phaed 2026-06-18T20:12:24+00:00 Writer LibreOffice 7.3 engines={image=false textcolor=true vector=false text=true} tetml={filename={D:\drim\repository\projects\drim_124_0\metadata\0\1\01feb2161bcbf4cac18103e7fc01fa0f\01feb2161bcbf4cac18103e7fc01fa0f.para.xml} elements={annotations=false bookmarks=false destinations=false fields=false javascripts=false} } granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true} Downloaded D o w n l o a d e d from f r o m SAE S A E International I n t e r n a t i o n a l by b y David D a v i d Merrill, M e r r i l l , Saturday, S a t u r d a y , November N o v e m b e r 12, 1 2 , 2016 2 0 1 6 ,& , & ,. , . A A ,r , r l!!'A l ! ! ' A erospace e r o s p a c e AEROSPACE A E R O S P A C E An A n SAE S A E Internationa I n t e r n a t i o n a l l Group G r o u p RECOMMENDED R E C O M M E N D E D PRACTICE P R A C T I C E ..•..e . . • . . e . . . . ARP4754 A R P 4 7 5 4 REV. R E V . A A Issued I s s u e d 1996-11 1 9 9 6 - 1 1 Revised R e v i s e d 2010-12 2 0 1 0 - 1 2 SupersedinQ S u p e r s e d i n Q ARP4754 A R P 4 7 5 4 (R) ( R ) Guidelines G u i d e l i n e s for f o r Development D e v e l o p m e n t of o f Civil C i v i l Aircraft A i r c r a f t and a n d Systems S y s t e m s RATIONALE R A T I O N A L E This T h i s document d o c u m e n t provides p r o v i d e s updated u p d a t e d and a n d expanded e x p a n d e d guidelines g u i d e l i n e s for f o r the t h e processes p r o c e s s e s used u s e d to t o develop d e v e l o p civil c i v i l aircraft a i r c r a f t and a n d systems. s y s t e m s . TABLE T A B L E OF O F CONTENTS C O N T E N T S 1. 1 . 1.1 1 . 1 1.2 1 . 2 2. 2 . 2.1 2 . 1 2.1. 2 . 1 . 1 1 2.1. 2 . 1 . 2 2 2.1.3 2 . 1 . 3 2.1.4 2 . 1 . 4 2.1.5 2 . 1 . 5 2.2 2 . 2 2.3 2 . 3 3. 3 . 3.1 3 . 1 3.2 3 . 2 3.2. 3 . 2 . 1 1 4. 4 . 4.1 4 . 1 4.1.1 4 . 1 . 1 4.1. 4 . 1 . 2 2 4.1. 4 . 1 . 3 3 4.1.4 4 . 1 . 4 4.1. 4 . 1 . 5 5 4.1. 4 . 1 . 6 6 4.1. 4 . 1 . 7 7 4.1. 4 . 1 . 8 8 4.2 4 . 2 4.3 4 . 3 4.4 4 . 4 4.5 4 . 5 4.6 4 . 6 4.6. 4 . 6 . 1 1 4.6. 4 . 6 . 2 2 SCOPE........................................................................................................................................................ S C O P E . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 5 Purpose.................................................................................................................................................6 P u r p o s e . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6 Document D o c u m e n t Background:............................................................................................................................... B a c k g r o u n d : . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 7 REFERENCES............................................................................................................................................ R E F E R E N C E S . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 8 Applicable A p p l i c a b l e Documents................................................................................................................................. D o c u m e n t s . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 8 SAE S A E Publications......................................................................................................................................... P u b l i c a t i o n s . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 8 FAA F A A Publications......................................................................................................................................... P u b l i c a t i o n s . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 8 EASA E A S A Publications....................................................................................................................................... P u b l i c a t i o n s . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 9 RTCA R T C A Publications....................................................................................................................................... P u b l i c a t i o n s . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 9 EUROCAE E U R O C A E Publications............................................................................................................................... P u b l i c a t i o n s . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 9 Definitions.................................................................................................................................................. D e f i n i t i o n s . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 10 1 0 Abbreviations A b b r e v i a t i o n s and a n d Acronyms..................................................................................................................... A c r o n y m s . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 14 1 4 DEVELOPMENT D E V E L O P M E N T PLANNING..................................................................................................................... P L A N N I N G . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 1 6 Planning P l a n n i n g Process....................................................................................................................................... P r o c e s s . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 16 1 6 Transition T r a n s i t i o n Criteria....................................................................................................................................... C r i t e r i a . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17 1 7 Deviations D e v i a t i o n s from f r o m Plans................................................................................................................................ P l a n s . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 19 1 9 AIRCRAFT A I R C R A F T AND A N D SYSTEM S Y S T E M DEVELOPMENT D E V E L O P M E N T PROCESS...........................................................................19 P R O C E S S . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 9 Conceptual C o n c e p t u a l Aircraft/System A i r c r a f t / S y s t e m Development D e v e l o p m e n t Process...................................................................................20 P r o c e s s . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 0 Development D e v e l o p m e n t Assurance............................................................................................................................ A s s u r a n c e . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 22 2 2 Introduction I n t r o d u c t i o n to t o Development D e v e l o p m e n t Assurance A s s u r a n c e Process......................................................................................22 P r o c e s s . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 2 Introduction I n t r o d u c t i o n to t o Hierarchical H i e r a r c h i c a l Safety S a f e t y Requirements R e q u i r e m e n t s Generated G e n e r a t e d from f r o m Safety S a f e t y Analyses..................................23 A n a l y s e s . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 3 Identification I d e n t i f i c a t i o n of o f Aircraft-Level A i r c r a f t - L e v e l Functions, F u n c t i o n s , Function F u n c t i o n Requirements R e q u i r e m e n t s and a n d Function F u n c t i o n Interfaces.......................25 I n t e r f a c e s . . . . . . . . . . . . . . . . . . . . . . . 2 5 Allocation A l l o c a t i o n of o f Aircraft A i r c r a f t Functions F u n c t i o n s to t o Systems................................................................................................25 S y s t e m s . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 5 Development D e v e l o p m e n t of o f System S y s t e m Architecture.........................................................................................................25 A r c h i t e c t u r e . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 5 Allocation A l l o c a t i o n of o f System S y s t e m Requirements R e q u i r e m e n t s to t o Items..............................................................................................25 I t e m s . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 5 System S y s t e m Implementation............................................................................................................................. I m p l e m e n t a t i o n . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 25 2 5 Aircraft A i r c r a f t Function F u n c t i o n Development...................................................................................................................25 D e v e l o p m e n t . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 5 Allocation A l l o c a t i o n of o f Aircraft A i r c r a f t Functions F u n c t i o n s to t o Systems................................................................................................28 S y s t e m s . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 8 Development D e v e l o p m e n t of o f System S y s t e m Architecture.........................................................................................................28 A r c h i t e c t u r e . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 8 Allocation A l l o c a t i o n of o f System S y s t e m Requirements R e q u i r e m e n t s to t o Items..............................................................................................28 I t e m s . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 8 System S y s t e m Implementation............................................................................................................................. I m p l e m e n t a t i o n . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29 2 9 Information I n f o r m a t i o n Flow F l o w - - System S y s t e m Process P r o c e s s To T o & & From F r o m Item I t e m Process(es)..............................................................29 P r o c e s s ( e s ) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 9 Hardware H a r d w a r e and a n d Software S o f t w a r e Design/Build........................................................................................................30 D e s i g n / B u i l d . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 0 granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true} Downloaded D o w n l o a d e d from f r o m SAE S A E International I n t e r n a t i o n a l by b y David D a v i d Merrill, M e r r i l l , Saturday, S a t u r d a y , November N o v e m b e r 12, 1 2 , SAE S A E Technical T e c h n i c a l Standards S t a n d a r d s Board B o a r d Rules R u l e s provide p r o v i d e 2016 2 0 1 6 that: t h a t : "This " T h i s report r e p o r t is i s published p u b l i s h e d by b y SAE S A E to t o advance a d v a n c e the t h e state s t a t e of o f technical t e c h n i c a l and a n d engineering e n g i n e e r i n g sciences. s c i e n c e s . The T h e use u s e of o f this t h i s report r e p o r t is i s entirely e n t i r e l y voluntary. v o l u n t a r y . and a n d its i t s applicability a p p l i c a b i l i t y and a n d suitability s u i t a b i l i t y for f o r any a n y particular p a r t i c u l a r use, u s e , including i n c l u d i n g any a n y patent p a t e n t infringement i n f r i n g e m e n t arising a r i s i n g therefrom, t h e r e f r o m , is i s the t h e sole s o l e responsibility r e s p o n s i b i l i t y of o f the t h e user." u s e r . " SAE S A E reviews r e v i e w s each e a c h technical t e c h n i c a l report r e p o r t at a t least l e a s t every e v e r y five f i v e years y e a r s at a t which w h i c h time t i m e it i t may m a y be b e reaffirmed, r e a f f i r m e d , revised, r e v i s e d , or o r cancelled. c a n c e l l e d . SAE S A E invites i n v i t e s your y o u r written w r i t t e n comments c o m m e n t s and a n d suggestions. s u g g e s t i o n s . Copyright C o p y r i g h t © © 201o 2 0 1 o SAE S A E International I n t e r n a t i o n a l All A l l rights r i g h t s reserved. r e s e r v e d . No N o part p a r t of o f this t h i s publication p u b l i c a t i o n may m a y be b e reproduced, r e p r o d u c e d , stored s t o r e d in i n a a retrieval r e t r i e v a l system s y s t e m or o r transmitted, t r a n s m i t t e d , in i n any a n y form f o r m or o r by b y any a n y means, m e a n s , electronic, e l e c t r o n i c , mechanical, m e c h a n i c a l , photocopying, p h o t o c o p y i n g , recording, r e c o r d i n g , or o r otherwise, o t h e r w i s e , without w i t h o u t the t h e prior p r i o r written w r i t t e n permission p e r m i s s i o n of o f SAE. S A E . TO T O PLACE P L A C E A A DOCUMENT D O C U M E N T ORDER: O R D E R : Tel: T e l : 877-606-7323 8 7 7 - 6 0 6 - 7 3 2 3 (inside ( i n s i d e USA U S A and a n d Canada) C a n a d a ) Tel: T e l : +1 + 1 724-776-4970 7 2 4 - 7 7 6 - 4 9 7 0 (outside ( o u t s i d e USA) U S A ) Fax: F a x : 724-776-0790 7 2 4 - 7 7 6 - 0 7 9 0 Email: E m a i l : CustomerService@sae.org C u s t o m e r S e r v i c e @ s a e . o r g SAE S A E WEB W E B ADDRESS A D D R E S S : : http://www.sae.org h t t p : / / w w w . s a e . o r g SAE S A E values v a l u e s your y o u r input. i n p u t . To T o provide p r o v i d e feedback f e e d b a c k on o n this t h i s Technical T e c h n i c a l Report, R e p o r t , please p l e a s e visit v i s i t granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true} Downloaded D o w n l o a d e d from f r o m SAE S A E International I n t e r n a t i o n a l by b y David D a v i d Merrill, M e r r i l l , Saturday, S a t u r d a y , November N o v e m b e r 12, 1 2 , 2016 2 0 1 6 SAE S A E ARP4754A A R P 4 7 5 4 A Page P a g e 2 2 of o f 115 1 1 5 4.6.3 4 . 6 . 3 Electronic E l e c t r o n i c Hardware/Software H a r d w a r e / S o f t w a r e Integration.................................................................................................31 I n t e g r a t i o n . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 1 4.6.4 4 . 6 . 4 Aircraft/System A i r c r a f t / S y s t e m Integration......................................................................................................................... I n t e g r a t i o n . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31 3 1 5. 5 . INTEGRAL I N T E G R A L PROCESSES......................................................................................................................... P R O C E S S E S . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31 3 1 5.1 5 . 1 Safety S a f e t y Assessment.................................................................................................................................... A s s e s s m e n t . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31 3 1 5.1.1 5 . 1 . 1 Functional F u n c t i o n a l Hazard H a z a r d Assessments............................................................................................................... A s s e s s m e n t s . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34 3 4 5.1.2 5 . 1 . 2 Preliminary P r e l i m i n a r y Aircraft A i r c r a f t I I System S y s t e m Safety S a f e t y Assessment......................................................................................34 A s s e s s m e n t . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 4 5.1.3 5 . 1 . 3 Aircraft A i r c r a f t I I System S y s t e m Safety S a f e t y Assessment.........................................................................................................34 A s s e s s m e n t . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 4 5.1.4 5 . 1 . 4 Common C o m m o n Cause C a u s e Analysis.......................................................................................................................... A n a l y s i s . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35 3 5 5.1.5 5 . 1 . 5 Safety S a f e t y Program P r o g r a m Plan................................................................................................................................. P l a n . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 36 3 6 5.1.6 5 . 1 . 6 Safety-Related S a f e t y - R e l a t e d Flight F l i g h t Operations O p e r a t i o n s or o r Maintenance M a i n t e n a n c e Tasks..........................................................................37 T a s k s . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 7 5.1.7 5 . 1 . 7 Relationship R e l a t i o n s h i p with w i t h In-Service I n - S e r v i c e Safety...........................................................................................................37 S a f e t y . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 7 5.2 5 . 2 Development D e v e l o p m e n t Assurance A s s u r a n c e Level L e v e l Assignment..............................................................................................37 A s s i g n m e n t . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 7 5.2.1 5 . 2 . 1 General G e n e r a l Principles P r i n c i p l e s - - Introduction I n t r o d u c t i o n to t o Development D e v e l o p m e n t Assurance A s s u r a n c e Level L e v e l Assignment......................38 A s s i g n m e n t . . . . . . . . . . . . . . . . . . . . . . 3 8 5.2.2 5 . 2 . 2 FOAL F O A L and a n d IDAL...................................................................................................................................39 I D A L . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 9 5.2.3 5 . 2 . 3 Detailed D e t a i l e d FOAL F O A L and a n d IDAL I D A L Assignment A s s i g n m e n t Guidelines.....................................................................................39 G u i d e l i n e s . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 9 5.2.4 5 . 2 . 4 FOAL F O A L Assignment A s s i g n m e n t Taking T a k i n g Credit C r e d i t for f o r External E x t e r n a l Events................................................................................50 E v e n t s . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 0 5.3 5 . 3 Requirements R e q u i r e m e n t s Capture.............................................................................................................................. C a p t u r e . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51 5 1 5.3.1 5 . 3 . 1 Types T y p e s of o f Requirements.............................................................................................................................. R e q u i r e m e n t s . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52 5 2 5.3.2 5 . 3 . 2 Deriving D e r i v i n g Safety-related S a f e t y - r e l a t e d Requirements R e q u i r e m e n t s from f r o m the t h e Safety S a f e t y Analyses..............................................................54 A n a l y s e s . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 4 5.3.3 5 . 3 . 3 Capturing C a p t u r i n g Maintenance M a i n t e n a n c e Requirements R e q u i r e m e n t s for f o r In-service I n - s e r v i c e Use.........................................................................54 U s e . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 4 5.4 5 . 4 Requirements R e q u i r e m e n t s Validation............................................................................................................................ V a l i d a t i o n . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 54 5 4 5.4.1 5 . 4 . 1 Process P r o c e s s Objectives.................................................................................................................................... O b j e c t i v e s . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 55 5 5 5.4.2 5 . 4 . 2 Validation V a l i d a t i o n Process P r o c e s s Model.......................................................................................................................... M o d e l . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 56 5 6 5.4.3 5 . 4 . 3 Correctness C o r r e c t n e s s Checks.................................................................................................................................. C h e c k s . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 59 5 9 5.4.4 5 . 4 . 4 Completeness C o m p l e t e n e s s Checks............................................................................................................................... C h e c k s . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 60 6 0 5.4.5 5 . 4 . 5 Validation V a l i d a t i o n Rigor......................................................................................................................................... R i g o r . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62 6 2 5.4.6 5 . 4 . 6 Validation V a l i d a t i o n Methods.................................................................................................................................... M e t h o d s . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 62 6 2 5.4.7 5 . 4 . 7 Validation V a l i d a t i o n Data.......................................................................................................................................... D a t a . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 64 6 4 5.5 5 . 5 Implementation I m p l e m e n t a t i o n Verification....................................................................................................................... V e r i f i c a t i o n . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65 6 5 5.5.1 5 . 5 . 1 Verification V e r i f i c a t i o n Process P r o c e s s Objectives................................................................................................................. O b j e c t i v e s . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 65 6 5 5.5.2 5 . 5 . 2 Verification V e r i f i c a t i o n Process P r o c e s s Model........................................................................................................................ M o d e l . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 66 6 6 5.5.3 5 . 5 . 3 Verification V e r i f i c a t i o n Rigor....................................................................................................................................... R i g o r . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 67 6 7 5.5.4 5 . 5 . 4 Verification V e r i f i c a t i o n Planning.................................................................................................................................. P l a n n i n g . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 67 6 7 5.5.5 5 . 5 . 5 Verification V e r i f i c a t i o n Methods.................................................................................................................................. M e t h o d s . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 68 6 8 5.5.6 5 . 5 . 6 Verification V e r i f i c a t i o n Data........................................................................................................................................ D a t a . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 70 7 0 5.6 5 . 6 Configuration C o n f i g u r a t i o n Management....................................................................................................................... M a n a g e m e n t . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 72 7 2 5.6.1 5 . 6 . 1 Configuration C o n f i g u r a t i o n Management M a n a g e m e n t Process P r o c e s s Objectives.......................................................................................72 O b j e c t i v e s . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 2 5.6.2 5 . 6 . 2 Configuration C o n f i g u r a t i o n Management M a n a g e m e n t Process P r o c e s s Activities..........................................................................................73 A c t i v i t i e s . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 3 5.7 5 . 7 Process P r o c e s s Assurance.................................................................................................................................... A s s u r a n c e . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 75 7 5 5.7.1 5 . 7 . 1 Process P r o c e s s Objectives.................................................................................................................................... O b j e c t i v e s . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 75 7 5 5.7.2 5 . 7 . 2 Process P r o c e s s Assurance A s s u r a n c e Plan........................................................................................................................... P l a n . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 76 7 6 5.7.3 5 . 7 . 3 Project P r o j e c t Plan P l a n Reviews................................................................................................................................. R e v i e w s . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 76 7 6 5.7.4 5 . 7 . 4 Evidence E v i d e n c e of o f Process P r o c e s s Assurance................................................................................................................ A s s u r a n c e . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 76 7 6 5.8 5 . 8 Certification C e r t i f i c a t i o n and a n d Regulatory R e g u l a t o r y Authority A u t h o r i t y Coordination..................................................................................76 C o o r d i n a t i o n . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 6 5.8.1 5 . 8 . 1 Certification C e r t i f i c a t i o n Planning................................................................................................................................. P l a n n i n g . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 77 7 7 5.8.2 5 . 8 . 2 Agreement A g r e e m e n t on o n the t h e Proposed P r o p o s e d Means M e a n s of o f Compliance..................................................................................77 C o m p l i a n c e . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 7 5.8.3 5 . 8 . 3 Compliance C o m p l i a n c e Substantiation........................................................................................................................ S u b s t a n t i a t i o n . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 77 7 7 5.8.4 5 . 8 . 4 Certification C e r t i f i c a t i o n Data....................................................................................................................................... D a t a . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 77 7 7 6. 6 . MODIFICATIONS M O D I F I C A T I O N S TO T O AIRCRAFT A I R C R A F T OR O R SYSTEMS.....................................................................................80 S Y S T E M S . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 0 6.1 6 . 1 Modification M o d i f i c a t i o n Process P r o c e s s Overview................................................................................................................. O v e r v i e w . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 80 8 0 6.2 6 . 2 Modification M o d i f i c a t i o n Management M a n a g e m e n t Process........................................................................................................... P r o c e s s . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 81 8 1 6.3 6 . 3 Modification M o d i f i c a t i o n Impact I m p a c t Analysis...................................................................................................................... A n a l y s i s . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 81 8 1 6.4 6 . 4 Modification M o d i f i c a t i o n Categorization C a t e g o r i z a t i o n and a n d Administration.........................................................................................82 A d m i n i s t r a t i o n . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 2 6.5 6 . 5 Evidence E v i d e n c e for f o r Acceptability A c c e p t a b i l i t y of o f a a Modification..............................................................................................82 M o d i f i c a t i o n . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 2 6.5.1 6 . 5 . 1 Use U s e of o f Service S e r v i c e History............................................................................................................................... H i s t o r y . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 83 8 3 6.6 6 . 6 Considerations C o n s i d e r a t i o n s for f o r Modifications............................................................................................................... M o d i f i c a t i o n s . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 83 8 3 6.6.1 6 . 6 . 1 Introducing I n t r o d u c i n g a a New N e w Aircraft-Level A i r c r a f t - L e v e l Function.................................................................................................83 F u n c t i o n . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 3 granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true} Downloaded D o w n l o a d e d from f r o m SAE S A E International I n t e r n a t i o n a l by b y David D a v i d Merrill, M e r r i l l , Saturday, S a t u r d a y , November N o v e m b e r 12, 1 2 , 2016 2 0 1 6 ARP4754A A R P 4 7 5 4 A Page P a g e 3 3 of o f 115 1 1 5 6.6.2 6 . 6 . 2 Replacing R e p l a c i n g Item I t e m or o r System S y s t e m With W i t h Another A n o t h e r on o n an a n Existing E x i s t i n g Aircraft..........................................................84 A i r c r a f t . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 4 6.6.3 6 . 6 . 3 Adapting A d a p t i n g Existing E x i s t i n g Item I t e m or o r System S y s t e m to t o a a Different D i f f e r e n t Aircraft A i r c r a f t Type....................................................................85 T y p e . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 5 6.6.4 6 . 6 . 4 Modification M o d i f i c a t i o n to t o Item I t e m or o r System S y s t e m Without W i t h o u t Adding A d d i n g a a Function........................................................................86 F u n c t i o n . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8 6 6.6.5 6 . 6 . 5 STC S T C Production P r o d u c t i o n Introduction...................................................................................................................... I n t r o d u c t i o n . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 87 8 7 7 7 NOTES N O T E S 87 8 7 APPENDIX A P P E N D I X A A PROCESS P R O C E S S OBJECTIVES O B J E C T I V E S DATA............................................................................................................... D A T A . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 88 8 8 APPENDIX A P P E N D I X B B SAFETY S A F E T Y PROGRAM P R O G R A M PLAN....................................................................................................................... P L A N . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 97 9 7 APPENDIX A P P E N D I X C C FDAUIDAL F D A U I D A L ASSIGNMENT A S S I G N M E N T PROCESS P R O C E S S EXAMPLE...................................................................................110 E X A M P L E . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 1 0 APPENDIX A P P E N D I X D D DELETED................................................................................................................................................ D E L E T E D . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 115 1 1 5 FIGURE F I G U R E 1 1 FIGURE F I G U R E 2 2 FIGURE F I G U R E 3 3 FIGURE F I G U R E 4 4 FIGURE F I G U R E 5 5 FIGURE F I G U R E 6 6 FIGURE F I G U R E 7 7 FIGURE F I G U R E 8 8 FIGURE F I G U R E 9 9 FIGURE F I G U R E 10 1 0 FIGURE F I G U R E 11 1 1 FIGURE F I G U R E 12 1 2 FIGURE F I G U R E 13 1 3 FIGURE F I G U R E 14 1 4 TABLE T A B L E 1 1 TABLE T A B L E 2 2 TABLE T A B L E 3 3 TABLE T A B L E 4 4 TABLE T A B L E 5 5 TABLE T A B L E 6 6 TABLE T A B L E 7 7 TABLE T A B L E 8 8 TABLE T A B L E 9 9 GUIDELINE G U I D E L I N E DOCUMENTS D O C U M E N T S COVERING C O V E R I N G DEVELOPMENT D E V E L O P M E N T AND A N D IN-SERVICE/OPERATI I N - S E R V I C E / O P E R A T I ONAL O N A L PHASES.....................................................................................................6 P H A S E S . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6 PLANNING P L A N N I N G PROCESS.............................................................................................................................. P R O C E S S . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 18 1 8 DEVELOPMENT D E V E L O P M E N T LIFE L I F E CYCLE.................................................................................................................. C Y C L E . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 20 2 0 AIRCRAFT A I R C R A F T OR O R SYSTEM S Y S T E M DEVELOPMENT D E V E L O P M E N T PROCESS P R O C E S S MODEL..............................................................21 M O D E L . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 1 INTERACTION I N T E R A C T I O N BETWEEN B E T W E E N SAFETY S A F E T Y AND A N D DEVELOPMENT D E V E L O P M E N T PROCESSES.............................................24 P R O C E S S E S . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 4 AIRCRAFT A I R C R A F T FUNCTION F U N C T I O N IMPLEMENTATION I M P L E M E N T A T I O N PROCESS..........................................................................27 P R O C E S S . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 2 7 SAFETY S A F E T Y ASSESSMENT A S S E S S M E N T PROCESS P R O C E S S MODEL...........................................................................................33 M O D E L . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 3 FDAUIDAL F D A U I D A L ASSIGNMENT A S S I G N M E N T PROCESS......................................................................................................39 P R O C E S S . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3 9 FUNCTION F U N C T I O N INDEPENDENCE I N D E P E N D E N C E AND A N D ITEM I T E M DEVELOPMENT D E V E L O P M E N T INDEPENDENCE.......................................45 I N D E P E N D E N C E . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 5 DEVELOPMENT D E V E L O P M E N T DEPENDENCY D E P E N D E N C Y OF O F MULTIPLE M U L T I P L E FUNCTIONS F U N C T I O N S IN I N THE T H E SAME S A M E FC.................................48 F C . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 8 PROTECTION P R O T E C T I O N FUNCTION F U N C T I O N FOAL F O A L ASSIGNMENT A S S I G N M E N T AS A S A A FUNCTION F U N C T I O N OF O F PROBABILITY P R O B A B I L I T Y OF O F AN A N EXTERNAL E X T E R N A L EVENT....................................................................................................................... E V E N T . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51 5 1 VALIDATION V A L I D A T I O N PROCESS P R O C E S S MODEL.............................................................................................................56 M O D E L . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5 6 VERIFICATION V E R I F I C A T I O N PROCESS P R O C E S S MODEL.........................................................................................................67 M O D E L . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6 7 CONFIGURATION C O N F I G U R A T I O N MANAGEMENT M A N A G E M E N T PROCESS P R O C E S S MODEL..........................................................................73 M O D E L . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 3 DEVELOPMENT D E V E L O P M E N T PLANNING P L A N N I N G ELEMENTS................................................................................................19 E L E M E N T S . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 9 TOP-LEVEL T O P - L E V E L FUNCTION F U N C T I O N FOAL F O A L ASSIGNMENT........................................................................................40 A S S I G N M E N T . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 0 DEVELOPMENT D E V E L O P M E N T ASSURANCE A S S U R A N C E LEVEL L E V E L ASSIGNMENT A S S I G N M E N T TO T O MEMBERS M E M B E R S OF O F A A FUNCTIONAL F U N C T I O N A L FAILURE F A I L U R E SET................................................................................................................44 S E T . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 4 EXAMPLE E X A M P L E ASSURANCE A S S U R A N C E ASSIGNMENT A S S I G N M E N T FOR F O R DESIGN D E S I G N DEPENDENCY D E P E N D E N C Y OF O F MULTIPLE M U L T I P L E FUNCTIONS F U N C T I O N S SAME S A M E FC..........................................................................................................46 F C . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 6 EXAMPLE E X A M P L E ASSURANCE A S S U R A N C E ASSIGNMENT A S S I G N M E N T FOR F O R DESIGN D E S I G N DEPENDENCY D E P E N D E N C Y OF O F MULTIPLE M U L T I P L E FUNCTIONS F U N C T I O N S SAME S A M E FC..........................................................................................................49 F C . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4 9 REQUIREMENTS R E Q U I R E M E N T S VALIDATION V A L I D A T I O N METHODS M E T H O D S AND A N D DATA.........................................................................64 D A T A . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6 4 VERIFICATION V E R I F I C A T I O N METHODS M E T H O D S AND A N D DATA....................................................................................................70 D A T A . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 0 CM C M ACTIVITIES A C T I V I T I E S TO T O CONTROL C O N T R O L CATEGORY C A T E G O R Y MAPPING.........................................................................75 M A P P I N G . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 5 CERTIFICATION C E R T I F I C A T I O N DATA D A T A CROSS C R O S S REFERENCE.......................................................................................78 R E F E R E N C E . