Aircraft System Safety

Assessments for Initial Airworthiness Certification

Duane Kritzinger

• Éditeur: Woodhead Publishing
• Année: 2016
• ISBN:
  9780081009321
• Sujet: Commerce
• Sous-sujet: Industrie des transports

Aircraft System Safety: Assessments for Initial Airworthiness Certification presents a practical guide for the novice safety practitioner in the more specific area of assessing aircraft system failures to show compliance to regulations such as FAR25.1302 and 1309. A case study and safety strategy beginning in chapter two shows the reader how to bring safety assessment together in a logical and efficient manner.

Written to supplement (not replace) the content of the advisory material to these regulations (e.g. AMC25.1309) as well as the main supporting reference standards (e.g. SAE ARP 4761, RTCA/DO-178, RTCA/DO-154), this book strives to amalgamate all these different documents into a consolidated strategy with simple process maps to aid in their understanding and optimise their efficient use.

• Covers the effect of design, manufacturing, and maintenance errors and the effects of common component errors
• Evaluates the malfunctioning of multiple aircraft components and the interaction which various aircraft systems have on the ability of the aircraft to continue safe flight and landing
• Presents and defines a case study (an aircraft modification program) and a safety strategy in the second chapter, after which each of the following chapters will explore the theory of the technique required and then apply the theory to the case study

1

Introduction

Abstract

When certifying a new (or modified) system, designers conduct a thorough assessment of potential failures to show that there is an inverse relationship between the probability of occurrence and the severity of consequence inherent in its effect (AMC25.1309). The designers also consider whether the design is such that it can lead unnecessarily to errors (during manufacture, maintenance or operation) or whether the system is vulnerable to foreseeable variations in the operating environment. The vehicle to report this assessment is commonly known as the System Safety Assessment, and it needs to consider ransom failure of system components as well as systematic errors which might be introduced during the development process.

Keywords

Aircraft/System Safety Assessment; Boundaries; Certification; Components; Development assurance level; Development errors; Failure conditions; Goal-based; Hazards; Hierarchy; Items; Materials; Means of compliance; Probability; Random failures; Requirement capture; Risk; Risk-based; Safety; Safety plan/strategy; Safety targets/criteria; Severity; Subsystem; System; System integration; System level; Systemic/systematic; V&V model of Systems Engineering

If we slide into one of those rare moments of military honesty, we realize that the technical demands of modern warfare are so complex a considerable percentage of our material is bound to malfunction even before it is deployed against a foe. We no longer waste manpower by carrying the flag into battle. Instead we need battalions of electronic engineers to keep the terrible machinery grinding.

Ernest K. Gann, The Black Watch

1.1. Introduction to System Safety Assessments

1.1.1. Background

It is broadly accepted that the prime causal factors of an aircraft accidents are either:

• Operational (such as pilot error, weather and operating procedures) or

• Technical (such as design errors, manufacturing errors, maintenance errors and component failures).

When certifying a new (or modified) system, designers conduct a thorough assessment of potential failures to demonstrate an inverse relationship exists between the probability of occurrence and the severity of consequence inherent in its effect (e.g. see Fig. 2.4). The designer must also consider whether the design presents qualities that might lead to errors during manufacture, maintenance or operation, or whether the system is vulnerable to foreseeable variations¹ in the operating environment.

The collated documents required to demonstrate the above are often collectively referred to as a System Safety Assessment (SSA).²

1.1.2. Aim of a System Safety Assessment

For a new (or modified) system, the SSA typically (Kritzinger (2006), Chapter 8) aims to ensure that:

• safety is designed into the system in a timely and cost-effective manner;

• hazards associated with each aircraft subsystem are identified, tracked, evaluated and eliminated or communicated (e.g. via warnings in the flight manual) to those likely to experience the hazard(s) during operation.

• Historical safety data, including lessons learned from other systems, are considered and applied where appropriate.

• Minimum risk is pursued in the use of novel technology, materials, or designs; and in any production, test and operational techniques.

• Those actions taken to eliminate hazards or reduce risk to an acceptable level are appropriately documented to ensure this is maintained in the Continuing Airworthiness phase.

• Any retrofit actions required to improve safety are minimised through the timely inclusion of appropriate additional safety features that are implemented when necessary.

• Procedural and Training requirements are identified to support and maintain safety assumptions and assertions.

• The program team is made aware of system safety and how the design can be used to mitigate certification risks.

Within the scope of this book, the SSA is generated as the primary means of compliance to design codes such as CS/FAR25.1309 (for large aircraft), CS/FAR23.1309 (for commuter aircraft), etc. The SSA is therefore defined as:

a pro-active opportunity to optimise the design and one which provides a structured body of objective evidence that the system, if used in accordance with the listed recommendations and limitations, can be certified as being “safe enough” to be released into a defined service environment.

1.1.3. Objectives of a System Safety Assessment

For a new (or modified) system, the SSA’s objectives are typically to:

• demonstrate that an inverse relationship exists between the probability of an undesired occurrence and the degree of severity inherent in its effect;

• demonstrate that the design is such that it cannot lead unnecessarily to errors during manufacture, maintenance or operation by the crew;

• demonstrate that the systems are suitable for the environment that the systems would ...