a given bundle may lead to a catastrophic failure condition, the mitigation process may lead to performing a complete analysis of each wire in the relevant bundle.
(5) Qualitative probability terms. When using qualitative analyses to determine compliance with § 25.1709, the following descriptions of the probability terms have become commonly accepted as aids to engineering judgment:
(a) Extremely remote failure conditions. These are failure conditions that are not anticipated to occur to an individual airplane during its total life but which may occur a few times when considering the total operational life of all airplanes of the type.
(b) Extremely improbable failure conditions. These are failure conditions so unlikely that they are not anticipated to occur during the entire operational life of all airplanes of one type.
(6) Relationship to other part 25 system safety assessments. The analysis described may be accomplished in conjunction with the required aircraft system safety assessments of §§ 25.1309, 25.671, etc.
(7) Classification of failure terms. The classification of failure conditions is given in Table 1. These failure conditions are identical to those proposed by the Aviation Rulemaking Advisory Committee for the draft (Arsenal) version of AC 25.1309-1b, dated June 10, 2002.
Table 1: Classification of Failure Conditions
Term Explanation No Safety Effect Failure conditions that would have no effect on safety, for example failure conditions that would not affect the operational capability of the airplane or increase flightcrew workload.
Minor Failure conditions that would not significantly reduce airplane safety, and involve flightcrew actions that are well within their capabilities. For example, minor failure conditions may include:
• a slight reduction in safety margins or functional capabilities;
• a slight increase in flightcrew workload, such as routine flight plan changes; or
• some physical discomfort to passengers or cabin crew.
Major Failure conditions that would reduce the capability of the airplane or the ability of the flightcrew to cope with adverse operating conditions to the extent that there would be, for example:
• a significant reduction in safety margins or functional capabilities;
• a significant increase in flightcrew workload or in conditions impairing flightcrew efficiency;
• discomfort to the flightcrew; or
• physical distress to passengers or cabin crew, possibly including injuries.
Hazardous Failure conditions that would reduce the capability of the airplane or the ability of the flightcrew to cope with adverse operating conditions to the extent that there would be, for example:
• a large reduction in safety margins or functional capabilities;
• physical distress or excessive workload such that the flightcrew cannot be relied upon to perform their tasks accurately or completely; or
• serious or fatal injuries to a relatively small number of persons other than the flightcrew.
Catastrophic Failure conditions that would result in multiple fatalities, usually with the loss of the airplane. (NOTE: A catastrophic failure condition was defined differently in previous versions of § 25.1309 and in accompanying advisory material as “a failure condition that would prevent continued safe flight and landing.”)
(8) Flowcharts depicting the analysis process. Flowcharts 1 and 2, which follow, outline one method of complying with the requirements of § 25.1709. The processes in both Flowcharts 1 and 2 identify two aspects of the analysis: physical failures and functional failures. The analysis processes described in both flowcharts begin by using the aircraft level functional hazard analysis developed for demonstrating compliance with § 25.1309 to identify catastrophic and hazardous failure events. A step-by-step explanation of the analysis depicted in the flowcharts is given in this AC in paragraphs 5.e.(11) (for Flowchart 1) and 5.e.(12) (for Flowchart 2).
(a) Flowchart 1. This flowchart applies to applicants for pre-TC work and for amended TCs, and STCs when the applicant has all data necessary to perform the analysis per Flowchart 1. If Flowchart 1 is used for post-TC modifications, the available data must include identification of the systems in the EWIS under consideration for modification and the system functions associated with that EWIS.
(b) Flowchart 2. This flowchart applies to applicants for post-TC modifications when the applicant cannot identify the systems or systems functions contained in EWIS under consideration for modification.
(9) Definitions applicable to § 25.1709. For this discussion the following definitions apply:
(a) Validation. Determination that requirements for a product are sufficiently correct and complete.
(b) Verification. Evaluation to determine that requirements have been met.
(c) Mitigation. Elimination of a hazard entirely or minimization of its severity and probability to an acceptable level. In the case of this rule, an EWIS failure must be mitigated to a point where the probability of a hazardous failure must be at 23
least extremely remote and the probability of a catastrophic failure at least extremely improbable
(10) Physical failure analysis.