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 7 8 granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true} Downloaded D o w n l o a d e d from f r o m SAE S A E International I n t e r n a t i o n a l by b y David D a v i d Merrill, M e r r i l l , Saturday, S a t u r d a y , November N o v e m b e r 12, 1 2 , 2016 2 0 1 6 SAE S A E ARP4754A A R P 4 7 5 4 A Page P a g e 4 4 of o f 115 1 1 5 ACKNOWLEDGMENTS A C K N O W L E D G M E N T S The T h e leadership l e a d e r s h i p of o f the t h e S-18 S - 1 8 and a n d WG-63 W G - 6 3 Committees C o m m i t t e e s would w o u l d like l i k e to t o thank t h a n k the t h e actively a c t i v e l y contributing c o n t r i b u t i n g committee c o m m i t t e e members, m e m b e r s , and a n d their t h e i r sponsoring s p o n s o r i n g companies, c o m p a n i e s , for f o r the t h e time, t i m e , effort, e f f o r t , and a n d expense e x p e n s e expended e x p e n d e d during d u r i n g the t h e years y e a r s of o f development d e v e l o p m e n t of o f this t h i s document. d o c u m e n t . Without W i t h o u t the t h e experience, e x p e r i e n c e , cooperation c o o p e r a t i o n and a n d dedication d e d i c a t i o n of o f these t h e s e people, p e o p l e , development d e v e l o p m e n t of o f this t h i s document d o c u m e n t would w o u l d not n o t have h a v e been b e e n possible. p o s s i b l e . John J o h n Dalton, D a l t o n , Chair C h a i r S-18 S - 1 8 Eric E r i c M M Peterson, P e t e r s o n , Vice V i c e Chair C h a i r S-18 S - 1 8 Bob B o b Mattern, M a t t e r n , Secretary S e c r e t a r y S-18 S - 1 8 Fernanda F e r n a n d a Altoe A l t o e Steve S t e v e Beland B e l a n d Art A r t Beutler B e u t l e r Alessandro A l e s s a n d r o Landi L a n d i Arun A r u n Murthi M u r t h i Michael M i c h a e l Burkett B u r k e t t Alfred A l f r e d DuPlessis D u P l e s s i s Ervin E r v i n Dvorak D v o r a k Rachid R a c h i d Elkhatib E l k h a t i b Charlie C h a r l i e Falke F a l k e Steve S t e v e Fisher F i s h e r Dan D a n Fogarty F o g a r t y ndre n d r e Forni F o r n i Jean J e a n Gauthier G a u t h i e r Scot S c o t Griffith G r i f f i t h Nazan N a z a n GOrbOz G O r b O z Don D o n Heck H e c k Jean J e a n Pierre P i e r r e Heckmann H e c k m a n n Linh L i n h Le L e Doug D o u g Kemp K e m p Zdzislaw Z d z i s l a w Klim K l i m Hals H a l s Larsen L a r s e n Tom T o m Lewis L e w i s Liza L i z a Lyon L y o n Jim J i m Marko M a r k o Boeing B o e i n g Commercial C o m m e r c i a l Airplane A i r p l a n e Group G r o u p Electron E l e c t r o n International I n t e r n a t i o n a l II, I I , Inc. I n c . Pratt P r a t t & & Whitney W h i t n e y EMBRAER E M B R A E R Boeing B o e i n g Commercial C o m m e r c i a l Airplane A i r p l a n e Group G r o u p Honeywell H o n e y w e l l International, I n t e r n a t i o n a l , Inc. I n c . Airbus A i r b u s Aero A e r o & & Space S p a c e USA U S A Rolls R o l l s Royce R o y c e Omnicon O m n i c o n Group G r o u p FAA F A A Rockwell R o c k w e l l Collins, C o l l i n s , Inc. I n c . CFSS C F S S LLC L L C Rolls R o l l s Royce R o y c e Boeing B o e i n g Commercial C o m m e r c i a l Airplane A i r p l a n e Group G r o u p CTA-IFI C T A - I F I Dassault D a s s a u l t Aviation A v i a t i o n Honeywell H o n e y w e l l International, I n t e r n a t i o n a l , Inc. I n c . STM S T M Boeing B o e i n g Commercial C o m m e r c i a l Airplane A i r p l a n e Group G r o u p Airbus A i r b u s FAA F A A Rolls R o l l s Royce R o y c e Bombardier B o m b a r d i e r Aerospace A e r o s p a c e FAA F A A Lockheed L o c k h e e d Martin M a r t i n Messier-Dowty M e s s i e r - D o w t y Transport T r a n s p o r t Canada C a n a d a Fred F r e d Moon M o o n Warren W a r r e n Prasuhn P r a s u h n John J o h n Riege R i e g e Matt M a t t Sandnas S a n d n a s Tilak T i l a k Sharma S h a r m a Doug D o u g Sheridan S h e r i d a n Alvaro A l v a r o Tamayo T a m a y o Cengiz C e n g i z Tendoros T e n d o r o s lnder l n d e r Verma V e r m a Andy A n d y Wallington W a l l i n g t o n Nelson N e l s o n Wilmers W i l m e r s Steve S t e v e Wilson W i l s o n Ed E d Wineman W i n e m a n Charles C h a r l e s Zamora, Z a m o r a , Chair C h a i r WG-63 W G - 6 3 Mark M a r k Nicholson, N i c h o l s o n , Secretary S e c r e t a r y WG-63 W G - 6 3 Philippe P h i l i p p e Bernard B e r n a r d Alain A l a i n Cabasson C a b a s s o n Ray R a y Chase C h a s e Jean-Daniel J e a n - D a n i e l Chauvet C h a u v e t Jean-Luc J e a n - L u c Delamaide D e l a m a i d e Jonathan J o n a t h a n Hughes H u g h e s Yuriy Y u r i y Ivanov I v a n o v Anne-Cecile A n n e - C e c i l e Kerbrat K e r b r a t Paul P a u l O'Donovan O ' D o n o v a n Alan A l a n Perry P e r r y Marielle M a r i e l l e Roux R o u x Jiri J i r i Rybecky R y b e c k y Bell B e l l Helicopter H e l i c o p t e r Rockwell R o c k w e l l Collins, C o l l i n s , Inc. I n c . Woodward W o o d w a r d Govenor G o v e n o r Goodrich G o o d r i c h Boeing B o e i n g Commercial C o m m e r c i a l Airplane A i r p l a n e Group G r o u p Cessna C e s s n a Aircraft A i r c r a f t Co. C o . Thales T h a l e s Avionics A v i o n i c s Canada C a n a d a STM S T M Electron E l e c t r o n International I n t e r n a t i o n a l II, I I , Inc. I n c . GE G E Aviation A v i a t i o n ANAC A N A C Rockwell R o c k w e l l Collins, C o l l i n s , Inc. I n c . Gulfstream G u l f s t r e a m Airbus A i r b u s Univ. U n i v . of o f York Y o r k lntertechnique l n t e r t e c h n i q u e Dassault D a s s a u l t Aviation A v i a t i o n GE G E Aviation A v i a t i o n Thales T h a l e s EASA E A S A CAA, C A A , U.K. U . K . NIIAO N I I A O Aeroconseil A e r o c o n s e i l GE G E Aviation A v i a t i o n AEC A E C Rockwell R o c k w e l l Collins, C o l l i n s , FR F R Andrew A n d r e w Ward W a r d Airbus A i r b u s Deutschland D e u t s c h l a n d JOrg J O r g Wolfrum W o l f r u m Rolls-Royce R o l l s - R o y c e Diehl D i e h l Aerospace A e r o s p a c e granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true} Downloaded D o w n l o a d e d from f r o m SAE S A E International I n t e r n a t i o n a l by b y David D a v i d Merrill, M e r r i l l , Saturday, S a t u r d a y , November N o v e m b e r 12, 1 2 , 2016 2 0 1 6 SAE S A E ARP4754A A R P 4 7 5 4 A Page P a g e 5 5 of o f 115 1 1 5 1. 1 . SCOPE S C O P E This T h i s document d o c u m e n t discusses d i s c u s s e s the t h e development d e v e l o p m e n t of o f aircraft a i r c r a f t systems s y s t e m s taking t a k i n g into i n t o account a c c o u n t the t h e overall o v e r a l l aircraft a i r c r a f t operating o p e r a t i n g environment e n v i r o n m e n t and a n d functions. f u n c t i o n s . This T h i s includes i n c l u d e s validation v a l i d a t i o n of o f requirements r e q u i r e m e n t s and a n d verification v e r i f i c a t i o n of o f the t h e design d e s i g n implementation i m p l e m e n t a t i o n for f o r certification c e r t i f i c a t i o n and a n d product p r o d u c t assurance. a s s u r a n c e . It I t provides p r o v i d e s practices p r a c t i c e s for f o r showing s h o w i n g compliance c o m p l i a n c e with w i t h the t h e regulations r e g u l a t i o n s and a n d serves s e r v e s to t o assist a s s i s t a a company c o m p a n y in i n developing d e v e l o p i n g and a n d meeting m e e t i n g its i t s own o w n internal i n t e r n a l standards s t a n d a r d s by b y considering c o n s i d e r i n g the t h e guidelines g u i d e l i n e s herein. h e r e i n . The T h e guidelines g u i d e l i n e s in i n this t h i s document d o c u m e n t were w e r e developed d e v e l o p e d in i n the t h e context c o n t e x t of o f Title T i t l e 14 1 4 Code C o d e of o f Federal F e d e r a l Regulations R e g u l a t i o n s (14CFR) ( 1 4 C F R ) Part P a r t 25 2 5 and a n d European E u r o p e a n Aviation A v i a t i o n Safety S a f e t y Agency A g e n c y (EASA) ( E A S A ) Certification C e r t i f i c a t i o n Specification S p e c i f i c a t i o n (CS) ( C S ) CS-25. C S - 2 5 . It I t may m a y be b e applicable a p p l i c a b l e to t o other o t h e r regulations, r e g u l a t i o n s , such s u c h as a s Parts P a r t s 23, 2 3 , 27, 2 7 , 29, 2 9 , 33, 3 3 , and a n d 35 3 5 (CS-23, ( C S - 2 3 , CS-27, C S - 2 7 , CS-29, C S - 2 9 , CS-E, C S - E , CS-P). C S - P ) . This T h i s document d o c u m e n t addresses a d d r e s s e s the t h e development d e v e l o p m e n t cycle c y c l e for f o r aircraft a i r c r a f t and a n d systems s y s t e m s that t h a t implement i m p l e m e n t aircraft a i r c r a f t functions f u n c t i o n s . . It I t does d o e s not n o t include i n c l u d e specific s p e c i f i c coverage c o v e r a g e of o f detailed d e t a i l e d software s o f t w a r e or o r electronic e l e c t r o n i c hardware h a r d w a r e development, d e v e l o p m e n t , safety s a f e t y assessment a s s e s s m e n t processes, p r o c e s s e s , in i n service s e r v i c e safety s a f e t y activities, a c t i v i t i e s , aircraft a i r c r a f t structural s t r u c t u r a l development d e v e l o p m e n t nor n o r does d o e s it i t address a d d r e s s the t h e development d e v e l o p m e n t of o f the t h e Master M a s t e r Minimum M i n i m u m Equipment E q u i p m e n t List L i s t (MMEL) ( M M E L ) or o r Configuration C o n f i g u r a t i o n Deviation D e v i a t i o n List L i s t (CDL). ( C D L ) . More M o r e detailed d e t a i l e d coverage c o v e r a g e of o f the t h e software s o f t w a r e aspects a s p e c t s of o f development d e v e l o p m e n t are a r e found f o u n d in i n RTCA R T C A document d o c u m e n t D0-1788, D 0 - 1 7 8 8 , "Software " S o f t w a r e Considerations C o n s i d e r a t i o n s in i n Airborne A i r b o r n e Systems S y s t e m s and a n d Equipment E q u i p m e n t Certification" C e r t i f i c a t i o n " and a n d its i t s EUROCAE E U R O C A E counterpart, c o u n t e r p a r t , ED-128. E D - 1 2 8 . Coverage C o v e r a g e of o f electronic e l e c t r o n i c hardware h a r d w a r e aspects a s p e c t s of o f development d e v e l o p m e n t are a r e found f o u n d in i n RTCA R T C A document d o c u m e n t D0-254/EUROCAE D 0 - 2 5 4 / E U R O C A E ED-80, E D - 8 0 , "Design " D e s i g n Assurance A s s u r a n c e Guidance G u i d a n c e for f o r Airborne A i r b o r n e Electronic E l e c t r o n i c Hardware". H a r d w a r e " . Design D e s i g n guidance g u i d a n c e and a n d certification c e r t i f i c a t i o n considerations c o n s i d e r a t i o n s for f o r integrated i n t e g r a t e d modular m o d u l a r avionics a v i o n i c s are a r e found f o u n d in i n appropriate a p p r o p r i a t e RTCNEUROCAE R T C N E U R O C A E document d o c u m e n t D0-297/ED-124 D 0 - 2 9 7 / E D - 1 2 4 . . Methodologies M e t h o d o l o g i e s for f o r safety s a f e t y assessment a s s e s s m e n t processes p r o c e s s e s are a r e outlined o u t l i n e d in i n SAE S A E document d o c u m e n t ARP4761, A R P 4 7 6 1 , "Guidelines " G u i d e l i n e s and a n d Methods M e t h o d s for f o r Conducting C o n d u c t i n g the t h e Safety S a f e t y Assessment A s s e s s m e n t Process P r o c e s s on o n Civil C i v i l Airborne A i r b o r n e Systems S y s t e m s and a n d Equipment". E q u i p m e n t " . Details D e t a i l s for f o r in-service i n - s e r v i c e safety s a f e t y assessment a s s e s s m e n t are a r e found f o u n d in i n ARP5150, A R P 5 1 5 0 , "Safety " S a f e t y Assessment A s s e s s m e n t of o f Transport T r a n s p o r t Airplanes A i r p l a n e s In I n Commercial C o m m e r c i a l Service" S e r v i c e " and a n d ARP5151 A R P 5 1 5 1 Safety S a f e t y Assessment A s s e s s m e n t of o f General G e n e r a l Aviation A v i a t i o n Airplanes A i r p l a n e s and a n d Rotorcraft R o t o r c r a f t In I n Commercial C o m m e r c i a l Service." S e r v i c e . " Post-certification P o s t - c e r t i f i c a t i o n activities a c t i v i t i e s (modification ( m o d i f i c a t i o n to t o a a certificated c e r t i f i c a t e d product) p r o d u c t ) are a r e covered c o v e r e d in i n section s e c t i o n 6 6 of o f this t h i s document. d o c u m e n t . The T h e regulations r e g u l a t i o n s and a n d processes p r o c e s s e s used u s e d to t o develop d e v e l o p and a n d approve a p p r o v e the t h e MMEL M M E L vary v a r y throughout t h r o u g h o u t the t h e world. w o r l d . Guidance G u i d a n c e for f o r the t h e development d e v e l o p m e n t of o f the t h e MMEL M M E L should s h o u l d be b e sought s o u g h t from f r o m the t h e local l o c a l airworthiness a i r w o r t h i n e s s authority a u t h o r i t y . . Figure F i g u r e 1 1 outlines o u t l i n e s the t h e relationships r e l a t i o n s h i p s between b e t w e e n the t h e various v a r i o u s development d e v e l o p m e n t documents, d o c u m e n t s , which w h i c h provide p r o v i d e guidelines g u i d e l i n e s for f o r safety s a f e t y assessment, a s s e s s m e n t , electronic e l e c t r o n i c hardware h a r d w a r e and a n d software s o f t w a r e life-cycle l i f e - c y c l e processes p r o c e s s e s and a n d the t h e system s y s t e m development d e v e l o p m e n t process p r o c e s s described d e s c r i b e d herein. h e r e i n . granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true} Downloaded D o w n l o a d e d from f r o m SAE S A E International I n t e r n a t i o n a l by b y David D a v i d Merrill, M e r r i l l , Saturday, S a t u r d a y , November N o v e m b e r 12, 1 2 , 2016 2 0 1 6 SAE S A E ARP4754A A R P 4 7 5 4 A Page P a g e 6 6 of o f 115 1 1 5 Inte I n t e nde n d e d d Airc A i r c raft r a f t Fun F u n ctio c t i o n n Safety S a f e t y Assessment A s s e s s m e n t Process P r o c e s s Guidelines G u i d e l i n e s & & Methods M e t h o d s (ARP ( A R P 4761) 4 7 6 1 ) Safety S a f e t y Assessment A s s e s s m e n t of o f Aircraft A i r c r a f t in i n Commercial C o m m e r c i a l Service S e r v i c e (ARP ( A R P 5150 5 1 5 0 / / 5151) 5 1 5 1 ) Function, F u n c t i o n , System S y s t e m Failure F a i l u r e & & Safety S a f e t y Design D e s i g n Information I n f o r m a t i o n Information I n f o r m a t i o n Aircraft A i r c r a f t & & System S y s t e m Development D e v e l o p m e n t Processes P r o c e s s e s Functional F u n c t i o n a l (ARP ( A R P 4754 4 7 5 4 / / ED-79) E D - 7 9 ) System S y s t e m Operation O p e r a t i o n Guidelines G u i d e l i n e s for f o r Integrated I n t e g r a t e d Modular M o d u l a r Avionics A v i o n i c s (00-297/ED-124) ( 0 0 - 2 9 7 / E D - 1 2 4 ) Electronic E l e c t r o n i c Hardware H a r d w a r e Development D e v e l o p m e n t Life- L i f e - Cycle C y c l e (00-254 ( 0 0 - 2 5 4 I I ED- E D - Software S o f t w a r e Development D e v e l o p m e n t Life-Cycle L i f e - C y c l e (00-1788/ED-128) ( 0 0 - 1 7 8 8 / E D - 1 2 8 ) Development D e v e l o p m e n t Phase P h a s e In-Service/Operational I n - S e r v i c e / O p e r a t i o n a l Phase P h a s e FIGURE F I G U R E 1 1 - - GUIDELINE G U I D E L I N E DOCUMENTS D O C U M E N T S COVERING C O V E R I N G DEVELOPMENT D E V E L O P M E N T AND A N D IN-SERVICE/OPERATIONAL I N - S E R V I C E / O P E R A T I O N A L PHASES P H A S E S 1.1 1 . 1 Purpose P u r p o s e The T h e guidelines g u i d e l i n e s herein h e r e i n are a r e directed d i r e c t e d toward t o w a r d systems s y s t e m s that t h a t support s u p p o r t aircraft-level a i r c r a f t - l e v e l functions f u n c t i o n s and a n d have h a v e failure f a i l u r e modes m o d e s with w i t h the t h e potential p o t e n t i a l to t o affect a f f e c t the t h e safety s a f e t y of o f the t h e aircraft. a i r c r a f t . Typically, T y p i c a l l y , these t h e s e systems s y s t e m s involve i n v o l v e significant s i g n i f i c a n t interactions i n t e r a c t i o n s with w i t h other o t h e r systems s y s t e m s in i n a a larger l a r g e r integrated i n t e g r a t e d environment. e n v i r o n m e n t . Frequently, F r e q u e n t l y , significant s i g n i f i c a n t elements e l e m e n t s of o f these t h e s e systems s y s t e m s are a r e developed d e v e l o p e d by b y separate s e p a r a t e individuals, i n d i v i d u a l s , groups g r o u p s or o r organizations. o r g a n i z a t i o n s . These T h e s e systems s y s t e m s require r e q u i r e added a d d e d design d e s i g n discipline d i s c i p l i n e and a n d development d e v e l o p m e n t structure s t r u c t u r e to t o ensure e n s u r e that t h a t safety s a f e t y and a n d operational o p e r a t i o n a l requirements r e q u i r e m e n t s can c a n be b e fully f u l l y realized r e a l i z e d and a n d substantiated. s u b s t a n t i a t e d . A A top t o p down d o w n iterative i t e r a t i v e approach a p p r o a c h from f r o m aircraft a i r c r a f t level l e v e l downwards d o w n w a r d s is i s key k e y to t o initiating i n i t i a t i n g the t h e processes p r o c e s s e s outlined o u t l i n e d herein. h e r e i n . The T h e contents c o n t e n t s are a r e recommended r e c o m m e n d e d practices p r a c t i c e s and a n d should s h o u l d not n o t be b e construed c o n s t r u e d to t o be b e regulatory r e g u l a t o r y requirements. r e q u i r e m e n t s . For F o r this t h i s reason, r e a s o n , the t h e use u s e of o f words w o r d s such s u c h as a s "shall" " s h a l l " and a n d "must" " m u s t " is i s avoided a v o i d e d except e x c e p t if i f used u s e d in i n the t h e context c o n t e x t of o f an a n example. e x a m p l e . It I t is i s recognized r e c o g n i z e d that t h a t alternative a l t e r n a t i v e methods m e t h o d s to t o the t h e processes p r o c e s s e s described d e s c r i b e d or o r referenced r e f e r e n c e d in i n this t h i s document d o c u m e n t may m a y be b e available a v a i l a b l e to t o an a n organization o r g a n i z a t i o n desiring d e s i r i n g to t o obtain o b t a i n certification c e r t i f i c a t i o n . . This T h i s document d o c u m e n t provides p r o v i d e s neither n e i t h e r guidelines g u i d e l i n e s concerning c o n c e r n i n g the t h e structure s t r u c t u r e of o f an a n individual i n d i v i d u a l organization o r g a n i z a t i o n nor n o r how h o w the t h e granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true} Downloaded D o w n l o a d e d from f r o m SAE S A E International I n t e r n a t i o n a l by b y David D a v i d Merrill, M e r r i l l , Saturday, S a t u r d a y , November N o v e m b e r 12, 1 2 , 2016 2 0 1 6 responsibilities r e s p o n s i b i l i t i e s for f o r certification c e r t i f i c a t i o n activities a c t i v i t i e s are a r e divided. d i v i d e d . No N o such s u c h guidance g u i d a n c e should s h o u l d be b e inferred i n f e r r e d from f r o m the t h e descriptions d e s c r i p t i o n s provided. p r o v i d e d . granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true} Downloaded D o w n l o a d e d from f r o m SAE S A E International I n t e r n a t i o n a l by b y David D a v i d Merrill, M e r r i l l , Saturday, S a t u r d a y , November N o v e m b e r 12, 1 2 , 2016 2 0 1 6 SAE S A E ARP4754A A R P 4 7 5 4 A Page P a g e 7 7 of o f 115 1 1 5 1.2 1 . 2 Document D o c u m e n t Background: B a c k g r o u n d : During D u r i n g development d e v e l o p m e n t of o f Revision R e v i s i o n B B to t o RTCNEUROCAE R T C N E U R O C A E document d o c u m e n t D0-178/ED-12, D 0 - 1 7 8 / E D - 1 2 , it i t became b e c a m e apparent a p p a r e n t that t h a t system-level s y s t e m - l e v e l information i n f o r m a t i o n would w o u l d be b e required r e q u i r e d as a s input i n p u t to t o the t h e software s o f t w a r e development d e v e l o p m e n t process. p r o c e s s . Since S i n c e many m a n y system-level s y s t e m - l e v e l decisions d e c i s i o n s are a r e fundamental f u n d a m e n t a l to t o the t h e safety s a f e t y and a n d functional f u n c t i o n a l aspects a s p e c t s of o f aircraft a i r c r a f t systems, s y s t e m s , regulatory r e g u l a t o r y involvement i n v o l v e m e n t in i n the t h e processes p r o c e s s e s and a n d results r e s u l t s relating r e l a t i n g to t o such s u c h decisions d e c i s i o n s is i s both b o t h necessary n e c e s s a r y and a n d appropriate. a p p r o p r i a t e . This T h i s document d o c u m e n t was w a s originally o r i g i n a l l y developed d e v e l o p e d in i n response r e s p o n s e to t o a a request r e q u e s t from f r o m the t h e FAA F A A to t o SAE. S A E . The T h e FAA F A A requested r e q u e s t e d that t h a t SAE S A E define d e f i n e the t h e appropriate a p p r o p r i a t e nature n a t u r e and a n d scope s c o p e of o f system-level s y s t e m - l e v e l information i n f o r m a t i o n for f o r demonstrating d e m o n s t r a t i n g regulatory r e g u l a t o r y compliance c o m p l i a n c e for f o r highly h i g h l y integrated i n t e g r a t e d or o r complex c o m p l e x avionic a v i o n i c systems. s y s t e m s . The T h e Systems S y s t e m s Integration I n t e g r a t i o n Requirements R e q u i r e m e n t s Task T a s k group g r o u p (SIRT) ( S I R T ) was w a s formed f o r m e d to t o develop d e v e l o p an a n ARP A R P that t h a t would w o u l d address a d d r e s s this t h i s need. n e e d . The T h e initial i n i t i a l members m e m b e r s of o f SIRT S I R T recognized r e c o g n i z e d that t h a t harmonization h a r m o n i z a t i o n of o f international i n t e r n a t i o n a l understanding u n d e r s t a n d i n g in i n this t h i s undertaking u n d e r t a k i n g was w a s highly h i g h l y desirable d e s i r a b l e and a n d encouraged e n c o u r a g e d participation p a r t i c i p a t i o n by b y both b o t h Federal F e d e r a l Aviation A v i a t i o n Administration A d m i n i s t r a t i o n (FAA) ( F A A ) and a n d Joint J o i n t Aviation A v i a t i o n Authorities A u t h o r i t i e s (JAA) ( J A A ) representatives. r e p r e s e n t a t i v e s . A A companion c o m p a n i o n working w o r k i n g group g r o u p was w a s formed f o r m e d under u n d e r EUROCAE, E U R O C A E , WG-42, W G - 4 2 , to t o coordinate c o o r d i n a t e European E u r o p e a n input i n p u t to t o the t h e SIRT S I R T group. g r o u p . The T h e task t a s k group g r o u p included i n c l u d e d people p e o p l e with w i t h direct d i r e c t experience e x p e r i e n c e in i n design d e s i g n and a n d support s u p p o r t of o f large l a r g e commercial c o m m e r c i a l aircraft, a i r c r a f t , commuter c o m m u t e r aircraft, a i r c r a f t , commercial c o m m e r c i a l and a n d general g e n e r a l aviation a v i a t i o n avionics, a v i o n i c s , jet j e t engines, e n g i n e s , and a n d engine e n g i n e controls c o n t r o l s . . Regulatory R e g u l a t o r y personnel p e r s o n n e l with w i t h a a variety v a r i e t y of o f backgrounds b a c k g r o u n d s and a n d interests i n t e r e s t s participated p a r t i c i p a t e d in i n the t h e work w o r k of o f the t h e task t a s k group. g r o u p . Both B o t h formal f o r m a l and a n d informal i n f o r m a l links l i n k s with w i t h RTCA R T C A special s p e c i a l committees c o m m i t t e e s (SC-167 ( S C - 1 6 7 and a n d SC-180) S C - 1 8 0 ) and a n d SAE S A E committee c o m m i t t e e (S-18) ( S - 1 8 ) were w e r e established e s t a b l i s h e d and a n d maintained. m a i n t a i n e d . Communication C o m m u n i c a t i o n with w i t h the t h e harmonization h a r m o n i z a t i o n working w o r k i n g group g r o u p addressing a d d r e s s i n g 14CFR/CS 1 4 C F R / C S 25.1309 2 5 . 1 3 0 9 was w a s maintained m a i n t a i n e d throughout t h r o u g h o u t development d e v e l o p m e n t of o f this t h i s document. d o c u m e n t . Throughout T h r o u g h o u t development d e v e l o p m e n t of o f this t h i s document, d o c u m e n t , discussion d i s c u s s i o n returned r e t u r n e d repeatedly r e p e a t e d l y to t o the t h e issue i s s u e of o f guideline g u i d e l i n e specificity s p e c i f i c i t y . . Strong S t r o n g arguments a r g u m e n t s were w e r e presented p r e s e n t e d in i n favor f a v o r of o f providing p r o v i d i n g a a list l i s t of o f very v e r y specific s p e c i f i c certification c e r t i f i c a t i o n steps, s t e p s , i.e. i . e . a a checklist. c h e c k l i s t . Equally E q u a l l y strong s t r o n g arguments a r g u m e n t s were w e r e made m a d e that t h a t the t h e guidelines g u i d e l i n e s should s h o u l d focus f o c u s on o n fundamental f u n d a m e n t a l issues, i s s u e s , allowing a l l o w i n g the t h e applicant a p p l i c a n t and a n d the t h e certification c e r t i f i c a t i o n authority a u t h o r i t y to t o tailor t a i l o r details d e t a i l s to t o the t h e specific s p e c i f i c system. s y s t e m . It I t was w a s recognized r e c o g n i z e d that t h a t in i n either e i t h e r case c a s e certification c e r t i f i c a t i o n of o f all a l l but b u t the t h e most m o s t idealized i d e a l i z e d systems s y s t e m s would w o u l d require r e q u i r e significant s i g n i f i c a n t engineering e n g i n e e r i n g judgment j u d g m e n t by b y both b o t h parties p a r t i e s . . The T h e quality q u a l i t y of o f those t h o s e judgments j u d g m e n t s is i s served s e r v e d best b e s t by b y a a common c o m m o n understanding u n d e r s t a n d i n g of, o f , and a n d attention a t t e n t i o n to, t o , fundamental f u n d a m e n t a l principles. p r i n c i p l e s . The T h e decision d e c i s i o n to t o follow f o l l o w this t h i s course c o u r s e was w a s supported s u p p o r t e d by b y several s e v e r a l other o t h e r factors; f a c t o r s ; the t h e variety v a r i e t y of o f potential p o t e n t i a l systems s y s t e m s applications, a p p l i c a t i o n s , the t h e rapid r a p i d development d e v e l o p m e n t of o f systems s y s t e m s engineering, e n g i n e e r i n g , and a n d industry i n d u s t r y experience e x p e r i e n c e with w i t h the t h e evolving e v o l v i n g guidance g u i d a n c e contained c o n t a i n e d in i n D0- D 0 - 178, 1 7 8 , D0-178NED-12A D 0 - 1 7 8 N E D - 1 2 A and a n d D0- D 0 - 178B/ED-12B 1 7 8 B / E D - 1 2 B being b e i n g particularly p a r t i c u l a r l y significant. s i g n i f i c a n t . The T h e current c u r r e n t trend t r e n d in i n system s y s t e m design d e s i g n is i s an a n increasing i n c r e a s i n g level l e v e l of o f integration i n t e g r a t i o n between b e t w e e n aircraft a i r c r a f t functions f u n c t i o n s and a n d the t h e systems s y s t e m s that t h a t implement i m p l e m e n t them. t h e m . While W h i l e there t h e r e can c a n be b e considerable c o n s i d e r a b l e value v a l u e gained g a i n e d when w h e n integrating i n t e g r a t i n g systems s y s t e m s with w i t h other o t h e r systems, s y s t e m s , the t h e increased i n c r e a s e d complexity c o m p l e x i t y yields y i e l d s increased i n c r e a s e d possibilities p o s s i b i l i t i e s for f o r errors, e r r o r s , particularly p a r t i c u l a r l y with w i t h functions f u n c t i o n s that t h a t are a r e performed p e r f o r m e d jointly j o i n t l y across a c r o s s multiple m u l t i p l e systems. s y s t e m s . Following F o l l o w i n g the t h e Aviation A v i a t i o n Rulemaking R u l e m a k i n g Advisory A d v i s o r y Committee C o m m i t t e e (ARAC) ( A R A C ) recommendations r e c o m m e n d a t i o n s to t o respond r e s p o n d to t o this t h i s increased i n c r e a s e d integration i n t e g r a t i o n which w h i c h referenced r e f e r e n c e d ARP4754/ED-79 A R P 4 7 5 4 / E D - 7 9 in i n advisory a d v i s o r y materials m a t e r i a l s for f o r compliance c o m p l i a n c e to t o 14CFR/CS 1 4 C F R / C S 23.1309 2 3 . 1 3 0 9 (see ( s e e AC23.1309-1D, A C 2 3 . 1 3 0 9 - 1 D , issued i s s u e d in i n 2009) 2 0 0 9 ) and a n d 25.1309 2 5 . 1 3 0 9 (see ( s e e AMC A M C 25.1309, 2 5 . 1 3 0 9 , published p u b l i s h e d in i n 2003 2 0 0 3 and a n d AC25 A C 2 5 .1309-Arsenal . 1 3 0 9 - A r s e n a l draft) d r a f t ) the t h e use u s e of o f the t h e ARP4754/ED-79 A R P 4 7 5 4 / E D - 7 9 in i n aircraft a i r c r a f t certification c e r t i f i c a t i o n has h a s become b e c o m e increasingly i n c r e a s i n g l y widespread w i d e s p r e a d . . Along A l o n g with w i t h the t h e increasing i n c r e a s i n g use, u s e , in i n particular p a r t i c u l a r Section S e c t i o n 5.4 5 . 4 Assignment A s s i g n m e n t of o f Development D e v e l o p m e n t Assurance A s s u r a n c e Levels L e v e l s in i n the t h e original o r i g i n a l ARP4754, A R P 4 7 5 4 , come c o m e insights i n s i g h t s on o n the t h e strengths s t r e n g t h s and a n d weaknesses w e a k n e s s e s of o f its i t s guidelines g u i d e l i n e s . . The T h e underlying u n d e r l y i n g philosophy p h i l o s o p h y is i s succinctly s u c c i n c t l y represented r e p r e s e n t e d in i n the t h e original o r i g i n a l section s e c t i o n 5.4 5 . 4 of o f ARP4754 A R P 4 7 5 4 as a s follows: f o l l o w s : "If " I f the t h e PSSA P S S A shows s h o w s that t h a t the t h e system s y s t e m architecture a r c h i t e c t u r e provides p r o v i d e s containment c o n t a i n m e n t for f o r the t h e effects e f f e c t s of o f design d e s i g n errors, e r r o r s , so s o that t h a t the t h e aircraft a i r c r a f t /eve/ / e v e / effects e f f e c t s of o f such s u c h errors e r r o r s are a r e sufficiently s u f f i c i e n t l y benign, b e n i g n , the t h e development d e v e l o p m e n t assurance a s s u r a n c e activities a c t i v i t i e s can c a n be b e conducted c o n d u c t e d at a t a a reduced r e d u c e d level l e v e l of o f process p r o c e s s rigor r i g o r for f o r the t h e system s y s t e m items i t e m s wholly w h o l l y within w i t h i n the t h e architectural a r c h i t e c t u r a l containment c o n t a i n m e n t boundary." b o u n d a r y . " Experience E x p e r i e n c e has h a s shown s h o w n that t h a t the t h e processes p r o c e s s e s and a n d definitions d e f i n i t i o n s used u s e d to t o determine d e t e r m i n e containment c o n t a i n m e n t have h a v e yielded y i e l d e d different d i f f e r e n t interpretation i n t e r p r e t a t i o n and a n d application a p p l i c a t i o n of o f the t h e philosophy p h i l o s o p h y . . Improvement I m p r o v e m e n t to t o the t h e development d e v e l o p m e n t assurance a s s u r a n c e level l e v e l assignment a s s i g n m e n t process p r o c e s s is i s one o n e of o f the t h e main m a i n features f e a t u r e s of o f this t h i s revision r e v i s i o n by b y providing p r o v i d i n g a a methodology m e t h o d o l o g y to t o assign a s s i g n the t h e correct c o r r e c t development d e v e l o p m e n t assurance a s s u r a n c e levels. l e v e l s . When W h e n the t h e original o r i g i n a l ARP A R P 4754/ED-79 4 7 5 4 / E D - 7 9 was w a s published p u b l i s h e d in i n 1996, 1 9 9 6 , the t h e SIRT S I R T and a n d WG-42 W G - 4 2 groups g r o u p s were w e r e dissolved. d i s s o l v e d . When W h e n the t h e document d o c u m e n t came c a m e due d u e for f o r revision, r e v i s i o n , a a group g r o u p with w i t h sufficient s u f f i c i e n t expertise e x p e r t i s e at a t the t h e aircraft a i r c r a f t level l e v e l was w a s required r e q u i r e d to t o address a d d r e s s this t h i s work. w o r k . The T h e SAE S A E S-18 S - 1 8 Airplane A i r p l a n e Safety S a f e t y Committee C o m m i t t e e was w a s chosen c h o s e n because b e c a u s e of o f their t h e i r familiarity f a m i l i a r i t y with w i t h the t h e original o r i g i n a l document d o c u m e n t and a n d the t h e close c l o s e association a s s o c i a t i o n of o f the t h e documents d o c u m e n t s they t h e y develop d e v e l o p and a n d this t h i s ARP. A R P . Several S e v e r a l S-18 S - 1 8 committee c o m m i t t e e members m e m b e r s were w e r e on o n the t h e SIRT S I R T group g r o u p that t h a t developed d e v e l o p e d the t h e original o r i g i n a l ARP4754 A R P 4 7 5 4 document. d o c u m e n t . At A t the t h e same s a m e time, t i m e , EUROCAE E U R O C A E chartered c h a r t e r e d a a Working W o r k i n g Group G r o u p to t o update u p d a t e ED-79. E D - 7 9 . WG- W G - 63 6 3 incorporated i n c o r p o r a t e d members m e m b e r s from f r o m the t h e original o r i g i n a l WG-42 W G - 4 2 working w o r k i n g group, g r o u p , as a s well w e l l as a s representatives r e p r e s e n t a t i v e s from f r o m a a wide w i d e range r a n g e of o f industrial i n d u s t r i a l and a n d academic a c a d e m i c participants p a r t i c i p a n t s in i n the t h e European E u r o p e a n Aerospace A e r o s p a c e industry. i n d u s t r y . Keeping K e e p i n g to t o the t h e Memorandum M e m o r a n d u m of o f Understanding U n d e r s t a n d i n g for f o r this t h i s document, d o c u m e n t , WG-63 W G - 6 3 worked w o r k e d alongside a l o n g s i d e S-18 S - 1 8 to t o ensure e n s u r e that t h a t ED-79A E D - 7 9 A is i s word-for-word w o r d - f o r - w o r d equivalent e q u i v a l e n t to t o ARP4754A. A R P 4 7 5 4 A . granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true} Downloaded D o w n l o a d e d from f r o m SAE S A E International I n t e r n a t i o n a l by b y David D a v i d Merrill, M e r r i l l , Saturday, S a t u r d a y , November N o v e m b e r 12, 1 2 , 2016 2 0 1 6 SAE S A E ARP4754A A R P 4 7 5 4 A Page P a g e 8 8 of o f 115 1 1 5 Revision R e v i s i o n A A contains c o n t a i n s updates u p d a t e s to t o the t h e document d o c u m e n t that t h a t take t a k e into i n t o account a c c o u n t the t h e evolution e v o l u t i o n of o f the t h e industry i n d u s t r y over o v e r the t h e intervening i n t e r v e n i n g years. y e a r s . The T h e relationship r e l a t i o n s h i p between b e t w e e n ARP A R P 4754/ED-79 4 7 5 4 / E D - 7 9 and a n d ARP A R P 4761, 4 7 6 1 , and a n d their t h e i r relationship r e l a t i o n s h i p with w i t h D0-178B/ED-12B D 0 - 1 7 8 B / E D - 1 2 B and a n d D0- D 0 - 254/ED-80 2 5 4 / E D - 8 0 are a r e strengthened s t r e n g t h e n e d and a n d discrepancies d i s c r e p a n c i e s between b e t w e e n the t h e documents d o c u m e n t s are a r e identified i d e n t i f i e d and a n d addressed. a d d r e s s e d . Revision R e v i s i o n A A also a l s o expands e x p a n d s the t h e design d e s i g n assurance a s s u r a n c e concept c o n c e p t for f o r application a p p l i c a t i o n at a t the t h e aircraft a i r c r a f t and a n d system s y s t e m level l e v e l and a n d standardizes s t a n d a r d i z e s on o n the t h e use u s e of o f the t h e term t e r m development d e v e l o p m e n t assurance. a s s u r a n c e . As A s a a consequence, c o n s e q u e n c e , for f o r aircraft a i r c r a f t and a n d systems s y s t e m s Functional F u n c t i o n a l Development D e v e l o p m e n t Assurance A s s u r a n c e Level L e v e l (FOAL) ( F O A L ) is i s introduced i n t r o d u c e d and a n d the t h e term t e r m design d e s i g n assurance a s s u r a n c e level l e v e l has h a s been b e e n renamed r e n a m e d Item I t e m Development D e v e l o p m e n t Assurance A s s u r a n c e Level L e v e l (IDAL). ( I D A L ) . Also A l s o included i n c l u d e d are a r e enhancements e n h a n c e m e n t s created c r e a t e d by b y feedback f e e d b a c k from f r o m the t h e industry i n d u s t r y since s i n c e the t h e first f i r s t publication. p u b l i c a t i o n . In I n addition, a d d i t i o n , S-18 S - 1 8 I I WG- W G - 63 6 3 coordinated c o o r d i n a t e d this t h i s revision r e v i s i o n effort e f f o r t with w i t h RTCA R T C A Special S p e c i a l Committee C o m m i t t e e 205 2 0 5 (SC-205) ( S C - 2 0 5 ) I I EUROCAE E U R O C A E WG-71 W G - 7 1 to t o ensure e n s u r e that t h a t the t h e terminology t e r m i n o l o g y and a n d approach a p p r o a c h being b e i n g used u s e d are a r e consistent c o n s i s t e n t with w i t h those t h o s e being b e i n g developed d e v e l o p e d for f o r the t h e update u p d a t e to t o D0-1788 D 0 - 1 7 8 8 I I ED-128. E D - 1 2 8 . 2. 2 . REFERENCES R E F E R E N C E S 2.1 2 . 1 Applicable A p p l i c a b l e Documents D o c u m e n t s The T h e following f o l l o w i n g publications p u b l i c a t i o n s are a r e referenced r e f e r e n c e d in i n this t h i s guideline g u i d e l i n e document. d o c u m e n t . The T h e applicable a p p l i c a b l e issue i s s u e of o f referenced r e f e r e n c e d publications p u b l i c a t i o n s is i s the t h e revision r e v i s i o n noted n o t e d in i n this t h i s section. s e c t i o n . Where W h e r e later l a t e r versions v e r s i o n s of o f these t h e s e documents d o c u m e n t s are a r e available, a v a i l a b l e , applicants a p p l i c a n t s should s h o u l d check c h e c k their t h e i r applicability a p p l i c a b i l i t y . . Note N o t e that t h a t the t h e revision r e v i s i o n level l e v e l of o f references r e f e r e n c e s may m a y not n o t be b e noted n o t e d elsewhere e l s e w h e r e in i n the t h e document d o c u m e n t unless u n l e s s pertinent. p e r t i n e n t . 2.1.1 2 . 1 . 1 SAE S A E Publications P u b l i c a t i o n s Available A v a i l a b l e from f r o m SAE S A E International, I n t e r n a t i o n a l , 400 4 0 0 Commonwealth C o m m o n w e a l t h Drive, D r i v e , Warrendale, W a r r e n d a l e , PA P A 15096-0001, 1 5 0 9 6 - 0 0 0 1 , Tel: T e l : 877-606-7323 8 7 7 - 6 0 6 - 7 3 2 3 (inside ( i n s i d e USA U S A and a n d Canada) C a n a d a ) or o r 724-776-4970 7 2 4 - 7 7 6 - 4 9 7 0 (outside ( o u t s i d e USA), U S A ) , www.sae.org. w w w . s a e . o r g . ARP4761 A R P 4 7 6 1 Guidelines G u i d e l i n e s and a n d Methods M e t h o d s for f o r Conducting C o n d u c t i n g the t h e Safety S a f e t y Assessment A s s e s s m e n t Process P r o c e s s on o n Civil C i v i l Airborne A i r b o r n e Systems S y s t e m s ARP5150 A R P 5 1 5 0 Safety S a f e t y Assessment A s s e s s m e n t of o f Transport T r a n s p o r t Airplanes A i r p l a n e s In I n Commercial C o m m e r c i a l Service S e r v i c e ARP5151 A R P 5 1 5 1 Safety S a f e t y Assessment A s s e s s m e n t of o f General G e n e r a l Aviation A v i a t i o n Airplanes A i r p l a n e s and a n d Rotorcraft R o t o r c r a f t In I n Commercial C o m m e r c i a l Service S e r v i c e 2.1.2 2 . 1 . 2 FAA F A A Publications P u b l i c a t i o n s Available A v a i l a b l e from f r o m Federal F e d e r a l Aviation A v i a t i o n Administration, A d m i n i s t r a t i o n , 800 8 0 0 Independence I n d e p e n d e n c e Avenue, A v e n u e , SW, S W , Washington, W a s h i n g t o n , DC D C 20591, 2 0 5 9 1 , Tel: T e l : 866-835- 8 6 6 - 8 3 5 - 5322, 5 3 2 2 , www.faa w w w . f a a .gov. . g o v . 14CFR 1 4 C F R Part P a r t 21 2 1 Certification C e r t i f i c a t i o n Procedures P r o c e d u r e s for f o r Products P r o d u c t s and a n d Parts P a r t s 14CFR 1 4 C F R Part P a r t 23 2 3 Airworthiness A i r w o r t h i n e s s Standards: S t a n d a r d s : Normal, N o r m a l , Utility, U t i l i t y , Acrobatic A c r o b a t i c and a n d Commuter C o m m u t e r Category C a t e g o r y Airplanes A i r p l a n e s 14CFR 1 4 C F R Part P a r t 25 2 5 Airworthiness A i r w o r t h i n e s s Standards: S t a n d a r d s : Transport T r a n s p o r t Category C a t e g o r y Airplanes A i r p l a n e s 14CFR 1 4 C F R Part P a r t 27 2 7 Airworthiness A i r w o r t h i n e s s Standards: S t a n d a r d s : Normal N o r m a l Category C a t e g o r y Rotorcraft R o t o r c r a f t 14CFR 1 4 C F R Part P a r t 29 2 9 Airworthiness A i r w o r t h i n e s s Standards: S t a n d a r d s : Transport T r a n s p o r t Category C a t e g o r y Rotorcraft R o t o r c r a f t 14CFR 1 4 C F R Part P a r t 33 3 3 Airworthiness A i r w o r t h i n e s s Standards: S t a n d a r d s : Aircraft A i r c r a f t Engines E n g i n e s 14CFR 1 4 C F R Part P a r t 35 3 5 Airworthiness A i r w o r t h i n e s s Standards: S t a n d a r d s : Propellers P r o p e l l e r s AC A C 23.1309-1D 2 3 . 1 3 0 9 - 1 D System S y s t e m Safety S a f e t y Analysis A n a l y s i s And A n d Assessment A s s e s s m e n t For F o r Part P a r t 23 2 3 Airplanes A i r p l a n e s AC A C 25.19 2 5 . 1 9 Certification C e r t i f i c a t i o n Maintenance M a i n t e n a n c e Requirements R e q u i r e m e n t s AC A C 25.1309-1A 2 5 . 1 3 0 9 - 1 A System S y s t e m Design D e s i g n and a n d Analysis, A n a l y s i s , Advisory A d v i s o r y Circular C i r c u l a r granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true} Downloaded D o w n l o a d e d from f r o m SAE S A E International I n t e r n a t i o n a l by b y David D a v i d Merrill, M e r r i l l , Saturday, S a t u r d a y , November N o v e m b e r 12, 1 2 , 2016 2 0 1 6 SAE S A E ARP4754A A R P 4 7 5 4 A Page P a g e 9 9 of o f 115 1 1 5 2.1.3 2 . 1 . 3 EASA E A S A Publications P u b l i c a t i o n s Available A v a i l a b l e from f r o m European E u r o p e a n Aviation A v i a t i o n Safety S a f e t y Agency, A g e n c y , Otto O t t o Platz P l a t z 1, 1 , Postfach P o s t f a c h 101253, 1 0 1 2 5 3 , D-50452, D - 5 0 4 5 2 , Cologne, C o l o g n e , Germany, G e r m a n y , www.easa.eu.int. w w w . e a s a . e u . i n t . IR-21 I R - 2 1 CS-23 C S - 2 3 CS-25 C S - 2 5 CS-27 C S - 2 7 CS-29 C S - 2 9 CS-E C S - E CS-P C S - P AMC A M C 25.19 2 5 . 