ARP4761A Introduction – Avionics Safety

1. Before an applicant proceeds with a detailed safety assessment, an FHA of the airplane and system functions to determine the need for and the scope of subsequent analysis should be prepared. This assessment may be conducted using service experience, engineering and operational judgment, or service experience and a top-down deductive qualitative examination of each function. An FHA is a systematic, comprehensive examination of airplane and system functions to identify potential no safety effect, minor, major, hazardous, and catastrophic failure conditions that may arise, not only as a result of malfunctions or failure to function but also as a result of normal responses to unusual or abnormal external factors. The FHA concerns the operational vulnerabilities of systems rather than a detailed analysis of the actual implementation.
2. Each system function should be examined regarding the other functions performed by the system because the loss or malfunction of all functions performed by the system may result in a more severe failure condition than the loss of a single function. In addition, each system function should be examined regarding functions performed by other airplane systems because the loss or malfunction of different but related functions, provided by separate systems, may affect the severity of failure conditions postulated for a particular system.
3. The FHA is an engineering tool that should be performed early in the design and updated as necessary. It is used to define the high-level airplane or system safety objectives that should be considered in the proposed system architectures. Also, it should be used to assist in determining the DALs for the systems. Many systems may need only a simple review of the system design by the applicant to determine the hazard classification. An FHA requires experienced engineering judgment and early coordination between the applicant and the certification authority.

The FHA is much more than a lengthy derivation; the FHA also includes aircraft and system level requirements that allow the objectives for failure probability to be achieved including:

• Design constraints
• Redundancy considerations
• Specification & annunciation of failure conditions
• Proposed pilot and crew mitigation action
• Recommended maintenance activity

FHA output data includes:

• Function list
• An FHA worksheet (table) showing the following:
  • function identification
  • failure conditions
  • phase of flight
  • effect of the failure condition on the aircraft, flight crew, and occupants
  • classification of the failure condition
  • verification method that the probability requirement is met
  • reference to supporting material
• Derived requirements for lower-level systems

The following figure shows classic Part-23 aircraft probabilities congruent to ARP4761: ARP4761 Part-23 Aircraft Classifications

Preliminary Aircraft Safety Assessment (PASA) – New Assessment in 4761A

PASA is a systematic examination of a proposed aircraft architecture to determine how failures could cause the Failure Conditions identified by the Aircraft FHA. The PASA process begins during the initial aircraft architecture development phase. Therefore, early identification of aircraft level safety requirements like function development assurance level, independence and probabilistic budgets, etc. helps to reduce risks during the system development process. The PASA is particularly important for evaluating aircraft level failure conditions when multiple systems are involved in performing an aircraft function.

Preliminary System Safety Assessment (PSSA)

The PSSA is a set of analyses normally performed during the system requirements and item requirements phases of the aircraft life cycle. The PSSA is where the proposed system architectures are evaluated and defined; this provides the ability to derive system and item safety requirements. The input documents to the PSSA are the aircraft FHA, preliminary aircraft FTA, and the system FHAs. The documents produced during the PSSA are the updated aircraft and system FHAs, updated aircraft and systems FTAs, and the preliminary system Common Cause Analyses (CCAs). The PSSA identifies derived system safety requirements like redundancy, partitioning, monitoring, dissimilarity, etc. The PSSA also identifies the necessary Development Assurance Levels for the system functions and items. The PSSA is a continuous and iterative process conducted at multiple stages of system development. The objective of the PSSA is to determine how the aircraft and system failures can lead to the hazards identified in the FHAs and to determine how the FHA requirements can be met.

System Safety Assessment (SSA)

The SSA verifies that the implemented aircraft and system designs meet the requirements of the aircraft/system FHA and the PSSA. The SSA documentation generated during the SSA includes:

• List of failure conditions from the system FHA and safety requirements allocated to the SSA with FTAs
• Results of the qualitative assessments of each failure condition or safety requirement
• Any material used to validate the failure condition classifications
• Any material shows that assumptions used in the assessment to be valid like flight manual procedures, not-to-exceed intervals, etc.
• Documentation showing item installation requirements
• If necessary, revised maintenance manuals detailing new maintenance tasks aimed at reducing component exposure times
• If necessary, revised flight crew operating manuals detailing procedures to be followed in the event of certain failure conditions
• Information showing that the system and items were developed in accordance with assigned development assurance levels.

 The following figure shows the ARP4761 FDAL versus IDAL delineation: Figure: ARP4754A / ARP4761 FDAL versus IDAL Delineation

Aircraft Safety Assessment (ASA) – New Assessment in 4761A

Aircraft Safety Assessment is a systematic, comprehensive evaluation of the implemented aircraft to verify that the implemented aircraft design meets the safety requirements as defined in the PASA. The ASA determines that the requirements from the AFHA and PASA have been met. The ASA also demonstrates that aircraft architecture, the relationships between aircraft functions and systems are acceptable. ASA is kind of final assessment that covers results and evidence of safety assessments performed during development process. The ASA basically covers;

• The list of Aircraft FHA Failure Condition with the evidence that they are satisfied
• Evidence that Safety Program Plan objectives have been achieved
• Evidence that aircraft architecture meets the qualitative and quantitative safety requirements
• Evidence that aircraft architecture meets the Development Assurance Level allocation requirements
• The status of open problem reports and their consequences on the aircraft