(a) Only single common cause events or failures need to be addressed during the physical failure analysis as described in this AC and shown on the left hand sides of Flowcharts 1 and 2. Multiple common cause events or failures need not be addressed.
(b) In relation to physical effects, it should be assumed that wires are carrying electrical energy and that, in the case of an EWIS failure, as defined in paragraph
5.e.(10)(a), this energy may result in hazardous or catastrophic effects directly or when combined with other factors, for example fuel, oxygen, hydraulic fluid, or damage by passengers. These failures may result in fire, smoke, emission of toxic gases, damage to co-located systems and structural elements, or injury to personnel.
This analysis considers all EWIS from all systems (autopilot, auto throttle, PA system, IFE systems, etc.) regardless of the system criticality.
Flowchart 1: Pre- and Post-Type Certification Safety Analysis Concept EWIS Characteristics:
- Installation criteria (separation, etc)
- EWIS components (design, selection) FHA, PSSA, CCA, and SSA* for each system:
- Capture, detail, update and refine the A/C FHA.
- Perform complete system failure analysis.
- Include EWIS failure effects.
Identify the EWIS that is to be analyzed and its routing.
Analyze possible physical failures of EWIS that can cause damage to co-located EWIS or other surrounding systems or structural elements or injury to personnel, etc. ( e.g. 1 st article inspection, design review, particular risks, zonal safety assessments, zonal inspections, common mode analysis, as applicable).
Determine airplane level effects of physical failures (e.g., collateral damage, localized fire, smoke in cabin, etc.) and their criticality as defined in Table 1 of this AC.
Develop necessary mitigation strategies 1 for hazardous (not shown to be extremely remote) and catastrophic airplane level effects identified in BOX E for physical failures.
Update design installation guidelines (BOX B) based on mitigation strategies.
Identify the EWIS that causes the failure condition under analysis.
Does the EWIS contributing factor to the failure need to be mitigated? 2 YES Validate and verify that mitigation strategies are adequate.
NO Document results of the EWIS safety analysis.
YES Aircraft Functional Hazard Assessment YES Physical Failures Functional Failures Check for possible adverse effects introduced Develop necessary mitigation strategies 1 for hazardous (not shown to be extremely remote) and catastrophic (not shown to be extremely improbable and does not result from a single failure) airplane level effects identified in BOX J for functional failures.
Complete the appropriate safety assessments.
Update A/C FHA and other system safety assessments as necessary B D C E F H P O N L K J A EWIS physical failure analysis results I 1 e.g., re-route, change clamping, add sleeving, add barrier, etc 2 Contributing means the EWIS causes the failure in whole or in part * FHA: Functional Hazard Assessment PSSA: Preliminary System Safety As sessment CCA: Common Cause Analysis SSA: System Safety Assessment NO M Validate and verify that mitigation strategies are adequate.
G NO 4 cases are considered:
Total failure Partial failure Inadvertent operation Malfunction Check for possible adverse effects introduced and update A/C FHA and other system safety assessments as necessary Mitigation as used in this flowchart means to eliminate the hazard entirely or minimize its severity and probability to an acceptable level. In the case of § 25.1709, the EWIS failure must be mitigated to a point where the probability of a hazardous failure is at least extremely remote and the probability of a catastrophic failure is at least extremely improbable 25
(11) Descriptive text for Flowchart 1
(a) BOX A Aircraft functional hazard assessment.
1 The functional failure analysis assumes that electrical wires are carrying power, signal, or information data. Failure of EWIS under these circumstances may lead to aircraft system degradation effects.
2 The functional hazard assessment (FHA) referred to in this box is not a stand-alone separate document specifically created to show compliance with § 25.1709. It is the aircraft level FHA that the applicant will have developed in compliance with § 25.1309 to help demonstrate acceptability of a design concept, identify potential problem areas or desirable design changes, or determine the need for and scope of any additional analyses (refer to AC
25.1309-1B).