1 9 Certification C e r t i f i c a t i o n Procedures P r o c e d u r e s for f o r Aircraft, A i r c r a f t , and a n d Related R e l a t e d Products P r o d u c t s & & Parts P a r t s Certification C e r t i f i c a t i o n Specifications S p e c i f i c a t i o n s for f o r Normal, N o r m a l , Utility, U t i l i t y , Aerobatic, A e r o b a t i c , and a n d Commuter C o m m u t e r Category C a t e g o r y Aeroplanes A e r o p l a n e s Certification C e r t i f i c a t i o n Specifications S p e c i f i c a t i o n s for f o r Large L a r g e Aeroplanes A e r o p l a n e s Certification C e r t i f i c a t i o n Specifications S p e c i f i c a t i o n s for f o r Small S m a l l Rotorcraft R o t o r c r a f t Certification C e r t i f i c a t i o n Specifications S p e c i f i c a t i o n s for f o r Large L a r g e Rotorcraft R o t o r c r a f t Certification C e r t i f i c a t i o n Specifications S p e c i f i c a t i o n s for f o r Engines E n g i n e s Certification C e r t i f i c a t i o n Specifications S p e c i f i c a t i o n s for f o r Propellers P r o p e l l e r s Certification C e r t i f i c a t i o n Maintenance M a i n t e n a n c e Requirements R e q u i r e m e n t s AMC A M C 25.1309 2 5 . 1 3 0 9 Equipment, E q u i p m e n t , Systems S y s t e m s and a n d Installations I n s t a l l a t i o n s EASA E A S A Acceptable A c c e p t a b l e Means M e a n s of o f Compliance C o m p l i a n c e 2.1.4 2 . 1 . 4 RTCA R T C A Publications P u b l i c a t i o n s Available A v a i l a b l e from f r o m Radio R a d i o Technical T e c h n i c a l Commission C o m m i s s i o n for f o r Aeronautics A e r o n a u t i c s Inc., I n c . , 1828 1 8 2 8 L L Street, S t r e e t , NW, N W , Suite S u i t e 805, 8 0 5 , Washington, W a s h i n g t o n , DC D C 20036, 2 0 0 3 6 , Tel: T e l : 202-833-9339, 2 0 2 - 8 3 3 - 9 3 3 9 , www.rtca.org. w w w . r t c a . o r g . D0-178 D 0 - 1 7 8 D0-178A D 0 - 1 7 8 A D0-1788 D 0 - 1 7 8 8 D0-254 D 0 - 2 5 4 Software S o f t w a r e Considerations C o n s i d e r a t i o n s in i n Airborne A i r b o r n e Systems S y s t e m s and a n d Equipment E q u i p m e n t Certification C e r t i f i c a t i o n Software S o f t w a r e Considerations C o n s i d e r a t i o n s in i n Airborne A i r b o r n e Systems S y s t e m s and a n d Equipment E q u i p m e n t Certification C e r t i f i c a t i o n Software S o f t w a r e Considerations C o n s i d e r a t i o n s in i n Airborne A i r b o r n e Systems S y s t e m s and a n d Equipment E q u i p m e n t Certification C e r t i f i c a t i o n Design D e s i g n Assurance A s s u r a n c e Guidance G u i d a n c e for f o r Airborne A i r b o r n e Electronic E l e c t r o n i c Hardware. H a r d w a r e . D0-297 D 0 - 2 9 7 Integrated I n t e g r a t e d Modular M o d u l a r Avionics A v i o n i c s (IMA) ( I M A ) Development D e v e l o p m e n t Guidance G u i d a n c e and a n d Certification C e r t i f i c a t i o n Considerations C o n s i d e r a t i o n s 2.1.5 2 . 1 . 5 EUROCAE E U R O C A E Publications P u b l i c a t i o n s Available A v a i l a b l e from f r o m EUROCAE, E U R O C A E , 102 1 0 2 rue r u e Etienne E t i e n n e Dolet D o l e t 92240, 9 2 2 4 0 , Malakoff, M a l a k o f f , France. F r a n c e . ED-12A E D - 1 2 A Software S o f t w a r e Considerations C o n s i d e r a t i o n s in i n Airborne A i r b o r n e Systems S y s t e m s and a n d Equipment E q u i p m e n t Certification C e r t i f i c a t i o n ED-128 E D - 1 2 8 ED-80 E D - 8 0 ED-124 E D - 1 2 4 Software S o f t w a r e Considerations C o n s i d e r a t i o n s in i n Airborne A i r b o r n e Systems S y s t e m s and a n d Equipment E q u i p m e n t Certification C e r t i f i c a t i o n Design D e s i g n Assurance A s s u r a n c e Guidance G u i d a n c e for f o r Airborne A i r b o r n e Electronic E l e c t r o n i c Hardware. H a r d w a r e . Integrated I n t e g r a t e d Modular M o d u l a r Avionics A v i o n i c s (IMA) ( I M A ) Development D e v e l o p m e n t Guidance G u i d a n c e and a n d Certification C e r t i f i c a t i o n Considerations C o n s i d e r a t i o n s granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true} Downloaded D o w n l o a d e d from f r o m SAE S A E International I n t e r n a t i o n a l by b y David D a v i d Merrill, M e r r i l l , Saturday, S a t u r d a y , November N o v e m b e r 12, 1 2 , 2016 2 0 1 6 SAE S A E ARP4754A A R P 4 7 5 4 A Page P a g e 10 1 0 of o f 115 1 1 5 2.2 2 . 2 Definitions D e f i n i t i o n s This T h i s section s e c t i o n provides p r o v i d e s definitions d e f i n i t i o n s for f o r terms t e r m s used u s e d in i n this t h i s document. d o c u m e n t . Citations C i t a t i o n s are a r e provided p r o v i d e d to t o other o t h e r industry i n d u s t r y sources s o u r c e s when w h e n usage u s a g e in i n this t h i s document d o c u m e n t is i s consistent c o n s i s t e n t with w i t h the t h e definition d e f i n i t i o n in i n the t h e referenced r e f e r e n c e d source s o u r c e material. m a t e r i a l . ACCEPTANCE A C C E P T A N C E : : Acknowledgment A c k n o w l e d g m e n t by b y the t h e certification c e r t i f i c a t i o n authority a u t h o r i t y that t h a t a a submission s u b m i s s i o n of o f data, d a t a , argument, a r g u m e n t , or o r claim c l a i m of o f equivalence e q u i v a l e n c e satisfies s a t i s f i e s applicable a p p l i c a b l e requirements. r e q u i r e m e n t s . AGREEMENT A G R E E M E N T : : Acknowledgment A c k n o w l e d g m e n t by b y the t h e certification c e r t i f i c a t i o n authority a u t h o r i t y that t h a t a a plan p l a n or o r proposal p r o p o s a l relating r e l a t i n g to, t o , or o r supporting, s u p p o r t i n g , an a n application a p p l i c a t i o n for f o r approval a p p r o v a l of o f a a system s y s t e m or o r component, c o m p o n e n t , is i s an a n acceptable a c c e p t a b l e statement s t a t e m e n t of o f intent i n t e n t with w i t h respect r e s p e c t to t o applicable a p p l i c a b l e requirements. r e q u i r e m e n t s . AIRWORTHI A I R W O R T H I NESS: N E S S : The T h e condition c o n d i t i o n of o f an a n aircraft, a i r c r a f t , aircraft a i r c r a f t system, s y s t e m , or o r component c o m p o n e n t in i n which w h i c h it i t operates o p e r a t e s in i n a a safe s a f e manner m a n n e r to t o accomplish a c c o m p l i s h its i t s intended i n t e n d e d function f u n c t i o n . . ANALYSIS: A N A L Y S I S : An A n evaluation e v a l u a t i o n based b a s e d on o n decomposition d e c o m p o s i t i o n into i n t o simple s i m p l e elements. e l e m e n t s . APPROVAL: A P P R O V A L : The T h e act a c t of o f formal f o r m a l sanction s a n c t i o n of o f an a n implementation i m p l e m e n t a t i o n by b y a a certification c e r t i f i c a t i o n authority a u t h o r i t y . . APPROVED: A P P R O V E D : Accepted A c c e p t e d by b y the t h e certification c e r t i f i c a t i o n authority a u t h o r i t y as a s suitable s u i t a b l e for f o r a a particular p a r t i c u l a r purpose. p u r p o s e . (ICAO). ( I C A O ) . ASSESSMENT: A S S E S S M E N T : An A n evaluation e v a l u a t i o n based b a s e d upon u p o n engineering e n g i n e e r i n g judgment. j u d g m e n t . ASSUMPTIONS A S S U M P T I O N S : : Statements, S t a t e m e n t s , principles, p r i n c i p l e s , and/or a n d / o r premises p r e m i s e s offered o f f e r e d without w i t h o u t proof. p r o o f . ASSURANCE: A S S U R A N C E : The T h e planned p l a n n e d and a n d systematic s y s t e m a t i c actions a c t i o n s necessary n e c e s s a r y to t o provide p r o v i d e adequate a d e q u a t e confidence c o n f i d e n c e and a n d evidence e v i d e n c e that t h a t a a product p r o d u c t or o r process p r o c e s s satisfies s a t i s f i e s given g i v e n requirements. r e q u i r e m e n t s . (RTCA ( R T C A D0-1788 D 0 - 1 7 8 8 I I ED-128) E D - 1 2 8 ) AUTHORITY: A U T H O R I T Y : The T h e organization o r g a n i z a t i o n or o r person p e r s o n responsible r e s p o n s i b l e within w i t h i n the t h e State S t a t e (Country) ( C o u n t r y ) concerned c o n c e r n e d with w i t h the t h e certification c e r t i f i c a t i o n of o f compliance c o m p l i a n c e with w i t h applicable a p p l i c a b l e requirements. r e q u i r e m e n t s . AVAILABILITY: A V A I L A B I L I T Y : Qualitative Q u a l i t a t i v e or o r quantitative q u a n t i t a t i v e attribute a t t r i b u t e that t h a t a a system s y s t e m or o r item i t e m is i s in i n a a functioning f u n c t i o n i n g state s t a t e at a t a a given g i v e n point p o i n t in i n time. t i m e . It I t is i s sometimes s o m e t i m e s expressed e x p r e s s e d in i n terms t e r m s of o f the t h e probability p r o b a b i l i t y of o f the t h e system s y s t e m (item) ( i t e m ) not n o t providing p r o v i d i n g its i t s output(s) o u t p u t ( s ) (i.e. ( i . e . unavailability) u n a v a i l a b i l i t y ) . . CERTIFICATION: C E R T I F I C A T I O N : The T h e legal l e g a l recognition r e c o g n i t i o n that t h a t a a product, p r o d u c t , service, s e r v i c e , organization o r g a n i z a t i o n or o r person p e r s o n complies c o m p l i e s with w i t h the t h e applicable a p p l i c a b l e requirements. r e q u i r e m e n t s . Such S u c h certification c e r t i f i c a t i o n comprises c o m p r i s e s the t h e activity a c t i v i t y of o f technically t e c h n i c a l l y checking c h e c k i n g the t h e product, p r o d u c t , service, s e r v i c e , organization o r g a n i z a t i o n or o r person, p e r s o n , and a n d the t h e formal f o r m a l recognition r e c o g n i t i o n of o f compliance c o m p l i a n c e with w i t h the t h e applicable a p p l i c a b l e requirements r e q u i r e m e n t s by b y issue i s s u e of o f a a certificate, c e r t i f i c a t e , license, l i c e n s e , approval a p p r o v a l or o r other o t h e r document d o c u m e n t as a s required r e q u i r e d by b y national n a t i o n a l laws l a w s and a n d procedures. p r o c e d u r e s . CERTIFICATION C E R T I F I C A T I O N AUTHORITY: A U T H O R I T Y : Organization O r g a n i z a t i o n or o r person p e r s o n responsible r e s p o n s i b l e for f o r granting g r a n t i n g approval a p p r o v a l in i n accordance a c c o r d a n c e with w i t h applicable a p p l i c a b l e regulations. r e g u l a t i o n s . CLASSIFICATION C L A S S I F I C A T I O N (FAILURE ( F A I L U R E CONDITION): C O N D I T I O N ) : A A discrete d i s c r e t e scale s c a l e allowing a l l o w i n g categorization c a t e g o r i z a t i o n of o f the t h e severity s e v e r i t y of o f the t h e effects e f f e c t s of o f a a failure f a i l u r e condition. c o n d i t i o n . The T h e classification c l a s s i f i c a t i o n levels l e v e l s are a r e defined d e f i n e d in i n the t h e appropriate a p p r o p r i a t e CFR/CS C F R / C S advisory a d v i s o r y material m a t e r i a l (section ( s e c t i o n 1309): 1 3 0 9 ) : Catastrophic, C a t a s t r o p h i c , Hazardous/Severe-Major, H a z a r d o u s / S e v e r e - M a j o r , Major, M a j o r , Minor, M i n o r , or o r No N o Safety S a f e t y Effect. E f f e c t . COMMON C O M M O N CAUSE C A U S E ANALYSIS: A N A L Y S I S : Generic G e n e r i c term t e r m encompassing e n c o m p a s s i n g zonal z o n a l safety s a f e t y analysis, a n a l y s i s , particular p a r t i c u l a r risk r i s k analysis, a n a l y s i s , and a n d common c o m m o n mode m o d e analysis. a n a l y s i s . Common C o m m o n Mode M o d e Analysis: A n a l y s i s : An A n analysis a n a l y s i s performed p e r f o r m e d to t o verify v e r i f y that t h a t failure f a i l u r e events e v e n t s identified i d e n t i f i e d in i n the t h e ASA/SSA A S A / S S A are a r e independent i n d e p e n d e n t in i n the t h e actual a c t u a l implementation i m p l e m e n t a t i o n . . COMMON C O M M O N MODE M O D E ERROR: E R R O R : An A n error e r r o r which w h i c h affects a f f e c t s a a number n u m b e r of o f elements e l e m e n t s otherwise o t h e r w i s e considered c o n s i d e r e d to t o be b e independent. i n d e p e n d e n t . COMPLEXITY: C O M P L E X I T Y : An A n attribute a t t r i b u t e of o f functions, f u n c t i o n s , systems s y s t e m s or o r items, i t e m s , which w h i c h makes m a k e s their t h e i r operation, o p e r a t i o n , failure f a i l u r e modes, m o d e s , or o r failure f a i l u r e effects e f f e c t s difficult d i f f i c u l t to t o comprehend c o m p r e h e n d without w i t h o u t the t h e aid a i d of o f analytical a n a l y t i c a l methods. m e t h o d s . granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true} Downloaded D o w n l o a d e d from f r o m SAE S A E International I n t e r n a t i o n a l by b y David D a v i d Merrill, M e r r i l l , Saturday, S a t u r d a y , November N o v e m b e r 12, 1 2 , 2016 2 0 1 6 SAE S A E ARP4754A A R P 4 7 5 4 A Page P a g e 11 1 1 of o f 115 1 1 5 COMPLIANCE: C O M P L I A N C E : Successful S u c c e s s f u l performance p e r f o r m a n c e of o f all a l l mandatory m a n d a t o r y activities; a c t i v i t i e s ; agreement a g r e e m e n t between b e t w e e n the t h e expected e x p e c t e d or o r specified s p e c i f i e d result r e s u l t and a n d the t h e actual a c t u a l result. r e s u l t . COMPONENT C O M P O N E N T : : Any A n y self-contained s e l f - c o n t a i n e d part, p a r t , combination c o m b i n a t i o n of o f parts, p a r t s , subassemblies s u b a s s e m b l i e s or o r units, u n i t s , that t h a t perform p e r f o r m a a distinctive d i s t i n c t i v e function f u n c t i o n necessary n e c e s s a r y to t o the t h e operation o p e r a t i o n of o f the t h e system. s y s t e m . CONFIGURATION C O N F I G U R A T I O N BASELINE: B A S E L I N E : A A known k n o w n aircraft/ a i r c r a f t / system s y s t e m /item / i t e m configuration c o n f i g u r a t i o n against a g a i n s t which w h i c h a a change c h a n g e process p r o c e s s can c a n be b e undertaken. u n d e r t a k e n . CONFIGURATION C O N F I G U R A T I O N ITEM: I T E M : Aircraft, A i r c r a f t , system, s y s t e m , item i t e m and a n d related r e l a t e d data d a t a that t h a t is i s under u n d e r configuration c o n f i g u r a t i o n control. c o n t r o l . CONFORMANCE: C O N F O R M A N C E : Established E s t a b l i s h e d as a s correct c o r r e c t with w i t h reference r e f e r e n c e to t o a a standard, s t a n d a r d , specification s p e c i f i c a t i o n or o r drawing. d r a w i n g . DEMONSTRATION: D E M O N S T R A T I O N : A A method m e t h o d of o f proof p r o o f of o f performance p e r f o r m a n c e by b y observation o b s e r v a t i o n . . DERIVED D E R I V E D REQUIREMENTS: R E Q U I R E M E N T S : Additional A d d i t i o n a l requirements r e q u i r e m e n t s resulting r e s u l t i n g from f r o m design d e s i g n or o r implementation i m p l e m e n t a t i o n decisions d e c i s i o n s during d u r i n g the t h e development d e v e l o p m e n t process p r o c e s s which w h i c h are a r e not n o t directly d i r e c t l y traceable t r a c e a b l e to t o higher-level h i g h e r - l e v e l requirements. r e q u i r e m e n t s . DEVELOPMENT D E V E L O P M E N T ASSURANCE: A S S U R A N C E : All A l l of o f those t h o s e planned p l a n n e d and a n d systematic s y s t e m a t i c actions a c t i o n s used u s e d to t o substantiate, s u b s t a n t i a t e , at a t an a n adequate a d e q u a t e level l e v e l of o f confidence, c o n f i d e n c e , that t h a t errors e r r o r s in i n requirements, r e q u i r e m e n t s , design d e s i g n and a n d implementation i m p l e m e n t a t i o n have h a v e been b e e n identified i d e n t i f i e d and a n d corrected c o r r e c t e d such s u c h that t h a t the t h e system s y s t e m satisfies s a t i s f i e s the t h e applicable a p p l i c a b l e certification c e r t i f i c a t i o n basis. b a s i s . (AMC ( A M C 25). 2 5 ) . DEVELOPMENT D E V E L O P M E N T ERROR: E R R O R : A A mistake m i s t a k e in i n requirements r e q u i r e m e n t s determination, d e t e r m i n a t i o n , design d e s i g n or o r implementation i m p l e m e n t a t i o n . . ERROR: E R R O R : An A n omitted o m i t t e d or o r incorrect i n c o r r e c t action a c t i o n by b y a a crewmember c r e w m e m b e r or o r maintenance m a i n t e n a n c e person, p e r s o n , or o r a a mistake m i s t a k e in i n requirements, r e q u i r e m e n t s , design, d e s i g n , or o r implementation i m p l e m e n t a t i o n (derived ( d e r i v e d from f r o m AMC A M C 25.1309). 2 5 . 1 3 0 9 ) . EXTERNAL E X T E R N A L EVENT: E V E N T : An A n occurrence o c c u r r e n c e which w h i c h has h a s its i t s origin o r i g i n distinct d i s t i n c t from f r o m the t h e aircraft a i r c r a f t or o r the t h e system s y s t e m being b e i n g examined, e x a m i n e d , such s u c h as a s atmospheric a t m o s p h e r i c conditions c o n d i t i o n s (e.g., ( e . g . , wind w i n d gusts/shear, g u s t s / s h e a r , temperature t e m p e r a t u r e variations, v a r i a t i o n s , icing, i c i n g , lightning l i g h t n i n g strikes), s t r i k e s ) , operating o p e r a t i n g environment e n v i r o n m e n t (e.g. ( e . g . runway r u n w a y conditions, c o n d i t i o n s , conditions c o n d i t i o n s of o f communication, c o m m u n i c a t i o n , navigation, n a v i g a t i o n , and a n d surveillance s u r v e i l l a n c e services),, s e r v i c e s ) , , cabin c a b i n and a n d baggage b a g g a g e fires, f i r e s , and a n d bird-strike. b i r d - s t r i k e . The T h e term t e r m is i s not n o t intended i n t e n d e d to t o cover c o v e r sabotage. s a b o t a g e . FAILURE: F A I L U R E : An A n occurrence o c c u r r e n c e which w h i c h affects a f f e c t s the t h e operation o p e r a t i o n of o f a a component, c o m p o n e n t , part p a r t or o r element e l e m e n t such s u c h that t h a t it i t can c a n no n o longer l o n g e r function f u n c t i o n as a s intended, i n t e n d e d , (this ( t h i s includes i n c l u d e s both b o t h loss l o s s of o f function f u n c t i o n and a n d malfunction) m a l f u n c t i o n ) . . Note: N o t e : errors e r r o r s may m a y cause c a u s e Failures, F a i l u r e s , but b u t are a r e not n o t considered c o n s i d e r e d to t o be b e Failures. F a i l u r e s . (AMC ( A M C 25.1309) 2 5 . 1 3 0 9 ) FAILURE F A I L U R E CONDITION: C O N D I T I O N : A A condition c o n d i t i o n having h a v i n g an a n effect e f f e c t on o n the t h e aircraft a i r c r a f t and/or a n d / o r its i t s occupants, o c c u p a n t s , either e i t h e r direct d i r e c t or o r consequential, c o n s e q u e n t i a l , which w h i c h is i s caused c a u s e d or o r contributed c o n t r i b u t e d to t o by b y one o n e or o r more m o r e failures f a i l u r e s or o r errors, e r r o r s , considering c o n s i d e r i n g flight f l i g h t phase p h a s e and a n d relevant r e l e v a n t adverse a d v e r s e operational o p e r a t i o n a l or o r environmental e n v i r o n m e n t a l conditions c o n d i t i o n s or o r external e x t e r n a l events e v e n t s (AMC ( A M C 25.1309). 2 5 . 1 3 0 9 ) . FAILURE F A I L U R E EFFECT: E F F E C T : A A description d e s c r i p t i o n of o f the t h e operation o p e r a t i o n of o f a a system s y s t e m or o r item i t e m as a s the t h e result r e s u l t of o f a a failure; f a i l u r e ; i.e., i . e . , the t h e consequence(s) c o n s e q u e n c e ( s ) a a failure f a i l u r e mode m o d e has h a s on o n the t h e operation, o p e r a t i o n , function f u n c t i o n or o r status s t a t u s of o f a a system s y s t e m or o r an a n item. i t e m . FAILURE F A I L U R E MODE: M O D E : The T h e way w a y in i n which w h i c h the t h e failure f a i l u r e of o f a a system s y s t e m or o r item i t e m occurs. o c c u r s . FAILURE F A I L U R E RATE: R A T E : The T h e gradient g r a d i e n t of o f the t h e failure f a i l u r e distribution d i s t r i b u t i o n function f u n c t i o n divided d i v i d e d by b y the t h e reliability r e l i a b i l i t y distribution d i s t r i b u t i o n function f u n c t i o n at a t time t i m e t. t . ii(t) i i ( t ) = = F'(t)/(1-F(t)) F ' ( t ) / ( 1 - F ( t ) ) FAULT: F A U L T : A A manifestation m a n i f e s t a t i o n of o f an a n error e r r o r in i n an a n item i t e m or o r system s y s t e m that t h a t may m a y lead l e a d to t o a a failure. f a i l u r e . FUNCTION: F U N C T I O N : Intended I n t e n d e d behavior b e h a v i o r of o f a a product p r o d u c t based b a s e d on o n a a defined d e f i n e d set s e t of o f requirements r e q u i r e m e n t s regardless r e g a r d l e s s of o f implementation i m p l e m e n t a t i o n . . FUNCTION F U N C T I O N Development D e v e l o p m e n t Assurance A s s u r a n c e Level: L e v e l : The T h e level l e v e l of o f rigor r i g o r of o f development d e v e l o p m e n t assurance a s s u r a n c e tasks t a s k s performed p e r f o r m e d to t o Functions. F u n c t i o n s . [Note: [ N o t e : The T h e FOAL F O A L is i s used u s e d to t o identify i d e n t i f y the t h e ARP4754 A R P 4 7 5 4 /ED-79 / E D - 7 9 objectives o b j e c t i v e s that t h a t need n e e d to t o be b e satisfied s a t i s f i e d for f o r the t h e aircraft/system a i r c r a f t / s y s t e m functions] f u n c t i o n s ] . . FUNCTIONAL F U N C T I O N A L FAILURE F A I L U R E SET: S E T : A A single s i n g l e Member M e m b e r or o r a a specific s p e c i f i c group g r o u p of o f Members M e m b e r s that t h a t are a r e considered c o n s i d e r e d to t o be b e independent i n d e p e n d e n t from f r o m one o n e another a n o t h e r (not ( n o t necessarily n e c e s s a r i l y limited l i m i t e d to t o one o n e system) s y s t e m ) that t h a t lead(s) l e a d ( s ) to t o a a top t o p level l e v e l Failure F a i l u r e Condition. C o n d i t i o n . granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true} Downloaded D o w n l o a d e d from f r o m SAE S A E International I n t e r n a t i o n a l by b y David D a v i d Merrill, M e r r i l l , Saturday, S a t u r d a y , November N o v e m b e r 12, 1 2 , 2016 2 0 1 6 SAE S A E ARP4754A A R P 4 7 5 4 A Page P a g e 12 1 2 of o f 115 1 1 5 FUNCTIONAL F U N C T I O N A L HAZARD H A Z A R D ASSESSMENT A S S E S S M E N T : : A A systematic, s y s t e m a t i c , comprehensive c o m p r e h e n s i v e examination e x a m i n a t i o n of o f functions f u n c t i o n s to t o identify i d e n t i f y and a n d classify c l a s s i f y Failure F a i l u r e Conditions C o n d i t i o n s of o f those t h o s e functions f u n c t i o n s according a c c o r d i n g to t o their t h e i r severity s e v e r i t y . . FUNCTIONAL F U N C T I O N A L INDEPENDENCE I N D E P E N D E N C E : : An A n attribute a t t r i b u t e where w h e r e the t h e Functions F u n c t i o n s are a r e different d i f f e r e n t in i n order o r d e r to t o minimize m i n i m i z e the t h e likelihood l i k e l i h o o d of o f a a common c o m m o n requirement r e q u i r e m e n t error. e r r o r . GUIDANCE G U I D A N C E : : Recommended R e c o m m e n d e d procedure p r o c e d u r e for f o r complying c o m p l y i n g with w i t h regulations. r e g u l a t i o n s . GUIDELINE: G U I D E L I N E : Supporting S u p p o r t i n g information i n f o r m a t i o n that t h a t can c a n be b e helpful h e l p f u l but b u t is i s not n o t considered c o n s i d e r e d to t o be b e guidance. g u i d a n c e . HARDWARE: H A R D W A R E : An A n item i t e m that t h a t has h a s physical p h y s i c a l being. b e i n g . HAZARD: H A Z A R D : A A condition c o n d i t i o n resulting r e s u l t i n g from f r o m failures, f a i l u r e s , external e x t e r n a l events, e v e n t s , errors, e r r o r s , or o r combinations c o m b i n a t i o n s thereof t h e r e o f where w h e r e safety s a f e t y is i s affected. a f f e c t e d . IMPLEMENTATION: I M P L E M E N T A T I O N : The T h e act a c t of o f creating c r e a t i n g a a physical p h y s i c a l reality r e a l i t y from f r o m a a specification s p e c i f i c a t i o n . . INDEPENDENCE: I N D E P E N D E N C E : 1. 1 . A A concept c o n c e p t that t h a t minimizes m i n i m i z e s the t h e likelihood l i k e l i h o o d of o f common c o m m o n mode m o d e errors e r r o r s and a n d cascade c a s c a d e failures f a i l u r e s between b e t w e e n aircrafVsystem a i r c r a f V s y s t e m functions f u n c t i o n s or o r items, i t e m s , 2. 2 . Separation S e p a r a t i o n of o f responsibilities r e s p o n s i b i l i t i e s that t h a t assures a s s u r e s the t h e accomplishment a c c o m p l i s h m e n t of o f objective o b j e c t i v e evaluation e v a l u a t i o n e.g. e . g . validation v a l i d a t i o n activities a c t i v i t i e s not n o t performed p e r f o r m e d solely s o l e l y by b y the t h e developer d e v e l o p e r of o f the t h e requirement r e q u i r e m e n t of o f a a system s y s t e m or o r item. i t e m . INSPECTION: I N S P E C T I O N : An A n examination e x a m i n a t i o n of o f a a system s y s t e m or o r item i t e m against a g a i n s t a a specific s p e c i f i c standard. s t a n d a r d . INTEGRATION: I N T E G R A T I O N : 1. 1 . The T h e act a c t of o f causing c a u s i n g elements e l e m e n t s of o f a a system s y s t e m I I item i t e m to t o function f u n c t i o n together. t o g e t h e r . 2. 2 . The T h e act a c t of o f gathering g a t h e r i n g a a number n u m b e r of o f separate s e p a r a t e functions f u n c t i o n s within w i t h i n a a single s i n g l e implementation i m p l e m e n t a t i o n . . INTEGRITY: I N T E G R I T Y : Qualitative Q u a l i t a t i v e or o r quantitative q u a n t i t a t i v e attribute a t t r i b u t e of o f a a system s y s t e m or o r an a n item i t e m indicating i n d i c a t i n g that t h a t it i t can c a n be b e relied r e l i e d upon u p o n to t o work w o r k correctly. c o r r e c t l y . It I t is i s sometimes s o m e t i m e s expressed e x p r e s s e d in i n terms t e r m s of o f the t h e probability p r o b a b i l i t y of o f not n o t meeting m e e t i n g the t h e work w o r k correctly c o r r e c t l y criteria. c r i t e r i a . INTERCHANGEABILITY I N T E R C H A N G E A B I L I T Y : : The T h e ability a b i l i t y to t o substitute s u b s t i t u t e one o n e part p a r t for f o r another a n o t h e r within w i t h i n a a system s y s t e m and a n d have h a v e the t h e system s y s t e m perform p e r f o r m to t o its i t s specification s p e c i f i c a t i o n . . ITEM: I T E M : A A hardware h a r d w a r e or o r software s o f t w a r e element e l e m e n t having h a v i n g bounded b o u n d e d and a n d well-defined w e l l - d e f i n e d interfaces. i n t e r f a c e s . ITEM I T E M DEVELOPMENT D E V E L O P M E N T ASSURANCE: A S S U R A N C E : All A l l of o f those t h o s e planned p l a n n e d and a n d systematic s y s t e m a t i c tasks t a s k s used u s e d to t o substantiate, s u b s t a n t i a t e , to t o an a n adequate a d e q u a t e level l e v e l of o f confidence, c o n f i d e n c e , that t h a t development d e v e l o p m e n t errors e r r o r s have h a v e been b e e n identified i d e n t i f i e d and a n d corrected c o r r e c t e d such s u c h that t h a t the t h e items i t e m s satisfy s a t i s f y a a defined d e f i n e d set s e t of o f requirements. r e q u i r e m e n t s . ITEM I T E M DEVELOPMENT D E V E L O P M E N T Assurance A s s u r a n c e Level L e v e l (IDAL): ( I D A L ) : The T h e level l e v e l of o f rigor r i g o r of o f development d e v e l o p m e n t assurance a s s u r a n c e tasks t a s k s performed p e r f o r m e d on o n ltem(s). l t e m ( s ) . [e.g. [ e . g . IDAL I D A L is i s the t h e appropriate a p p r o p r i a t e Software S o f t w a r e Level L e v e l in i n D0-178B/ED-12B, D 0 - 1 7 8 B / E D - 1 2 B , and a n d design d e s i g n assurance a s s u r a n c e level l e v e l in i n D0-254/ED-80 D 0 - 2 5 4 / E D - 8 0 objectives o b j e c t i v e s that t h a t need n e e d to t o be b e satisfied s a t i s f i e d for f o r an a n item]. i t e m ] . ITEM I T E M DEVELOPMENT D E V E L O P M E N T INDEPENDENCE I N D E P E N D E N C E - - An A n attribute a t t r i b u t e that t h a t minimizes m i n i m i z e s the t h e likelihood l i k e l i h o o d of o f a a common c o m m o n mode m o d e error e r r o r in i n the t h e item i t e m development d e v e l o p m e n t process. p r o c e s s . MEAN M E A N TIME T I M E BETWEEN B E T W E E N FAILURES F A I L U R E S (MTBF): ( M T B F ) : Mathematical M a t h e m a t i c a l expectation e x p e c t a t i o n of o f the t h e time t i m e interval i n t e r v a l between b e t w e e n two t w o consecutive c o n s e c u t i v e failures f a i l u r e s of o f a a hardware h a r d w a r e item. i t e m . NOTE: N O T E : The T h e definition d e f i n i t i o n of o f this t h i s statistic s t a t i s t i c has h a s meaning m e a n i n g only o n l y for f o r repairable r e p a i r a b l e items. i t e m s . For F o r non n o n repairable r e p a i r a b l e items, i t e m s , the t h e term t e r m Mean M e a n Time T i m e To T o Failure F a i l u r e (MTTF) ( M T T F ) is i s used. u s e d . MEMBER: M E M B E R : An A n aircrafVsystem a i r c r a f V s y s t e m function f u n c t i o n or o r item i t e m that t h a t may m a y contain c o n t a i n an a n error e r r o r causing c a u s i n g its i t s loss l o s s or o r anomalous a n o m a l o u s behavior. b e h a v i o r . [This [ T h i s definition d e f i n i t i o n is i s limited l i m i t e d to t o the t h e Functional F u n c t i o n a l Failure F a i l u r e Set S e t application a p p l i c a t i o n herein.] h e r e i n . ] MODEL: M O D E L : An A n abstract a b s t r a c t representation r e p r e s e n t a t i o n of o f a a given g i v e n set s e t of o f aspects a s p e c t s of o f a a system/function/item s y s t e m / f u n c t i o n / i t e m that t h a t is i s used u s e d for f o r analysis, a n a l y s i s , simulation s i m u l a t i o n and/or a n d / o r code c o d e generation g e n e r a t i o n and a n d that t h a t has h a s an a n unambiguous, u n a m b i g u o u s , well w e l l defined d e f i n e d syntax s y n t a x and a n d semantics. s e m a n t i c s . MODELING M O D E L I N G TECHNIQUE: T E C H N I Q U E : The T h e approach a p p r o a c h used u s e d to t o model m o d e l a a given g i v e n aspect a s p e c t of o f a a system/function/item s y s t e m / f u n c t i o n / i t e m . . granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true} Downloaded D o w n l o a d e d from f r o m SAE S A E International I n t e r n a t i o n a l by b y David D a v i d Merrill, M e r r i l l , Saturday, S a t u r d a y , November N o v e m b e r 12, 1 2 , 2016 2 0 1 6 SAE S A E ARP4754A A R P 4 7 5 4 A Page P a g e 13 1 3 of o f 115 1 1 5 PARTICULAR P A R T I C U L A R RISKS: R I S K S : Particular P a r t i c u l a r risks r i s k s are a r e defined d e f i n e d as a s those t h o s e events e v e n t s or o r influences i n f l u e n c e s which w h i c h are a r e external e x t e r n a l to t o the t h e aircraft a i r c r a f t or o r within w i t h i n the t h e aircraft a i r c r a f t but b u t external e x t e r n a l to t o the t h e system(s) s y s t e m ( s ) and a n d item(s) i t e m ( s ) being b e i n g analyzed, a n a l y z e d , but b u t which w h i c h may m a y violate v i o l a t e failure f a i l u r e independence i n d e p e n d e n c e claims. c l a i m s . PARTITIONING: P A R T I T I O N I N G : The T h e mechanism m e c h a n i s m used u s e d to t o separate s e p a r a t e portions p o r t i o n s of o f a a system s y s t e m or o r an a n item i t e m with w i t h sufficient s u f f i c i e n t independence i n d e p e n d e n c e such s u c h that t h a t a a specific s p e c i f i c development d e v e l o p m e n t assurance a s s u r a n c e level l e v e l can c a n be b e substantiated s u b s t a n t i a t e d within w i t h i n the t h e partitioned p a r t i t i o n e d portion. p o r t i o n . PRELIMINARY P R E L I M I N A R Y SYSTEM S Y S T E M SAFETY S A F E T Y ASSESSMENT A S S E S S M E N T : : A A systematic s y s t e m a t i c evaluation e v a l u a t i o n of o f a a proposed p r o p o s e d system s y s t e m architecture a r c h i t e c t u r e and a n d its i t s implementation, i m p l e m e n t a t i o n , based b a s e d on o n the t h e Functional F u n c t i o n a l Hazard H a z a r d Assessment A s s e s s m e n t and a n d Failure F a i l u r e Condition C o n d i t i o n classification, c l a s s i f i c a t i o n , to t o determine d e t e r m i n e safety s a f e t y requirements r e q u i r e m e n t s for f o r systems s y s t e m s and a n d items. i t e m s . PROCESS: P R O C E S S : A A set s e t of o f interrelated i n t e r r e l a t e d activities a c t i v i t i e s performed p e r f o r m e d to t o produce p r o d u c e a a prescribed p r e s c r i b e d output o u t p u t or o r product. p r o d u c t . (D0-254/ED-80) ( D 0 - 2 5 4 / E D - 8 0 ) REDUNDANCY R E D U N D A N C Y : : Multiple M u l t i p l e independent i n d e p e n d e n t means m e a n s incorporated i n c o r p o r a t e d to t o accomplish a c c o m p l i s h a a given g i v e n function. f u n c t i o n . RELIABILITY: R E L I A B I L I T Y : The T h e probability p r o b a b i l i t y that t h a t a a system s y s t e m or o r item i t e m will w i l l perform p e r f o r m a a required r e q u i r e d function f u n c t i o n under u n d e r specified s p e c i f i e d conditions, c o n d i t i o n s , without w i t h o u t failure, f a i l u r e , for f o r a a specified s p e c i f i e d period p e r i o d of o f time. t i m e . REQUIREMENT R E Q U I R E M E N T : : An A n identifiable i d e n t i f i a b l e element e l e m e n t of o f a a function f u n c t i o n specification s p e c i f i c a t i o n that t h a t can c a n be b e validated v a l i d a t e d and a n d against a g a i n s t which w h i c h an a n implementation i m p l e m e n t a t i o n can c a n be b e verified. v e r i f i e d . REQUIREMENTS R E Q U I R E M E N T S MODEL: M O D E L : A A model m o d e l representing r e p r e s e n t i n g completely c o m p l e t e l y or o r partially, p a r t i a l l y , the t h e requirements r e q u i r e m e n t s at a t the t h e abstraction a b s t r a c t i o n level l e v e l the t h e model m o d e l addresses a d d r e s s e s . . RISK: R I S K : The T h e combination c o m b i n a t i o n of o f the t h e frequency f r e q u e n c y (probability) ( p r o b a b i l i t y ) of o f an a n occurrence o c c u r r e n c e and a n d its i t s associated a s s o c i a t e d level l e v e l of o f severity s e v e r i t y . . SAFETY: S A F E T Y : The T h e state s t a t e in i n which w h i c h risk r i s k is i s acceptable. a c c e p t a b l e . SIMILARITY: S I M I L A R I T Y : Applicable A p p l i c a b l e to t o systems s y s t e m s similar s i m i l a r in i n characteristics c h a r a c t e r i s t i c s and a n d usage u s a g e to t o systems s y s t e m s used u s e d on o n previously p r e v i o u s l y certificated c e r t i f i c a t e d aircraft. a i r c r a f t . In I n principle, p r i n c i p l e , there t h e r e are a r e no n o parts p a r t s of o f the t h e subject s u b j e c t system s y s t e m more m o r e at a t risk r i s k (due ( d u e to t o environment e n v i r o n m e n t or o r installation) i n s t a l l a t i o n ) and a n d that t h a t operational o p e r a t i o n a l stresses s t r e s s e s are a r e no n o more m o r e severe s e v e r e than t h a n on o n the t h e previously p r e v i o u s l y certificated c e r t i f i c a t e d aircraft. a i r c r a f t . SOFTWARE: S O F T W A R E : Computer C o m p u t e r programs, p r o g r a m s , procedures, p r o c e d u r e s , rules, r u l e s , and a n d any a n y associated a s s o c i a t e d documentation d o c u m e n t a t i o n pertaining p e r t a i n i n g to t o the t h e operation o p e r a t i o n of o f a a computer c o m p u t e r system. s y s t e m . SPECIFICATION: S P E C I F I C A T I O N : A A collection c o l l e c t i o n of o f requirements r e q u i r e m e n t s which, w h i c h , when w h e n taken t a k e n together, t o g e t h e r , constitute c o n s t i t u t e the t h e criteria c r i t e r i a that t h a t define d e f i n e the t h e functions f u n c t i o n s and a n d attributes a t t r i b u t e s of o f a a system, s y s t e m , component c o m p o n e n t or o r item. i t e m . SYSTEM: S Y S T E M : A A combination c o m b i n a t i o n of o f inter-related i n t e r - r e l a t e d items i t e m s arranged a r r a n g e d to t o perform p e r f o r m a a specific s p e c i f i c function(s) f u n c t i o n ( s ) . . SYSTEM S Y S T E M SAFETY S A F E T Y ASSESSMENT: A S S E S S M E N T : A A systematic, s y s t e m a t i c , comprehensive c o m p r e h e n s i v e evaluation e v a l u a t i o n of o f the t h e implemented i m p l e m e n t e d system s y s t e m to t o show s h o w that t h a t the t h e relevant r e l e v a n t safety s a f e t y requirements r e q u i r e m e n t s are a r e met. m e t . TEST: T E S T : A A quantitative q u a n t i t a t i v e procedure p r o c e d u r e to t o prove p r o v e performance p e r f o r m a n c e using u s i n g stated s t a t e d objective o b j e c t i v e criteria c r i t e r i a with w i t h pass p a s s or o r fail f a i l results. r e s u l t s . TRACEABI T R A C E A B I LITY: L I T Y : The T h e recorded r e c o r d e d relationship r e l a t i o n s h i p established e s t a b l i s h e d between b e t w e e n two t w o or o r more m o r e elements e l e m e n t s of o f the t h e development d e v e l o p m e n t process. p r o c e s s . For F o r example, e x a m p l e , between b e t w e e n a a requirement r e q u i r e m e n t and a n d its i t s source s o u r c e or o r between b e t w e e n a a verification v e r i f i c a t i o n method m e t h o d and a n d its i t s requirement. r e q u i r e m e n t . VALIDATION: V A L I D A T I O N : The T h e determination d e t e r m i n a t i o n that t h a t the t h e requirements r e q u i r e m e n t s for f o r a a product p r o d u c t are a r e correct c o r r e c t and a n d complete. c o m p l e t e . [Are [ A r e we w e building b u i l d i n g the t h e right r i g h t aircraft/ a i r c r a f t / system/ s y s t e m / function/ f u n c t i o n / item?] i t e m ? ] VERIFICATION: V E R I F I C A T I O N : The T h e evaluation e v a l u a t i o n of o f an a n implementation i m p l e m e n t a t i o n of o f requirements r e q u i r e m e n t s to t o determine d e t e r m i n e that t h a t they t h e y have h a v e been b e e n met. m e t . [Did [ D i d we w e build b u i l d the t h e aircraft/ a i r c r a f t / system/ s y s t e m / function/ f u n c t i o n / item i t e m right?] r i g h t ? ] ZONAL Z O N A L SAFETY S A F E T Y Analysis: A n a l y s i s : The T h e safety s a f e t y analysis a n a l y s i s standard s t a n d a r d with w i t h respect r e s p e c t to t o installation, i n s t a l l a t i o n , interference i n t e r f e r e n c e between b e t w e e n systems, s y s t e m s , and a n d potential p o t e n t i a l maintenance m a i n t e n a n c e errors e r r o r s that t h a t can c a n affect a f f e c t system s y s t e m safety. s a f e t y . granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true} Downloaded D o w n l o a d e d from f r o m SAE S A E International I n t e r n a t i o n a l by b y David D a v i d Merrill, M e r r i l l , Saturday, S a t u r d a y , November N o v e m b e r 12, 1 2 , 2016 2 0 1 6 SAE S A E ARP4754A A R P 4 7 5 4 A Page P a g e 14 1 4 of o f 115 1 1 5 2.3 2 . 