Note: ARP4761 and ARP4761A are complex topics, best handled via training. AFuzion’s AFP4761A training is available here: https://afuzion.com/private-training/arp-4761a-training-aviation-safety-training/

Fault Tree Analysis

Fault Tree Analysis (FTA) is a top-down analysis technique to determine what single failures or combinations of failures can exist at the lower levels that might cause each failure condition. The primary purpose of an FTA is to determine the probability of occurrence of the top event — therefore, demonstrating compliance with a probability requirement specified in a higher level document (usually an FHA). Also, the FTA meets additional objectives:

• FTAs allow the evaluation of the proposed system architecture enabling the assignment of reliability budgets to systems and items
• FTAs identify the need for design modification:
  • Added reliability of components redundancy
  • Additional redundancy
  • Additional monitoring
  • Increased maintenance activity

The FTA Basic Events may get their failure rates from the FMEA.

Failure Modes and Effects Analysis

Failure Modes and Effects Analysis (FMEA) is a systematic, bottom-up analysis performed to identify the failure modes of a system, item, or function and determining the effect of the failure on the next higher level. FMEA’s can be done at the component, function, or LRU level. Generally, an FMEA deals with the individual and the combined effects of single failures. At minimum, an FMEA should include the following:

• Identification of the component or function
• Failure mode(s) of the component or function
• Failure rate for each failure mode
• Severity of failure effects
• Failure effect at the next higher level
• Means of detecting the failure
• Compensating actions (i.e., automatic or manual)

Functional Independence concerns using different functional requirements to implement an aircraft or system level function as explained in the following figure: Figure: ARP4754A and ARP4761 Functional Independence (for details of Item Independence, download the rest of this ARP4761A PDF whitepaper)

Safety Aspects of Software

Unlike hardware (where you can quantify the safety of an item by calculating its probability of failure over a specified period of time) software safety cannot be numerically measured. So, rather than specifying probabilities of failure associated with software according to the severity of the failure condition — the intensity of the software documentation and verification is established according to the severity of the failure condition associated with the failure of the software to perform its intended function. Software failure condition categories are similar to the hardware failure condition categories described earlier in this whitepaper. The following table is from DO-178.

Failure Condition Category	Description	Software Development Assurance Level
Catastrophic	Failure conditions that would prevent continued safe flight and landing	A
Hazardous/ Severe Major	Failure Conditions that would reduce the capability of the aircraft or the ability of the crew to cope with adverse operating conditions to the extent that there would be: 1. A large reduction in safety margins or functional capabilities, 2. Physical distress or higher workload such that the flight crew could not be relied upon to perform their tasks accurately or completely, or 3. Adverse effects on occupants including serious injury or potential fatal injuries to a small number of occupants	B
Major	Failure conditions that would reduce the capability of the aircraft or the capability of the crew to cope with adverse operating conditions to the extent that there would be, for example: 1. A significant reduction in safety margins or functional capabilities, 2. A significant increase in crew workload or in conditions impairing crew efficiency, or 3. Discomfort to occupants, possibly including injuries	C
Minor	Failure conditions that would not significantly reduce aircraft safety and that would involve crew actions that are well within their capabilities. For example: 1. A slight reduction in safety margins or functional capabilities 2. A slight increase in crew workload, such as routine flight plan changes, or 3. Some inconvenience to occupants	D

Figure: ARP4754A / ARP4761 FDAL versus IDAL Delineation ARP4761 and ARP4761A require a safety process beginning at the Aircraft level and then sequencing through various ARP4761A compliant safety assessments as shown in the following figure:

ARP4761A Certification Software & Platforms

The ARP4761A certification process is complex and time consuming, as we all know. However there are strategies and tools you can apply that will improve the certification process, reducing the resource commitment, time for certification and as a result the cost of certification. Ultimately though these tools can help also improve the safety of your aircraft because less time and resource is committed performing tasks that can be automated. This can leave more time for engineers to spend on design and safety of the aircraft.

One of the tools we utilize in our projects is a Model-based tool that creates a Digital Risk Twins (DRT). Known as MADe (Maintenance Aware Design Environment), the MADe platform has added benefits to ARP4761A certification which came through from our analysis. These can be broken into short term and long-term benefits.

Short-term benefits of such tools:

✔ auto generation of certification documentation,

✔ standardized taxonomy,

✔ safety verification PSSA or SSA,

✔ assisting in the population of FHA, and

✔ Simulation based analyses.

The preceding material provides a brief overview of ARP4761A. Advanced ARP4761A information and techniques are provided in the corresponding workshop “Understanding & Applying ARP4761A” which includes the following topics:

1. ARP4761A Overview
2. ARP4761A Safety – The Details
3. Common ARP4761A Mistakes
4. ARP4761A: Best practices
5. ARP4761A By the Numbers
6. ARP4761A Safety Analysis Planning, Performing & Auditing

Other places to add ARP4761 

1. “The safety assessment should answer the following questions for the aircraft, then each system, as depicted below:” ADD: “(excerpted from AFuzion’s ARP4761 Training):”