ANALYSIS OF POSSIBLE PHYSICAL FAILURES
(b) BOX B EWIS characteristics. Use the results of the FHA (BOX A) and the preliminary system safety assessment (PSSA), common cause analysis (CCA), and system safety assessment (SSA) (BOX J) to identify EWIS installation criteria and definitions of component characteristics. Results from BOX B are fed into the preliminary system safety analysis (PSSA) and system safety analysis (SSA) of BOX J.
(c) BOXES C, D, and E Validation and verification of installation criteria.
1 Ensure that the EWIS component qualification satisfies the design requirements and that components are selected, installed, and used according to their qualification characteristics and the aircraft constraints linked to their location (refer to the requirements of §§ 25.1703 and 25.1707).
2 Use available information (digital mockup, physical mockup, airplane data, and historical data) to perform inspections and analyses to validate that design and installation criteria are adequate to the zone/function, including considerations of multi-systems impact. Such inspections and analyses may include a 1st article inspection, design review, particular risk assessment, zonal safety assessment, zonal inspection, and common mode analysis, as applicable. Use such assessments and inspections to ascertain whether design and installation criteria were correctly applied. You should give special consideration to known problem areas identified by service history and historical data (areas of arcing, smoke, loose clamps, chafing, arc tracking, interference with other systems, wires and cables that are required to regularly flex, such as those in doors and hatches, etc.). Regardless of probability, any 26
single arcing failure should be assumed for any power-carrying wire. The intensity and consequence of the arc and its mitigation should be substantiated.
Give special consideration to cases where new (previously unused) material or technologies are used. In any case § 25.1703(b) requires that the selection of wires must take into account known characteristics in relation to each installation and application to minimize the risk of wire damage, including any arc tracking phenomena.
3 You should evaluate deviations from installation and component selection criteria identified by these activities. A determination can then be made about their acceptability. Develop alternative mitigation strategies as necessary.
(d) BOXES F & G Development and validation of mitigation strategy. Identify and develop a mitigation strategy for the physical failures and their adverse effects identified in Boxes D and E. Validation and verification of the mitigation solution should ensure that:
1 Hazardous failure conditions are extremely remote.
2 Catastrophic failure conditions are extremely improbable and do not result from a single common cause event or failure.
3 This mitigation solution does not introduce any new potential failure conditions.
(e) BOX H Incorporation of applicable mitigation strategies.
Incorporate newly developed mitigation strategies (BOX F) into guidelines (BOX B) for further design and inspection and analysis processes.
(f) BOX I Physical failure analysis results. From the EWIS physical failure analysis, document:
• Physical failures addressed.
• Effects of those physical failures.
• Mitigation strategies developed.
This information supports the final analysis documentation (BOX P).
ANALYSIS OF POSSIBLE FUNCTIONAL FAILURES
(g) BOX J System safety assessments. Use the results of the airplane level FHA (BOX A) to guide the system level FHA (BOX J). Incorporate EWIS failures identified by § 25.1709 into the system level and aircraft level FHA, as necessary, the PSSA, the CCA, and the SSA. These analyses are performed to satisfy requirements of § 25.1309. Use results of these analyses to update the EWIS definition (BOX B).
(h) BOXES K, L, and M Hazardous and catastrophic failure conditions.
Use the analyses in BOX J to determine if the EWIS associated with the system under analysis can contribute (in whole or in part) to the failure condition under study.
Determine whether the EWIS failure needs to be mitigated. If so, develop, validate, and verify a mitigation strategy. If no mitigation is needed, complete the appropriate safety assessment per § 25.1309, § 25.671, etc..
NOTE: If the EWIS was the failure cause, the subsequent mitigation strategy developed may introduce new adverse effects not previously identified by the analysis. Check for any new adverse effects and update the aircraft level FHA and other system safety assessments as necessary.
(i) BOXES N and O Development and validation of mitigation strategy. Identify and develop a mitigation strategy for the functional failures and adverse effects identified in BOX J. Validation and verification of the mitigation solution should -
• Determine if initial objective is fully reached.
• Confirm that this mitigation solution is compatible with existing installations and installation criteria.