3 Abbreviations A b b r e v i a t i o n s and a n d Acronyms A c r o n y m s AC A C Advisory A d v i s o r y Circular C i r c u l a r (FAA) ( F A A ) AMC A M C Acceptable A c c e p t a b l e Means M e a n s of o f Compliance C o m p l i a n c e (EASA) ( E A S A ) AOA A O A Angle A n g l e of o f Attack A t t a c k ARAC A R A C ARP A R P ASA A S A ASAT A S A T ATC A T C CAT C A T CFR C F R cc c c CCA C C A CM C M CMA C M A CMP C M P CMR C M R COTS C O T S cs c s DD D D EASA E A S A ETOPS E T O P S ETSO E T S O EUROCAE E U R O C A E FAA F A A FC F C FOAL F O A L FFS F F S FHA F H A Aviation A v i a t i o n Rulemaking R u l e m a k i n g Advisory A d v i s o r y Committee C o m m i t t e e (FAA) ( F A A ) Aerospace A e r o s p a c e Recommended R e c o m m e n d e d Practice P r a c t i c e (SAE) ( S A E ) Aircraft A i r c r a f t Safety S a f e t y Assessment A s s e s s m e n t Aircraft-Level A i r c r a f t - L e v e l Safety S a f e t y Assessment A s s e s s m e n t Team T e a m Amended A m e n d e d Type T y p e Certificate C e r t i f i c a t e Catastrophic C a t a s t r o p h i c Code C o d e of o f Federal F e d e r a l Regulations R e g u l a t i o n s Change C h a n g e Control C o n t r o l Common C o m m o n Cause C a u s e Analysis A n a l y s i s Configuration C o n f i g u r a t i o n Management M a n a g e m e n t Common C o m m o n Mode M o d e Analysis A n a l y s i s Configuration C o n f i g u r a t i o n Management M a n a g e m e n t Plan P l a n Certification C e r t i f i c a t i o n Maintenance M a i n t e n a n c e Requirement R e q u i r e m e n t Commercial C o m m e r c i a l Off-The-Shelf O f f - T h e - S h e l f Certification C e r t i f i c a t i o n Specifications S p e c i f i c a t i o n s Dependence D e p e n d e n c e Diagram D i a g r a m European E u r o p e a n Aviation A v i a t i o n Safety S a f e t y Agency A g e n c y Extended E x t e n d e d Twin T w i n Operations O p e r a t i o n s European E u r o p e a n Technical T e c h n i c a l Standard S t a n d a r d Order O r d e r European E u r o p e a n Organization O r g a n i z a t i o n for f o r Civil C i v i l Aviation A v i a t i o n Equipment E q u i p m e n t Federal F e d e r a l Aviation A v i a t i o n Administration A d m i n i s t r a t i o n Failure F a i l u r e Condition C o n d i t i o n Function F u n c t i o n Development D e v e l o p m e n t Assurance A s s u r a n c e Level L e v e l Functional F u n c t i o n a l Failure F a i l u r e Set S e t Functional F u n c t i o n a l Hazard H a z a r d Assessment A s s e s s m e n t granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true} Downloaded D o w n l o a d e d from f r o m SAE S A E International I n t e r n a t i o n a l by b y David D a v i d Merrill, M e r r i l l , Saturday, S a t u r d a y , November N o v e m b e r 12, 1 2 , 2016 2 0 1 6 SAE S A E ARP4754A A R P 4 7 5 4 A Page P a g e 15 1 5 of o f 115 1 1 5 FMEA F M E A FMES F M E S FTA F T A HAZ H A Z HDL H D L HW H W or o r H/W H / W ICA I C A ICAO I C A O IDAL I D A L IMA I M A IR I R JAA J A A MA M A MMEL M M E L MSG-3 M S G - 3 MTBF M T B F OEM O E M PASA P A S A POA P O A PR P R PRA P R A PSSA P S S A RTCA R T C A SAE S A E SC S C SIRT S I R T SSA S S A STC S T C SW S W or o r S/W S / W Failure F a i l u r e Modes M o d e s and a n d Effect E f f e c t Analysis A n a l y s i s Failure F a i l u r e Modes M o d e s and a n d Effect E f f e c t Summary S u m m a r y Fault F a u l t Tree T r e e Analysis A n a l y s i s Hazardous H a z a r d o u s Hardware H a r d w a r e Description D e s c r i p t i o n (Design) ( D e s i g n ) Language L a n g u a g e Hardware H a r d w a r e Instructions I n s t r u c t i o n s for f o r Continued C o n t i n u e d Airworthiness A i r w o r t h i n e s s International I n t e r n a t i o n a l Civil C i v i l Aviation A v i a t i o n Organization O r g a n i z a t i o n Item I t e m Development D e v e l o p m e n t Assurance A s s u r a n c e Level L e v e l Integrated I n t e g r a t e d Modular M o d u l a r Architecture A r c h i t e c t u r e Implementation I m p l e m e n t a t i o n Rule R u l e Joint J o i n t Aviation A v i a t i o n Authorities A u t h o r i t i e s Markov M a r k o v Analysis A n a l y s i s Master M a s t e r Minimum M i n i m u m Equipment E q u i p m e n t List L i s t Maintenance M a i n t e n a n c e Steering S t e e r i n g Group G r o u p 3 3 Mean M e a n Time T i m e Between B e t w e e n Failures F a i l u r e s Original O r i g i n a l Equipment E q u i p m e n t Manufacturer M a n u f a c t u r e r Preliminary P r e l i m i n a r y Aircraft A i r c r a f t Safety S a f e t y Assessment A s s e s s m e n t Production P r o d u c t i o n Organization O r g a n i z a t i o n Approval A p p r o v a l Problem P r o b l e m Report R e p o r t Particular P a r t i c u l a r Risk R i s k Analysis A n a l y s i s Preliminary P r e l i m i n a r y System S y s t e m Safety S a f e t y Assessment A s s e s s m e n t RTCA, R T C A , Inc. I n c . SAE S A E International I n t e r n a t i o n a l System S y s t e m Control C o n t r o l Category C a t e g o r y Systems S y s t e m s Integration I n t e g r a t i o n Requirements R e q u i r e m e n t s Task T a s k System S y s t e m Safety S a f e t y Assessment A s s e s s m e n t Supplemental S u p p l e m e n t a l Type T y p e Certificate C e r t i f i c a t e granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true} S S o o f f t t w w a a r r e e Downloaded D o w n l o a d e d from f r o m SAE S A E International I n t e r n a t i o n a l by b y David D a v i d Merrill, M e r r i l l , Saturday, S a t u r d a y , November N o v e m b e r 12, 1 2 , 2016 2 0 1 6 granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true} Downloaded D o w n l o a d e d from f r o m SAE S A E International I n t e r n a t i o n a l by b y David D a v i d Merrill, M e r r i l l , Saturday, S a t u r d a y , November N o v e m b e r 12, 1 2 , 2016 2 0 1 6 SAE S A E ARP4754A A R P 4 7 5 4 A Page P a g e 16 1 6 of o f 115 1 1 5 TC T C Type T y p e Certificate, C e r t i f i c a t e , Transport T r a n s p o r t Canada C a n a d a TSO T S O Technical T e c h n i c a l Standard S t a n d a r d Order O r d e r V&V V & V Validation V a l i d a t i o n and a n d Verification V e r i f i c a t i o n VHDL V H D L VHSIC V H S I C Hardware H a r d w a r e Description D e s c r i p t i o n (Design) ( D e s i g n ) Language L a n g u a g e VHSIC V H S I C Very V e r y High H i g h Speed S p e e d Integrated I n t e g r a t e d Circuit C i r c u i t WG-# W G - # A A numbered n u m b e r e d working w o r k i n g group g r o u p (EUROCAE). ( E U R O C A E ) . ZSA Z S A Zonal Z o n a l Safety S a f e t y Analysis A n a l y s i s 3. 3 . DEVELOPMENT D E V E L O P M E N T PLANNING P L A N N I N G The T h e purpose p u r p o s e of o f the t h e development d e v e l o p m e n t planning p l a n n i n g process p r o c e s s is i s to t o define d e f i n e the t h e means m e a n s of o f producing p r o d u c i n g an a n aircraft a i r c r a f t or o r system s y s t e m which w h i c h will w i l l satisfy s a t i s f y the t h e aircrafVsystem a i r c r a f V s y s t e m requirements r e q u i r e m e n t s and a n d provide p r o v i d e the t h e level l e v e l of o f confidence c o n f i d e n c e which w h i c h is i s consistent c o n s i s t e n t with w i t h airworthiness a i r w o r t h i n e s s requirements. r e q u i r e m e n t s . The T h e objectives o b j e c t i v e s of o f the t h e development d e v e l o p m e n t planning p l a n n i n g process p r o c e s s are: a r e : • • To T o define d e f i n e the t h e activities a c t i v i t i e s of o f the t h e development d e v e l o p m e n t processes p r o c e s s e s and a n d integral i n t e g r a l processes p r o c e s s e s of o f the t h e development d e v e l o p m e n t life l i f e cycle c y c l e that t h a t will w i l l address a d d r e s s the t h e aircrafVsystem a i r c r a f V s y s t e m requirements, r e q u i r e m e n t s , functional f u n c t i o n a l development d e v e l o p m e n t assurance a s s u r a n c e level(s) l e v e l ( s ) and a n d item i t e m development d e v e l o p m e n t assurance a s s u r a n c e level(s). l e v e l ( s ) . • • To T o define d e f i n e the t h e development d e v e l o p m e n t life l i f e cycle(s), c y c l e ( s ) , including i n c l u d i n g the t h e inter-relationships i n t e r - r e l a t i o n s h i p s between b e t w e e n the t h e processes, p r o c e s s e s , their t h e i r sequencing, s e q u e n c i n g , feedback f e e d b a c k mechanisms, m e c h a n i s m s , and a n d transition t r a n s i t i o n criteria. c r i t e r i a . • • To T o select s e l e c t the t h e life l i f e cycle c y c l e environment, e n v i r o n m e n t , including i n c l u d i n g the t h e methods m e t h o d s and a n d tools t o o l s to t o be b e used u s e d for f o r the t h e activities a c t i v i t i e s of o f each e a c h life l i f e cycle c y c l e process. p r o c e s s . • • To T o define d e f i n e the t h e development d e v e l o p m e n t standards s t a n d a r d s consistent c o n s i s t e n t with w i t h the t h e aircrafVsystem a i r c r a f V s y s t e m safety s a f e t y objectives o b j e c t i v e s for f o r the t h e aircrafVsystem a i r c r a f V s y s t e m to t o be b e produced. p r o d u c e d . • • To T o develop d e v e l o p plans p l a n s that t h a t comply c o m p l y with w i t h objectives o b j e c t i v e s of o f each e a c h integral i n t e g r a l process p r o c e s s (section ( s e c t i o n 5). 5 ) . The T h e outputs o u t p u t s of o f the t h e planning p l a n n i n g process p r o c e s s can c a n exist e x i s t in i n various v a r i o u s formats f o r m a t s such s u c h as a s integrated i n t e g r a t e d schedules s c h e d u l e s or o r formally f o r m a l l y released r e l e a s e d planning p l a n n i n g documents. d o c u m e n t s . The T h e iterative i t e r a t i v e nature n a t u r e of o f the t h e design d e s i g n process p r o c e s s should s h o u l d be b e considered c o n s i d e r e d during d u r i n g the t h e planning p l a n n i n g process p r o c e s s . . Interrelationships I n t e r r e l a t i o n s h i p s between b e t w e e n the t h e planning p l a n n i n g elements e l e m e n t s and a n d feedback f e e d b a c k loops l o o p s should s h o u l d also a l s o be b e identified i d e n t i f i e d and a n d managed, m a n a g e d , as a s appropriate. a p p r o p r i a t e . 3.1 3 . 1 Planning P l a n n i n g Process P r o c e s s Figure F i g u r e 2 2 is i s an a n example e x a m p l e of o f the t h e overall o v e r a l l planning p l a n n i n g process p r o c e s s and a n d includes i n c l u d e s some s o m e generic g e n e r i c objectives o b j e c t i v e s applicable a p p l i c a b l e to t o all a l l planning p l a n n i n g elements. e l e m e n t s . The T h e basic b a s i c process p r o c e s s shown s h o w n in i n Figure F i g u r e 2 2 suggests s u g g e s t s that t h a t all a l l of o f the t h e planning p l a n n i n g elements e l e m e n t s need n e e d to t o be b e thought t h o u g h t about a b o u t before b e f o r e documenting d o c u m e n t i n g any a n y of o f them. t h e m . In I n reality, r e a l i t y , the t h e development d e v e l o p m e n t of o f these t h e s e planning p l a n n i n g elements e l e m e n t s may m a y not n o t happen h a p p e n at a t the t h e same s a m e time. t i m e . Therefore, T h e r e f o r e , it i t is i s important i m p o r t a n t to t o make m a k e sure s u r e the t h e planning p l a n n i n g elements e l e m e n t s are a r e consistent c o n s i s t e n t with w i t h each e a c h other o t h e r and a n d collectively c o l l e c t i v e l y make m a k e up u p a a complete c o m p l e t e plan p l a n for f o r the t h e entire e n t i r e development d e v e l o p m e n t life l i f e cycle. c y c l e . The T h e reviewers r e v i e w e r s should s h o u l d keep k e e p this t h i s in i n mind m i n d when w h e n reviewing r e v i e w i n g individual i n d i v i d u a l planning p l a n n i n g elements. e l e m e n t s . Throughout T h r o u g h o u t this t h i s document, d o c u m e n t , the t h e individual i n d i v i d u a l planning p l a n n i n g activities a c t i v i t i e s for f o r each e a c h process p r o c e s s are a r e described d e s c r i b e d in i n detail d e t a i l in i n their t h e i r sections. s e c t i o n s . Table T a b l e 1 1 summarizes s u m m a r i z e s the t h e elements e l e m e n t s that t h a t should s h o u l d be b e included i n c l u d e d in i n the t h e planning p l a n n i n g phase. p h a s e . They T h e y should s h o u l d address a d d r e s s the t h e design d e s i g n and a n d certification c e r t i f i c a t i o n of o f the t h e respective r e s p e c t i v e aircraft, a i r c r a f t , system s y s t e m or o r item. i t e m . This T h i s process p r o c e s s can c a n be b e re-entered r e - e n t e r e d for f o r aircraft a i r c r a f t or o r system s y s t e m changes, c h a n g e s , such s u c h as a s a a new n e w derivative d e r i v a t i v e model m o d e l or o r modifications m o d i f i c a t i o n s to t o an a n in i n service s e r v i c e aircraft. a i r c r a f t . granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true} Downloaded D o w n l o a d e d from f r o m SAE S A E International I n t e r n a t i o n a l by b y David D a v i d Merrill, M e r r i l l , Saturday, S a t u r d a y , November N o v e m b e r 12, 1 2 , 2016 2 0 1 6 SAE S A E ARP4754A A R P 4 7 5 4 A Page P a g e 17 1 7 of o f 115 1 1 5 3.2 3 . 2 Transition T r a n s i t i o n Criteria C r i t e r i a A A key k e y component c o m p o n e n t of o f planning p l a n n i n g is i s the t h e establishment e s t a b l i s h m e n t of o f life l i f e cycle c y c l e process p r o c e s s checkpoints c h e c k p o i n t s and a n d reviews, r e v i e w s , which w h i c h are a r e aligned a l i g n e d with w i t h program p r o g r a m phases p h a s e s and a n d gates. g a t e s . The T h e plans p l a n s should s h o u l d clearly c l e a r l y define d e f i n e maturity m a t u r i t y expectations e x p e c t a t i o n s to t o provide p r o v i d e visibility v i s i b i l i t y on o n the t h e progress p r o g r e s s and a n d integration i n t e g r a t i o n state s t a t e for f o r the t h e major m a j o r elements e l e m e n t s of o f design, d e s i g n , implementation, i m p l e m e n t a t i o n , and a n d certification. c e r t i f i c a t i o n . This T h i s can c a n be b e accomplished a c c o m p l i s h e d by b y clearly c l e a r l y identifying i d e n t i f y i n g the t h e technical t e c h n i c a l and a n d process p r o c e s s entrance e n t r a n c e and a n d exit e x i t criteria. c r i t e r i a . Issues I s s u e s left l e f t open o p e n when w h e n transitioning t r a n s i t i o n i n g from f r o m one o n e stage s t a g e of o f development d e v e l o p m e n t to t o another a n o t h e r should s h o u l d be b e tracked t r a c k e d and a n d managed, m a n a g e d , as a s appropriate. a p p r o p r i a t e . granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true} D D = = s s . . = = Review R e v i e w plans p l a n s for f o r accuracy, a c c u r a c y , consistency, c o n s i s t e n c y , completeness c o m p l e t e n e s s Plan P l a n Plan(s) P l a n ( s ) elements""Yesdocumented e l e m e n t s " " Y e s d o c u m e n t e d and a n d approved a p p r o v e d Transition T r a n s i t i o n from f r o m planning p l a n n i n g to t o Development D e v e l o p m e n t Processes P r o c e s s e s Identify I d e n t i f y which w h i c h plan p l a n elements e l e m e n t s are a r e needed n e e d e d and a n d how h o w they t h e y will w i l l be b e documented d o c u m e n t e d (i.e. ( i . e . all a l l in i n one o n e plan p l a n or o r in i n individual i n d i v i d u a l plans) p l a n s ) Identify I d e n t i f y transition t r a n s i t i o n criteria c r i t e r i a for f o r each e a c h of o f the t h e phases p h a s e s within w i t h i n the t h e development d e v e l o p m e n t and a n d integral i n t e g r a l processes p r o c e s s e s Identify I d e n t i f y development d e v e l o p m e n t phases p h a s e s related r e l a t e d to t o plan p l a n element e l e m e n t Identify I d e n t i f y relationships r e l a t i o n s h i p s or o r dependencies d e p e n d e n c i e s between b e t w e e n planning p l a n n i n g elements e l e m e n t s Identify I d e n t i f y applicable a p p l i c a b l e processes p r o c e s s e s and a n d industry i n d u s t r y stand s t a n d Identify I d e n t i f y how h o w deviations d e v i a t i o n s to t o the t h e plans p l a n s will w i l l be b e handled h a n d l e d Development D e v e l o p m e n t Processes P r o c e s s e s m m t::I t : : I c:> c : > [ [ c:> c : > = = ..i . . i . . . . =i. = i . ::;, : : ; , c:> c : > 9 9 r:,, r : , , ... . . . d d c:> c : > )> ) > ;;o ; ; o C' C ' "U " U t::I t : : I -..J - . . J CJ1 C J 1 DO D O ;:$. ; : $ . =i. = i . ::: : : : FIGURE F I G U R E 2 2 - - PLANNING P L A N N I N G PROCESS P R O C E S S )> ) > ...,. . . . , . ir:,, i r : , , DO D O ., . , =i. = i . DO D O '.:' ' . : ' z z c:>a c : > a C C ...,. . . . , . ' ' .... . . . . ,!" , ! " N N .... . . . . 0\ 0 \ "U " U !l) ! l ) C C CD C D ...... . . . . . . 00 0 0 ạ ạ ..... . . . . . ...... . . . . . . CJ1 C J 1 Document D o c u m e n t planning p l a n n i n g elements e l e m e n t s No N o granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true} Downloaded D o w n l o a d e d from f r o m SAE S A E International I n t e r n a t i o n a l by b y David D a v i d Merrill, M e r r i l l , Saturday, S a t u r d a y , November N o v e m b e r 12, 1 2 , 2016 2 0 1 6 SAE S A E ARP4754A A R P 4 7 5 4 A Page P a g e 19 1 9 of o f 115 1 1 5 TABLE T A B L E 1 1 - - DEVELOPMENT D E V E L O P M E N T PLANNING P L A N N I N G ELEMENTS E L E M E N T S Planning P l a n n i n g Elements E l e m e n t s Element E l e m e n t Description D e s c r i p t i o n Development D e v e l o p m e n t Safety S a f e t y Program P r o g r a m Requirements R e q u i r e m e n t s Management M a n a g e m e n t Validation V a l i d a t i o n Implementation I m p l e m e n t a t i o n Verification V e r i f i c a t i o n Configuration C o n f i g u r a t i o n Management M a n a g e m e n t Process P r o c e s s Assurance A s s u r a n c e Certification C e r t i f i c a t i o n Establish E s t a b l i s h the t h e process p r o c e s s and a n d methods m e t h o d s to t o be b e used u s e d to t o provide p r o v i d e the t h e framework f r a m e w o r k for f o r the t h e aircraft/system a i r c r a f t / s y s t e m architecture a r c h i t e c t u r e development d e v e l o p m e n t , , integration i n t e g r a t i o n and a n d implementation. i m p l e m e n t a t i o n . Establish E s t a b l i s h scope s c o p e and a n d content c o n t e n t of o f the t h e safety s a f e t y activities a c t i v i t i e s related r e l a t e d to t o the t h e development d e v e l o p m e n t of o f the t h e aircraft a i r c r a f t or o r system. s y s t e m . Identify I d e n t i f y and a n d describe d e s c r i b e how h o w the t h e requirements r e q u i r e m e n t s are a r e captured c a p t u r e d and a n d managed. m a n a g e d . Sometimes S o m e t i m e s these t h e s e elements e l e m e n t s are a r e included i n c l u d e d in i n conjunction c o n j u n c t i o n with w i t h the t h e validation v a l i d a t i o n elements. e l e m e n t s . Describe D e s c r i b e how h o w the t h e requirements r e q u i r e m e n t s and a n d assumptions a s s u m p t i o n s will w i l l be b e shown s h o w n to t o be b e complete c o m p l e t e and a n d correct. c o r r e c t . Define D e f i n e the t h e processes p r o c e s s e s and a n d criteria c r i t e r i a to t o be b e applied a p p l i e d when w h e n showing s h o w i n g how h o w the t h e implementation i m p l e m e n t a t i o n satisfies s a t i s f i e s its i t s requirements. r e q u i r e m e n t s . Describe D e s c r i b e the t h e key k e y development d e v e l o p m e n t related r e l a t e d configuration c o n f i g u r a t i o n items i t e m s and a n d how h o w they t h e y will w i l l be b e managed. m a n a g e d . Describe D e s c r i b e the t h e means m e a n s to t o assure a s s u r e the t h e practices p r a c t i c e s and a n d procedures p r o c e d u r e s to t o be b e applied a p p l i e d during d u r i n g system s y s t e m development d e v e l o p m e n t are a r e followed. f o l l o w e d . Describe D e s c r i b e the t h e process p r o c e s s and a n d methods m e t h o d s that t h a t will w i l l be b e used u s e d to t o achieve a c h i e v e certification. c e r t i f i c a t i o n . 4754A 4 7 5 4 A Section S e c t i o n This T h i s section s e c t i o n and a n d 4.0 4 . 0 5.1.5 5 . 1 . 5 5.3 5 . 3 5.4 5 . 4 5.5 5 . 5 5.6 5 . 6 5.7 5 . 7 5.8 5 . 8 3.2.1 3 . 2 . 1 Deviations D e v i a t i o n s from f r o m Plans P l a n s During D u r i n g development d e v e l o p m e n t there t h e r e may m a y be b e times t i m e s when w h e n it i t is i s necessary n e c e s s a r y to t o deviate d e v i a t e from f r o m the t h e documented d o c u m e n t e d plans. p l a n s . Therefore, T h e r e f o r e , during d u r i n g the t h e planning p l a n n i n g phase p h a s e it i t is i s important i m p o r t a n t to t o identify i d e n t i f y a a process p r o c e s s to t o address a d d r e s s deviatations d e v i a t a t i o n s from f r o m the t h e plans. p l a n s . Methods M e t h o d s for f o r reporting, r e p o r t i n g , gaining g a i n i n g approval a p p r o v a l of, o f , and a n d documenting d o c u m e n t i n g any a n y deviations d e v i a t i o n s should s h o u l d be b e described d e s c r i b e d in i n the t h e planning p l a n n i n g elements. e l e m e n t s . 4. 4 . AIRCRAFT A I R C R A F T AND A N D SYSTEM S Y S T E M DEVELOPMENT D E V E L O P M E N T PROCESS P R O C E S S This T h i s section s e c t i o n provides p r o v i d e s an a n overview o v e r v i e w of o f a a generic g e n e r i c approach a p p r o a c h for f o r developing d e v e l o p i n g aircraft a i r c r a f t and a n d aircraft a i r c r a f t systems s y s t e m s from f r o m conceptual c o n c e p t u a l definition d e f i n i t i o n to t o certification. c e r t i f i c a t i o n . This T h i s section s e c t i o n establishes e s t a b l i s h e s common c o m m o n terminology t e r m i n o l o g y and a n d expectations e x p e c t a t i o n s associated a s s o c i a t e d with w i t h development d e v e l o p m e n t processes p r o c e s s e s and a n d their t h e i r inter-relationships i n t e r - r e l a t i o n s h i p s in i n order o r d e r to t o understand u n d e r s t a n d the t h e intent i n t e n t and a n d applicability a p p l i c a b i l i t y of o f the t h e substantiating s u b s t a n t i a t i n g material. m a t e r i a l . The T h e development d e v e l o p m e n t life l i f e cycle c y c l e has h a s a a beginning b e g i n n i n g and a n d an a n end, e n d , and a n d can c a n be b e re-entered r e - e n t e r e d to t o address a d d r e s s aircraft a i r c r a f t or o r system s y s t e m changes c h a n g e s . . Figure F i g u r e 3 3 is i s a a simple s i m p l e illustration i l l u s t r a t i o n of o f a a development d e v e l o p m e n t life l i f e cycle. c y c l e . The T h e guidelines g u i d e l i n e s contained c o n t a i n e d in i n this t h i s document d o c u m e n t are a r e primarily p r i m a r i l y geared g e a r e d toward t o w a r d the t h e "Development" " D e v e l o p m e n t " phase. p h a s e . granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true} Downloaded D o w n l o a d e d from f r o m SAE S A E International I n t e r n a t i o n a l by b y David D a v i d Merrill, M e r r i l l , Saturday, S a t u r d a y , November N o v e m b e r 12, 1 2 , 2016 2 0 1 6 SAE S A E ARP4754A A R P 4 7 5 4 A Page P a g e 20 2 0 of o f 115 1 1 5 I I Concept C o n c e p t I I I I I I I I I I I I I I Development D e v e l o p m e n t Function F u n c t i o n Architecture A r c h i t e c t u r e - - -Design - D e s i g n Implementation I m p l e m e n t a t i o n I I I I I I I I Production/ P r o d u c t i o n / I I Operation O p e r a t i o n I I I I I I I I Production, P r o d u c t i o n , test t e s t & & operation o p e r a t i o n data d a t a I I I I I I I I I I I I I I I I I I I I I I FIGURE F I G U R E 3 3 - - DEVELOPMENT D E V E L O P M E N T LIFE L I F E CYCLE C Y C L E The T h e Concept C o n c e p t phase p h a s e (i.e. ( i . e . research r e s e a r c h and a n d preliminary p r e l i m i n a r y development d e v e l o p m e n t phase) p h a s e ) determines d e t e r m i n e s the t h e overall o v e r a l l aircraft a i r c r a f t performance p e r f o r m a n c e and a n d configuration c o n f i g u r a t i o n such s u c h as a s payload p a y l o a d and a n d range, r a n g e , aircraft a i r c r a f t size, s i z e , number n u m b e r and a n d locations l o c a t i o n s of o f engines, e n g i n e s , airfoil, a i r f o i l , applications a p p l i c a t i o n s of o f new n e w technologies t e c h n o l o g i e s in i n design d e s i g n and a n d manufacturing. m a n u f a c t u r i n g . The T h e Development D e v e l o p m e n t phase p h a s e follows f o l l o w s the t h e Concept C o n c e p t phase p h a s e readying r e a d y i n g the t h e implementation i m p l e m e n t a t i o n for f o r Production/Operation P r o d u c t i o n / O p e r a t i o n . . The T h e Development D e v e l o p m e n t phase p h a s e is i s complete c o m p l e t e when: w h e n : • • Build/test B u i l d / t e s t information i n f o r m a t i o n is i s provided p r o v i d e d to t o a a production p r o d u c t i o n facility(ies), f a c i l i t y ( i e s ) , • • All A l l regulatory r e g u l a t o r y compliance c o m p l i a n c e data d a t a is i s submitted s u b m i t t e d and a n d approved, a p p r o v e d , • • The T h e design d e s i g n has h a s met m e t all a l l internal i n t e r n a l compliance c o m p l i a n c e data d a t a (as ( a s required), r e q u i r e d ) , • • Limitations, L i m i t a t i o n s , maintenance m a i n t e n a n c e and a n d other o t h e r operational o p e r a t i o n a l information i n f o r m a t i o n are a r e provided p r o v i d e d to t o the t h e aircraft a i r c r a f t operators. o p e r a t o r s . 4.1 4 . 1 Conceptual C o n c e p t u a l Aircraft/System A i r c r a f t / S y s t e m Development D e v e l o p m e n t Process P r o c e s s The T h e generic g e n e r i c aircraft/system a i r c r a f t / s y s t e m development d e v e l o p m e n t process p r o c e s s outlined o u t l i n e d in i n this t h i s section s e c t i o n establishes e s t a b l i s h e s a a framework f r a m e w o r k for f o r discussing d i s c u s s i n g the t h e process. p r o c e s s . This T h i s section s e c t i o n does d o e s not n o t imply i m p l y a a preferred p r e f e r r e d method m e t h o d or o r process; p r o c e s s ; nor n o r does d o e s it i t imply i m p l y a a specific s p e c i f i c organizational o r g a n i z a t i o n a l structure. s t r u c t u r e . Figure F i g u r e 4 4 provides p r o v i d e s a a graphical g r a p h i c a l representation r e p r e s e n t a t i o n of o f the t h e system s y s t e m development d e v e l o p m e n t process p r o c e s s model m o d e l with w i t h the t h e numerical n u m e r i c a l entries e n t r i e s in i n each e a c h activity a c t i v i t y box b o x representing r e p r e s e n t i n g the t h e section s e c t i o n numbers n u m b e r s of o f this t h i s document d o c u m e n t in i n which w h i c h the t h e activity a c t i v i t y is i s further f u r t h e r explained. e x p l a i n e d . A A top-down t o p - d o w n sequence s e q u e n c e for f o r developing d e v e l o p i n g a a specific s p e c i f i c system s y s t e m implementation i m p l e m e n t a t i o n from f r o m knowledge k n o w l e d g e of o f an a n intended i n t e n d e d aircraft a i r c r a f t function f u n c t i o n provides p r o v i d e s a a convenient c o n v e n i e n t conceptual c o n c e p t u a l model m o d e l for f o r the t h e system s y s t e m development d e v e l o p m e n t process. p r o c e s s . A A typical t y p i c a l system s y s t e m development d e v e l o p m e n t progresses p r o g r e s s e s in i n an a n iterative i t e r a t i v e and a n d concurrent c o n c u r r e n t fashion f a s h i o n using u s i n g both b o t h top-down t o p - d o w n and a n d bottom-up b o t t o m - u p strategies. s t r a t e g i e s . In I n this t h i s document, d o c u m e n t , emphasis e m p h a s i s is i s focused f o c u s e d on o n the t h e top-down t o p - d o w n aspect a s p e c t since s i n c e it i t provides p r o v i d e s the t h e necessary n e c e s s a r y links l i n k s between b e t w e e n aircraft a i r c r a f t safety s a f e t y and a n d system s y s t e m development. d e v e l o p m e n t . It I t is i s recognized r e c o g n i z e d that t h a t company c o m p a n y organizations o r g a n i z a t i o n s may m a y structure s t r u c t u r e their t h e i r functional/product f u n c t i o n a l / p r o d u c t breakdown b r e a k d o w n with w i t h additional a d d i t i o n a l layers. l a y e r s . The T h e processes p r o c e s s e s described d e s c r i b e d in i n this t h i s document d o c u m e n t would w o u l d then t h e n be b e applied, a p p l i e d , with w i t h appropriate a p p r o p r i a t e adaptations, a d a p t a t i o n s , to t o these t h e s e layers l a y e r s from f r o m the t h e aircraft a i r c r a f t to t o item i t e m levels. l e v e l s . granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true} t t iD i D a a a a a a 5.1 5 . 1 SAFETY S A F E T Y ASSESSMENT A S S E S S M E N T 5.2 5 . 2 DEVELOPMENT D E V E L O P M E N T ASSURANCE A S S U R A N C E LEVEL L E V E L ASSIGNMENT A S S I G N M E N T 5.3 5 . 3 REQUIREMENTS R E Q U I R E M E N T S CAPTURE C A P T U R E 5.4 5 . 4 REQUIREMENTS R E Q U I R E M E N T S VALIDATION V A L I D A T I O N 5.6 5 . 6 CONFIGURATION C O N F I G U R A T I O N MANAGEMENT M A N A G E M E N T 5.7 5 . 7 PROCESS P R O C E S S ASSURANCE A S S U R A N C E 5.8 5 . 8 CERTIFICATION C E R T I F I C A T I O N & & REGULATORY R E G U L A T O R Y AUTHORITY A U T H O R I T Y COORDINATION C O O R D I N A T I O N 5.5 5 . 5 IMPLEMENTATION I M P L E M E N T A T I O N VERIFICATION V E R I F I C A T I O N _ _ _ _ - - - - - - AIRCRAFT A I R C R A F T FUNCTION F U N C T I O N DEVELOPMENT D E V E L O P M E N T 4.2 4 . 2 ALLOCATION A L L O C A T I O N OF O F SYSTEM S Y S T E M REQUIREMENTS R E Q U I R E M E N T S TO T O ITEMS I T E M S 4.5 4 . 5 ATA A T A & & MENTATION M E N T A T I O N m m AIRCRA A I R C R A DEVELOPM D E V E L O P M rIN-:;:;GP;;-CE-;;ES- r I N - : ; : ; G P ; ; - C E - ; ; E S - - - - - I I I I I I L L FIGURE F I G U R E 4 4 - - AIRCRAFT A I R C R A F T OR O R SYSTEM S Y S T E M DEVELOPMENT D E V E L O P M E N T PROCESS P R O C E S S MODEL M O D E L , , )> ) > ;a ; a ""U " " U .I),. . I ) , . -...J - . . . J 01 0 1 t::I t : : I 0 0 = = ..i . . i . . . . =i. = i . ::;, : : ; , E E ... . . . dD d D : : O O :; : ; § § !!?. ! ! ? . CT C T t::I t : : I DO D O ;:$. ; : $ . =i. = i . : : . . .. . . : : , , . . : : ::i. : : i . .F . F er, e r , S" S " DO D O '.:' ' . : ' z z 0 0 ... . . . CT C T .... . . . . ,!'-' , ! ' - ' .... . . . . 0\ 0 \ ""U " " U ll) l l ) :a : a CD C D I\,) I \ , ) ....... . . . . . . . ....... . . . . . . . ....... . . . . . . . 01 0 1 PLANNING P L A N N I N G 3.0 3 . 0 FT/SYSTEM F T / S Y S T E M ENT E N T PROCESS P R O C E S S 4.0 4 . 0 - - - - - - - - - - - - - - · · - - - - - - 1 1 I I SYSTEM S Y S T E M IMPLEMENTATION I M P L E M E N T A T I O N 4.6 4 . 6 I I D D DOCU D O C U ALLOCATION A L L O C A T I O N OF O F AIRCRAFT A I R C R A F T FUNCTIONS F U N C T I O N S TO T O SYSTEMS S Y S T E M S 4.3 4 . 3 DEVELOPME D E V E L O P M E NT N T OF O F SYSTEM S Y S T E M ARCHITECTU A R C H I T E C T U granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true} Downloaded D o w n l o a d e d from f r o m SAE S A E International I n t e r n a t i o n a l by b y David D a v i d Merrill, M e r r i l l , Saturday, S a t u r d a y , November N o v e m b e r 12, 1 2 , 2016 2 0 1 6 SAE S A E ARP4754A A R P 4 7 5 4 A Page P a g e 22 2 2 of o f 115 1 1 5 4.1.1 4 . 1 . 1 Development D e v e l o p m e n t Assurance A s s u r a n c e Due D u e to t o the t h e highly h i g h l y complex c o m p l e x and a n d integrated i n t e g r a t e d nature n a t u r e of o f modern m o d e r n aircraft a i r c r a f t systems s y s t e m s the t h e regulatory r e g u l a t o r y authorities a u t h o r i t i e s have h a v e highlighted h i g h l i g h t e d concerns c o n c e r n s about a b o u t the t h e possibility p o s s i b i l i t y of o f development d e v e l o p m e n t errors e r r o r s causing c a u s i n g or o r contributing c o n t r i b u t i n g to t o aircraft a i r c r a f t Failure F a i l u r e Conditions C o n d i t i o n s . . To T o address a d d r e s s these t h e s e concerns, c o n c e r n s , a a methodology m e t h o d o l o g y to t o mitigate m i t i g a t e development d e v e l o p m e n t errors e r r o r s is i s required. r e q u i r e d . The T h e following f o l l o w i n g text t e x t reflects r e f l e c t s the t h e concerns c o n c e r n s expressed e x p r e s s e d in i n current c u r r e n t certification c e r t i f i c a t i o n requirements/regulations r e q u i r e m e n t s / r e g u l a t i o n s : : a. a . A A concern c o n c e r n arose a r o s e regarding r e g a r d i n g the t h e efficiency e f f i c i e n c y and a n d coverage c o v e r a g e of o f the t h e techniques t e c h n i q u e s used u s e d for f o r assessing a s s e s s i n g safety s a f e t y aspects a s p e c t s of o f highly h i g h l y integrated i n t e g r a t e d systems s y s t e m s that t h a t perform p e r f o r m complex c o m p l e x and a n d interrelated i n t e r r e l a t e d functions, f u n c t i o n s , particularly p a r t i c u l a r l y through t h r o u g h the t h e use u s e of o f electronic e l e c t r o n i c technology t e c h n o l o g y and a n d software s o f t w a r e based b a s e d techniques. t e c h n i q u e s . The T h e concern c o n c e r n is i s that t h a t design d e s i g n and a n d analysis a n a l y s i s techniques t e c h n i q u e s traditionally t r a d i t i o n a l l y applied a p p l i e d to t o deterministic d e t e r m i n i s t i c risks r i s k s or o r to t o conventional, c o n v e n t i o n a l , non-complex n o n - c o m p l e x systems s y s t e m s may m a y not n o t provide p r o v i d e adequate a d e q u a t e safety s a f e t y coverage c o v e r a g e for f o r more m o r e complex c o m p l e x systems. s y s t e m s . Thus, T h u s , other o t h e r assurance a s s u r a n c e techniques, t e c h n i q u e s , such s u c h as a s development d e v e l o p m e n t assurance a s s u r a n c e utilizing u t i l i z i n g a a combination c o m b i n a t i o n of o f process p r o c e s s assurance, a s s u r a n c e , validation v a l i d a t i o n and a n d verification v e r i f i c a t i o n coverage c o v e r a g e criteria, c r i t e r i a , or o r structured s t r u c t u r e d analysis a n a l y s i s or o r assessment a s s e s s m e n t techniques t e c h n i q u e s applied a p p l i e d at a t the t h e aircraft a i r c r a f t level, l e v e l , if i f necessary, n e c e s s a r y , or o r at a t least l e a s t across a c r o s s integrated i n t e g r a t e d or o r interacting i n t e r a c t i n g systems, s y s t e m s , have h a v e been b e e n applied a p p l i e d to t o these t h e s e more m o r e complex c o m p l e x systems. s y s t e m s . Their T h e i r systematic s y s t e m a t i c use u s e increases i n c r e a s e s confidence c o n f i d e n c e that t h a t errors e r r o r s in i n requirements r e q u i r e m e n t s or o r design, d e s i g n , and a n d integration i n t e g r a t i o n or o r interaction i n t e r a c t i o n effects e f f e c t s have h a v e been b e e n adequately a d e q u a t e l y identified i d e n t i f i e d and a n d corrected. c o r r e c t e d . b. b . Considering C o n s i d e r i n g the t h e above a b o v e developments, d e v e l o p m e n t s , as a s well w e l l as a s revisions r e v i s i o n s made m a d e to t o 14CFR/CS 1 4 C F R / C S 25.1309; 2 5 . 1 3 0 9 ; AMC25 A M C 2 5 .1309 . 1 3 0 9 was w a s revised r e v i s e d to t o include i n c l u d e new n e w approaches, a p p r o a c h e s , both b o t h qualitative q u a l i t a t i v e and a n d quantitative, q u a n t i t a t i v e , which w h i c h may m a y be b e used u s e d to t o assist a s s i s t in i n determining d e t e r m i n i n g safety s a f e t y requirements r e q u i r e m e n t s and a n d establishing e s t a b l i s h i n g compliance c o m p l i a n c e with w i t h these t h e s e requirements, r e q u i r e m e n t s , and a n d to t o reflect r e f l e c t revisions r e v i s i o n s in i n the t h e rule, r u l e , considering c o n s i d e r i n g the t h e whole w h o l e aircraft a i r c r a f t and a n d its i t s systems. s y s t e m s . It I t also a l s o provides p r o v i d e s guidance g u i d a n c e for f o r determining d e t e r m i n i n g when, w h e n , or o r if, i f , particular p a r t i c u l a r analyses a n a l y s e s or o r development d e v e l o p m e n t assurance a s s u r a n c e actions a c t i o n s should s h o u l d be b e conducted c o n d u c t e d in i n the t h e frame f r a m e of o f the t h e development d e v e l o p m e n t and a n d safety s a f e t y assessment a s s e s s m e n t processes. p r o c e s s e s . Numerical N u m e r i c a l values v a l u e s are a r e assigned a s s i g n e d to t o the t h e probabilistic p r o b a b i l i s t i c terms t e r m s included i n c l u d e d in i n the t h e requirements r e q u i r e m e n t s for f o r use u s e in i n those t h o s e cases c a s e s where w h e r e the t h e impact i m p a c t of o f system s y s t e m failures f a i l u r e s is i s examined e x a m i n e d by b y quantitative q u a n t i t a t i v e methods m e t h o d s of o f analysis. a n a l y s i s . The T h e analytical a n a l y t i c a l tools t o o l s used u s e d in i n determining d e t e r m i n i n g numerical n u m e r i c a l values v a l u e s are a r e intended i n t e n d e d to t o be b e used u s e d in i n addition a d d i t i o n to t o (but ( b u t not n o t replace) r e p l a c e ) qualitative q u a l i t a t i v e methods m e t h o d s based b a s e d on o n engineering e n g i n e e r i n g and a n d operational o p e r a t i o n a l judgment. j u d g m e n t . Therefore, T h e r e f o r e , a a process p r o c e s s is i s needed, n e e d e d , which w h i c h establishes e s t a b l i s h e s levels l e v e l s of o f confidence c o n f i d e n c e that t h a t development d e v e l o p m e n t errors e r r o r s that t h a t can c a n cause c a u s e or o r contribute c o n t r i b u t e to t o identified i d e n t i f i e d Failure F a i l u r e Conditions C o n d i t i o n s have h a v e been b e e n minimized m i n i m i z e d with w i t h an a n appropriate a p p r o p r i a t e level l e v e l of o f rigor. r i g o r . This T h i s henceforth h e n c e f o r t h is i s referred r e f e r r e d to t o as a s the t h e Development D e v e l o p m e n t Assurance A s s u r a n c e process. p r o c e s s . 4.1.2 4 . 1 . 