Appendix A Safety Assessment

A1 General

This section provides material that may be useful in supporting the safety assessment activities identified in Section 13.

A2 Identification of Failure Conditions

The following “failures” should be considered for applicability when establishing Failure Conditions as indicated in Section 13:

Loss of autopilot in single or multiple axes

Loss of guidance in single or multiple axes

Loss of thrust control

Partial loss or degradation of autopilot function

A failure resulting in unintended autopilot commands in a single axis or multiple axes simultaneously (e.g., hardover, slowover, and oscillatory failure modes) A failure resulting in unintended guidance commands in a single axis or multiple axes A failure resulting in unintended thrust control

A sustained out-of-trim condition with the autopilot engaged without a warning

An autopilot disengagement in an out-of-trim condition

Autopilot disengagement without a warning

Inability to disengage the autopilot or autothrust function

Un-commanded engagement of an autopilot or autothrust

Jamming or loading of primary flight controls

Un-intended thrust asymmetry

A typical Failure Condition statement may be of the form:

‘{Failure}’ during ‘{Phase of Flight}’ that ‘{Effect}’ when ‘{Mitigation Consideration}’ Failure Conditions may result from failures within the FGS or from failure associated with aircraft interfacing systems or components (e.g., navigation receivers, attitude heading reference systems, flight management systems, hydraulics, electrical systems, etc.).

A3 Considerations when Assessing the Severity of Failure Condition Effects

The Failure Condition definition is complete (as defined in AMC 25.1309) when the effects resulting from “failure” are identified. A complete definition of the Failure Condition and its effect will then support the subsequent Failure Condition classification.

When assessing the effect that results from a failure, the following items should be considered for various phases of flight:

The impact of the loss of control, or unintended control, on the structural integrity of the aeroplane as a result of simple loading or as a result of excitation of aerodynamic or structural modes, both at the time of occurrence and while the flight continues.

Implications of the aeroplane response in terms of attitude, speed, accelerations, flight path, and the impact on the occupants and on flight crew performance.

Degradation in the stability or other flying qualities of the aeroplane.

The duration of the condition.

The aircraft configuration.

The aircraft motion cues that will be used by the flight crew for recognition.

Availability, level, and type of alerting provided to the flight crew.

Expected flight crew corrective action on detection of the failure.

Failure Conditions may include the following characteristics:

“Hardover” effects - typically considered to significant and are readily detectable by the flight crew based on the resulting aircraft motion or guidance cues.

“Slowover” effects - typically not readily detected by the flight crew. The effect may involve departures from intended flight path that are not initially detectable by aircraft motion alone, and may only be detectable by motion cues when a significant flight path deviation has occurred or by the provision of an appropriate flight crew alert.

“Oscillatory” effects – typically a repetitive motion or guidance condition not related to intended guidance or control. The magnitude, period and duration of the condition and any mitigation considerations will determine the final effect.

“Loss of” effects – typically the removal of control, guidance or functionality that may have an immediate effect or may not be immediately apparent to the flight crew.

Section 14 provides guidance on crew recognition considerations.

A4 Failure Condition Classification

The following are examples of the type of Failure Condition effects that have been identified in previous aeroplane certification programs. The specific number and type of Failure Condition may vary with aeroplane type, aeroplane system architecture and FGS system design philosophy (e.g., failure detection, redundancy management, failure annunciation, etc.).

A4.1 Catastrophic Failure Conditions

The following effects have been assessed Catastrophic in previous aeroplane certification programs:

A load on any part of the primary structure sufficient to cause a structural failure preventing safe flight and landing (Refer to CS 25.302).

Unrecoverable loss of flight path control.

Exceedance of VDF/MDF.

Flutter or vibration that causes a structural failure preventing safe flight and landing (Refer to CS 25.302).

A temporary loss of control (e.g., stall) where the flight crew is unable to prevent contact with obstacles or terrain.

Deviations in flight path from which the flight crew are unable to prevent contact with obstacles, terrain, or other aircraft.

A4.2 Hazardous Failure Conditions

The following effects have been assessed Hazardous in previous aeroplane certification programs:

Exceedance of airspeed halfway between VMO and VDF or a Mach number halfway between MMO and MDF.

A stall, even if the flight crew is able to recover safe flight path control.

A load factor less than zero.

Bank angles of more than 60 degrees en route or more than 30 degrees below a height of 300 m (1000 ft). above an applicable airport elevation.

Degradation of the flying qualities of the aeroplane that excessively increases flight crew workload.

Failure that could result in a RTO and high speed overrun (e.g., 110 km/h (60 kt)).

A flight path deviation that requires a severe manoeuvre to prevent contact with obstacle, terrain or other aircraft.

NOTE: Severe manoeuvre includes risk of serious injury or death of a small number of occupants.

A4.3 Major Failure Conditions

The following effects have been assessed Major in previous aeroplane certification programs:

A flight path deviation, a required recovery manoeuvre, which may result in passenger injuries (e.g., consideration should be given to phases of flight where the occupants may reasonably be moving about the aeroplane or be serving or consuming hot drinks).

Degradation of the flying qualities of the aeroplane that significantly increase flight crew workload.

[Amdt 25/4]