(j) BOX P Documentation of EWIS safety analysis results. After mitigation strategies have been validated and verified, document the results of the§ 25.1709 analysis. Update as necessary the aircraft level FHA that has been developed in support of certification of the proposed modification, in compliance with § 25.1309 (BOX A).
Flowchart 2: Post-TC Safety Analysis Concept
EWIS Characteristics:
- Installation criteria (separation, etc)
- EWIS component s (design, selection) FHA, PSSA , CCA, and SSA* for each system :
- Capture, detail, update and re fine the A/C FHA.
- Perform complete system failure analysis.
- Include the EWIS failure effects .
Identify the EWIS to be analyzed and its routing.
Determine airplane level effects of physical failures (e.g., collateral damage, localized fire, smoke in cabin, etc.) and their criticality as defined in Table 1 of this AC.
Develop necessary m itigation strategies 1 for hazardous ( not shown to be extremely remote) and c atastrophic airplane level effects identified in BOX E for physical failures.
NO Update design installation guidelines (BOX B) based on mitigation strategies.
Identify the EWIS that causes the fail ure condi tion under analysis.
Does the EWIS contributing factor to the failure need to be mitigated? 2 YES Validate and verify that mitigation strategies are adequate.
NO Document results of the EWIS safety analysis.
YES Aircraft Funct ional Hazard Assessment based on the propos ed modification YES, Physical Failures Functional Failures Check for possible adverse effects introduce d Develop necessary m itigation strategies 1 for hazardous (not shown to be extremely remote) and catastrophi c (not shown to be extremely improba ble and doe s not result from a single failure) airplane level effects identified in BOX J for functional failures.
Complete the appropri ate safety assessments.
Updat e A/C FHA and other system safety assessments as necessary B D E F H P O N L K J A EWIS physical failure analysis results I 1 e.g., re-route, change clamping, add s leeving, add ba rrier, etc 2 Contributing means the EWIS causes th e failure in whole or in part * FHA: Functi onal Hazard Assessment PSSA : Preliminary System Safety Assessment CCA: Common Cause Analysis SSA: System Safety Assessment
NO M Validate and verify that mitigation strateg ies are adequate.
G Physically separate the new EWIS from other existing EWIS to preclude collateral EWIS damage.
C 4 cases are co nsidered:
( Total failure ( Partial failure ( Inadvertent operation ( Malfunction Check for possible adverse effects introduce d and update A/C FHA and other system safety assessments as necess ary
Mitigation as used in this flowchart means to eliminate the hazard entirely or minimize its severity and probability to an acceptable level. In the case of § 25.1709, the EWIS failure must be mitigated to a point where the probability of a hazardous failure is at least extremely remote and the probability of a catastrophic failure is at least extremely improbable 29
(12) Descriptive Text for Flowchart 2.
(a) Applicants for post-TC modifications should use the analysis depicted in Flowchart 2 when the applicant cannot identify the systems or systems functions contained in existing aircraft EWIS that may be utilized as part of the modification. An applicant should not add EWIS to an existing EWIS if the systems or systems functions contained in the existing EWIS are unknown. To do so could introduce unacceptable hazards. For example, IFE power wires could inadvertently be routed with aircraft autoland EWIS.
(b) The main objectives are to ensure that the proposed modification –
• Will be correctly designed and installed.
• Will not introduce unacceptable hazards either through its own failure or by adversely aff ecting existing aircraft systems.
As far as EWIS is concerned, correct incorporation of the modification should be ensured by both good knowledge of original aircraft manufacturer installation practices and their correct implementation or by adequate separation of the added EWIS from existing EWIS. In either case, physical analyses should be performed (similar to the physical failures part of Flowchart 1).
(c) BOX A Aircraft functional hazard assessment. Airplane level effects must be considered for modified systems or systems added to the aircraft. If the airplane level FHA is available, the applicant should examine it to determine the airplane level effect of the proposed modification. If the airplane level FHA is not available, then the applicant must generate an airplane level FHA based on the proposed modification.