2 Introduction I n t r o d u c t i o n to t o Development D e v e l o p m e n t Assurance A s s u r a n c e Process P r o c e s s The T h e guidance g u i d a n c e material m a t e r i a l presented p r e s e n t e d in i n D0-1788/ED-128 D 0 - 1 7 8 8 / E D - 1 2 8 and a n d D0-254/ED-80 D 0 - 2 5 4 / E D - 8 0 has h a s been b e e n recognized r e c o g n i z e d by b y industry i n d u s t r y and a n d the t h e various v a r i o u s regulatory r e g u l a t o r y authorities a u t h o r i t i e s to t o establish e s t a b l i s h levels l e v e l s of o f confidence c o n f i d e n c e that t h a t a a specific s p e c i f i c item i t e m of o f software s o f t w a r e and a n d electronic e l e c t r o n i c hardware h a r d w a r e respectively r e s p e c t i v e l y performs p e r f o r m s to t o its i t s intended i n t e n d e d design d e s i g n requirements. r e q u i r e m e n t s . To T o establish e s t a b l i s h levels l e v e l s of o f confidence c o n f i d e n c e for f o r the t h e aircraft a i r c r a f t systems s y s t e m s as a s a a whole, w h o l e , the t h e process p r o c e s s outlined o u t l i n e d herein h e r e i n presents p r e s e n t s the t h e guidelines g u i d e l i n e s for f o r developing d e v e l o p i n g aircraft a i r c r a f t level, l e v e l , system s y s t e m level, l e v e l , and a n d item i t e m level l e v e l requirements. r e q u i r e m e n t s . The T h e process p r o c e s s includes i n c l u d e s validating v a l i d a t i n g requirements, r e q u i r e m e n t s , and a n d verifying v e r i f y i n g that t h a t requirements r e q u i r e m e n t s are a r e met, m e t , together t o g e t h e r with w i t h the t h e necessary n e c e s s a r y configuration c o n f i g u r a t i o n management m a n a g e m e n t and a n d process p r o c e s s assurance a s s u r a n c e activities. a c t i v i t i e s . As A s development d e v e l o p m e n t assurance a s s u r a n c e level l e v e l assignments a s s i g n m e n t s are a r e dependent d e p e n d e n t on o n classification c l a s s i f i c a t i o n of o f Failure F a i l u r e Conditions, C o n d i t i o n s , the t h e safety s a f e t y analysis a n a l y s i s process p r o c e s s is i s used u s e d in i n conjunction c o n j u n c t i o n with w i t h the t h e development d e v e l o p m e n t assurance a s s u r a n c e process p r o c e s s defined d e f i n e d herein h e r e i n to t o identify i d e n t i f y Failure F a i l u r e Conditions C o n d i t i o n s and a n d severity s e v e r i t y classifications c l a s s i f i c a t i o n s which w h i c h are a r e used u s e d to t o derive d e r i v e the t h e level l e v e l of o f rigor r i g o r required r e q u i r e d for f o r development. d e v e l o p m e n t . Complex C o m p l e x systems s y s t e m s and a n d integrated i n t e g r a t e d aircraft a i r c r a f t level l e v e l functions f u n c t i o n s present p r e s e n t greater g r e a t e r risk r i s k of o f development d e v e l o p m e n t error e r r o r (requirements ( r e q u i r e m e n t s determination d e t e r m i n a t i o n and a n d design d e s i g n errors) e r r o r s ) and a n d undesirable, u n d e s i r a b l e , unintended u n i n t e n d e d effects. e f f e c t s . At A t the t h e same s a m e time t i m e it i t is i s generally g e n e r a l l y not n o t practical p r a c t i c a l (and ( a n d may m a y not n o t even e v e n be b e possible) p o s s i b l e ) to t o develop d e v e l o p a a finite f i n i t e test t e s t suite s u i t e for f o r highly-integrated h i g h l y - i n t e g r a t e d and a n d complex c o m p l e x systems s y s t e m s which w h i c h conclusively c o n c l u s i v e l y demonstrates d e m o n s t r a t e s that t h a t there t h e r e are a r e no n o residual r e s i d u a l development d e v e l o p m e n t errors. e r r o r s . Since S i n c e these t h e s e errors e r r o r s are a r e generally g e n e r a l l y not n o t deterministic d e t e r m i n i s t i c and a n d suitable s u i t a b l e numerical n u m e r i c a l methods m e t h o d s for f o r characterizing c h a r a c t e r i z i n g them t h e m are a r e not n o t available, a v a i l a b l e , other o t h e r qualitative q u a l i t a t i v e means m e a n s should s h o u l d be b e used u s e d to t o establish e s t a b l i s h that t h a t the t h e system s y s t e m can c a n satisfy s a t i s f y safety s a f e t y objectives o b j e c t i v e s . . Furthermore F u r t h e r m o r e there t h e r e is i s no n o direct d i r e c t correlation c o r r e l a t i o n between b e t w e e n function f u n c t i o n development d e v e l o p m e n t assurance a s s u r a n c e level l e v e l (FOAL) ( F O A L ) and a n d numerical n u m e r i c a l probabilities. p r o b a b i l i t i e s . The T h e safety s a f e t y objectives o b j e c t i v e s associated a s s o c i a t e d with w i t h Failure F a i l u r e Condition C o n d i t i o n classifications c l a s s i f i c a t i o n s can c a n be b e satisfied s a t i s f i e d by b y both b o t h the t h e designated d e s i g n a t e d function f u n c t i o n development d e v e l o p m e n t assurance a s s u r a n c e rigor r i g o r and a n d by b y numerical n u m e r i c a l analysis a n a l y s i s methods m e t h o d s (as ( a s needed). n e e d e d ) . These T h e s e two t w o separate s e p a r a t e methods, m e t h o d s , in i n general, g e n e r a l , are a r e not n o t related r e l a t e d and a n d do d o not n o t complement c o m p l e m e n t each e a c h other. o t h e r . In I n this t h i s context, c o n t e x t , this t h i s ARP4754A/ED-79A A R P 4 7 5 4 A / E D - 7 9 A regards r e g a r d s the t h e activities a c t i v i t i e s of o f D0-1788/ED-128 D 0 - 1 7 8 8 / E D - 1 2 8 and a n d D0-254/ED-80 D 0 - 2 5 4 / E D - 8 0 as a s a a means m e a n s to t o implement i m p l e m e n t the t h e development d e v e l o p m e n t assurance a s s u r a n c e rigor r i g o r for f o r the t h e software s o f t w a r e and a n d electronic e l e c t r o n i c hardware h a r d w a r e items. i t e m s . These T h e s e software s o f t w a r e and a n d electronic e l e c t r o n i c hardware h a r d w a r e related r e l a t e d processes p r o c e s s e s are a r e no n o longer l o n g e r considered c o n s i d e r e d to t o be b e adequate a d e q u a t e to t o mitigate m i t i g a t e aircraft/system a i r c r a f t / s y s t e m errors e r r o r s without w i t h o u t a a development d e v e l o p m e n t assurance a s s u r a n c e process p r o c e s s from f r o m aircraft a i r c r a f t level l e v e l down d o w n to t o item i t e m level, l e v e l , as a s shown s h o w n in i n Figure F i g u r e 5. 5 . granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true} Downloaded D o w n l o a d e d from f r o m SAE S A E International I n t e r n a t i o n a l by b y David D a v i d Merrill, M e r r i l l , Saturday, S a t u r d a y , November N o v e m b e r 12, 1 2 , 2016 2 0 1 6 SAE S A E ARP4754A A R P 4 7 5 4 A Page P a g e 23 2 3 of o f 115 1 1 5 Section S e c t i o n 5.2 5 . 2 provides p r o v i d e s the t h e guidelines g u i d e l i n e s for f o r assigning a s s i g n i n g the t h e FOALs F O A L s and a n d IOALs I O A L s starting s t a r t i n g from f r o m the t h e aircraft a i r c r a f t level l e v e l through t h r o u g h to t o item i t e m level l e v e l requirements. r e q u i r e m e n t s . The T h e objectives o b j e c t i v e s for f o r accomplishment a c c o m p l i s h m e n t of o f each e a c h FOAL F O A L are a r e outlined o u t l i n e d in i n Appendix A p p e n d i x A A The T h e objectives o b j e c t i v e s for f o r accomplishment a c c o m p l i s h m e n t of o f each e a c h IOAL I O A L are a r e per p e r 00-1788/E0-128 0 0 - 1 7 8 8 / E 0 - 1 2 8 and a n d 00-254/E0-80 0 0 - 2 5 4 / E 0 - 8 0 for f o r software s o f t w a r e and a n d electronic e l e c t r o n i c hardware h a r d w a r e items, i t e m s , respectively r e s p e c t i v e l y . . In I n summary, s u m m a r y , development d e v e l o p m e n t assurance a s s u r a n c e is i s a a process p r o c e s s based b a s e d approach a p p r o a c h which w h i c h establishes e s t a b l i s h e s confidence c o n f i d e n c e that t h a t system s y s t e m development d e v e l o p m e n t has h a s been b e e n accomplished a c c o m p l i s h e d in i n a a sufficiently s u f f i c i e n t l y disciplined d i s c i p l i n e d manner m a n n e r to t o limit l i m i t the t h e likelihood l i k e l i h o o d of o f development d e v e l o p m e n t errors e r r o r s that t h a t could c o u l d impact i m p a c t aircraft a i r c r a f t safety. s a f e t y . 4.1.3 4 . 1 . 3 Introduction I n t r o d u c t i o n to t o Hierarchical H i e r a r c h i c a l Safety S a f e t y Requirements R e q u i r e m e n t s Generated G e n e r a t e d from f r o m Safety S a f e t y Analyses A n a l y s e s Safety S a f e t y requirements r e q u i r e m e n t s exist e x i s t at a t the t h e aircraft, a i r c r a f t , system, s y s t e m , and a n d item i t e m level. l e v e l . Types T y p e s of o f safety s a f e t y requirements r e q u i r e m e n t s include i n c l u d e independence, i n d e p e n d e n c e , quantitative q u a n t i t a t i v e (probabilistic), ( p r o b a b i l i s t i c ) , qualitative, q u a l i t a t i v e , availability, a v a i l a b i l i t y , integrity, i n t e g r i t y , monitoring, m o n i t o r i n g , FOAL, F O A L , operational o p e r a t i o n a l and a n d maintenance m a i n t e n a n c e requirements. r e q u i r e m e n t s . Safety S a f e t y requirements r e q u i r e m e n t s are a r e functionally f u n c t i o n a l l y decomposed d e c o m p o s e d from f r o m aircraft a i r c r a f t level l e v e l function f u n c t i o n to t o item i t e m level l e v e l in i n a a hierarchical h i e r a r c h i c a l structure s t r u c t u r e . . At A t aircraft a i r c r a f t level l e v e l the t h e safety s a f e t y requirements r e q u i r e m e n t s are a r e those t h o s e requirements r e q u i r e m e n t s generated g e n e r a t e d from f r o m the t h e aircraft a i r c r a f t FHA F H A based b a s e d on o n aircraft a i r c r a f t functions f u n c t i o n s e.g. e . g . directional d i r e c t i o n a l control, c o n t r o l , deceleration d e c e l e r a t i o n on o n ground, g r o u n d , etc. e t c . At A t system s y s t e m level, l e v e l , the t h e safety s a f e t y requirements r e q u i r e m e n t s are a r e all a l l those t h o s e system s y s t e m level l e v e l requirements r e q u i r e m e n t s generated g e n e r a t e d from f r o m the t h e system s y s t e m FHA F H A which w h i c h are a r e decompositions d e c o m p o s i t i o n s of o f the t h e aircraft a i r c r a f t level l e v e l safety s a f e t y requirements. r e q u i r e m e n t s . At A t the t h e next n e x t level l e v e l down d o w n the t h e requirements r e q u i r e m e n t s are a r e all a l l those t h o s e aspects a s p e c t s of o f the t h e system s y s t e m which w h i c h allow a l l o w the t h e safety s a f e t y objectives o b j e c t i v e s associated a s s o c i a t e d with w i t h the t h e system s y s t e m FHA F H A classifications c l a s s i f i c a t i o n s to t o be b e satisfied. s a t i s f i e d . Figure F i g u r e 5 5 illustrates i l l u s t r a t e s the t h e various v a r i o u s requirement r e q u i r e m e n t levels. l e v e l s . Safety S a f e t y requirements r e q u i r e m e n t s may m a y also a l s o be b e generated g e n e r a t e d from f r o m Common C o m m o n Cause C a u s e Analyses A n a l y s e s . . granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true} I I I I +- + - IDENTIFICATION I D E N T I F I C A T I O N I I a:, a : , : : I I Aircraft A i r c r a f t CCA C C A 0 0 DO D O I I I I I I Q Q I I . . t t i i I I ., . , I I ẓ ẓ I I ., . , . . 0 0 I I AIRCRAFT A I R C R A F T VERIFICATION V E R I F I C A T I O N 5.5 5 . 5 System S y s t e m SSA S S A - - II I I System S y s t e m CCA C C A :I : I iI- i I - System S y s t e m FTA F T A I I I. I . - - SystemCMA S y s t e m C M A System S y s t e m CMA C M A System S y s t e m FMEA/ F M E A / FMES F M E S Validation V a l i d a t i o n of! o f ! I I : : I I I I Hardware H a r d w a r e Design D e s i g n I I ; ; / / I I I I I I I I I I I I I I ! ! "" " " / / I I Software S o f t w a r e Design D e s i g n I I ARP4754A A R P 4 7 5 4 A Process P r o c e s s I I D0-1788/D0-254 D 0 - 1 7 8 8 / D 0 - 2 5 4 Process P r o c e s s I I ED-128/ED-80 E D - 1 2 8 / E D - 8 0 Process P r o c e s s m m AIRCRAFT A I R C R A F T w w SYSTEM S Y S T E M I I ITEM I T E M I I I I ITEM I T E M I I REQUIREMENTS R E Q U I R E M E N T S REQUIREMENTS R E Q U I R E M E N T S I I REQUIREMENTS R E Q U I R E M E N T S I I ITEM I T E M DESIGN D E S I G N I I I I SYSTEM S Y S T E M IDENTIFICATION I D E N T I F I C A T I O N IDENTIFICATION I D E N T I F I C A T I O N I I I I - - I I . . VERIFICATION V E R I F I C A T I O N + + VERIFICATION V E R I F I C A T I O N 1 1 4.1.5 4 . 1 . 5 & & 4.3 4 . 3 : : 4.1.7 4 . 1 . 7 & & 4.5 4 . 5 I I 4.6.2 4 . 6 . 2 & & 4.6.3 4 . 6 . 3 I I 5.5 5 . 5 I I 5.5 5 . 5 I I I I I I I I I I ... . . . I I I I I I I I ... . . . I I I I I I I I t::I t : : I I I Q Q [ [ Q Q I I .........,! . . . . . . . . . , ! ... . . . ::;, : : ; , Q Q 9 9 r:,, r : , , I I PSSA P S S A Ii I i -<.1h - < . 1 h I I I I I I ,, , , I I Bottom B o t t o m Up U p I I I I ... . . . :ḷ : ḷ )> ) > = = !!?. ! ! ? . I I I I Safety S a f e t y ::0 : : 0 I I -u - u I I i7 i 7 I I I I Requirements R e q u i r e m e n t s I I I I Verification V e r i f i c a t i o n .,l:l,. . , l : l , . -..J - . . J t::I t : : I DO D O I I 01 0 1 s; s ; I I I I ... . . . I I I I I I r:,, r : , , I I DO D O I I I.,: I . , : I I I I :. : . D D < < O O I I Q Q I I I I 9 9 I I C' C ' I I ... . . . I I N N I I N=... N = . . . FIGURE F I G U R E 5 5 - - INTERACTION I N T E R A C T I O N BETWEEN B E T W E E N SAFETY S A F E T Y AND A N D DEVELOPMENT D E V E L O P M E N T PROCESSES P R O C E S S E S -u - u !l) ! l ) :a : a CD C D I\..) I \ . . ) .,l:l,. . , l : l , . ạ ạ ...... . . . . . . ....... . . . . . . . 01 0 1 C C granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true} Downloaded D o w n l o a d e d from f r o m SAE S A E International I n t e r n a t i o n a l by b y David D a v i d Merrill, M e r r i l l , Saturday, S a t u r d a y , November N o v e m b e r 12, 1 2 , 2016 2 0 1 6 SAE S A E ARP4754A A R P 4 7 5 4 A Page P a g e 25 2 5 of o f 115 1 1 5 4.1.4 4 . 1 . 4 Identification I d e n t i f i c a t i o n of o f Aircraft-Level A i r c r a f t - L e v e l Functions, F u n c t i o n s , Function F u n c t i o n Requirements R e q u i r e m e n t s and a n d Function F u n c t i o n Interfaces I n t e r f a c e s This T h i s activity a c t i v i t y establishes e s t a b l i s h e s basic b a s i c aircraft a i r c r a f t level l e v e l performance p e r f o r m a n c e and a n d operational o p e r a t i o n a l requirements. r e q u i r e m e n t s . From F r o m these t h e s e basic b a s i c requirements, r e q u i r e m e n t s , aircraft a i r c r a f t level l e v e l functions f u n c t i o n s and a n d their t h e i r requirements r e q u i r e m e n t s can c a n be b e established e s t a b l i s h e d and a n d the t h e function f u n c t i o n interfaces i n t e r f a c e s with w i t h the t h e external e x t e r n a l physical p h y s i c a l and a n d operational o p e r a t i o n a l environment e n v i r o n m e n t identified. i d e n t i f i e d . Aircraft-level A i r c r a f t - l e v e l functions f u n c t i o n s are a r e high-level h i g h - l e v e l activities a c t i v i t i e s and a n d are a r e not n o t necessarily n e c e s s a r i l y associated a s s o c i a t e d with w i t h a a single, s i n g l e , physical p h y s i c a l system s y s t e m implementation i m p l e m e n t a t i o n . . The T h e output o u t p u t of o f this t h i s activity a c t i v i t y is i s a a list l i s t of o f aircraft-level a i r c r a f t - l e v e l functions f u n c t i o n s and a n d the t h e associated a s s o c i a t e d function f u n c t i o n requirements r e q u i r e m e n t s and a n d interfaces i n t e r f a c e s for f o r these t h e s e functions. f u n c t i o n s . 4.1.5 4 . 1 . 5 Allocation A l l o c a t i o n of o f Aircraft A i r c r a f t Functions F u n c t i o n s to t o Systems S y s t e m s This T h i s level l e v e l of o f activity a c t i v i t y establishes e s t a b l i s h e s the t h e appropriate a p p r o p r i a t e grouping g r o u p i n g of o f aircraft a i r c r a f t functions f u n c t i o n s and a n d the t h e allocation a l l o c a t i o n of o f the t h e requirements r e q u i r e m e n t s for f o r these t h e s e functions f u n c t i o n s to t o systems. s y s t e m s . The T h e output o u t p u t of o f this t h i s activity a c t i v i t y is i s a a set s e t of o f requirements r e q u i r e m e n t s for f o r each e a c h aircraft a i r c r a f t system s y s t e m including i n c l u d i n g their t h e i r associated a s s o c i a t e d interfaces. i n t e r f a c e s . 4.1.6 4 . 1 . 6 Development D e v e l o p m e n t of o f System S y s t e m Architecture A r c h i t e c t u r e The T h e system s y s t e m architecture a r c h i t e c t u r e is i s accomplished a c c o m p l i s h e d as a s a a part p a r t of o f this t h i s process p r o c e s s activity. a c t i v i t y . This T h i s system s y s t e m architecture a r c h i t e c t u r e establishes e s t a b l i s h e s the t h e structure s t r u c t u r e and a n d boundaries b o u n d a r i e s within w i t h i n which w h i c h specific s p e c i f i c item i t e m designs d e s i g n s are a r e implemented i m p l e m e n t e d to t o meet m e e t all a l l of o f the t h e established e s t a b l i s h e d safety s a f e t y and a n d technical t e c h n i c a l performance p e r f o r m a n c e requirements. r e q u i r e m e n t s . The T h e outputs o u t p u t s of o f this t h i s activity a c t i v i t y include i n c l u d e the t h e system s y s t e m architecture a r c h i t e c t u r e to t o the t h e item i t e m level l e v e l and a n d the t h e allocation a l l o c a t i o n of o f system s y s t e m function f u n c t i o n and a n d safety s a f e t y requirements r e q u i r e m e n t s to t o the t h e appropriate a p p r o p r i a t e items. i t e m s . 4.1.7 4 . 1 . 7 Allocation A l l o c a t i o n of o f System S y s t e m Requirements R e q u i r e m e n t s to t o Items I t e m s In I n practice, p r a c t i c e , system s y s t e m architecture a r c h i t e c t u r e development d e v e l o p m e n t and a n d the t h e allocation a l l o c a t i o n of o f requirements r e q u i r e m e n t s are a r e tightly-coupled, t i g h t l y - c o u p l e d , iterative i t e r a t i v e processes. p r o c e s s e s . With W i t h each e a c h iteration i t e r a t i o n cycle, c y c l e , the t h e identification i d e n t i f i c a t i o n and a n d understanding u n d e r s t a n d i n g of o f the t h e requirements r e q u i r e m e n t s increases i n c r e a s e s and a n d the t h e allocation a l l o c a t i o n of o f the t h e system-level s y s t e m - l e v e l requirements r e q u i r e m e n t s to t o hardware h a r d w a r e or o r software s o f t w a r e items i t e m s becomes b e c o m e s clearer. c l e a r e r . Outputs O u t p u t s of o f this t h i s allocation a l l o c a t i o n effort e f f o r t are a r e requirements r e q u i r e m e n t s allocated a l l o c a t e d to t o hardware h a r d w a r e and a n d software, s o f t w a r e , inclusive i n c l u s i v e of o f safety s a f e t y objectives, o b j e c t i v e s , development d e v e l o p m e n t assurance a s s u r a n c e levels l e v e l s and a n d function/performance f u n c t i o n / p e r f o r m a n c e requirements. r e q u i r e m e n t s . 4.1.8 4 . 1 . 8 System S y s t e m Implementation I m p l e m e n t a t i o n The T h e System S y s t e m Implementation I m p l e m e n t a t i o n stage s t a g e of o f the t h e process p r o c e s s model m o d e l interfaces i n t e r f a c e s the t h e system s y s t e m process p r o c e s s model m o d e l described d e s c r i b e d in i n this t h i s document d o c u m e n t and a n d the t h e D0-1788/ED-128 D 0 - 1 7 8 8 / E D - 1 2 8 software s o f t w a r e and a n d D0-254/ED-80 D 0 - 2 5 4 / E D - 8 0 electronic e l e c t r o n i c hardware h a r d w a r e development d e v e l o p m e n t process p r o c e s s life-cycle l i f e - c y c l e guidance g u i d a n c e documents. d o c u m e n t s . This T h i s stage s t a g e also a l s o provides p r o v i d e s the t h e tasks t a s k s for f o r ensuring e n s u r i n g the t h e aircraft a i r c r a f t systems s y s t e m s individually i n d i v i d u a l l y and a n d collectively c o l l e c t i v e l y operate o p e r a t e correctly. c o r r e c t l y . The T h e outputs o u t p u t s of o f this t h i s phase p h a s e include i n c l u d e hardware-software h a r d w a r e - s o f t w a r e integration i n t e g r a t i o n procedures, p r o c e d u r e s , system s y s t e m integration i n t e g r a t i o n procedures, p r o c e d u r e s , released r e l e a s e d hardware h a r d w a r e drawings, d r a w i n g s , software s o f t w a r e source s o u r c e code c o d e together t o g e t h e r with w i t h related r e l a t e d documentation, d o c u m e n t a t i o n , applicable a p p l i c a b l e development d e v e l o p m e n t assurance a s s u r a n c e data, d a t a , breadboard b r e a d b o a r d or o r prototype p r o t o t y p e hardware, h a r d w a r e , if i f applicable; a p p l i c a b l e ; and a n d lab/flight l a b / f l i g h t test t e s t articles. a r t i c l e s . 4.2 4 . 2 Aircraft A i r c r a f t Function F u n c t i o n Development D e v e l o p m e n t While W h i l e Figure F i g u r e 4 4 illustrates i l l u s t r a t e s the t h e generic g e n e r i c system s y s t e m development d e v e l o p m e n t process, p r o c e s s , Figure F i g u r e 6 6 shows s h o w s an a n aircraft a i r c r a f t function f u n c t i o n implementation i m p l e m e n t a t i o n process. p r o c e s s . The T h e model m o d e l includes i n c l u d e s multiple m u l t i p l e system s y s t e m development d e v e l o p m e n t processes. p r o c e s s e s . Each E a c h system s y s t e m development d e v e l o p m e n t process p r o c e s s can c a n consist c o n s i s t of o f multiple m u l t i p l e item i t e m development d e v e l o p m e n t processes. p r o c e s s e s . There T h e r e are a r e certain c e r t a i n integral i n t e g r a l processes p r o c e s s e s that t h a t take t a k e place p l a c e repetitively r e p e t i t i v e l y during d u r i n g each e a c h of o f the t h e development d e v e l o p m e n t activities. a c t i v i t i e s . Most M o s t actual a c t u a l system s y s t e m development d e v e l o p m e n t processes p r o c e s s e s involve i n v o l v e many m a n y iterative i t e r a t i v e cycles, c y c l e s , making m a k i n g the t h e experience e x p e r i e n c e appear a p p e a r more m o r e cyclic c y c l i c than t h a n sequential. s e q u e n t i a l . The T h e entry e n t r y point p o i n t for f o r aircraft a i r c r a f t function f u n c t i o n implementation i m p l e m e n t a t i o n may m a y occur o c c u r at a t any a n y point p o i n t in i n the t h e cycle. c y c l e . For F o r a a new n e w aircraft a i r c r a f t level l e v e l function, f u n c t i o n , the t h e process p r o c e s s begins b e g i n s with w i t h the t h e top-level t o p - l e v e l definition d e f i n i t i o n of o f functions. f u n c t i o n s . For F o r adding a d d i n g functions f u n c t i o n s to t o an a n aircraft, a i r c r a f t , the t h e entry e n t r y point p o i n t may m a y occur o c c u r in i n the t h e context c o n t e x t of o f changes c h a n g e s to t o a a particular p a r t i c u l a r item. i t e m . However, H o w e v e r , regardless r e g a r d l e s s of o f the t h e entry e n t r y point, p o i n t , an a n assessment a s s e s s m e n t of o f the t h e impact i m p a c t of o f the t h e new n e w or o r modified m o d i f i e d function f u n c t i o n on o n other o t h e r aircraft-level a i r c r a f t - l e v e l functions f u n c t i o n s and a n d their t h e i r supporting s u p p o r t i n g requirements r e q u i r e m e n t s is i s necessary. n e c e s s a r y . In I n practice p r a c t i c e many m a n y of o f the t h e development d e v e l o p m e n t activities a c t i v i t i e s shown s h o w n in i n Figure F i g u r e 6 6 are a r e concurrent c o n c u r r e n t and a n d may m a y involve i n v o l v e interactive i n t e r a c t i v e dependencies d e p e n d e n c i e s that t h a t lead l e a d to t o alteration a l t e r a t i o n of o f previously p r e v i o u s l y established e s t a b l i s h e d requirements. r e q u i r e m e n t s . granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true} Downloaded D o w n l o a d e d from f r o m SAE S A E International I n t e r n a t i o n a l by b y David D a v i d Merrill, M e r r i l l , Saturday, S a t u r d a y , November N o v e m b e r 12, 1 2 , 2016 2 0 1 6 SAE S A E ARP4754A A R P 4 7 5 4 A Page P a g e 26 2 6 of o f 115 1 1 5 As A s part p a r t of o f the t h e function f u n c t i o n requirements r e q u i r e m e n t s allocation a l l o c a t i o n process, p r o c e s s , the t h e associated a s s o c i a t e d Failure F a i l u r e Condition C o n d i t i o n classification c l a s s i f i c a t i o n information i n f o r m a t i o n should s h o u l d be b e stated s t a t e d explicitly e x p l i c i t l y . . This T h i s provides p r o v i d e s traceability t r a c e a b i l i t y in i n order o r d e r to t o substantiate s u b s t a n t i a t e any a n y advantage a d v a n t a g e from f r o m further f u r t h e r architectural a r c h i t e c t u r a l partitioning p a r t i t i o n i n g . . Derived D e r i v e d requirements r e q u i r e m e n t s again a g a i n emerge e m e r g e from f r o m this t h i s portion p o r t i o n of o f the t h e allocation a l l o c a t i o n process, p r o c e s s , and a n d should s h o u l d be b e validated v a l i d a t e d and a n d their t h e i r impact i m p a c t on o n safety s a f e t y determined. d e t e r m i n e d . Typical T y p i c a l aircraft a i r c r a f t functions f u n c t i o n s may m a y include: i n c l u d e : a. a . Flight F l i g h t Control C o n t r o l b. b . Ground G r o u n d Steering S t e e r i n g C. C . Aircraft A i r c r a f t Aspects A s p e c t s of o f ATC A T C d. d . Automatic A u t o m a t i c Flight F l i g h t Control C o n t r o l e. e . Cargo C a r g o Handling H a n d l i n g f. f . Engine E n g i n e Control C o n t r o l g. g . Collision C o l l i s i o n Avoidance A v o i d a n c e h. h . Ground G r o u n d Deceleration D e c e l e r a t i o n i. i . Environmental E n v i r o n m e n t a l Control C o n t r o l j j . . Passenger P a s s e n g e r Comfort C o m f o r t k. k . Communication C o m m u n i c a t i o n I. I . Guidance G u i d a n c e m. m . Navigation N a v i g a t i o n n. n . Passenger P a s s e n g e r Safety S a f e t y When W h e n this t h i s document d o c u m e n t is i s applied a p p l i e d to t o engine e n g i n e development, d e v e l o p m e n t , typical t y p i c a l engine e n g i n e functions f u n c t i o n s may m a y include: i n c l u d e : a. a . Modulate M o d u l a t e Thrust T h r u s t b. b . Thrust T h r u s t Reverser R e v e r s e r Control C o n t r o l c. c . Passenger P a s s e n g e r Safety S a f e t y d. d . Aircraft A i r c r a f t Communication C o m m u n i c a t i o n e. e . Engine E n g i n e Health H e a l t h Monitoring M o n i t o r i n g When W h e n this t h i s document d o c u m e n t is i s applied a p p l i e d to t o propeller p r o p e l l e r development, d e v e l o p m e n t , typical t y p i c a l propeller p r o p e l l e r functions f u n c t i o n s may m a y include: i n c l u d e : a. a . Modulate M o d u l a t e Speed S p e e d b. b . Passenger P a s s e n g e r Safety S a f e t y c. c . Modulate M o d u l a t e Pitch P i t c h of o f Blade B l a d e granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true} IMPLEMENTATION I M P L E M E N T A T I O N VERIFICATION V E R I F I C A T I O N CONFIGURATION C O N F I G U R A T I O N MANAGEMENT M A N A G E M E N T PROCESS P R O C E S S ASSURANCE A S S U R A N C E HARDWARE H A R D W A R E DEVELOPME D E V E L O P M E NT N T LIFE- L I F E - CYCLE C Y C L E SOFTWARE S O F T W A R E DEVELOPME D E V E L O P M E NT N T LIFE- L I F E - CYCLE C Y C L E - - Downloaded D o w n l o a d e d from f r o m SAE S A E International I n t e r n a t i o n a l by b y David D a v i d Merrill, M e r r i l l , Saturday, S a t u r d a y , November N o v e m b e r 12, 1 2 , 2016 2 0 1 6 SAE S A E ARP4754A A R P 4 7 5 4 A Page P a g e 27 2 7 of o f 115 1 1 5 r r 'I ' I Integral I n t e g r a l Processes P r o c e s s e s .i . i Aircraft A i r c r a f t Function F u n c t i o n z z I I Aircraft A i r c r a f t Function F u n c t i o n 2 2 I I Aircraft A i r c r a f t Function F u n c t i o n 1 1 .i . i System S y s t e m y y I I System S y s t e m 2 2 I I System S y s t e m 1 1 vt v t .iI . i I I I Sub-System S u b - S y s t e m x x Sub-Svstem S u b - S v s t e m 2 2 Sub-System S u b - S y s t e m 1 1 .iI . i I I I \. \ . ,J , J I I I I i i ;::... ; : : . . . I I 1\ 1 \ I I f-- f - - - - f-- f - - - - - - Sub-System S u b - S y s t e m Development D e v e l o p m e n t - - System S y s t e m Development D e v e l o p m e n t f-- f - - f-- f - - - - Aircraft A i r c r a f t Function F u n c t i o n Development D e v e l o p m e n t - - FIGURE F I G U R E 6 6 - - AIRCRAFT A I R C R A F T FUNCTION F U N C T I O N IMPLEMENTATION I M P L E M E N T A T I O N PROCESS P R O C E S S DEVELOPMENT D E V E L O P M E N T ASSURANCE A S S U R A N C E LEVEL L E V E L CERTIFICATION C E R T I F I C A T I O N COORDINATION C O O R D I N A T I O N SAFETY S A F E T Y ASSESSMENT A S S E S S M E N T REQUIREMENTS R E Q U I R E M E N T S CAPTURE C A P T U R E REQUIREMENTS R E Q U I R E M E N T S VALIDATION V A L I D A T I O N granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true} Downloaded D o w n l o a d e d from f r o m SAE S A E International I n t e r n a t i o n a l by b y David D a v i d Merrill, M e r r i l l , Saturday, S a t u r d a y , November N o v e m b e r 12, 1 2 , 2016 2 0 1 6 SAE S A E ARP4754A A R P 4 7 5 4 A Page P a g e 28 2 8 of o f 115 1 1 5 4.3 4 . 3 Allocation A l l o c a t i o n of o f Aircraft A i r c r a f t Functions F u n c t i o n s to t o Systems S y s t e m s The T h e next n e x t level l e v e l of o f activity a c t i v i t y consists c o n s i s t s of o f establishing e s t a b l i s h i n g the t h e appropriate a p p r o p r i a t e grouping g r o u p i n g of o f aircraft a i r c r a f t functions f u n c t i o n s and a n d the t h e allocation a l l o c a t i o n of o f the t h e related r e l a t e d requirements r e q u i r e m e n t s (including ( i n c l u d i n g requirements r e q u i r e m e n t s from f r o m the t h e aircraft a i r c r a f t level l e v e l FHA) F H A ) to t o systems. s y s t e m s . The T h e process p r o c e s s for f o r selecting s e l e c t i n g the t h e appropriate a p p r o p r i a t e functional f u n c t i o n a l grouping g r o u p i n g out o u t of o f the t h e range r a n g e of o f possible p o s s i b l e groupings g r o u p i n g s is i s often o f t e n complicated. c o m p l i c a t e d . No N o specific s p e c i f i c recommendations r e c o m m e n d a t i o n s for f o r accomplishing a c c o m p l i s h i n g the t h e grouping g r o u p i n g activity a c t i v i t y are a r e provided p r o v i d e d in i n this t h i s document. d o c u m e n t . However, H o w e v e r , careful c a r e f u l attention a t t e n t i o n to t o the t h e basis b a s i s for f o r the t h e selection s e l e c t i o n decisions d e c i s i o n s including i n c l u d i n g related r e l a t e d assumptions a s s u m p t i o n s is i s fundamental f u n d a m e n t a l to t o the t h e success s u c c e s s of o f subsequent s u b s e q u e n t processes. p r o c e s s e s . The T h e functional f u n c t i o n a l groupings g r o u p i n g s interact i n t e r a c t with w i t h the t h e aircraft a i r c r a f t architecture a r c h i t e c t u r e and a n d are a r e the t h e basis b a s i s for f o r system s y s t e m architecture a r c h i t e c t u r e development. d e v e l o p m e n t . While W h i l e it i t is i s not n o t necessary n e c e s s a r y to t o know k n o w in i n detail d e t a i l how h o w a a system s y s t e m will w i l l be b e implemented i m p l e m e n t e d to t o accomplish a c c o m p l i s h the t h e necessary n e c e s s a r y functional f u n c t i o n a l groupings, g r o u p i n g s , implementation i m p l e m e n t a t i o n constraints, c o n s t r a i n t s , failure f a i l u r e effects, e f f e c t s , and a n d life-cycle l i f e - c y c l e support s u p p o r t may m a y all a l l play p l a y a a significant s i g n i f i c a n t role r o l e in i n selecting s e l e c t i n g the t h e most m o s t appropriate a p p r o p r i a t e groupings. g r o u p i n g s . The T h e allocation a l l o c a t i o n should s h o u l d also a l s o define d e f i n e inputs, i n p u t s , processes p r o c e s s e s performed p e r f o r m e d and a n d outputs o u t p u t s and a n d consider c o n s i d e r operational o p e r a t i o n a l and a n d support s u p p o r t aspects. a s p e c t s . Assumptions A s s u m p t i o n s that t h a t are a r e made m a d e in i n the t h e course c o u r s e of o f this t h i s process p r o c e s s become b e c o m e a a vital v i t a l part p a r t of o f the t h e overall o v e r a l l system s y s t e m requirements r e q u i r e m e n t s package p a c k a g e and a n d are a r e subject s u b j e c t to t o the t h e same s a m e validation v a l i d a t i o n activity a c t i v i t y as a s are a r e other o t h e r requirements. r e q u i r e m e n t s . From F r o m the t h e function f u n c t i o n allocations a l l o c a t i o n s and a n d the t h e associated a s s o c i a t e d failure f a i l u r e consequences, c o n s e q u e n c e s , further f u r t h e r specific s p e c i f i c system s y s t e m requirements r e q u i r e m e n t s necessary n e c e s s a r y to t o achieve a c h i e v e the t h e safety s a f e t y objectives o b j e c t i v e s are a r e determined. d e t e r m i n e d . Derived D e r i v e d requirements r e q u i r e m e n t s and a n d additional a d d i t i o n a l assumptions a s s u m p t i o n s will w i l l emerge e m e r g e during d u r i n g this t h i s phase p h a s e as a s the t h e consequences c o n s e q u e n c e s of o f the t h e various v a r i o u s combinations c o m b i n a t i o n s of o f functions, f u n c t i o n s , allocations a l l o c a t i o n s to t o systems s y s t e m s and a n d to t o people p e o p l e are a r e considered. c o n s i d e r e d . These, T h e s e , in i n turn, t u r n , may m a y alter a l t e r the t h e aircraft-level a i r c r a f t - l e v e l function f u n c t i o n requirements. r e q u i r e m e n t s . The T h e output o u t p u t of o f this t h i s activity a c t i v i t y is i s a a set s e t of o f requirements r e q u i r e m e n t s for f o r each e a c h aircraft a i r c r a f t system s y s t e m together t o g e t h e r with w i t h associated a s s o c i a t e d interfaces. i n t e r f a c e s . The T h e interfaces i n t e r f a c e s should s h o u l d be b e defined d e f i n e d with w i t h all a l l inputs i n p u t s having h a v i n g a a source s o u r c e and a n d all a l l outputs o u t p u t s having h a v i n g destination(s), d e s t i n a t i o n ( s ) , either e i t h e r human h u m a n or o r another a n o t h e r system. s y s t e m . 4.4 4 . 4 Development D e v e l o p m e n t of o f System S y s t e m Architecture: A r c h i t e c t u r e : The T h e system s y s t e m architecture a r c h i t e c t u r e establishes e s t a b l i s h e s the t h e structure s t r u c t u r e and a n d boundaries b o u n d a r i e s within w i t h i n which w h i c h specific s p e c i f i c item i t e m designs d e s i g n s are a r e implemented i m p l e m e n t e d to t o meet m e e t the t h e established e s t a b l i s h e d requirements. r e q u i r e m e n t s . More M o r e than t h a n one o n e candidate c a n d i d a t e system s y s t e m architecture a r c h i t e c t u r e may m a y be b e considered c o n s i d e r e d for f o r implementation. i m p l e m e n t a t i o n . These T h e s e candidate c a n d i d a t e system s y s t e m architectures a r c h i t e c t u r e s may m a y be b e evaluated e v a l u a t e d using u s i n g such s u c h factors f a c t o r s as a s technology t e c h n o l o g y readiness, r e a d i n e s s , implementation i m p l e m e n t a t i o n schedules, s c h e d u l e s , producibility, p r o d u c i b i l i t y , contractual c o n t r a c t u a l obligations, o b l i g a t i o n s , economics, e c o n o m i c s , prior p r i o r experience e x p e r i e n c e and a n d industry i n d u s t r y precedence. p r e c e d e n c e . The T h e candidate c a n d i d a t e architectures a r c h i t e c t u r e s are a r e then t h e n iteratively i t e r a t i v e l y evaluated e v a l u a t e d using u s i n g functional f u n c t i o n a l and a n d performance p e r f o r m a n c e analyses, a n a l y s e s , the t h e Preliminary P r e l i m i n a r y Aircraft A i r c r a f t Safety S a f e t y Assessment A s s e s s m e n t (PASA) ( P A S A ) I I Preliminary P r e l i m i n a r y System S y s t e m Safety S a f e t y Assessment A s s e s s m e n t (PSSA) ( P S S A ) and a n d Common C o m m o n Cause C a u s e Analysis A n a l y s i s (CCA) ( C C A ) processes p r o c e s s e s to t o establish e s t a b l i s h feasibility f e a s i b i l i t y in i n meeting m e e t i n g the t h e function f u n c t i o n and a n d top t o p level l e v e l safety s a f e t y requirements r e q u i r e m e n t s assigned a s s i g n e d to t o the t h e system. s y s t e m . Guidelines G u i d e l i n e s for f o r performing p e r f o r m i n g the t h e PASNPSSA P A S N P S S A and a n d CCA C C A are a r e summarized s u m m a r i z e d in i n sections s e c t i o n s 5.1.2 5 . 1 . 2 and a n d 5.1.4, 5 . 1 . 4 , respectively. r e s p e c t i v e l y . Derived D e r i v e d requirements r e q u i r e m e n t s stemming s t e m m i n g from f r o m technology, t e c h n o l o g y , architecture, a r c h i t e c t u r e , system s y s t e m and a n d item i t e m interfaces, i n t e r f a c e s , or o r implementation i m p l e m e n t a t i o n choices c h o i c e s become b e c o m e more m o r e clearly c l e a r l y visible v i s i b l e as a s work w o r k on o n the t h e system s y s t e m architecture a r c h i t e c t u r e progresses. p r o g r e s s e s . The T h e potential p o t e n t i a l impact i m p a c t of o f derived d e r i v e d requirements r e q u i r e m e n t s on o n higher h i g h e r level l e v e l requirements r e q u i r e m e n t s needs n e e d s to t o be b e assessed. a s s e s s e d . The T h e outputs o u t p u t s of o f this t h i s activity a c t i v i t y are a r e the t h e definition d e f i n i t i o n of o f the t h e system s y s t e m architecture a r c h i t e c t u r e to t o the t h e item i t e m level l e v e l and a n d the t h e allocation a l l o c a t i o n of o f top t o p level l e v e l system s y s t e m functional f u n c t i o n a l and a n d associated a s s o c i a t e d lower l o w e r level l e v e l safety s a f e t y requirements. r e q u i r e m e n t s . Requirements R e q u i r e m e n t s governing g o v e r n i n g item i t e m interfaces, i n t e r f a c e s , system s y s t e m constraints c o n s t r a i n t s (physical, ( p h y s i c a l , environmental, e n v i r o n m e n t a l , etc). e t c ) . and a n d integration i n t e g r a t i o n should s h o u l d be b e included. i n c l u d e d . 4.5 4 . 5 Allocation A l l o c a t i o n of o f System S y s t e m Requirements R e q u i r e m e n t s to t o Items I t e m s In I n practice, p r a c t i c e , system s y s t e m architecture a r c h i t e c t u r e development d e v e l o p m e n t and a n d the t h e allocation a l l o c a t i o n of o f system s y s t e m requirements r e q u i r e m e n t s to t o item i t e m requirements r e q u i r e m e n t s are a r e tightly t i g h t l y coupled, c o u p l e d , iterative i t e r a t i v e processes. p r o c e s s e s . With W i t h each e a c h cycle, c y c l e , the t h e identification i d e n t i f i c a t i o n and a n d understanding u n d e r s t a n d i n g of o f derived d e r i v e d requirements r e q u i r e m e n t s increases i n c r e a s e s and a n d the t h e rationale r a t i o n a l e for f o r the t h e allocation a l l o c a t i o n of o f system-level s y s t e m - l e v e l requirements r e q u i r e m e n t s to t o hardware h a r d w a r e or o r software s o f t w a r e at a t the t h e item i t e m level l e v e l becomes b e c o m e s clearer. c l e a r e r . The T h e process p r o c e s s is i s complete c o m p l e t e when w h e n all a l l requirements r e q u i r e m e n t s can c a n be b e accommodated a c c o m m o d a t e d within w i t h i n the t h e final f i n a l architecture a r c h i t e c t u r e . . The T h e decomposition d e c o m p o s i t i o n and a n d allocation a l l o c a t i o n of o f requirements r e q u i r e m e n t s to t o items i t e m s should s h o u l d also a l s o ensure e n s u r e that t h a t the t h e item i t e m can c a n be b e shown s h o w n to t o fully f u l l y implement i m p l e m e n t the t h e allocated a l l o c a t e d requirements. r e q u i r e m e n t s . Derived D e r i v e d requirements r e q u i r e m e n t s arising a r i s i n g from f r o m allocation a l l o c a t i o n may m a y be b e system s y s t e m related r e l a t e d or o r software-hardware s o f t w a r e - h a r d w a r e related. r e l a t e d . Similarly S i m i l a r l y the t h e verification v e r i f i c a t i o n of o f implementation i m p l e m e n t a t i o n against a g a i n s t allocated a l l o c a t e d requirements r e q u i r e m e n t s may m a y be b e performed p e r f o r m e d at a t the t h e system s y s t e m level l e v e l or o r at a t the t h e item i t e m level. l e v e l . granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true} Downloaded D o w n l o a d e d from f r o m SAE S A E International I n t e r n a t i o n a l by b y David D a v i d Merrill, M e r r i l l , Saturday, S a t u r d a y , November N o v e m b e r 12, 1 2 , 2016 2 0 1 6 SAE S A E ARP4754A A R P 4 7 5 4 A Page P a g e 29 2 9 of o f 115 1 1 5 Outputs O u t p u t s of o f this t h i s allocation a l l o c a t i o n effort e f f o r t are a r e requirements r e q u i r e m e n t s allocated a l l o c a t e d to t o hardware, h a r d w a r e , with w i t h appropriate a p p r o p r i a t e safety s a f e t y objectives o b j e c t i v e s and a n d development d e v e l o p m e n t assurance a s s u r a n c e levels, l e v e l s , and a n d requirements r e q u i r e m e n t s allocated a l l o c a t e d to t o software, s o f t w a r e , including i n c l u d i n g development d e v e l o p m e n t assurance a s s u r a n c e levels, l e v e l s , for f o r each e a c h item. i t e m . Requirements R e q u i r e m e n t s governing g o v e r n i n g hardware-software h a r d w a r e - s o f t w a r e integration i n t e g r a t i o n should s h o u l d be b e included, i n c l u d e d , where w h e r e necessary n e c e s s a r y . . The T h e results r e s u l t s of o f this t h i s activity a c t i v i t y are a r e also a l s o used u s e d to t o update u p d a t e the t h e preliminary p r e l i m i n a r y system s y s t e m safety s a f e t y assessment. a s s e s s m e n t . 4.6 4 . 6 System S y s t e m Implementation I m p l e m e n t a t i o n System S y s t e m implementation i m p l e m e n t a t i o n has h a s four f o u r primary p r i m a r y points; p o i n t s ; a. a . Information I n f o r m a t i o n flow f l o w from f r o m the t h e system s y s t e m process p r o c e s s to t o the t h e hardware h a r d w a r e & & software s o f t w a r e processes p r o c e s s e s and a n d vice-versa, v i c e - v e r s a , b. b . Hardware/Software H a r d w a r e / S o f t w a r e Design D e s i g n & & Build, B u i l d , c. c . Hardware/Software H a r d w a r e / S o f t w a r e Integration I n t e g r a t i o n and a n d d. d . System S y s t e m Integration. I n t e g r a t i o n . These T h e s e are a r e further f u r t h e r discussed d i s c u s s e d in i n the t h e next n e x t sub-paragraphs s u b - p a r a g r a p h s . . 4.6.1 4 . 6 . 1 Information I n f o r m a t i o n Flow F l o w - - System S y s t e m Process P r o c e s s To T o & & From F r o m Item I t e m Process(es) P r o c e s s ( e s ) 4.6.1.1 4 . 6 . 1 . 1 Information I n f o r m a t i o n Flow F l o w From F r o m System S y s t e m Process P r o c e s s To T o Hardware/Software H a r d w a r e / S o f t w a r e Processes P r o c e s s e s System S y s t e m requirements r e q u i r e m e n t s are a r e decomposed d e c o m p o s e d and a n d allocated a l l o c a t e d to t o hardware h a r d w a r e and/or a n d / o r software s o f t w a r e as a s determined d e t e r m i n e d by b y the t h e system s y s t e m architecture. a r c h i t e c t u r e . The T h e decomposition d e c o m p o s i t i o n and a n d allocation a l l o c a t i o n of o f requirements r e q u i r e m e n t s to t o hardware h a r d w a r e and/or a n d / o r software s o f t w a r e follows f o l l o w s the t h e system s y s t e m process p r o c e s s . . The T h e interface i n t e r f a c e between b e t w e e n the t h e system s y s t e m process p r o c e s s and a n d the t h e hardware h a r d w a r e and a n d software s o f t w a r e processes p r o c e s s e s is i s dealt d e a l t with w i t h in i n the t h e following f o l l o w i n g sections. s e c t i o n s . The T h e point p o i n t where w h e r e requirements r e q u i r e m e n t s are a r e allocated a l l o c a t e d to t o hardware h a r d w a r e and a n d software s o f t w a r e items i t e m s is i s also a l s o the t h e point p o i n t where w h e r e the t h e guidelines g u i d e l i n e s of o f this t h i s document d o c u m e n t transition t r a n s i t i o n to t o the t h e guidance g u i d a n c e of o f D0-1788/ED-128 D 0 - 1 7 8 8 / E D - 1 2 8 (for ( f o r software), s o f t w a r e ) , D0-254/ED-80 D 0 - 2 5 4 / E D - 8 0 (for ( f o r electronic e l e c t r o n i c hardware), h a r d w a r e ) , and a n d other o t h e r existing e x i s t i n g industry i n d u s t r y guidelines. g u i d e l i n e s . This T h i s document d o c u m e n t provides p r o v i d e s guidelines g u i d e l i n e s for f o r architecture, a r c h i t e c t u r e , development d e v e l o p m e n t assurance a s s u r a n c e level, l e v e l , and a n d functional f u n c t i o n a l decomposition d e c o m p o s i t i o n including i n c l u d i n g redundancy r e d u n d a n c y management. m a n a g e m e n t . This T h i s means m e a n s that t h a t the t h e requirement r e q u i r e m e n t allocation a l l o c a t i o n to t o hardware h a r d w a r e and/or a n d / o r software s o f t w a r e has h a s been b e e n reached r e a c h e d at a t the t h e point p o i n t when w h e n architecture, a r c h i t e c t u r e , redundancy r e d u n d a n c y management m a n a g e m e n t and a n d requirement r e q u i r e m e n t decomposition d e c o m p o s i t i o n are a r e complete. c o m p l e t e . The T h e following f o l l o w i n g data d a t a is i s passed p a s s e d to t o the t h e software s o f t w a r e and a n d hardware h a r d w a r e processes p r o c e s s e s as a s part p a r t of o f the t h e requirements r e q u i r e m e n t s allocation: a l l o c a t i o n : a. a . Requirements R e q u i r e m e n t s allocated a l l o c a t e d to t o hardware. h a r d w a r e . b. b . Requirements R e q u i r e m e n t s allocated a l l o c a t e d to t o software. s o f t w a r e . c. c . Development D e v e l o p m e n t assurance a s s u r a n c e level(s) l e v e l ( s ) for f o r item(s) i t e m ( s ) and a n d a a description d e s c r i p t i o n of o f associated a s s o c i a t e d Failure F a i l u r e Condition(s), C o n d i t i o n ( s ) , if i f applicable. a p p l i c a b l e . d. d . Allocated A l l o c a t e d failure f a i l u r e rates r a t e s and a n d exposure e x p o s u r e interval(s) i n t e r v a l ( s ) for f o r hardware h a r d w a r e failures. f a i l u r e s . e. e . System S y s t e m description. d e s c r i p t i o n . f. f . Design D e s i g n constraints, c o n s t r a i n t s , including i n c l u d i n g function f u n c t i o n isolation, i s o l a t i o n , separation, s e p a r a t i o n , data/models d a t a / m o d e l s of o f other o t h e r external e x t e r n a l interfacing i n t e r f a c i n g elements e l e m e n t s and a n d partitioning p a r t i t i o n i n g requirements r e q u i r e m e n t s and a n d any a n y item i t e m development d e v e l o p m e n t independence i n d e p e n d e n c e requirement. r e q u i r e m e n t . g. g . System S y s t e m verification v e r i f i c a t i o n activities a c t i v i t i e s to t o be b e performed p e r f o r m e d at a t the t h e software s o f t w a r e or o r hardware h a r d w a r e development d e v e l o p m e n t level, l e v e l , as a s applicable. a p p l i c a b l e . h. h . Evidence E v i d e n c e of o f the t h e acceptability a c c e p t a b i l i t y by b y the t h e system s y s t e m process p r o c e s s of o f any a n y data d a t a provided p r o v i d e d by b y the t h e hardware h a r d w a r e and/or a n d / o r software s o f t w a r e processes p r o c e s s e s to t o the t h e system s y s t e m process p r o c e s s on o n which w h i c h any a n y activity a c t i v i t y or o r assessment a s s e s s m e n t has h a s been b e e n conducted c o n d u c t e d by b y the t h e system s y s t e m process. p r o c e s s . An A n example e x a m p l e of o f such s u c h an a n activity a c t i v i t y is i s the t h e system s y s t e m process p r o c e s s evaluation e v a l u a t i o n of o f derived d e r i v e d requirements r e q u i r e m e n t s provided p r o v i d e d by b y the t h e software s o f t w a r e process p r o c e s s to t o determine d e t e r m i n e if i f there t h e r e is i s any a n y impact i m p a c t on o n the t h e SSA S S A granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true} Downloaded D o w n l o a d e d from f r o m SAE S A E International I n t e r n a t i o n a l by b y David D a v i d Merrill, M e r r i l l , Saturday, S a t u r d a y , November N o v e m b e r 12, 1 2 , 2016 2 0 1 6 SAE S A E ARP4754A A R P 4 7 5 4 A Page P a g e 30 3 0 of o f 115 1 1 5 4.6.1.2 4 . 6 . 1 . 2 Information I n f o r m a t i o n Flow F l o w From F r o m Hardware/Software H a r d w a r e / S o f t w a r e Processes P r o c e s s e s To T o System S y s t e m Process P r o c e s s The T h e information i n f o r m a t i o n listed l i s t e d below b e l o w should s h o u l d be b e included i n c l u d e d in i n the t h e data d a t a passed p a s s e d to t o the t h e system s y s t e m process p r o c e s s in i n support s u p p o r t of o f system s y s t e m level l e v e l development d e v e l o p m e n t activities a c t i v i t i e s and a n d integral i n t e g r a l processes: p r o c e s s e s : a. a . Derived D e r i v e d requirements r e q u i r e m e n t s (both ( b o t h hardware h a r d w a r e and a n d software) s o f t w a r e ) to t o be b e evaluated e v a l u a t e d against a g a i n s t the t h e system s y s t e m or o r item i t e m requirements r e q u i r e m e n t s and a n d safety s a f e t y assessments, a s s e s s m e n t s , b. b . Description D e s c r i p t i o n of o f the t h e implemented i m p l e m e n t e d hardware h a r d w a r e or o r software s o f t w a r e architecture a r c h i t e c t u r e sufficient s u f f i c i e n t to t o show s h o w the t h e achieved a c h i e v e d independence i n d e p e n d e n c e and a n d fault f a u l t containment c o n t a i n m e n t capabilities c a p a b i l i t i e s (e.g. ( e . g . hardware h a r d w a r e segregation, s e g r e g a t i o n , software s o f t w a r e partitioning), p a r t i t i o n i n g ) , c. c . Evidence E v i d e n c e of o f system/item s y s t e m / i t e m verification v e r i f i c a t i o n activities a c t i v i t i e s performed p e r f o r m e d at a t the t h e software s o f t w a r e or o r hardware h a r d w a r e development d e v e l o p m e n t level, l e v e l , if i f any, a n y , d. d . Hardware H a r d w a r e failure f a i l u r e rates, r a t e s , fault f a u l t detection d e t e c t i o n coverage, c o v e r a g e , common c o m m o n cause c a u s e analyses a n a l y s e s and a n d latency l a t e n c y intervals, i n t e r v a l s , for f o r incorporation i n c o r p o r a t i o n in i n the t h e SSA, S S A , e. e . Problem P r o b l e m or o r change c h a n g e documentation d o c u m e n t a t i o n that t h a t may m a y impact i m p a c t system s y s t e m or o r item i t e m requirements r e q u i r e m e n t s or o r hardware/software h a r d w a r e / s o f t w a r e derived d e r i v e d requirements, r e q u i r e m e n t s , to t o be b e evaluated e v a l u a t e d against a g a i n s t the t h e system s y s t e m or o r item i t e m requirements r e q u i r e m e n t s or o r the t h e safety s a f e t y assessments, a s s e s s m e n t s , f. f . Any A n y limitations l i m i t a t i o n s of o f use, u s e , configuration c o n f i g u r a t i o n identification/status i d e n t i f i c a t i o n / s t a t u s constraints, c o n s t r a i n t s , performance/timing/accuracy p e r f o r m a n c e / t i m i n g / a c c u r a c y characteristics. c h a r a c t e r i s t i c s . g. g . Data D a t a to t o facilitate f a c i l i t a t e integration i n t e g r a t i o n of o f the t h e hardware h a r d w a r e I I software s o f t w a r e into i n t o the t h e system s y s t e m (e.g. ( e . g . installation i n s t a l l a t i o n drawings, d r a w i n g s , schematics, s c h e m a t i c s , parts p a r t s lists), l i s t s ) , h. h . Details D e t a i l s of o f proposed p r o p o s e d hardware/software h a r d w a r e / s o f t w a r e verification v e r i f i c a t i o n activities a c t i v i t i e s to t o be b e performed p e r f o r m e d during d u r i n g system s y s t e m level l e v e l verification. v e r i f i c a t i o n . Additionally, A d d i t i o n a l l y , evidence e v i d e n c e should s h o u l d be b e made m a d e available a v a i l a b l e that t h a t the t h e process p r o c e s s activities a c t i v i t i e s consistent c o n s i s t e n t with w i t h the t h e assigned a s s i g n e d item i t e m development d e v e l o p m e n t assurance a s s u r a n c e level(s) l e v e l ( s ) have h a v e been b e e n performed, p e r f o r m e d , including i n c l u d i n g any a n y assurance a s s u r a n c e achieved a c h i e v e d through t h r o u g h tools. t o o l s . 4.6.1.3 4 . 6 . 1 . 3 Information I n f o r m a t i o n Flow F l o w between b e t w e e n Hardware H a r d w a r e Design D e s i g n Life L i f e Cycle C y c l e and a n d Software S o f t w a r e Life L i f e Cycle C y c l e Processes P r o c e s s e s The T h e information i n f o r m a t i o n below b e l o w should s h o u l d be b e passed p a s s e d between b e t w e e n the t h e hardware h a r d w a r e and a n d software s o f t w a r e life l i f e cycle c y c l e processes. p r o c e s s e s . This T h i s information i n f o r m a t i o n should s h o u l d flow f l o w via v i a the t h e systems s y s t e m s process. p r o c e s s . This T h i s data d a t a includes: i n c l u d e s : a. a . Derived D e r i v e d requirements r e q u i r e m e n t s needed n e e d e d for f o r hardware/software h a r d w a r e / s o f t w a r e integration, i n t e g r a t i o n , such s u c h as a s definition d e f i n i t i o n of o f protocols, p r o t o c o l s , timing t i m i n g constraints, c o n s t r a i n t s , and a n d addressing a d d r e s s i n g schemes s c h e m e s for f o r the t h e interface i n t e r f a c e between b e t w e e n hardware h a r d w a r e and a n d software, s o f t w a r e , b. b . Instances I n s t a n c e s where w h e r e hardware h a r d w a r e and a n d software s o f t w a r e verification v e r i f i c a t i o n activities a c t i v i t i e s require r e q u i r e coordination, c o o r d i n a t i o n , c. c . Identified I d e n t i f i e d incompatibilities i n c o m p a t i b i l i t i e s between b e t w e e n the t h e hardware h a r d w a r e and a n d the t h e software, s o f t w a r e , which w h i c h may m a y be b e part p a r t of o f a a reporting r e p o r t i n g and a n d corrective c o r r e c t i v e action a c t i o n process. p r o c e s s . 4.6.2 4 . 6 . 2 Hardware H a r d w a r e and a n d Software S o f t w a r e Design/Build D e s i g n / B u i l d The T h e hardware h a r d w a r e and a n d software s o f t w a r e design/build d e s i g n / b u i l d processes p r o c e s s e s should s h o u l d provide p r o v i d e traceability t r a c e a b i l i t y to t o the t h e requirements r e q u i r e m e n t s allocated a l l o c a t e d to t o hardware h a r d w a r e and a n d software. s o f t w a r e . If I f hardware h a r d w a r e and a n d software s o f t w a r e implementation i m p l e m e n t a t i o n proceeds p r o c e e d s in i n parallel p a r a l l e l with w i t h the t h e requirements r e q u i r e m e n t s allocation a l l o c a t i o n and a n d architecture a r c h i t e c t u r e definition d e f i n i t i o n phases, p h a s e s , then t h e n sufficient s u f f i c i e n t discipline d i s c i p l i n e is i s needed n e e d e d to t o ensure e n s u r e that t h a t derived d e r i v e d requirements r e q u i r e m e n t s are a r e captured c a p t u r e d and a n d that t h a t all a l l function f u n c t i o n requirements r e q u i r e m e n t s are a r e achieved a c h i e v e d in i n the t h e implementation i m p l e m e n t a t i o n . . The T h e outputs o u t p u t s of o f this t h i s phase p h a s e include i n c l u d e electronic e l e c t r o n i c hardware-software h a r d w a r e - s o f t w a r e integration i n t e g r a t i o n procedures, p r o c e d u r e s , released r e l e a s e d hardware h a r d w a r e drawings, d r a w i n g s , software s o f t w a r e source s o u r c e code c o d e together t o g e t h e r with w i t h related r e l a t e d life l i f e cycle c y c l e data, d a t a , applicable a p p l i c a b l e development d e v e l o p m e n t assurance a s s u r a n c e data, d a t a , breadboard b r e a d b o a r d or o r prototype p r o t o t y p e hardware, h a r d w a r e , if i f applicable; a p p l i c a b l e ; and a n d lab/flight l a b / f l i g h t test t e s t articles. a r t i c l e s . The T h e RTCA/EUROCAE R T C A / E U R O C A E documents d o c u m e n t s referenced r e f e r e n c e d in i n section s e c t i o n 2.1.4 2 . 1 . 4 and a n d 2.1.5 2 . 1 . 5 provide p r o v i d e guidance g u i d a n c e for f o r the t h e development d e v e l o p m e n t of o f electronic e l e c t r o n i c hardware h a r d w a r e and a n d software. s o f t w a r e . granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true} Downloaded D o w n l o a d e d from f r o m SAE S A E International I n t e r n a t i o n a l by b y David D a v i d Merrill, M e r r i l l , Saturday, S a t u r d a y , November N o v e m b e r 12, 1 2 , 2016 2 0 1 6 SAE S A E ARP4754A A R P 4 7 5 4 A Page P a g e 31 3 1 of o f 115 1 1 5 4.6.3 4 . 6 . 3 Electronic E l e c t r o n i c Hardware/Software H a r d w a r e / S o f t w a r e Integration I n t e g r a t i o n Depending D e p e n d i n g on o n the t h e nature n a t u r e of o f the t h e system s y s t e m and a n d the t h e development d e v e l o p m e n t process p r o c e s s used, u s e d , initial i n i t i a l item i t e m electronic e l e c t r o n i c hardware h a r d w a r e and a n d software s o f t w a r e integration i n t e g r a t i o n may m a y occur o c c u r on o n breadboards, b r e a d b o a r d s , prototypes, p r o t o t y p e s , computer c o m p u t e r emulation, e m u l a t i o n , lab l a b or o r flight-worthy f l i g h t - w o r t h y articles. a r t i c l e s . The T h e output o u t p u t is i s equipment e q u i p m e n t under u n d e r configuration c o n f i g u r a t i o n control c o n t r o l together t o g e t h e r with w i t h development d e v e l o p m e n t assurance a s s u r a n c e data d a t a and a n d hardware h a r d w a r e and/or a n d / o r software s o f t w a r e life l i f e cycle c y c l e data. d a t a . Detailed D e t a i l e d procedures p r o c e d u r e s developed d e v e l o p e d during d u r i n g the t h e design-build d e s i g n - b u i l d process p r o c e s s should s h o u l d be b e used u s e d to t o verify v e r i f y that t h a t all a l l electronic e l e c t r o n i c hardware h a r d w a r e and a n d software s o f t w a r e integration i n t e g r a t i o n requirements r e q u i r e m e n t s are a r e met. m e t . It I t may m a y be b e beneficial b e n e f i c i a l to t o enhance e n h a n c e the t h e electronic e l e c t r o n i c hardware/software h a r d w a r e / s o f t w a r e integration i n t e g r a t i o n process p r o c e s s through t h r o u g h development d e v e l o p m e n t of o f interface i n t e r f a c e documents. d o c u m e n t s . This T h i s would w o u l d ensure e n s u r e that t h a t the t h e electronic e l e c t r o n i c hardware h a r d w a r e and a n d software s o f t w a r e provide p r o v i d e compatible c o m p a t i b l e functionality f u n c t i o n a l i t y (e ( e .g. . g . electronic e l e c t r o n i c hardware h a r d w a r e is i s correctly c o r r e c t l y initialized, i n i t i a l i z e d , memory m e m o r y maps, m a p s , etc.). e t c . ) . 4.6.4 4 . 6 . 4 Aircraft/System A i r c r a f t / S y s t e m Integration I n t e g r a t i o n Normally, N o r m a l l y , systems s y s t e m s integration i n t e g r a t i o n begins b e g i n s with w i t h item i t e m by b y item i t e m integration i n t e g r a t i o n and a n d progresses p r o g r e s s e s to t o complete c o m p l e t e system s y s t e m integration. i n t e g r a t i o n . The T h e difficulty d i f f i c u l t y of o f fully f u l l y anticipating a n t i c i p a t i n g or o r modeling m o d e l i n g the t h e aircraft a i r c r a f t environment e n v i r o n m e n t may m a y dictate d i c t a t e that t h a t some s o m e integration i n t e g r a t i o n activities a c t i v i t i e s be b e performed p e r f o r m e d on o n the t h e aircraft. a i r c r a f t . While W h i l e the t h e validity v a l i d i t y of o f on-the-aircraft o n - t h e - a i r c r a f t integration i n t e g r a t i o n is i s generally g e n e r a l l y assumed a s s u m e d to t o be b e high, h i g h , more m o r e meaningful m e a n i n g f u l or o r cost c o s t effective e f f e c t i v e results r e s u l t s often o f t e n can c a n be b e achieved a c h i e v e d in i n laboratory l a b o r a t o r y or o r simulation s i m u l a t i o n environments e n v i r o n m e n t s . . Specific S p e c i f i c procedures p r o c e d u r e s for f o r system s y s t e m integration i n t e g r a t i o n vary v a r y widely w i d e l y across a c r o s s the t h e industry. i n d u s t r y . During D u r i n g the t h e integration i n t e g r a t i o n process, p r o c e s s , identified i d e n t i f i e d deficiencies d e f i c i e n c i e s should s h o u l d be b e referred r e f e r r e d back b a c k to t o the t h e appropriate a p p r o p r i a t e development d e v e l o p m e n t or o r integral i n t e g r a l activity a c t i v i t y (requirements ( r e q u i r e m e n t s capture, c a p t u r e , allocation a l l o c a t i o n or o r validation; v a l i d a t i o n ; implementation; i m p l e m e n t a t i o n ; verification, v e r i f i c a t i o n , etc.) e t c . ) for f o r resolution r e s o l u t i o n and a n d the t h e process p r o c e s s iterated. i t e r a t e d . When W h e n all a l l iterations i t e r a t i o n s are a r e concluded, c o n c l u d e d , the t h e output o u t p u t of o f this t h i s activity a c t i v i t y is i s a a verified v e r i f i e d integrated i n t e g r a t e d system, s y s t e m , along a l o n g with w i t h the t h e data d a t a demonstrating d e m o n s t r a t i n g that t h a t the t h e system s y s t e m satisfies s a t i s f i e s all a l l functional f u n c t i o n a l and a n d safety s a f e t y requirements. r e q u i r e m e n t s . Aircraft/System A i r c r a f t / S y s t e m integration i n t e g r a t i o n is i s the t h e task t a s k of o f ensuring e n s u r i n g all a l l the t h e aircraft a i r c r a f t systems s y s t e m s operate o p e r a t e correctly c o r r e c t l y individually i n d i v i d u a l l y and a n d together t o g e t h e r as a s installed i n s t a l l e d on o n the t h e aircraft. a i r c r a f t . This T h i s provides p r o v i d e s the t h e means m e a n s to t o show s h o w that t h a t intersystem i n t e r s y s t e m requirements, r e q u i r e m e n t s , taken t a k e n as a s a a group, g r o u p , have h a v e been b e e n satisfied. s a t i s f i e d . It I t also a l s o provides p r o v i d e s an a n opportunity o p p o r t u n i t y to t o discover d i s c o v e r and a n d eliminate e l i m i n a t e undesired u n d e s i r e d unintended u n i n t e n d e d functions. f u n c t i o n s . 5. 5 . INTEGRAL I N T E G R A L PROCESSES P R O C E S S E S The T h e process p r o c e s s elements e l e m e n t s described d e s c r i b e d in i n this t h i s section s e c t i o n are a r e fundamental f u n d a m e n t a l elements e l e m e n t s of o f the t h e overall o v e r a l l process. p r o c e s s . They T h e y have h a v e multiple m u l t i p l e interactions i n t e r a c t i o n s to t o the t h e process p r o c e s s tasks t a s k s in i n section s e c t i o n 4.1. 4 . 1 . 5.1 5 . 1 Safety S a f e t y Assessment A s s e s s m e n t The T h e safety s a f e t y assessment a s s e s s m e n t process p r o c e s s is i s used u s e d by b y a a company c o m p a n y to t o show s h o w compliance c o m p l i a n c e with w i t h certification c e r t i f i c a t i o n requirements r e q u i r e m e n t s (e.g. ( e . g . 14CFR/CS 1 4 C F R / C S Parts P a r t s 23 2 3 and a n d 25, 2 5 , section s e c t i o n 1309) 1 3 0 9 ) and a n d in i n meeting m e e t i n g its i t s own o w n internal i n t e r n a l safety s a f e t y standards. s t a n d a r d s . The T h e process p r o c e s s includes i n c l u d e s specific s p e c i f i c assessments a s s e s s m e n t s conducted c o n d u c t e d and a n d updated u p d a t e d during d u r i n g system s y s t e m development d e v e l o p m e n t and a n d includes i n c l u d e s how h o w it i t interacts i n t e r a c t s with w i t h the t h e other o t h e r system s y s t e m development d e v e l o p m e n t processes. p r o c e s s e s . The T h e primary p r i m a r y safety s a f e t y assessment a s s e s s m e n t processes p r o c e s s e s are a r e detailed d e t a i l e d in i n ARP A R P 4761 4 7 6 1 and a n d are a r e summarized s u m m a r i z e d below. b e l o w . a. a . Functional F u n c t i o n a l Hazard H a z a r d Assessment A s s e s s m e n t (FHA): ( F H A ) : Examines E x a m i n e s aircraft a i r c r a f t and a n d system s y s t e m functions f u n c t i o n s to t o identify i d e n t i f y potential p o t e n t i a l functional f u n c t i o n a l failures f a i l u r e s and a n d classifies c l a s s i f i e s the t h e hazards h a z a r d s associated a s s o c i a t e d with w i t h specific s p e c i f i c failure f a i l u r e conditions. c o n d i t i o n s . The T h e FHA F H A is i s developed d e v e l o p e d early e a r l y in i n the t h e development d e v e l o p m e n t process p r o c e s s and a n d is i s updated u p d a t e d as a s new n e w functions f u n c t i o n s or o r Failure F a i l u r e Conditions C o n d i t i o n s are a r e identified. i d e n t i f i e d . Thus, T h u s , the t h e FHA F H A is i s a a living l i v i n g document d o c u m e n t throughout t h r o u g h o u t the t h e design d e s i g n development d e v e l o p m e n t cycle. c y c l e . b. b . Preliminary P r e l i m i n a r y Aircraft A i r c r a f t Safety S a f e t y Assessment A s s e s s m e n t I I Preliminary P r e l i m i n a r y System S y s t e m Safety S a f e t y Assessment A s s e s s m e n t (PASNPSSA): ( P A S N P S S A ) : Establish E s t a b l i s h the t h e aircraft a i r c r a f t or o r specific s p e c i f i c system s y s t e m or o r item i t e m safety s a f e t y requirements r e q u i r e m e n t s and a n d provide p r o v i d e a a preliminary p r e l i m i n a r y indication i n d i c a t i o n that t h a t the t h e anticipated a n t i c i p a t e d aircraft a i r c r a f t or o r system s y s t e m architectures a r c h i t e c t u r e s can c a n meet m e e t those t h o s e safety s a f e t y requirements. r e q u i r e m e n t s . The T h e PASA P A S A and a n d PSSA P S S A are a r e updated u p d a t e d throughout t h r o u g h o u t the t h e system s y s t e m development d e v e l o p m e n t process p r o c e s s ultimately u l t i m a t e l y resulting r e s u l t i n g in i n the t h e Aircraft A i r c r a f t Safety S a f e t y Assessment A s s e s s m e n t and a n d System S y s t e m Safety S a f e t y Assessments A s s e s s m e n t s . . c. c . Aircraft A i r c r a f t Safety S a f e t y Assessment A s s e s s m e n t I I System S y s t e m Safety S a f e t y Assessment A s s e s s m e n t (ASNSSA): ( A S N S S A ) : Collects, C o l l e c t s , analyzes, a n a l y z e s , and a n d documents d o c u m e n t s verification v e r i f i c a t i o n that t h a t the t h e aircraft a i r c r a f t and a n d systems, s y s t e m s , as a s implemented, i m p l e m e n t e d , meet m e e t the t h e safety s a f e t y requirements r e q u i r e m e n t s established e s t a b l i s h e d by b y the t h e PASA P A S A and a n d the t h e PSSA. P S S A . d. d . Common C o m m o n Cause C a u s e Analysis A n a l y s i s (CCA): ( C C A ) : Establishes E s t a b l i s h e s and a n d verifies v e r i f i e s physical p h y s i c a l and a n d functional f u n c t i o n a l separation, s e p a r a t i o n , isolation i s o l a t i o n and a n d independence i n d e p e n d e n c e requirements r e q u i r e m e n t s between b e t w e e n systems s y s t e m s and a n d items i t e m s and a n d verifies v e r i f i e s that t h a t these t h e s e requirements r e q u i r e m e n t s have h a v e been b e e n met. m e t . granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true} Downloaded D o w n l o a d e d from f r o m SAE S A E International I n t e r n a t i o n a l by b y David D a v i d Merrill, M e r r i l l , Saturday, S a t u r d a y , November N o v e m b e r 12, 1 2 , 2016 2 0 1 6 SAE S A E ARP4754A A R P 4 7 5 4 A Page P a g e 32 3 2 of o f 115 1 1 5 Additionally, A d d i t i o n a l l y , for f o r appropriate a p p r o p r i a t e management m a n a g e m e n t of o f the t h e safety s a f e t y assessment a s s e s s m e n t process, p r o c e s s , a a Safety S a f e t y Program P r o g r a m Plan P l a n should s h o u l d be b e created. c r e a t e d . The T h e Failure F a i l u r e Conditions C o n d i t i o n s identified i d e n t i f i e d in i n the t h e FHA F H A may m a y also a l s o be b e tracked t r a c k e d through t h r o u g h the t h e development d e v e l o p m e n t process p r o c e s s to t o provide p r o v i d e active a c t i v e status s t a t u s that t h a t the t h e design d e s i g n implementation i m p l e m e n t a t i o n is i s satisfying s a t i s f y i n g the t h e safety s a f e t y criteria. c r i t e r i a . Figure F i g u r e 7 7 shows s h o w s the t h e fundamental f u n d a m e n t a l relationships r e l a t i o n s h i p s between b e t w e e n these t h e s e four f o u r specific s p e c i f i c assessments a s s e s s m e n t s and a n d the t h e system s y s t e m development d e v e l o p m e n t processes. p r o c e s s e s . In I n reality, r e a l i t y , there t h e r e are a r e many m a n y feedback f e e d b a c k loops l o o p s within w i t h i n and a n d among a m o n g these t h e s e relationships, r e l a t i o n s h i p s , though t h o u g h they t h e y have h a v e been b e e n omitted o m i t t e d from f r o m the t h e figure f i g u r e for f o r clarity. c l a r i t y . The T h e level l e v e l of o f detail d e t a i l needed n e e d e d for f o r the t h e various v a r i o u s safety s a f e t y assessment a s s e s s m e n t activities a c t i v i t i e s is i s dependent d e p e n d e n t on o n the t h e aircraft-level a i r c r a f t - l e v e l Failure F a i l u r e Condition C o n d i t i o n classification, c l a s s i f i c a t i o n , the t h e degree d e g r e e of o f integration, i n t e g r a t i o n , and a n d the t h e complexity c o m p l e x i t y of o f the t h e system s y s t e m implementation. i m p l e m e n t a t i o n . The T h e safety s a f e t y assessment a s s e s s m e n t process p r o c e s s should s h o u l d be b e planned p l a n n e d and a n d managed m a n a g e d so s o as a s to t o provide p r o v i d e the t h e necessary n e c e s s a r y assurance a s s u r a n c e that t h a t all a l l relevant r e l e v a n t failure f a i l u r e conditions c o n d i t i o n s have h a v e been b e e n identified, i d e n t i f i e d , and a n d that t h a t all a l l significant s i g n i f i c a n t combinations c o m b i n a t i o n s of o f failures f a i l u r e s that t h a t could c o u l d cause c a u s e those t h o s e failure f a i l u r e conditions c o n d i t i o n s have h a v e been b e e n considered. c o n s i d e r e d . The T h e safety s a f e t y assessment a s s e s s m e n t process p r o c e s s is i s of o f fundamental f u n d a m e n t a l importance i m p o r t a n c e in i n establishing e s t a b l i s h i n g appropriate a p p r o p r i a t e safety s a f e t y objectives o b j e c t i v e s for f o r the t h e aircraft a i r c r a f t and a n d systems s y s t e m s and a n d determining d e t e r m i n i n g that t h a t the t h e implementation i m p l e m e n t a t i o n satisfies s a t i s f i e s these t h e s e objectives. o b j e c t i v e s . The T h e safety s a f e t y assessment a s s e s s m e n t activities a c t i v i t i e s are a r e summarized s u m m a r i z e d in i n the t h e subsequent s u b s e q u e n t sections s e c t i o n s of o f this t h i s document. d o c u m e n t . granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true} I I - - System-Level S y s t e m - L e v e l I I a a I I I I - - - - - - - - Requirements R e q u i r e m e n t s I I - - - - Separation S e p a r a t i o n & & I I ASA A S A Results R e s u l t s I I - - Results R e s u l t s I I - - , , Downloaded D o w n l o a d e d from f r o m SAE S A E International I n t e r n a t i o n a l by b y David D a v i d Merrill, M e r r i l l , Saturday, S a t u r d a y , November N o v e m b e r 12, 1 2 , 2016 2 0 1 6 SAE S A E ARP4754A A R P 4 7 5 4 A Page P a g e 33 3 3 of o f 115 1 1 5 - - - - Aircraft A i r c r a f t Level L e v e l I I I I I I Aircraft A i r c r a f t Aircraft A i r c r a f t Function F u n c t i o n lnitialCCA l n i t i a l C C A + + FHA/ F H A / PASA P A S A - - I I Functions F u n c t i o n s Development D e v e l o p m e n t Findings F i n d i n g s 5.1.1/5.1.2 5 . 1 . 1 / 5 . 1 . 2 I I To T o ASA A S A a a I I Failure F a i l u r e Condition, C o n d i t i o n , Effects, E f f e c t s , Functional F u n c t i o n a l Classification, C l a s s i f i c a t i o n , Safety S a f e t y Requirements R e q u i r e m e n t s - - Allocation A l l o c a t i o n of o f Interactions I n t e r a c t i o n s ,, , , - - System S y s t e m Aircraft A i r c r a f t Functions F u n c t i o n s - - - - I I Functions F u n c t i o n s to t o Systems S y s t e m s - - Failure F a i l u r e - - FHA F H A Sections S e c t i o n s Condition C o n d i t i o n 5.1.1 5 . 1 . 1 I I & & Effects E f f e c t s jl j l Failure F a i l u r e Condition, C o n d i t i o n , Effects E f f e c t s I I ,. , . Classification, C l a s s i f i c a t i o n , Safety S a f e t y Objectives O b j e c t i v e s I I - - Development D e v e l o p m e n t of o f ,. , . Architectural, A r c h i t e c t u r a l , System S y s t e m CCAs C C A s Safety S a f e t y Architecture A r c h i t e c t u r e Requirements R e q u i r e m e n t s _ _ I I Separation S e p a r a t i o n PSSAs P S S A s 1 1 System S y s t e m Architecture A r c h i t e c t u r e Requirement-- R e q u i r e m e n t - - s s . . 5.1.2 5 . 1 . 2 I I ,, , , - - I I Allocation A l l o c a t i o n of o f Item I t e m Requirements R e q u i r e m e n t s _ _ System S y s t e m Item I t e m Requirements, R e q u i r e m e n t s , - - Safety S a f e t y Objectives, O b j e c t i v e s , I I Analyses A n a l y s e s Required R e q u i r e d ,, , , I I I I Items I t e m s PA•SA P A • S A IImplementation I I m p l e m e n t a t i o n - - Results R e s u l t s - - - - - - I I 5.1.4 5 . 1 . 4 - - From F r o m ,, , , SSAs S S A s Implementation I m p l e m e n t a t i o n ,. , . 5.1.3 5 . 1 . 3 I I System S y s t e m see s e e FiQure F i Q u r e 4-2 4 - 2 Verification V e r i f i c a t i o n - - System/Aircraft S y s t e m / A i r c r a f t I I - - Level L e v e l Integration I n t e g r a t i o n 5.1.3 5 . 1 . 3 I I - - & & Verification V e r i f i c a t i o n I I I I Physical P h y s i c a l System S y s t e m Paragraph P a r a g r a p h reference r e f e r e n c e shown s h o w n in i n lower l o w e r r r i i g g h h t t c c o o r r n n e e r r o o f f j j I I granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true} Downloaded D o w n l o a d e d from f r o m SAE S A E International I n t e r n a t i o n a l by b y David D a v i d Merrill, M e r r i l l , Saturday, S a t u r d a y , November N o v e m b e r 12, 1 2 , I I 2016 2 0 1 6 Development D e v e l o p m e n t Complete C o m p l e t e & & Ready R e a d y for f o r Certification C e r t i f i c a t i o n I I process p r o c e s s boxes. b o x e s . Safety S a f e t y Assessment A s s e s s m e n t Process P r o c e s s System S y s t e m Development D e v e l o p m e n t Process P r o c e s s FIGURE F I G U R E 7 7 - - SAFETY S A F E T Y ASSESSMENT A S S E S S M E N T PROCESS P R O C E S S MODEL M O D E L granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true} Downloaded D o w n l o a d e d from f r o m SAE S A E International I n t e r n a t i o n a l by b y David D a v i d Merrill, M e r r i l l , Saturday, S a t u r d a y , November N o v e m b e r 12, 1 2 , 2016 2 0 1 6 SAE S A E ARP4754A A R P 4 7 5 4 A Page P a g e 34 3 4 of o f 115 1 1 5 5.1.1 5 . 1 . 1 Functional F u n c t i o n a l Hazard H a z a r d Assessments A s s e s s m e n t s The T h e functional f u n c t i o n a l hazard h a z a r d assessments a s s e s s m e n t s (FHAs) ( F H A s ) should s h o u l d be b e carried c a r r i e d out o u t at a t both b o t h the t h e aircraft a i r c r a f t and a n d system s y s t e m levels. l e v e l s . They T h e y should s h o u l d provide p r o v i d e the t h e following f o l l o w i n g information i n f o r m a t i o n relative r e l a t i v e to t o each e a c h function f u n c t i o n (aircraft ( a i r c r a f t or o r system s y s t e m level l e v e l accordingly): a c c o r d i n g l y ) : a. a . Identification I d e n t i f i c a t i o n of o f related r e l a t e d Failure F a i l u r e Condition(s) C o n d i t i o n ( s ) . . b. b . Identification I d e n t i f i c a t i o n of o f the t h e effects e f f e c t s of o f the t h e Failure F a i l u r e Condition(s) C o n d i t i o n ( s ) . . c. c . Classification C l a s s i f i c a t i o n of o f each e a c h Failure F a i l u r e Condition C o n d i t i o n based b a s e d on o n the t h e identified i d e n t i f i e d effects e f f e c t s (i.e., ( i . e . , Catastrophic, C a t a s t r o p h i c , Hazardous/Severe-Major, H a z a r d o u s / S e v e r e - M a j o r , Major, M a j o r , Minor, M i n o r , or o r No N o Safety S a f e t y Effect) E f f e c t ) and a n d assignment a s s i g n m e n t of o f the t h e necessary n e c e s s a r y safety s a f e t y objectives, o b j e c t i v e s , as a s defined d e f i n e d in i n e.g. e . g . AC A C 25.1309- 2 5 . 1 3 0 9 - 1A, 1 A , AC23 A C 2 3 .1309-1D . 1 3 0 9 - 1 D and a n d AMC A M C 25.1309 2 5 . 1 3 0 9 extended e x t e n d e d to t o include i n c l u d e the t h e No N o Safety S a f e t y Effect E f f e c t classification. c l a s s i f i c a t i o n . d. d . A A statement s t a t e m e n t outlining o u t l i n i n g what w h a t was w a s considered c o n s i d e r e d and a n d what w h a t assumptions a s s u m p t i o n s were w e r e made m a d e when w h e n evaluating e v a l u a t i n g each e a c h Failure F a i l u r e Condition C o n d i t i o n (e.g., ( e . g . , adverse a d v e r s e operational o p e r a t i o n a l or o r environmental e n v i r o n m e n t a l conditions c o n d i t i o n s and a n d phase p h a s e of o f flight). f l i g h t ) . The T h e goal g o a l in i n conducting c o n d u c t i n g this t h i s step s t e p is i s to t o clearly c l e a r l y identify i d e n t i f y the t h e circumstances c i r c u m s t a n c e s and a n d severity s e v e r i t y of o f each e a c h Failure F a i l u r e Condition C o n d i t i o n along a l o n g with w i t h the t h e rationale r a t i o n a l e for f o r its i t s classification. c l a s s i f i c a t i o n . Since S i n c e it i t is i s possible p o s s i b l e that t h a t use u s e of o f common c o m m o n architectures a r c h i t e c t u r e s or o r complex c o m p l e x components c o m p o n e n t s in i n separate s e p a r a t e systems s y s t e m s could c o u l d introduce i n t r o d u c e additional a d d i t i o n a l aircraft-level a i r c r a f t - l e v e l Failure F a i l u r e Conditions C o n d i t i o n s involving i n v o l v i n g multiple m u l t i p l e functions, f u n c t i o n s , the t h e FHA F H A should s h o u l d identify i d e n t i f y and a n d classify c l a s s i f y these t h e s e new n e w Failure F a i l u r e Conditions. C o n d i t i o n s . When W h e n aircraft-level a i r c r a f t - l e v e l functions f u n c t i o n s are a r e integrated i n t e g r a t e d by b y a a system s y s t e m or o r combination c o m b i n a t i o n of o f systems, s y s t e m s , the t h e FHA F H A should s h o u l d be b e re-evaluated r e - e v a l u a t e d to t o identify i d e n t i f y and a n d classify c l a s s i f y Failure F a i l u r e Conditions C o n d i t i o n s involving i n v o l v i n g multiple m u l t i p l e functions. f u n c t i o n s . If I f the t h e FHA F H A is i s constructed c o n s t r u c t e d in i n system- s y s t e m - oriented o r i e n t e d sections, s e c t i o n s , traceability t r a c e a b i l i t y of o f hazards h a z a r d s and a n d Failure F a i l u r e Conditions C o n d i t i o n s between b e t w e e n the t h e aircraft-level a i r c r a f t - l e v e l and a n d system-level s y s t e m - l e v e l is i s necessary. n e c e s s a r y . Implementation I m p l e m e n t a t i o n choices c h o i c e s made m a d e during d u r i n g development d e v e l o p m e n t may m a y introduce i n t r o d u c e common c o m m o n causes c a u s e s for f o r multiple m u l t i p l e aircraft-level a i r c r a f t - l e v e l Failure F a i l u r e Conditions C o n d i t i o n s or o r interactions i n t e r a c t i o n s between b e t w e e n systems s y s t e m s resulting r e s u l t i n g in i n failure. f a i l u r e . These T h e s e common c o m m o n causes c a u s e s could c o u l d cross c r o s s system s y s t e m or o r function f u n c t i o n boundaries. b o u n d a r i e s . A A review r e v i e w of o f the t h e implementations i m p l e m e n t a t i o n s of o f systems s y s t e m s should s h o u l d be b e performed p e r f o r m e d to t o determine d e t e r m i n e if i f there t h e r e are a r e such s u c h conditions c o n d i t i o n s and a n d if i f they t h e y should s h o u l d be b e added a d d e d to t o the t h e aircraft-level a i r c r a f t - l e v e l FHA. F H A . For F o r details d e t a i l s on o n performing p e r f o r m i n g an a n aircraft a i r c r a f t or o r a a system s y s t e m level l e v e l FHA, F H A , see s e e ARP4761 A R P 4 7 6 1 Appendix A p p e n d i x A. A . 