This airplane level FHA would be limited to just those airplane systems affected by the proposed modification. If it is determined that no airplane level functional effects are introduced, a statement to this effect and the supporting data is sufficient to satisfy BOX A.
ANALYSIS OF POSSIBLE PHYSICAL FAILURES
(d) BOX B EWIS characteristics. Use results of the airplane level FHA (BOX A) to identify EWIS installation criteria and definitions of component characteristics. Results of BOX B are fed into the PSSA and SSA of BOX J.
(e) BOX C Physical separation of new EWIS from existing EWIS.
1 Separate the EWIS to be added from existing airplane EWIS since the systems or system functions contained in the existing EWIS are unknown. Establish physical separation between the new and existing EWIS either by separation distance or by an appropriate barrier or other means shown to be at least equivalent to the physical separation distance when allowed by § 25.1707. Methods given in the advisory material for § 25.1707 provide an acceptable way to determine adequate separation.
2 In cases where separation cannot be maintained because of physical constraints (e.g., terminal strips and connectors), the applicant should accomplish the appropriate analysis to show that no adverse failure conditions result from sharing the common device. This analysis requires knowledge of the systems or system functions sharing the common device (e.g., terminal strips and connectors).
(f) BOXES D and E Validation and verification of installation criteria.
1 Ensure that the EWIS component qualification satisfies the design requirements and that components are selected, installed, and used according to their qualification characteristics and the airplane constraints linked to their location (refer to the requirements of §§ 25.1703 and 25.1707).
2 Use available information (digital mockup, physical mockup, airplane data, and historical data) to perform inspections and analyses to validate that design and installation criteria are adequate to the zone/function, including considerations of multi-systems impact. Such inspections and analyses may include a 1st article inspection, design review, particular risk assessment, zonal safety assessment, zonal inspection, and common mode analysis, as applicable. Use such assessments and inspections to ascertain whether design and installation criteria were correctly applied. You should give special consideration to known problem areas identified by service history and historical data (areas of arcing, smoke, loose clamps, chafing, arc tracking, interference with other systems, etc.). Regardless of probability, any single arcing failure should be assumed for any powercarrying wire. The intensity and consequence of the arc and its mitigation should be substantiated. You should give special consideration to cases where new (previously unused) material or technologies are used. Evaluate deviations from installation and component selection criteria identified by these activities and determine their acceptability.
3 Alternative mitigation strategies should be developed as necessary.
(g) BOXES F & G Development and validation of mitigation strategy. Identify and develop a mitigation strategy for the physical failures identified in BOXES D and E and resulting adverse effects.
Validation and verification of a mitigation solution should ensure that:
1 Hazardous failure conditions are extremely remote.
2 Catastrophic failure conditions are extremely improbable and do not result from a single common cause event or failure.
3 This mitigation solution does not introduce any new potential failure conditions.
h) BOX H Incorporation of Applicable Mitigation Strategies.
Incorporate newly developed mitigation strategies (BOX F) into guidelines (BOX B) for further design and inspection and analysis process.
(i) BOX I Physical failure analysis documentation. From the EWIS physical failure analysis, document:
• Physical failures addressed.
• Effects of those physical failures.
• Mitigation strategies developed.
This information supports the final analysis documentation (BOX P).
ANALYSIS OF POSSIBLE FUNCTIONAL FAILURES
(j) BOX J System safety assessments. Use the results of the airplane level FHA (BOX A) to guide the system level FHA (BOX J).
Incorporate EWIS failures identified by § 25.1709 into the system level and aircraft level FHA, as necessary, the PSSA, the CCA, and the SSA. These analyses are performed to satisfy requirements of § 25.1309. Use results of these analyses to update the EWIS definition (BOX B).
(k) BOXES K, L, and M Hazardous and catastrophic failure conditions. Use the analyses in BOX J to determine if the EWIS associated with the system under analysis can contribute (in whole or in part) to the failure condition under study. Determine whether the EWIS failure needs to be mitigated. If so, develop, validate, and verify a mitigation strategy. If no mitigation is needed, complete the appropriate safety assessment (e.g., per § 25.1309, § 25.671, etc.).