5.1.2 5 . 1 . 2 Preliminary P r e l i m i n a r y Aircraft A i r c r a f t I I System S y s t e m Safety S a f e t y Assessment A s s e s s m e n t A A Preliminary P r e l i m i n a r y Aircraft A i r c r a f t I I System S y s t e m Safety S a f e t y Assessment A s s e s s m e n t (PASNPSSA) ( P A S N P S S A ) is i s a a systematic s y s t e m a t i c examination e x a m i n a t i o n of o f a a proposed p r o p o s e d architecture(s) a r c h i t e c t u r e ( s ) to t o determine d e t e r m i n e how h o w failures f a i l u r e s could c o u l d cause c a u s e the t h e Failure F a i l u r e Conditions C o n d i t i o n s identified i d e n t i f i e d by b y the t h e FHA. F H A . The T h e objectives o b j e c t i v e s of o f the t h e PASA P A S A and a n d PSSA P S S A are a r e to t o complete c o m p l e t e the t h e safety s a f e t y requirements r e q u i r e m e n t s of o f an a n aircraft, a i r c r a f t , system s y s t e m or o r item i t e m and a n d validate v a l i d a t e that t h a t the t h e proposed p r o p o s e d architecture a r c h i t e c t u r e can c a n reasonably r e a s o n a b l y be b e expected e x p e c t e d to t o meet m e e t the t h e safety s a f e t y requirements. r e q u i r e m e n t s . The T h e PASNPSSA P A S N P S S A may m a y identify i d e n t i f y the t h e need n e e d for f o r alternative a l t e r n a t i v e protective p r o t e c t i v e strategies s t r a t e g i e s (e.g., ( e . g . , partitioning, p a r t i t i o n i n g , built-in-test, b u i l t - i n - t e s t , monitoring, m o n i t o r i n g , independence i n d e p e n d e n c e and a n d safety s a f e t y maintenance m a i n t e n a n c e task t a s k intervals, i n t e r v a l s , etc.). e t c . ) . The T h e PASNPSSA P A S N P S S A outputs o u t p u t s should s h o u l d be b e used u s e d as a s an a n input i n p u t to t o the t h e ASNSSA A S N S S A and a n d other o t h e r documents, d o c u m e n t s , including, i n c l u d i n g , but b u t not n o t limited l i m i t e d to, t o , system s y s t e m requirements, r e q u i r e m e n t s , software s o f t w a r e requirements, r e q u i r e m e n t s , and a n d hardware h a r d w a r e requirements. r e q u i r e m e n t s . The T h e PASNPSSA P A S N P S S A are a r e iterative i t e r a t i v e processes p r o c e s s e s associated a s s o c i a t e d with w i t h the t h e design d e s i g n definition. d e f i n i t i o n . The T h e PASNPSSA P A S N P S S A is i s conducted c o n d u c t e d at a t multiple m u l t i p l e stages s t a g e s of o f system s y s t e m development d e v e l o p m e n t including i n c l u d i n g aircraft, a i r c r a f t , system, s y s t e m , and a n d item i t e m design d e s i g n definitions. d e f i n i t i o n s . At A t the t h e lowest l o w e s t level, l e v e l , the t h e PSSA P S S A determines d e t e r m i n e s the t h e safety s a f e t y related r e l a t e d design d e s i g n requirements r e q u i r e m e n t s of o f hardware h a r d w a r e and a n d software. s o f t w a r e . For F o r details d e t a i l s on o n performing p e r f o r m i n g a a preliminary p r e l i m i n a r y aircraft a i r c r a f t or o r systems s y s t e m s safety s a f e t y assessment a s s e s s m e n t (PASNPSSA), ( P A S N P S S A ) , see s e e ARP4761 A R P 4 7 6 1 Appendix A p p e n d i x B. B . 5.1.3 5 . 1 . 3 Aircraft A i r c r a f t I I System S y s t e m Safety S a f e t y Assessment A s s e s s m e n t An A n Aircraft/System A i r c r a f t / S y s t e m Safety S a f e t y Assessment A s s e s s m e n t (ASNSSA) ( A S N S S A ) is i s a a systematic, s y s t e m a t i c , comprehensive c o m p r e h e n s i v e evaluation e v a l u a t i o n of o f the t h e implemented i m p l e m e n t e d aircraft a i r c r a f t and a n d system(s) s y s t e m ( s ) to t o show s h o w that t h a t relevant r e l e v a n t safety s a f e t y requirements r e q u i r e m e n t s are a r e satisfied. s a t i s f i e d . The T h e difference d i f f e r e n c e between b e t w e e n the t h e PASNPSSA P A S N P S S A and a n d an a n ASNSSA A S N S S A is i s that t h a t the t h e PASNPSSA P A S N P S S A are a r e methods m e t h o d s to t o evaluate e v a l u a t e proposed p r o p o s e d architectures a r c h i t e c t u r e s and a n d derive d e r i v e system/item s y s t e m / i t e m safety s a f e t y requirements; r e q u i r e m e n t s ; whereas w h e r e a s the t h e ASNSSA A S N S S A are a r e methods m e t h o d s to t o verify v e r i f y that t h a t the t h e implemented i m p l e m e n t e d design d e s i g n meets m e e t s the t h e safety s a f e t y requirements r e q u i r e m e n t s as a s defined d e f i n e d in i n the t h e PASA P A S A and a n d PSSA. P S S A . granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true} Downloaded D o w n l o a d e d from f r o m SAE S A E International I n t e r n a t i o n a l by b y David D a v i d Merrill, M e r r i l l , Saturday, S a t u r d a y , November N o v e m b e r 12, 1 2 , 2016 2 0 1 6 SAE S A E ARP4754A A R P 4 7 5 4 A Page P a g e 35 3 5 of o f 115 1 1 5 The T h e ASNSSA A S N S S A integrates i n t e g r a t e s the t h e results r e s u l t s of o f the t h e various v a r i o u s analyses a n a l y s e s to t o verify v e r i f y the t h e safety s a f e t y of o f the t h e overall o v e r a l l aircraft/systems a i r c r a f t / s y s t e m s and a n d to t o cover c o v e r all a l l of o f the t h e specific s p e c i f i c safety s a f e t y considerations c o n s i d e r a t i o n s identified i d e n t i f i e d in i n the t h e PASNPSSA. P A S N P S S A . The T h e ASNSSA A S N S S A process p r o c e s s data d a t a includes i n c l u d e s results r e s u l t s of o f the t h e relevant r e l e v a n t analyses a n a l y s e s and a n d substantiation. s u b s t a n t i a t i o n . This T h i s may m a y include i n c l u d e the t h e following f o l l o w i n g information: i n f o r m a t i o n : a. a . List L i s t of o f previously p r e v i o u s l y agreed a g r e e d upon u p o n external e x t e r n a l event e v e n t probabilities, p r o b a b i l i t i e s , b. b . System S y s t e m description d e s c r i p t i o n including i n c l u d i n g functions f u n c t i o n s and a n d interfaces, i n t e r f a c e s , c. c . List L i s t of o f Failure F a i l u r e Conditions C o n d i t i o n s (FHA, ( F H A , PASA, P A S A , PSSA), P S S A ) , d. d . Failure F a i l u r e Condition C o n d i t i o n classification c l a s s i f i c a t i o n (FHA, ( F H A , PASA, P A S A , PSSA), P S S A ) , e. e . Qualitative Q u a l i t a t i v e analyses a n a l y s e s for f o r Failure F a i l u r e Conditions C o n d i t i o n s (e.g. ( e . g . FTA, F T A , FMES, F M E S , Markov M a r k o v Analysis, A n a l y s i s , Dependence D e p e n d e n c e Diagrams), D i a g r a m s ) , f. f . Quantitative Q u a n t i t a t i v e analyses a n a l y s e s for f o r Failure F a i l u r e Conditions C o n d i t i o n s (e.g. ( e . g . FTA, F T A , FMES, F M E S , Markov M a r k o v Analysis, A n a l y s i s , Dependence D e p e n d e n c e Diagrams), D i a g r a m s ) , g. g . The T h e results r e s u l t s obtained o b t a i n e d from f r o m Common C o m m o n Cause C a u s e Analyses, A n a l y s e s , h. h . Safety S a f e t y related r e l a t e d tasks t a s k s and a n d intervals i n t e r v a l s (FTA, ( F T A , FMES, F M E S , Markov M a r k o v Analysis, A n a l y s i s , Dependence D e p e n d e n c e Diagrams), D i a g r a m s ) , i. i . Development D e v e l o p m e n t Assurance A s s u r a n c e Levels L e v e l s for f o r aircraft a i r c r a f t functions f u n c t i o n s and a n d systems s y s t e m s (FOAL) ( F O A L ) (PASA, ( P A S A , PSSA), P S S A ) , j j . . Development D e v e l o p m e n t Assurance A s s u r a n c e Levels L e v e l s for f o r electronic e l e c t r o n i c hardware h a r d w a r e and a n d software s o f t w a r e items i t e m s (IDAL) ( I D A L ) (PSSA), ( P S S A ) , k. k . Verification V e r i f i c a t i o n that t h a t safety s a f e t y requirements r e q u i r e m e n t s from f r o m the t h e PASA, P A S A , PSSA P S S A are a r e incorporated i n c o r p o r a t e d into i n t o the t h e design d e s i g n and/or a n d / o r testing t e s t i n g process, p r o c e s s , I. I . The T h e results r e s u l t s of o f the t h e non-analytic n o n - a n a l y t i c verification v e r i f i c a t i o n processes p r o c e s s e s (i.e. ( i . e . test, t e s t , demonstration d e m o n s t r a t i o n and a n d inspection). i n s p e c t i o n ) . The T h e Aircraft A i r c r a f t Safety S a f e t y Assessment A s s e s s m e n t should s h o u l d provide p r o v i d e a a summary s u m m a r y of o f the t h e aircraft a i r c r a f t safety s a f e t y activities a c t i v i t i e s from f r o m the t h e beginning b e g i n n i n g of o f the t h e concept c o n c e p t development d e v e l o p m e n t to t o the t h e completion c o m p l e t i o n of o f the t h e detailed d e t a i l e d design d e s i g n development. d e v e l o p m e n t . It I t aims a i m s to t o show s h o w compliance c o m p l i a n c e with w i t h aircraft a i r c r a f t level l e v e l requirements r e q u i r e m e n t s and a n d objectives o b j e c t i v e s and a n d give g i v e assurance a s s u r a n c e that t h a t the t h e appropriate a p p r o p r i a t e methods m e t h o d s and a n d process p r o c e s s have h a v e been b e e n applied. a p p l i e d . The T h e Aircraft A i r c r a f t Safety S a f e t y Assessment A s s e s s m e n t verifies v e r i f i e s that: t h a t : • • All A l l the t h e safety s a f e t y activities a c t i v i t i e s have h a v e been b e e n performed p e r f o r m e d according a c c o r d i n g to t o the t h e Safety S a f e t y Plan, P l a n , • • Safety S a f e t y requirements r e q u i r e m e n t s for f o r the t h e aircraft a i r c r a f t are a r e satisfied s a t i s f i e d and a n d associated a s s o c i a t e d supporting s u p p o r t i n g material m a t e r i a l is i s available, a v a i l a b l e , • • Safety S a f e t y ValidationNerification V a l i d a t i o n N e r i f i c a t i o n process p r o c e s s is i s completed c o m p l e t e d and a n d results r e s u l t s accepted, a c c e p t e d , • • All A l l the t h e activities a c t i v i t i e s undertaken u n d e r t a k e n form f o r m a a logical l o g i c a l argument a r g u m e n t supporting s u p p o r t i n g the t h e conclusion c o n c l u s i o n that t h a t the t h e aircraft a i r c r a f t is i s safe. s a f e . This T h i s assessment a s s e s s m e n t forms f o r m s part p a r t of o f what w h a t is i s sometimes s o m e t i m e s called c a l l e d a a "safety " s a f e t y case" c a s e " or o r "safety " s a f e t y synthesis". s y n t h e s i s " . A A safety s a f e t y case c a s e or o r safety s a f e t y synthesis s y n t h e s i s communicates c o m m u n i c a t e s a a clear, c l e a r , comprehensible c o m p r e h e n s i b l e and a n d defensible d e f e n s i b l e argument a r g u m e n t that t h a t the t h e aircraft a i r c r a f t and a n d systems s y s t e m s are a r e acceptably a c c e p t a b l y safe s a f e to t o operate o p e r a t e in i n a a particular p a r t i c u l a r context. c o n t e x t . Note: N o t e : When W h e n Fault F a u l t Tree T r e e Analysis A n a l y s i s (FTA) ( F T A ) is i s used u s e d herein, h e r e i n , it i t should s h o u l d be b e understood u n d e r s t o o d that t h a t other o t h e r analysis a n a l y s i s methods m e t h o d s such s u c h as a s Dependence D e p e n d e n c e Diagrams D i a g r a m s (DD) ( D D ) or o r Markov M a r k o v Analsis A n a l s i s (MA) ( M A ) may m a y also a l s o be b e used u s e d if i f they t h e y are a r e the t h e appropriate a p p r o p r i a t e analysis a n a l y s i s for f o r the t h e situation. s i t u a t i o n . For F o r details d e t a i l s on o n performing p e r f o r m i n g an a n aircraft a i r c r a f t or o r systems s y s t e m s level l e v e l safety s a f e t y assessment a s s e s s m e n t (ASNSSA), ( A S N S S A ) , see s e e ARP4761 A R P 4 7 6 1 Appendix A p p e n d i x C. C . 5.1.4 5 . 1 . 4 Common C o m m o n Cause C a u s e Analysis A n a l y s i s Independence I n d e p e n d e n c e between b e t w e e n functions, f u n c t i o n s , systems s y s t e m s or o r items i t e m s may m a y be b e required r e q u i r e d to t o satisfy s a t i s f y the t h e safety s a f e t y or o r regulatory r e g u l a t o r y requirements. r e q u i r e m e n t s . Therefore, T h e r e f o r e , it i t is i s necessary n e c e s s a r y to t o ensure e n s u r e that t h a t such s u c h independence i n d e p e n d e n c e exists, e x i s t s , or o r that t h a t the t h e lack l a c k of o f independence i n d e p e n d e n c e is i s acceptable a c c e p t a b l e . . Common C o m m o n Cause C a u s e Analysis A n a l y s i s (CCA) ( C C A ) provides p r o v i d e s the t h e tools t o o l s to t o verify v e r i f y this t h i s independence, i n d e p e n d e n c e , or o r to t o identify i d e n t i f y specific s p e c i f i c dependencies. d e p e n d e n c i e s . Common C o m m o n cause c a u s e events e v e n t s should s h o u l d be b e precluded p r e c l u d e d for f o r catastrophic c a t a s t r o p h i c failure f a i l u r e conditions. c o n d i t i o n s . granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true} Downloaded D o w n l o a d e d from f r o m SAE S A E International I n t e r n a t i o n a l by b y David D a v i d Merrill, M e r r i l l , Saturday, S a t u r d a y , November N o v e m b e r 12, 1 2 , 2016 2 0 1 6 SAE S A E ARP4754A A R P 4 7 5 4 A Page P a g e 36 3 6 of o f 115 1 1 5 In I n particular, p a r t i c u l a r , the t h e CCA C C A identifies i d e n t i f i e s individual i n d i v i d u a l failure f a i l u r e modes m o d e s or o r external e x t e r n a l events e v e n t s that t h a t can c a n lead l e a d to t o a a Catastrophic C a t a s t r o p h i c or o r Hazardous/Severe-Major H a z a r d o u s / S e v e r e - M a j o r Failure F a i l u r e Condition. C o n d i t i o n . Common C o m m o n Cause C a u s e Analysis A n a l y s i s is i s sub-divided s u b - d i v i d e d into i n t o the t h e following f o l l o w i n g areas a r e a s of o f study s t u d y to t o aid a i d in i n the t h e assessment: a s s e s s m e n t : a. a . Particular P a r t i c u l a r Risks R i s k s Analysis A n a l y s i s b. b . Common C o m m o n Mode M o d e Analysis A n a l y s i s c. c . Zonal Z o n a l Safety S a f e t y Analysis A n a l y s i s These T h e s e analyses a n a l y s e s may m a y be b e performed p e r f o r m e d at a t any a n y stage s t a g e of o f the t h e design d e s i g n process. p r o c e s s . Obviously, O b v i o u s l y , the t h e most m o s t cost-effective c o s t - e f f e c t i v e time t i m e is i s early e a r l y in i n the t h e design d e s i g n process p r o c e s s because b e c a u s e of o f the t h e potential p o t e n t i a l influence i n f l u e n c e on o n system s y s t e m architecture a r c h i t e c t u r e and a n d installation. i n s t a l l a t i o n . However, H o w e v e r , confirmation c o n f i r m a t i o n may m a y not n o t always a l w a y s be b e feasible f e a s i b l e until u n t i l implementation i m p l e m e n t a t i o n is i s complete. c o m p l e t e . A A Particular P a r t i c u l a r Risk R i s k Analysis A n a l y s i s evaluates e v a l u a t e s risks r i s k s defined d e f i n e d as a s those t h o s e events e v e n t s or o r influences i n f l u e n c e s which w h i c h are a r e outside o u t s i d e the t h e system(s) s y s t e m ( s ) and a n d item(s) i t e m ( s ) concerned, c o n c e r n e d , but b u t which w h i c h may m a y violate v i o l a t e failure f a i l u r e independence i n d e p e n d e n c e claims. c l a i m s . Some S o m e particular p a r t i c u l a r risks r i s k s require r e q u i r e analysis a n a l y s i s because b e c a u s e of o f airworthiness a i r w o r t h i n e s s regulations, r e g u l a t i o n s , while w h i l e others o t h e r s arise a r i s e from f r o m known k n o w n external e x t e r n a l threats t h r e a t s to t o the t h e aircraft a i r c r a f t or o r systems. s y s t e m s . These T h e s e particular p a r t i c u l a r risks r i s k s may m a y also a l s o influence i n f l u e n c e several s e v e r a l zones z o n e s at a t the t h e same s a m e time, t i m e , whereas w h e r e a s zonal z o n a l safety s a f e t y analysis a n a l y s i s is i s restricted r e s t r i c t e d to t o each e a c h specific s p e c i f i c zone z o n e . . Details D e t a i l s for f o r performing p e r f o r m i n g a a Particular P a r t i c u l a r Risks R i s k s Assessment A s s e s s m e n t are a r e found f o u n d in i n ARP4761, A R P 4 7 6 1 , Appendix A p p e n d i x J J . . A A Common C o m m o n Mode M o d e Analysis A n a l y s i s is i s performed p e r f o r m e d to t o verify v e r i f y that t h a t failure f a i l u r e events e v e n t s identified i d e n t i f i e d in i n the t h e ASNSSA A S N S S A (FT ( F T NDD N D D or o r MA) M A ) are a r e independent i n d e p e n d e n t in i n the t h e actual a c t u a l implementation i m p l e m e n t a t i o n . . The T h e effects e f f e c t s of o f development, d e v e l o p m e n t , manufacturing, m a n u f a c t u r i n g , installation, i n s t a l l a t i o n , maintenance m a i n t e n a n c e and a n d crew c r e w errors, e r r o r s , and a n d failures f a i l u r e s of o f system s y s t e m components c o m p o n e n t s that t h a t defeat d e f e a t the t h e independence i n d e p e n d e n c e should s h o u l d be b e analyzed. a n a l y z e d . Considerations C o n s i d e r a t i o n s should s h o u l d be b e given g i v e n to t o the t h e independence i n d e p e n d e n c e of o f functions f u n c t i o n s and a n d their t h e i r respective r e s p e c t i v e monitors. m o n i t o r s . Identical I d e n t i c a l systems s y s t e m s or o r items i t e m s could c o u l d be b e susceptible s u s c e p t i b l e to t o common c o m m o n failures/faults f a i l u r e s / f a u l t s that t h a t could c o u l d cause c a u s e failures f a i l u r e s in i n the t h e multiple m u l t i p l e systems s y s t e m s or o r items. i t e m s . The T h e results r e s u l t s of o f preliminary p r e l i m i n a r y common c o m m o n mode m o d e analyses a n a l y s e s are a r e key k e y to t o the t h e assignment a s s i g n m e n t of o f the t h e development d e v e l o p m e n t assurance a s s u r a n c e levels. l e v e l s . Details D e t a i l s for f o r performing p e r f o r m i n g a a Common C o m m o n Mode M o d e Analysis A n a l y s i s are a r e found f o u n d in i n ARP4761, A R P 4 7 6 1 , Appendix A p p e n d i x K. K . A A Zonal Z o n a l Safety S a f e t y Analysis A n a l y s i s should s h o u l d be b e performed p e r f o r m e d on o n each e a c h zone z o n e of o f the t h e aircraft. a i r c r a f t . The T h e objective o b j e c t i v e of o f the t h e analysis a n a l y s i s is i s to t o ensure e n s u r e that t h a t the t h e installation i n s t a l l a t i o n meets m e e t s the t h e safety s a f e t y requirements r e q u i r e m e n t s with w i t h respect r e s p e c t to t o basic b a s i c installation, i n s t a l l a t i o n , interference i n t e r f e r e n c e between b e t w e e n systems, s y s t e m s , or o r maintenance m a i n t e n a n c e errors. e r r o r s . For F o r details d e t a i l s on o n performing p e r f o r m i n g a a Zonal Z o n a l Safety S a f e t y Analysis A n a l y s i s are a r e found f o u n d in i n ARP4761, A R P 4 7 6 1 , Appendix A p p e n d i x I. I . 5.1.5 5 . 1 . 5 Safety S a f e t y Program P r o g r a m Plan P l a n The T h e Safety S a f e t y Program P r o g r a m Plan P l a n should s h o u l d define d e f i n e the t h e scope s c o p e and a n d the t h e content c o n t e n t of o f the t h e safety s a f e t y activities a c t i v i t i e s that t h a t are a r e applicable a p p l i c a b l e at a t the t h e aircraft a i r c r a f t level. l e v e l . The T h e concepts c o n c e p t s of o f a a safety s a f e t y plan p l a n may m a y also a l s o be b e applied a p p l i e d at a t system s y s t e m level, l e v e l , if i f so s o desired. d e s i r e d . The T h e following f o l l o w i n g provides p r o v i d e s an a n overview o v e r v i e w on o n topics t o p i c s that t h a t might m i g h t be b e covered c o v e r e d through t h r o u g h the t h e Safety S a f e t y Program P r o g r a m Plan: P l a n : • • Identify I d e n t i f y the t h e input i n p u t requirements r e q u i r e m e n t s at a t the t h e aircraft a i r c r a f t level l e v e l for f o r which w h i c h safety s a f e t y design d e s i g n and a n d analysis a n a l y s i s responsibility r e s p o n s i b i l i t y is i s being b e i n g taken, t a k e n , • • Identify I d e n t i f y applicable a p p l i c a b l e safety s a f e t y standards, s t a n d a r d s , • • Identify I d e n t i f y the t h e project p r o j e c t safety s a f e t y organization o r g a n i z a t i o n and a n d define d e f i n e responsibilities r e s p o n s i b i l i t i e s within w i t h i n this t h i s organization o r g a n i z a t i o n and a n d its i t s relationship r e l a t i o n s h i p with w i t h partners p a r t n e r s and/or a n d / o r suppliers s u p p l i e r s with w i t h respect r e s p e c t to t o the t h e safety s a f e t y process, p r o c e s s , • • Describe D e s c r i b e the t h e safety s a f e t y activities a c t i v i t i e s and a n d deliverables, d e l i v e r a b l e s , • • Define D e f i n e the t h e key k e y project p r o j e c t milestones m i l e s t o n e s for f o r which w h i c h reports r e p o r t s are a r e required, r e q u i r e d , • • Include I n c l u d e the t h e principles p r i n c i p l e s of o f the t h e management, m a n a g e m e n t , validation v a l i d a t i o n of o f the t h e safety s a f e t y requirements r e q u i r e m e n t s and a n d the t h e verification v e r i f i c a t i o n that t h a t the t h e design d e s i g n meets m e e t s those t h o s e requirements, r e q u i r e m e n t s , • • Identify I d e n t i f y the t h e links l i n k s with w i t h the t h e other o t h e r appropriate a p p r o p r i a t e plans p l a n s (e.g. ( e . g . certification c e r t i f i c a t i o n plan, p l a n , validation v a l i d a t i o n and a n d verification v e r i f i c a t i o n plan, p l a n , process p r o c e s s assurance a s s u r a n c e plan). p l a n ) . Appendix A p p e n d i x B B herein h e r e i n provides p r o v i d e s example e x a m p l e contents c o n t e n t s for f o r the t h e Safety S a f e t y Program P r o g r a m Plan. P l a n . granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true} Downloaded D o w n l o a d e d from f r o m SAE S A E International I n t e r n a t i o n a l by b y David D a v i d Merrill, M e r r i l l , Saturday, S a t u r d a y , November N o v e m b e r 12, 1 2 , 2016 2 0 1 6 SAE S A E ARP4754A A R P 4 7 5 4 A Page P a g e 37 3 7 of o f 115 1 1 5 5.1.6 5 . 1 . 6 Safety-Related S a f e t y - R e l a t e d Flight F l i g h t Operations O p e r a t i o n s or o r Maintenance M a i n t e n a n c e Tasks T a s k s The T h e functions f u n c t i o n s allocated a l l o c a t e d to t o aircraft a i r c r a f t operations o p e r a t i o n s and a n d maintenance m a i n t e n a n c e personnel p e r s o n n e l result r e s u l t in i n tasks t a s k s and a n d procedures p r o c e d u r e s that t h a t may m a y have h a v e an a n associated a s s o c i a t e d safety s a f e t y requirement. r e q u i r e m e n t . Safety-effects S a f e t y - e f f e c t s of o f identified i d e n t i f i e d failure f a i l u r e conditions c o n d i t i o n s may m a y be b e resolved r e s o l v e d through t h r o u g h assignment a s s i g n m e n t of o f specific s p e c i f i c tasks t a s k s or o r identification i d e n t i f i c a t i o n of o f specific s p e c i f i c limitations l i m i t a t i o n s to t o these t h e s e personnel. p e r s o n n e l . Where W h e r e safety-related s a f e t y - r e l a t e d tasks t a s k s or o r limitations l i m i t a t i o n s form f o r m part p a r t of o f the t h e certification c e r t i f i c a t i o n substantiation, s u b s t a n t i a t i o n , they t h e y should s h o u l d be b e identified i d e n t i f i e d and a n d recorded r e c o r d e d in i n the t h e certification c e r t i f i c a t i o n data d a t a (see ( s e e 5 5 .8.4). . 8 . 4 ) . For F o r certification c e r t i f i c a t i o n maintenance m a i n t e n a n c e requirements, r e q u i r e m e n t s , see s e e AC/AMC A C / A M C 25.19. 2 5 . 1 9 . 5.1.7 5 . 1 . 7 Relationship R e l a t i o n s h i p with w i t h In-Service I n - S e r v i c e Safety S a f e t y A A process p r o c e s s for f o r accomplishing a c c o m p l i s h i n g in-service i n - s e r v i c e safety s a f e t y assessment a s s e s s m e n t is i s described d e s c r i b e d in i n ARP5150 A R P 5 1 5 0 "Safety " S a f e t y Assessment A s s e s s m e n t of o f Transport T r a n s p o r t Airplanes A i r p l a n e s in i n Commercial C o m m e r c i a l Service" S e r v i c e " and a n d ARP5151 A R P 5 1 5 1 "Safety " S a f e t y Assessment A s s e s s m e n t of o f General G e n e r a l Aviation A v i a t i o n Airplanes A i r p l a n e s and a n d Rotorcraft R o t o r c r a f t In I n Commercial C o m m e r c i a l Service". S e r v i c e " . These T h e s e documents d o c u m e n t s contain c o n t a i n an a n in-depth i n - d e p t h study s t u d y of o f the t h e processes p r o c e s s e s used u s e d to t o establish e s t a b l i s h and a n d maintain m a i n t a i n surveillance s u r v e i l l a n c e of o f safety s a f e t y concerns c o n c e r n s on o n in-service i n - s e r v i c e airplanes a i r p l a n e s and a n d to t o resolve r e s o l v e those t h o s e issues i s s u e s and a n d document d o c u m e n t the t h e resolutions. r e s o l u t i o n s . Taken T a k e n as a s a a whole, w h o l e , ARP4761 A R P 4 7 6 1 and a n d ARP5150 A R P 5 1 5 0 (or ( o r ARP5151) A R P 5 1 5 1 ) encompass e n c o m p a s s the t h e safety s a f e t y assessment a s s e s s m e n t process p r o c e s s for f o r the t h e entire e n t i r e life l i f e cycle c y c l e of o f the t h e civil c i v i l aircraft a i r c r a f t and a n d its i t s systems s y s t e m s and a n d items i t e m s from f r o m conceptual c o n c e p t u a l design d e s i g n to t o obsolescence. o b s o l e s c e n c e . Safety S a f e t y is i s not n o t self-sustaining s e l f - s u s t a i n i n g . . When W h e n an a n aircraft a i r c r a f t is i s delivered d e l i v e r e d it i t has h a s an a n initial i n i t i a l level l e v e l of o f safety s a f e t y as a s identified i d e n t i f i e d by b y the t h e SSA S S A and a n d the t h e aircraft a i r c r a f t safety s a f e t y assessment. a s s e s s m e n t . As A s aircraft a i r c r a f t are a r e operated, o p e r a t e d , the t h e level l e v e l of o f safety s a f e t y is i s maintained m a i n t a i n e d through t h r o u g h a a continuing c o n t i n u i n g process p r o c e s s of o f monitoring m o n i t o r i n g service s e r v i c e experience, e x p e r i e n c e , identifying i d e n t i f y i n g safety s a f e t y related r e l a t e d issues i s s u e s and a n d opportunities, o p p o r t u n i t i e s , and a n d then t h e n addressing a d d r e s s i n g these t h e s e issues i s s u e s through t h r o u g h appropriate a p p r o p r i a t e product p r o d u c t or o r procedure p r o c e d u r e changes. c h a n g e s . The T h e Ongoing O n g o i n g Safety S a f e t y Assessment A s s e s s m e n t Process P r o c e s s includes i n c l u d e s three t h r e e objectives: o b j e c t i v e s : a. a . Maintain M a i n t a i n the t h e airworthiness a i r w o r t h i n e s s (certification) ( c e r t i f i c a t i o n ) of o f the t h e aircraft a i r c r a f t b. b . Maintain M a i n t a i n the t h e safety s a f e t y of o f the t h e aircraft a i r c r a f t c. c . Improve I m p r o v e the t h e safety s a f e t y of o f the t h e aircraft a i r c r a f t The T h e in-service i n - s e r v i c e safety s a f e t y assessment a s s e s s m e n t process p r o c e s s is i s expected e x p e c t e d to t o be b e continuous, c o n t i n u o u s , iterative i t e r a t i v e and a n d closed-loop. c l o s e d - l o o p . When W h e n an a n event e v e n t is i s identified, i d e n t i f i e d , assessed a s s e s s e d and a n d action a c t i o n implemented, i m p l e m e n t e d , the t h e monitoring m o n i t o r i n g continues c o n t i n u e s to t o validate v a l i d a t e the t h e effectiveness e f f e c t i v e n e s s of o f the t h e action. a c t i o n . 5.2 5 . 2 Development D e v e l o p m e n t Assurance A s s u r a n c e Level L e v e l Assignment A s s i g n m e n t The T h e prerequisites p r e r e q u i s i t e s needed n e e d e d for f o r a a good g o o d understanding u n d e r s t a n d i n g of o f this t h i s section s e c t i o n are a r e the t h e definitions d e f i n i t i o n s of o f Function, F u n c t i o n , Failure F a i l u r e Condition, C o n d i t i o n , Failure, F a i l u r e , Error E r r o r and a n d Independence I n d e p e n d e n c e . . A A Failure F a i l u r e Condition C o n d i t i o n can c a n be b e caused c a u s e d by b y one o n e or o r more m o r e Failures F a i l u r e s or o r Errors. E r r o r s . The T h e mitigation m i t i g a t i o n of o f Failures F a i l u r e s is i s performed p e r f o r m e d by b y setting s e t t i n g safety s a f e t y qualitative q u a l i t a t i v e and/or a n d / o r quantitative q u a n t i t a t i v e requirements, r e q u i r e m e n t s , including i n c l u d i n g the t h e fail-safe f a i l - s a f e design d e s i g n concept c o n c e p t of o f AC/AMC A C / A M C 25.1309 2 5 . 1 3 0 9 which w h i c h influence i n f l u e n c e the t h e system s y s t e m architectures. a r c h i t e c t u r e s . These T h e s e aspects a s p e c t s are a r e described d e s c r i b e d in i n section s e c t i o n 5.1 5 . 1 of o f this t h i s document d o c u m e n t (Safety ( S a f e t y Assessment) A s s e s s m e n t ) . . Errors E r r o r s are a r e mitigated m i t i g a t e d by b y implementation i m p l e m e n t a t i o n of o f a a Development D e v e l o p m e n t Assurance A s s u r a n c e Process. P r o c e s s . The T h e Development D e v e l o p m e n t Assurance A s s u r a n c e Process P r o c e s s establishes e s t a b l i s h e s confidence c o n f i d e n c e that t h a t system s y s t e m development d e v e l o p m e n t has h a s been b e e n accomplished a c c o m p l i s h e d in i n a a sufficiently s u f f i c i e n t l y disciplined d i s c i p l i n e d manner m a n n e r to t o limit l i m i t the t h e likelihood l i k e l i h o o d of o f development d e v e l o p m e n t errors e r r o r s that t h a t could c o u l d impact i m p a c t aircraft a i r c r a f t safety. s a f e t y . The T h e Development D e v e l o p m e n t Assurance A s s u r a n c e Level L e v e l is i s the t h e measure m e a s u r e of o f rigor r i g o r applied a p p l i e d to t o the t h e development d e v e l o p m e n t process p r o c e s s to t o limit, l i m i t , to t o a a level l e v e l acceptable a c c e p t a b l e for f o r safety, s a f e t y , the t h e likelihood l i k e l i h o o d of o f Errors E r r o r s occurring o c c u r r i n g during d u r i n g the t h e development d e v e l o p m e n t process p r o c e s s of o f aircraft/system a i r c r a f t / s y s t e m functions f u n c t i o n s and a n d items i t e m s that t h a t have h a v e an a n adverse a d v e r s e safety s a f e t y effect e f f e c t if i f they t h e y are a r e exposed e x p o s e d in i n service. s e r v i c e . The T h e Development D e v e l o p m e n t Assurance A s s u r a n c e Level L e v e l of o f an a n aircraft/system a i r c r a f t / s y s t e m function f u n c t i o n or o r item i t e m applies a p p l i e s not n o t only o n l y to t o the t h e development d e v e l o p m e n t process p r o c e s s of o f this t h i s aircraft/system a i r c r a f t / s y s t e m function f u n c t i o n or o r item, i t e m , but b u t also a l s o to t o the t h e development d e v e l o p m e n t of o f the t h e interfaces i n t e r f a c e s with w i t h all a l l the t h e other o t h e r aircraft/system a i r c r a f t / s y s t e m functions f u n c t i o n s or o r items i t e m s inter-related i n t e r - r e l a t e d to t o the t h e extent e x t e n t that t h a t they t h e y may m a y affect a f f e c t the t h e function f u n c t i o n or o r item i t e m being b e i n g examined. e x a m i n e d . granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true} Downloaded D o w n l o a d e d from f r o m SAE S A E International I n t e r n a t i o n a l by b y David D a v i d Merrill, M e r r i l l , Saturday, S a t u r d a y , November N o v e m b e r 12, 1 2 , 2016 2 0 1 6 SAE S A E ARP4754A A R P 4 7 5 4 A Page P a g e 38 3 8 of o f 115 1 1 5 The T h e Development D e v e l o p m e n t Assurance A s s u r a n c e Level L e v e l is i s assigned a s s i g n e d depending d e p e n d i n g on o n the t h e severity s e v e r i t y classification c l a s s i f i c a t i o n of o f Failure F a i l u r e Conditions C o n d i t i o n s considering c o n s i d e r i n g the t h e possible p o s s i b l e independence i n d e p e n d e n c e between b e t w e e n development d e v e l o p m e n t processes p r o c e s s e s that t h a t can c a n limit l i m i t the t h e consequences c o n s e q u e n c e s of o f development d e v e l o p m e n t errors. e r r o r s . The T h e more m o r e severe s e v e r e the t h e Failure F a i l u r e Condition C o n d i t i o n Classification, C l a s s i f i c a t i o n , the t h e greater g r e a t e r the t h e level l e v e l of o f Development D e v e l o p m e n t Assurance A s s u r a n c e necessary n e c e s s a r y to t o mitigate m i t i g a t e the t h e Failure F a i l u r e Condition. C o n d i t i o n . 5.2.1 5 . 2 . 1 General G e n e r a l Principles P r i n c i p l e s - - Introduction I n t r o d u c t i o n to t o Development D e v e l o p m e n t Assurance A s s u r a n c e Level L e v e l Assignment A s s i g n m e n t The T h e general g e n e r a l principles p r i n c i p l e s for f o r Development D e v e l o p m e n t Assurance A s s u r a n c e Level L e v e l assignment a s s i g n m e n t taking t a k i n g into i n t o account a c c o u n t Aircraft A i r c r a f t Level L e v e l Failure F a i l u r e Conditions C o n d i t i o n s severity s e v e r i t y classification c l a s s i f i c a t i o n are a r e described d e s c r i b e d in i n the t h e following f o l l o w i n g paragraphs. p a r a g r a p h s . When W h e n a a Catastrophic C a t a s t r o p h i c FC F C is i s involved, i n v o l v e d , the t h e assignment a s s i g n m e n t principles p r i n c i p l e s are: a r e : • • If I f a a Catastrophic C a t a s t r o p h i c Failure F a i l u r e Condition C o n d i t i o n (FC) ( F C ) could c o u l d result r e s u l t from f r o m a a possible p o s s i b l e development d e v e l o p m e n t error e r r o r in i n an a n aircraft/system a i r c r a f t / s y s t e m function f u n c t i o n or o r item, i t e m , then t h e n the t h e associated a s s o c i a t e d Development D e v e l o p m e n t Assurance A s s u r a n c e process p r o c e s s is i s assigned a s s i g n e d level l e v e l A A • • If I f a a Catastrophic C a t a s t r o p h i c Failure F a i l u r e Condition C o n d i t i o n could c o u l d result r e s u l t from f r o m a a combination c o m b i n a t i o n of o f possible p o s s i b l e development d e v e l o p m e n t errors e r r o r s between b e t w e e n two t w o or o r more m o r e independently i n d e p e n d e n t l y developed d e v e l o p e d aircraft/system a i r c r a f t / s y s t e m functions f u n c t i o n s or o r items i t e m s then, t h e n , either e i t h e r one o n e Development D e v e l o p m e n t Assurance A s s u r a n c e process p r o c e s s is i s assigned a s s i g n e d level l e v e l A, A , or o r two t w o Development D e v e l o p m e n t Assurance A s s u r a n c e processes p r o c e s s e s are a r e assigned a s s i g n e d at a t least l e a s t level l e v e l B B . . The T h e other o t h e r independently i n d e p e n d e n t l y developed d e v e l o p e d aircraft/system a i r c r a f t / s y s t e m functions f u n c t i o n s or o r items i t e m s are a r e assigned a s s i g n e d no n o lower l o w e r than t h a n Development D e v e l o p m e n t Assurance A s s u r a n c e Level L e v e l C. C . The T h e Development D e v e l o p m e n t Assurance A s s u r a n c e process p r o c e s s establishing e s t a b l i s h i n g that t h a t the t h e two t w o or o r more m o r e independently i n d e p e n d e n t l y developed d e v e l o p e d aircraft/system a i r c r a f t / s y s t e m functions f u n c t i o n s or o r items i t e m s are a r e in i n fact f a c t independent i n d e p e n d e n t should s h o u l d remain r e m a i n level l e v e l A A When W h e n a a Hazardous H a z a r d o u s FC F C is i s involved, i n v o l v e d , the t h e assignment a s s i g n m e n t principles p r i n c i p l e s are: a r e : • • If I f a a Hazardous/Severe H a z a r d o u s / S e v e r e Major M a j o r Failure F a i l u r e Condition C o n d i t i o n could c o u l d result r e s u l t from f r o m a a possible p o s s i b l e development d e v e l o p m e n t error e r r o r in i n an a n aircraft/system a i r c r a f t / s y s t e m function f u n c t i o n or o r item, i t e m , then t h e n the t h e associated a s s o c i a t e d Development D e v e l o p m e n t Assurance A s s u r a n c e process p r o c e s s is i s assigned a s s i g n e d at a t least l e a s t level l e v e l B. B . • • If I f a a Hazardous H a z a r d o u s Failure/Severe F a i l u r e / S e v e r e Major M a j o r Condition C o n d i t i o n could c o u l d result r e s u l t from f r o m a a combination c o m b i n a t i o n of o f possible p o s s i b l e development d e v e l o p m e n t errors e r r o r s between b e t w e e n two t w o or o r more m o r e independently i n d e p e n d e n t l y developed d e v e l o p e d aircraft/system a i r c r a f t / s y s t e m functions f u n c t i o n s or o r items i t e m s then, t h e n , either e i t h e r one o n e Development D e v e l o p m e n t Assurance A s s u r a n c e process p r o c e s s is i s assigned a s s i g n e d at a t least l e a s t level l e v e l B, B , or o r two t w o Development D e v e l o p m e n t Assurance A s s u r a n c e processes p r o c e s s e s are a r e assigned a s s i g n e d at a t least l e a s t level l e v e l C. C . The T h e other o t h e r independently i n d e p e n d e n t l y developed d e v e l o p e d aircraft/system a i r c r a f t / s y s t e m functions f u n c t i o n s or o r items i t e m s are a r e assigned a s s i g n e d no n o lower l o w e r than t h a n Development D e v e l o p m e n t Assurance A s s u r a n c e Level L e v e l D. D . The T h e Development D e v e l o p m e n t Assurance A s s u r a n c e process p r o c e s s establishing e s t a b l i s h i n g that t h a t the t h e two t w o or o r more m o r e independently i n d e p e n d e n t l y developed d e v e l o p e d aircraft/system a i r c r a f t / s y s t e m functions f u n c t i o n s or o r items i t e m s are a r e in i n fact f a c t independent i n d e p e n d e n t should s h o u l d remain r e m a i n level l e v e l B. B . When W h e n a a Major M a j o r FC F C is i s involved, i n v o l v e d , the t h e assignment a s s i g n m e n t principles p r i n c i p l e s are: a r e : • • If I f a a Major M a j o r Failure F a i l u r e Condition C o n d i t i o n could c o u l d result r e s u l t from f r o m a a possible p o s s i b l e development d e v e l o p m e n t error e r r o r in i n an a n aircraft/system a i r c r a f t / s y s t e m function f u n c t i o n or o r item, i t e m , then t h e n the t h e associated a s s o c i a t e d development d e v e l o p m e n t assurance a s s u r a n c e process p r o c e s s is i s assigned a s s i g n e d a a level l e v e l C. C . • • If I f a a Major M a j o r Failure F a i l u r e Condition C o n d i t i o n could c o u l d result r e s u l t from f r o m a a combination c o m b i n a t i o n of o f possible p o s s i b l e development d e v e l o p m e n t errors e r r o r s between b e t w e e n two t w o or o r more m o r e independently i n d e p e n d e n t l y developed d e v e l o p e d aircraft/system a i r c r a f t / s y s t e m functions f u n c t i o n s or o r items i t e m s then, t h e n , one o n e development d e v e l o p m e n t assurance a s s u r a n c e process p r o c e s s is i s assigned a s s i g n e d at a t least l e a s t level l e v e l C C or o r two t w o development d e v e l o p m e n t assurance a s s u r a n c e processes p r o c e s s e s are a r e assigned a s s i g n e d at a t least l e a s t level l e v e l D. D . The T h e Development D e v e l o p m e n t Assurance A s s u r a n c e process p r o c e s s establishing e s t a b l i s h i n g that t h a t the t h e two t w o or o r more m o r e independently i n d e p e n d e n t l y developed d e v e l o p e d aircraft/system a i r c r a f t / s y s t e m functions f u n c t i o n s or o r items i t e m s are a r e in i n fact f a c t independent i n d e p e n d e n t should s h o u l d remain r e m a i n level l e v e l C. C . When W h e n a a Minor M i n o r FC F C is i s involved, i n v o l v e d , the t h e assignment a s s i g n m e n t principles p r i n c i p l e s are: a r e : • • If I f a a Minor M i n o r Failure F a i l u r e Condition C o n d i t i o n could c o u l d result r e s u l t from f r o m a a possible p o s s i b l e development d e v e l o p m e n t error e r r o r in i n an a n aircraft/system a i r c r a f t / s y s t e m function f u n c t i o n or o r item, i t e m , then t h e n the t h e associated a s s o c i a t e d development d e v e l o p m e n t assurance a s s u r a n c e process p r o c e s s is i s assigned a s s i g n e d at a t least l e a s t level l e v e l D. D . • • If I f a a Minor M i n o r Failure F a i l u r e Condition C o n d i t i o n could c o u l d result r e s u l t from f r o m a a combination c o m b i n a t i o n of o f possible p o s s i b l e development d e v e l o p m e n t errors e r r o r s between b e t w e e n two t w o or o r more m o r e independently i n d e p e n d e n t l y developed d e v e l o p e d aircraft/system a i r c r a f t / s y s t e m functions f u n c t i o n s or o r items i t e m s then, t h e n , one o n e development d e v e l o p m e n t assurance a s s u r a n c e process p r o c e s s is i s assigned a s s i g n e d at a t least l e a s t level l e v e l D. D . granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true} Downloaded D o w n l o a d e d from f r o m SAE S A E International I n t e r n a t i o n a l by b y David D a v i d Merrill, M e r r i l l , Saturday, S a t u r d a y , November N o v e m b e r 12, 1 2 , 2016 2 0 1 6 SAE S A E ARP4754A A R P 4 7 5 4 A Page P a g e 39 3 9 of o f 115 1 1 5 5.2.2 5 . 2 . 2 FOAL F O A L and a n d IDAL I D A L To T o address a d d r e s s the t h e general g e n e r a l principles p r i n c i p l e s during d u r i n g the t h e development d e v e l o p m e n t phase, p h a s e , two t w o phases p h a s e s can c a n be b e identified i d e n t i f i e d with w i t h two t w o different d i f f e r e n t types t y p e s of o f development d e v e l o p m e n t processes: p r o c e s s e s : Function F u n c t i o n development d e v e l o p m e n t phase p h a s e and a n d item i t e m development d e v e l o p m e n t phase. p h a s e . Function F u n c t i o n development d e v e l o p m e n t phase: p h a s e : During D u r i n g this t h i s phase, p h a s e , requirements r e q u i r e m e n t s for f o r Functions F u n c t i o n s are a r e developed d e v e l o p e d and a n d allocated a l l o c a t e d to t o items. i t e m s . The T h e requirement r e q u i r e m e n t development d e v e l o p m e n t process p r o c e s s includes i n c l u d e s validation v a l i d a t i o n (assurance ( a s s u r a n c e of o f completeness c o m p l e t e n e s s and a n d correctness) c o r r e c t n e s s ) of o f the t h e requirement r e q u i r e m e n t set. s e t . The T h e level l e v e l of o f rigor r i g o r of o f the t h e development d e v e l o p m e n t process p r o c e s s for f o r Function F u n c t i o n requirement r e q u i r e m e n t development d e v e l o p m e n t is i s given g i v e n by b y the t h e Development D e v e l o p m e n t Assurance A s s u r a n c e Level L e v e l of o f the t h e Function F u n c t i o n hereafter h e r e a f t e r called c a l l e d FOAL. F O A L . The T h e objectives o b j e c t i v e s to t o be b e met m e t are a r e provided p r o v i d e d within w i t h i n this t h i s document; d o c u m e n t ; Appendix A p p e n d i x A A gives g i v e s the t h e applicability a p p l i c a b i l i t y of o f these t h e s e objectives o b j e c t i v e s for f o r each e a c h FOAL. F O A L . Item I t e m development d e v e l o p m e n t phase: p h a s e : During D u r i n g this t h i s phase p h a s e items i t e m s are a r e developed. d e v e l o p e d . The T h e level l e v e l of o f rigor r i g o r of o f the t h e development d e v e l o p m e n t process p r o c e s s for f o r items i t e m s is i s given g i v e n by b y the t h e electronic e l e c t r o n i c hardware h a r d w a r e or o r software s o f t w a r e assurance a s s u r a n c e level l e v e l called c a l l e d hereafter h e r e a f t e r IDAL. I D A L . In I n the t h e context c o n t e x t of o f IDAL I D A L assignment a s s i g n m e n t an a n item i t e m does d o e s not n o t contain c o n t a i n architectural a r c h i t e c t u r a l features f e a t u r e s to t o be b e used u s e d for f o r credit c r e d i t in i n mitigating m i t i g a t i n g potential p o t e n t i a l development d e v e l o p m e n t errors e r r o r s within w i t h i n itself i t s e l f . . The T h e objectives o b j e c t i v e s to t o be b e met, m e t , dependent d e p e n d e n t on o n the t h e IDAL I D A L are a r e given g i v e n in i n the t h e D0-254/ED-80 D 0 - 2 5 4 / E D - 8 0 for f o r electronic e l e c t r o n i c hardware h a r d w a r e and a n d D0- D 0 - 1788/ED-128 1 7 8 8 / E D - 1 2 8 for f o r software. s o f t w a r e . The T h e objectives o b j e c t i v e s to t o be b e met m e t for f o r the t h e integration i n t e g r a t i o n of o f electronic e l e c t r o n i c hardware h a r d w a r e and a n d software s o f t w a r e are a r e provided p r o v i d e d by b y this t h i s document. d o c u m e n t . Note N o t e that t h a t the t h e boundaries b o u n d a r i e s between b e t w e e n systems s y s t e m s and a n d items i t e m s may m a y not n o t coincide c o i n c i d e with w i t h the t h e boundaries b o u n d a r i e s between b e t w e e n aircraft a i r c r a f t manufacturers m a n u f a c t u r e r s and a n d suppliers, s u p p l i e r s , or o r between b e t w e e n suppliers s u p p l i e r s and a n d sub-tier s u b - t i e r suppliers s u p p l i e r s or o r with w i t h physical p h y s i c a l packaging. p a c k a g i n g . 5.2.3 5 . 2 . 3 Detailed D e t a i l e d FOAL F O A L and a n d IDAL I D A L Assignment A s s i g n m e n t Guidelines G u i d e l i n e s The T h e safety s a f e t y assessment a s s e s s m e n t techniques t e c h n i q u e s (e.g. ( e . g . Aircraft A i r c r a f t FHA, F H A , PASA, P A S A , System S y s t e m FHA, F H A , PSSA, P S S A , CMA) C M A ) of o f ARP4761 A R P 4 7 6 1 can c a n be b e used u s e d to t o identify i d e n t i f y Failure F a i l u r e Conditions C o n d i t i o n s in i n a a systematic s y s t e m a t i c manner m a n n e r early e a r l y in i n system s y s t e m development. d e v e l o p m e n t . The T h e relationships r e l a t i o n s h i p s among a m o n g functions, f u n c t i o n s , related r e l a t e d Failure F a i l u r e Condition C o n d i t i o n Classifications, C l a s s i f i c a t i o n s , systems s y s t e m s and a n d item i t e m requirements, r e q u i r e m e n t s , and a n d the t h e corresponding c o r r e s p o n d i n g assignment a s s i g n m e n t of o f Development D e v e l o p m e n t Assurance A s s u r a n c e Levels L e v e l s is i s summarized s u m m a r i z e d in i n Figure F i g u r e 8. 8 . Proposed P r o p o s e d allocations a l l o c a t i o n s of o f Aircraft A i r c r a f t Functions F u n c t i o n s are a r e evaluated e v a l u a t e d for f o r potential p o t e n t i a l Failure F a i l u r e Conditions C o n d i t i o n s using u s i n g the t h e aircraft a i r c r a f t FHA F H A technique, t e c h n i q u e , to t o validate v a l i d a t e aircraft-level a i r c r a f t - l e v e l architectures a r c h i t e c t u r e s and a n d derive d e r i v e safety s a f e t y requirements r e q u i r e m e n t s for f o r the t h e various v a r i o u s systems s y s t e m s contributing c o n t r i b u t i n g to t o those t h o s e aircraft a i r c r a f t level l e v e l Functions. F u n c t i o n s . Particular P a r t i c u l a r Risk R i s k Analyses A n a l y s e s and a n d Zonal Z o n a l Safety S a f e t y Analysis A n a l y s i s are a r e not n o t used u s e d to t o assign a s s i g n Development D e v e l o p m e n t Assurance A s s u r a n c e Level. L e v e l . FHA F H A (A/C, ( A / C , Sys) S y s ) ...r, . . . r , PASA P A S A I I PSSA P S S A 1 1 .I....-- . I . . . . - - . . .., . . , Architecture A r c h i t e c t u r e F_un_cti F _ u n _ c t i ._.,I . _ . , I I I changes c h a n g e s I I I I o_ns o _ n s Operational O p e r a t i o n a l I I It-- I t - - .., . . , Derived D e r i v e d Safety S a f e t y Requirements R e q u i r e m e n t s .., . . , 1 1 I I Requirements R e q u i r e m e n t s Proposed P r o p o s e d I I FOAL F O A L & & IDAL I D A L I I Architecture A r c h i t e c t u r e I I Assignment A s s i g n m e n t ............. . . . . . . . . . . . . . 1 1 -------- - - - - - - - - FDAL, F D A L , IDAL I D A L ....;.;..;;;.;..;.;.;=-=-= . . . . ; . ; . . ; ; ; . ; . . ; . ; . ; = - = - = - - Process P r o c e s s I I •Functions • F u n c t i o n s I I •Electronic • E l e c t r o n i c Hardware H a r d w a r e I I •Software • S o f t w a r e FIGURE F I G U R E 8 8 - - FDAUIDAL F D A U I D A L ASSIGNMENT A S S I G N M E N T PROCESS P R O C E S S Development D e v e l o p m e n t Assurance A s s u r a n c e Levels L e v e l s are a r e assigned a s s i g n e d to t o aircraft/system a i r c r a f t / s y s t e m functions f u n c t i o n s and a n d items i t e m s so s o that t h a t the t h e appropriate a p p r o p r i a t e validation v a l i d a t i o n and a n d verification v e r i f i c a t i o n processes p r o c e s s e s are a r e invoked i n v o k e d to t o minimize m i n i m i z e Errors E r r o r s in i n their t h e i r development d e v e l o p m e n t processes. p r o c e s s e s . The T h e assigned a s s i g n e d Development D e v e l o p m e n t Assurance A s s u r a n c e Level L e v e l does d o e s not n o t imply i m p l y particular p a r t i c u l a r random r a n d o m hardware h a r d w a r e failure f a i l u r e probabilities, p r o b a b i l i t i e s , i.e. i . e . the t h e probability p r o b a b i l i t y analysis a n a l y s i s of o f the t h e Failure F a i l u r e Condition C o n d i t i o n is i s also a l s o required r e q u i r e d when w h e n necessary n e c e s s a r y to t o demonstrate d e m o n s t r a t e compliance c o m p l i a n c e with w i t h the t h e safety s a f e t y requirements. r e q u i r e m e n t s . It I t should s h o u l d be b e understood u n d e r s t o o d that t h a t the t h e level l e v e l of o f rigor r i g o r in i n the t h e Development D e v e l o p m e n t Assurance A s s u r a n c e of o f an a n aircraft/system a i r c r a f t / s y s t e m function f u n c t i o n or o r item i t e m is i s established e s t a b l i s h e d by b y assignment a s s i g n m e n t of o f a a Development D e v e l o p m e n t Assurance A s s u r a n c e Level, L e v e l , be b e it i t a a FOAL F O A L to t o a a Function F u n c t i o n or o r IDAL I D A L to t o an a n item. i t e m . Interactions I n t e r a c t i o n s of o f system s y s t e m Functions F u n c t i o n s making m a k i n g up u p an a n Aircraft A i r c r a f t Function F u n c t i o n need n e e d to t o be b e assessed a s s e s s e d at a t the t h e FOAL F O A L of o f the t h e aircraft a i r c r a f t Function. F u n c t i o n . Interactions I n t e r a c t i o n s of o f items i t e m s making m a k i n g up u p a a system s y s t e m Function F u n c t i o n need n e e d to t o be b e assessed a s s e s s e d at a t the t h e higher h i g h e r of o f the t h e FDALs F D A L s of o f the t h e aircraft a i r c r a f t and a n d system s y s t e m Functions. F u n c t i o n s . granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true} Downloaded D o w n l o a d e d from f r o m SAE S A E International I n t e r n a t i o n a l by b y David D a v i d Merrill, M e r r i l l , Saturday, S a t u r d a y , November N o v e m b e r 12, 1 2 , 2016 2 0 1 6 SAE S A E ARP4754A A R P 4 7 5 4 A Page P a g e 40 4 0 of o f 115 1 1 5 The T h e Development D e v e l o p m e n t Assurance A s s u r a n c e Level L e v e l assignment a s s i g n m e n t process p r o c e s s begins b e g i n s with w i t h FOAL F O A L assignment a s s i g n m e n t to t o the t h e Functions F u n c t i o n s involved i n v o l v e d in i n the t h e aircraft's a i r c r a f t ' s and/or a n d / o r systems' s y s t e m s ' FHA F H A Failure F a i l u r e Conditions C o n d i t i o n s (called ( c a l l e d herein h e r e i n Top-Level T o p - L e v e l Failure F a i l u r e Conditions). C o n d i t i o n s ) . An A n FOAL F O A L is i s assigned a s s i g n e d to t o the t h e top-level t o p - l e v e l Function, F u n c t i o n , based b a s e d on o n its i t s most m o s t severe s e v e r e Top-Level T o p - L e v e l Failure F a i l u r e Condition C o n d i t i o n Classification. C l a s s i f i c a t i o n . This T h i s is i s performed p e r f o r m e d for f o r each e a c h Function F u n c t i o n in i n the t h e aircraft a i r c r a f t and a n d system s y s t e m FHAs F H A s in i n accordance a c c o r d a n c e with w i t h Table T a b l e 2. 2 . This T h i s assignment a s s i g n m e n t establishes e s t a b l i s h e s the t h e rigor r i g o r for f o r the t h e applicable a p p l i c a b l e Development D e v e l o p m e n t Assurance A s s u r a n c e processes p r o c e s s e s described d e s c r i b e d in i n this t h i s ARP. A R P . TABLE T A B L E 2 2 - - TOP-LEVEL T O P - L E V E L FUNCTION F U N C T I O N FOAL F O A L ASSIGNMENT A S S I G N M E N T Top-Level T o p - L e v e l Failure F a i l u r e Condition C o n d i t i o n Severity S e v e r i t y Classification C l a s s i f i c a t i o n Associated A s s o c i a t e d Top-Level T o p - L e v e l Function F u n c t i o n FOAL F O A L Assignment A s s i g n m e n t Catastrophic C a t a s t r o p h i c A A Hazardous/Severe H a z a r d o u s / S e v e r e Major M a j o r B B Major M a j o r C C Minor M i n o r D D No N o Safety S a f e t y Effect E f f e c t E E 5.2.3.1 5 . 2 . 3 . 1 FOAL F O A L Assignment A s s i g n m e n t without w i t h o u t System S y s t e m Architecture A r c h i t e c t u r e Consideration C o n s i d e r a t i o n Table T a b l e 2 2 can c a n be b e used u s e d to t o directly d i r e c t l y assign a s s i g n the t h e Development D e v e l o p m e n t Assurance A s s u r a n c e Levels L e v e l s for f o r everything e v e r y t h i n g under u n d e r that t h a t Function F u n c t i o n (i.e. ( i . e . FOAL F O A L for f o r all a l l the t h e Functions F u n c t i o n s supporting s u p p o r t i n g the t h e Top-Level T o p - L e v e l Function, F u n c t i o n , and a n d IDAL I D A L for f o r all a l l items i t e m s in i n the t h e architecture a r c h i t e c t u r e at a t the t h e same s a m e level l e v e l as a s the t h e Top-Level T o p - L e v e l Function F u n c t i o n FOAL). F O A L ) . When W h e n the t h e mitigation m i t i g a t i o n strategy s t r a t e g y for f o r systematic s y s t e m a t i c errors e r r o r s is i s a a single s i n g l e FOAL F O A L A A development d e v e l o p m e n t process p r o c e s s for f o r a a Catastrophic C a t a s t r o p h i c Failure F a i l u r e Condition, C o n d i t i o n , then t h e n the t h e applicant a p p l i c a n t may m a y be b e required r e q u i r e d to t o substantiate s u b s t a n t i a t e that t h a t the t h e development d e v e l o p m e n t process p r o c e s s for f o r that t h a t member m e m b e r has h a s sufficient s u f f i c i e n t independent i n d e p e n d e n t validation/verification v a l i d a t i o n / v e r i f i c a t i o n activities, a c t i v i t i e s , techniques t e c h n i q u e s and a n d completion c o m p l e t i o n criteria c r i t e r i a to t o ensure e n s u r e that t h a t potential p o t e n t i a l development d e v e l o p m e n t error(s) e r r o r ( s ) having h a v i n g a a catastrophic c a t a s t r o p h i c effect e f f e c t have h a v e been b e e n removed r e m o v e d or o r mitigated. m i t i g a t e d . In I n this t h i s case, c a s e , the t h e development d e v e l o p m e n t assurance a s s u r a n c e process p r o c e s s needs n e e d s to t o provide p r o v i d e confidence c o n f i d e n c e that t h a t development d e v e l o p m e n t error e r r o r (s) ( s ) will w i l l be b e detected d e t e c t e d and a n d resolved r e s o l v e d within w i t h i n the t h e process p r o c e s s rather r a t h e r than t h a n relying r e l y i n g on o n independence i n d e p e n d e n c e within w i t h i n the t h e architecture a r c h i t e c t u r e . . 5.2.3.2 5 . 2 . 3 . 2 FOAL F O A L Assignment A s s i g n m e n t with w i t h System S y s t e m Architecture A r c h i t e c t u r e Consideration C o n s i d e r a t i o n Once O n c e an a n FOAL F O A L is i s assigned a s s i g n e d to t o a a Top-Level T o p - L e v e l Function F u n c t i o n based b a s e d on o n the t h e Top-Level T o p - L e v e l Failure F a i l u r e Conditions' C o n d i t i o n s ' severity s e v e r i t y classification, c l a s s i f i c a t i o n , the t h e architecture a r c h i t e c t u r e of o f the t h e system s y s t e m Functions F u n c t i o n s involved i n v o l v e d in i n that t h a t Top-Level T o p - L e v e l Function F u n c t i o n is i s examined e x a m i n e d to t o determine d e t e r m i n e the t h e Development D e v e l o p m e n t Assurance A s s u r a n c e levels l e v e l s of o f those t h o s e system s y s t e m Functions. F u n c t i o n s . This T h i s section s e c t i o n describes d e s c r i b e s a a process p r o c e s s for f o r determining d e t e r m i n i n g the t h e FDALs F D A L s for f o r the t h e supporting s u p p o r t i n g system s y s t e m Functions. F u n c t i o n s . During D u r i n g allocation a l l o c a t i o n of o f a a top-level t o p - l e v e l function f u n c t i o n into i n t o two t w o or o r more m o r e independent i n d e p e n d e n t sub-functions s u b - f u n c t i o n s (i.e. ( i . e . one o n e sub-function s u b - f u n c t i o n by b y itself i t s e l f cannot c a n n o t cause c a u s e the t h e top t o p level l e v e l hazard), h a z a r d ) , it i t is i s possible p o s s i b l e to t o assign a s s i g n an a n FOAL F O A L of o f at a t least l e a s t one o n e of o f the t h e sub-functions s u b - f u n c t i o n s lower l o w e r than t h a n the t h e top-level t o p - l e v e l function's f u n c t i o n ' s FOAL. F O A L . However, H o w e v e r , there t h e r e may m a y also a l s o be b e functional f u n c t i o n a l allocations a l l o c a t i o n s where w h e r e the t h e FOAL F O A L assignment a s s i g n m e n t of o f at a t least l e a s t one o n e of o f the t h e sub-functions s u b - f u n c t i o n s may m a y be b e as a s high h i g h as a s the t h e level l e v e l of o f the t h e top t o p hazard. h a z a r d . Several S e v e r a l different d i f f e r e n t FOAL F O A L assignment a s s i g n m e n t cases c a s e s are a r e discussed d i s c u s s e d in i n succeeding s u c c e e d i n g paragraphs. p a r a g r a p h s . The T h e prerequisites p r e r e q u i s i t e s for f o r a a good g o o d understanding u n d e r s t a n d i n g of o f FOAL F O A L (and ( a n d IDAL) I D A L ) assignment a s s i g n m e n t are a r e the t h e definitions d e f i n i t i o n s of o f Functional F u n c t i o n a l Failure F a i l u r e Set, S e t , Members M e m b e r s and a n d Independence. I n d e p e n d e n c e . A A systematic s y s t e m a t i c approach a p p r o a c h to t o assigning a s s i g n i n g Development D e v e l o p m e n t Assurance A s s u r a n c e Levels, L e v e l s , when w h e n considering c o n s i d e r i n g system s y s t e m architectures, a r c h i t e c t u r e s , is i s to t o use u s e the t h e concept c o n c e p t of o f Functional F u n c t i o n a l Failure F a i l u r e Sets S e t s (FFS). ( F F S ) . System S y s t e m Safety S a f e t y Assessment A s s e s s m e n t techniques t e c h n i q u e s are a r e used u s e d to t o identify i d e n t i f y all a l l the t h e Functional F u n c t i o n a l Failure F a i l u r e Sets S e t s (FFSs) ( F F S s ) that t h a t lead l e a d to t o each e a c h top-level t o p - l e v e l Failure F a i l u r e Condition C o n d i t i o n and a n d the t h e Members M e m b e r s of o f each e a c h FFS. F F S . The T h e FFSs F F S s for f o r a a given g i v e n Failure F a i l u r e Condition C o n d i t i o n may m a y be b e identified i d e n t i f i e d by b y using u s i n g qualitative q u a l i t a t i v e safety s a f e t y assessment a s s e s s m e n t techniques, t e c h n i q u e s , such s u c h as a s Fault F a u l t Tree T r e e Analysis A n a l y s i s (ref: ( r e f : ARP4761 A R P 4 7 6 1 Appendix A p p e n d i x D) D ) or o r Dependence D e p e n d e n c e Diagrams D i a g r a m s (ref: ( r e f : ARP4761 A R P 4 7 6 1 Appendix A p p e n d i x E). E ) . granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true} Downloaded D o w n l o a d e d from f r o m SAE S A E International I n t e r n a t i o n a l by b y David D a v i d Merrill, M e r r i l l , Saturday, S a t u r d a y , November N o v e m b e r 12, 1 2 , 2016 2 0 1 6 SAE S A E ARP4754A A R P 4 7 5 4 A Page P a g e 41 4 1 of o f 115 1 1 5 Conceptually, C o n c e p t u a l l y , for f o r FOAL F O A L (and ( a n d subsequently s u b s e q u e n t l y IDAL) I D A L ) assignment a s s i g n m e n t purposes, p u r p o s e s , a a FFS F F S is i s equivalent e q u i v a l e n t to t o a a Fault F a u l t Tree T r e e minimal m i n i m a l cut c u t set s e t (as ( a s defined d e f i n e d in i n ARP4761 A R P 4 7 6 1 ), ) , whose w h o s e members m e m b e r s represent r e p r e s e n t the t h e result r e s u l t of o f potential p o t e n t i a l development d e v e l o p m e n t errors e r r o r s rather r a t h e r than t h a n failures. f a i l u r e s . The T h e FFS F F S is i s used u s e d to t o identify i d e n t i f y combinations c o m b i n a t i o n s of o f members m e m b e r s which w h i c h may m a y lead l e a d to t o each e a c h Failure F a i l u r e Condition C o n d i t i o n and a n d assign a s s i g n the t h e appropriate a p p r o p r i a t e rigor r i g o r to t o mitigate m i t i g a t e the t h e potential p o t e n t i a l Errors. E r r o r s . A A Failure F a i l u r e Condition C o n d i t i o n may m a y have h a v e a a single s i n g l e FFS F F S or o r multiple m u l t i p l e FFSs, F F S s , and a n d each e a c h FFS F F S may m a y contain c o n t a i n either e i t h e r a a single s i n g l e or o r multiple m u l t i p l e Members. M e m b e r s . 5.2.3.2.1 5 . 2 . 3 . 2 . 1 Independence I n d e p e n d e n c e Attributes A t t r i b u t e s Independence I n d e p e n d e n c e between b e t w e e n aircraft/system a i r c r a f t / s y s t e m functions f u n c t i o n s or o r items i t e m s can c a n protect p r o t e c t against a g a i n s t potential p o t e n t i a l common c o m m o n mode m o d e Errors E r r o r s and a n d is i s a a fundamental f u n d a m e n t a l attribute a t t r i b u t e to t o consider c o n s i d e r when w h e n assigning a s s i g n i n g Development D e v e l o p m e n t Assurance A s s u r a n c e Levels. L e v e l s . The T h e intent i n t e n t of o f Independence I n d e p e n d e n c e attributes a t t r i b u t e s is i s to t o have h a v e sufficient s u f f i c i e n t confidence c o n f i d e n c e that t h a t the t h e likelihood l i k e l i h o o d of o f a a common c o m m o n mode m o d e Error E r r o r is i s minimized m i n i m i z e d between b e t w e e n two t w o or o r more m o r e members m e m b e r s commensurate c o m m e n s u r a t e with w i t h the t h e severity s e v e r i t y of o f the t h e Failure F a i l u r e Condition C o n d i t i o n Classification. C l a s s i f i c a t i o n . For F o r the t h e purposes p u r p o s e s of o f assigning a s s i g n i n g FOAL F O A L and a n d IDAL, I D A L , two t w o types t y p e s of o f independence i n d e p e n d e n c e attributes, a t t r i b u t e s , Functional F u n c t i o n a l Independence I n d e p e n d e n c e and a n d item i t e m Development D e v e l o p m e n t Independence I n d e p e n d e n c e are a r e considered. c o n s i d e r e d . 5.2.3.2.1.%1%Functional 5 . 2 . 3 . 2 . 1 . % 1 % F u n c t i o n a l Independence I n d e p e n d e n c e Functional F u n c t i o n a l Independence I n d e p e n d e n c e is i s an a n attribute a t t r i b u t e where w h e r e the t h e Functions F u n c t i o n s are a r e different d i f f e r e n t in i n order o r d e r to t o minimize m i n i m i z e the t h e likelihood l i k e l i h o o d of o f a a common c o m m o n requirement r e q u i r e m e n t Error. E r r o r . For F o r example, e x a m p l e , allocation a l l o c a t i o n of o f two t w o different d i f f e r e n t sets s e t s of o f Functional F u n c t i o n a l requirements r e q u i r e m e n t s could c o u l d minimize m i n i m i z e the t h e likelihood l i k e l i h o o d of o f the t h e same s a m e Error E r r o r being b e i n g present p r e s e n t in i n both. b o t h . Analysis A n a l y s i s should s h o u l d show s h o w that t h a t the t h e requirements r e q u i r e m e n t s have h a v e been b e e n subjected s u b j e c t e d to t o a a sufficiently s u f f i c i e n t l y thorough t h o r o u g h examination, e x a m i n a t i o n , at a t a a level l e v e l commensurate c o m m e n s u r a t e with w i t h the t h e severity s e v e r i t y of o f the t h e Failure F a i l u r e Condition C o n d i t i o n being b e i n g examined, e x a m i n e d , and a n d no n o adverse a d v e r s e commonality c o m m o n a l i t y was w a s identified. i d e n t i f i e d . Functional F u n c t i o n a l Independence I n d e p e n d e n c e minimizes m i n i m i z e s the t h e likelihood l i k e l i h o o d of o f common c o m m o n sources s o u r c e s of o f error e r r o r associated a s s o c i a t e d with: w i t h : • • Common C o m m o n requirements r e q u i r e m e n t s errors, e r r o r s , • • Common C o m m o n requirement r e q u i r e m e n t interpretation i n t e r p r e t a t i o n errors. e r r o r s . Examples E x a m p l e s of o f Functional F u n c t i o n a l Independence I n d e p e n d e n c e where w h e r e different d i f f e r e n t requirements r e q u i r e m e n t s are a r e employed e m p l o y e d to t o implemenUachieve i m p l e m e n U a c h i e v e an a n aircraft a i r c r a f t or o r system s y s t e m level l e v e l Function F u n c t i o n and a n d may m a y mitigate m i t i g a t e the t h e relevant r e l e v a n t Top-Level T o p - L e v e l Failure F a i l u r e Conditions C o n d i t i o n s include: i n c l u d e : • • Decelerate D e c e l e r a t e on o n the t h e ground g r o u n d (wheel ( w h e e l brakes, b r a k e s , engine e n g i n e thrust t h r u s t reversers r e v e r s e r s and a n d ground g r o u n d spoilers), s p o i l e r s ) , • • Control C o n t r o l direction d i r e c t i o n on o n ground g r o u n d (nose ( n o s e wheel w h e e l steering, s t e e r i n g , differential d i f f e r e n t i a l braking, b r a k i n g , and a n d the t h e rudder r u d d e r at a t high h i g h speed), s p e e d ) , • • Control C o n t r o l aircraft a i r c r a f t in i n the t h e air a i r (flight ( f l i g h t control c o n t r o l surfaces s u r f a c e s and a n d vectored v e c t o r e d thrust), t h r u s t ) , • • Provide P r o v i d e relative r e l a t i v e aircraft a i r c r a f t position p o s i t i o n (Communication ( C o m m u n i c a t i o n and a n d Navigation), N a v i g a t i o n ) , • • Navigate N a v i g a t e (GPS ( G P S and a n d Inertial I n e r t i a l Reference R e f e r e n c e System), S y s t e m ) , • • Provide P r o v i d e AOA A O A (vane ( v a n e and a n d synthetic s y n t h e t i c AOA A O A computed c o m p u t e d from f r o m airspeed a i r s p e e d and a n d inertial i n e r t i a l data), d a t a ) , • • Provide P r o v i d e Fuel F u e l Quantity Q u a n t i t y (engine ( e n g i n e fuel f u e l flow f l o w rate r a t e and a n d tank t a n k fuel f u e l probes). p r o b e s ) . The T h e requirements r e q u i r e m e n t s necessary n e c e s s a r y to t o enforce/maintain e n f o r c e / m a i n t a i n Functional F u n c t i o n a l Independence I n d e p e n d e n c e should s h o u l d be b e managed m a n a g e d throughout t h r o u g h o u t the t h e development d e v e l o p m e n t cycle c y c l e and a n d may m a y lead l e a d to t o constraints c o n s t r a i n t s on o n item i t e m development. d e v e l o p m e n t . Functional F u n c t i o n a l Independence I n d e p e n d e n c e is i s substantiated s u b s t a n t i a t e d when w h e n the t h e common c o m m o n sources s o u r c e s of o f Error E r r o r between b e t w e e n multiple m u l t i p l e requirement r e q u i r e m e n t sets s e t s have h a v e been b e e n minimized m i n i m i z e d at a t a a level l e v e l of o f rigor r i g o r commensurate c o m m e n s u r a t e with w i t h the t h e Top-Level T o p - L e v e l Failure F a i l u r e Condition C o n d i t i o n severity s e v e r i t y classification c l a s s i f i c a t i o n . . If I f the t h e presence p r e s e n c e of o f common c o m m o n Error E r r o r sources s o u r c e s in i n the t h e requirements r e q u i r e m e n t s is i s indeterminate, i n d e t e r m i n a t e , then t h e n Functional F u n c t i o n a l Independence I n d e p e n d e n c e cannot c a n n o t be b e claimed. c l a i m e d . This T h i s should s h o u l d be b e substantiated s u b s t a n t i a t e d at a t all a l l levels l e v e l s of o f abstraction a b s t r a c t i o n or o r requirement r e q u i r e m e n t decomposition. d e c o m p o s i t i o n . granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true} Downloaded D o w n l o a d e d from f r o m SAE S A E International I n t e r n a t i o n a l by b y David D a v i d Merrill, M e r r i l l , Saturday, S a t u r d a y , November N o v e m b e r 12, 1 2 , 2016 2 0 1 6 SAE S A E ARP4754A A R P 4 7 5 4 A Page P a g e 42 4 2 of o f 115 1 1 5 5.2.3.2.1.%1% 5 . 2 . 3 . 2 . 1 . % 1 % Item I t e m Development D e v e l o p m e n t Independence I n d e p e n d e n c e Item I t e m Development D e v e l o p m e n t Independence I n d e p e n d e n c e is i s an a n attribute a t t r i b u t e where w h e r e the t h e items i t e m s are a r e different d i f f e r e n t in i n order o r d e r to t o minimize m i n i m i z e the t h e likelihood l i k e l i h o o d of o f a a common c o m m o n mode m o d e Error E r r o r between b e t w e e n the t h e individually i n d i v i d u a l l y developed d e v e l o p e d items. i t e m s . Examples E x a m p l e s of o f Errors E r r o r s that t h a t may m a y be b e mitigated m i t i g a t e d by b y Item I t e m Development D e v e l o p m e n t Independence: I n d e p e n d e n c e : • • Software S o f t w a r e design d e s i g n error e r r o r (including ( i n c l u d i n g software s o f t w a r e requirements, r e q u i r e m e n t s , software s o f t w a r e architecture, a r c h i t e c t u r e , etc.), e t c . ) , • • Software S o f t w a r e development d e v e l o p m e n t error e r r o r (including ( i n c l u d i n g software s o f t w a r e development d e v e l o p m e n t process, p r o c e s s , software s o f t w a r e configuration c o n f i g u r a t i o n control, c o n t r o l , etc.), e t c . ) , • • Hardware H a r d w a r e design d e s i g n error e r r o r (including ( i n c l u d i n g hardware h a r d w a r e requirements, r e q u i r e m e n t s , hardware h a r d w a r e architecture, a r c h i t e c t u r e , etc.), e t c . ) , • • Hardware H a r d w a r e development d e v e l o p m e n t error e r r o r (including ( i n c l u d i n g hardware h a r d w a r e development d e v e l o p m e n t process, p r o c e s s , hardware h a r d w a r e configuration c o n f i g u r a t i o n control, c o n t r o l , etc.), e t c . ) , • • Electronic E l e c t r o n i c hardware h a r d w a r e tool t o o l errors e r r o r s (VHDL ( V H D L coders, c o d e r s , layout l a y o u t tools, t o o l s , etc.), e t c . ) , • • Software S o f t w a r e development d e v e l o p m e n t tool t o o l errors e r r o r s (compiler, ( c o m p i l e r , linker, l i n k e r , etc.),. e t c . ) , . Examples E x a m p l e s of o f means m e a n s to t o achieve a c h i e v e Item I t e m Development D e v e l o p m e n t Independence: I n d e p e n d e n c e : • • Different D i f f e r e n t technology t e c h n o l o g y such s u c h as a s use u s e of o f hydraulic h y d r a u l i c vs. v s . electrical e l e c t r i c a l power, p o w e r , • • Different D i f f e r e n t operating o p e r a t i n g systems, s y s t e m s , • • Different D i f f e r e n t computer/software c o m p u t e r / s o f t w a r e languages, l a n g u a g e s , • • Different D i f f e r e n t microprocessors, m i c r o p r o c e s s o r s , • • Different D i f f e r e n t teams t e a m s and a n d processes, p r o c e s s e s , Item I t e m Development D e v e l o p m e n t Independence I n d e p e n d e n c e is i s substantiated s u b s t a n t i a t e d when w h e n the t h e common c o m m o n sources s o u r c e s of o f Error E r r o r between b e t w e e n multiple m u l t i p l e items i t e m s have h a v e been b e e n minimized. m i n i m i z e d . Substantiation S u b s t a n t i a t i o n is i s accomplished a c c o m p l i s h e d by b y applying a p p l y i n g a a level l e v e l of o f rigor r i g o r commensurate c o m m e n s u r a t e with w i t h the t h e severity s e v e r i t y of o f the t h e Top-Level T o p - L e v e l Failure F a i l u r e Condition C o n d i t i o n classification c l a s s i f i c a t i o n with w i t h considerations c o n s i d e r a t i o n s such s u c h as a s the t h e state-of-the-art s t a t e - o f - t h e - a r t and a n d in-service i n - s e r v i c e experience. e x p e r i e n c e . Requirements R e q u i r e m e n t s for f o r independence i n d e p e n d e n c e between b e t w e e n items i t e m s should s h o u l d be b e flowed f l o w e d to t o those t h o s e items i t e m s from f r o m the t h e system s y s t e m as a s needed. n e e d e d . If I f the t h e presence p r e s e n c e of o f common c o m m o n Error E r r o r sources s o u r c e s between b e t w e e n the t h e items i t e m s is i s indeterminate i n d e t e r m i n a t e or o r cannot c a n n o t be b e substantiated, s u b s t a n t i a t e d , then t h e n Item I t e m Development D e v e l o p m e n t Independence I n d e p e n d e n c e cannot c a n n o t be b e claimed. c l a i m e d . 5.2.3.2.1.%1%Summary 5 . 2 . 3 . 2 . 1 . % 1 % S u m m a r y of o f Functional F u n c t i o n a l and a n d Item I t e m Development D e v e l o p m e n t Independence I n d e p e n d e n c e Functional F u n c t i o n a l Independence I n d e p e n d e n c e ensures e n s u r e s that t h a t the t h e Function F u n c t i o n requirements r e q u i r e m e n t s should s h o u l d not n o t suffer s u f f e r from f r o m a a common c o m m o n Error, E r r o r , whereas w h e r e a s item i t e m Development D e v e l o p m e n t Independence I n d e p e n d e n c e ensures e n s u r e s that t h a t the t h e development d e v e l o p m e n t of o f items i t e m s on o n which w h i c h the t h e Function(s) F u n c t i o n ( s ) is(are) i s ( a r e ) implemented, i m p l e m e n t e d , should s h o u l d not n o t suffer s u f f e r from f r o m a a common c o m m o n mode m o d e Error. E r r o r . 5.2.3.2.2 5 . 2 . 3 . 2 . 2 FOAL F O A L and a n d IDAL I D A L Assignment A s s i g n m e n t Process P r o c e s s FOAL F O A L and a n d IDAL I D A L assurance a s s u r a n c e level l e v e l assignment a s s i g n m e n t is i s a a top t o p down d o w n process p r o c e s s starting s t a r t i n g with w i t h the t h e Failure F a i l u r e Condition C o n d i t i o n severity s e v e r i t y classification c l a s s i f i c a t i o n from f r o m the t h e FHA F H A and a n d assigning a s s i g n i n g the t h e Top-level T o p - l e v e l FOAL F O A L in i n the t h e PASA/PSSA. P A S A / P S S A . After A f t e r decomposing d e c o m p o s i n g the t h e top-level t o p - l e v e l function f u n c t i o n into i n t o sub-functions, s u b - f u n c t i o n s , the t h e sub-functions' s u b - f u n c t i o n s ' FDALs F D A L s are a r e assigned. a s s i g n e d . Each E a c h sub-function s u b - f u n c t i o n is i s then t h e n decomposed d e c o m p o s e d and/or a n d / o r allocated a l l o c a t e d further f u r t h e r into i n t o items i t e m s and a n d then t h e n items' i t e m s ' IDALs I D A L s are a r e assigned. a s s i g n e d . The T h e FOAL F O A L and a n d IDAL I D A L assignment a s s i g n m e n t process p r o c e s s should s h o u l d be b e applied a p p l i e d when w h e n developing d e v e l o p i n g new n e w Functions F u n c t i o n s and a n d new n e w items. i t e m s . Nevertheless, N e v e r t h e l e s s , experience e x p e r i e n c e identifies i d e n t i f i e s that t h a t development d e v e l o p m e n t often o f t e n makes m a k e s use u s e of o f aircraft/system a i r c r a f t / s y s t e m functions f u n c t i o n s and a n d items i t e m s that t h a t have h a v e been b e e n developed d e v e l o p e d and a n d certificated c e r t i f i c a t e d for f o r previous p r e v i o u s applications. a p p l i c a t i o n s . When W h e n considering c o n s i d e r i n g re-use r e - u s e of o f previously p r e v i o u s l y developed d e v e l o p e d aircraft/system a i r c r a f t / s y s t e m functions f u n c t i o n s and a n d items, i t e m s , their t h e i r FOAL F O A L and a n d IDAL I D A L should s h o u l d be b e shown s h o w n to t o address a d d r e s s the t h e "General " G e n e r a l Principles" P r i n c i p l e s " defined d e f i n e d in i n 5.2.1 5 . 2 . 1 and a n d specific s p e c i f i c cases c a s e s of o f Section S e c t i o n 5.2.3.3 5 . 2 . 3 . 3 and a n d 5.2.4. 5 . 2 . 4 . granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true} Downloaded D o w n l o a d e d from f r o m SAE S A E International I n t e r n a t i o n a l by b y David D a v i d Merrill, M e r r i l l , Saturday, S a t u r d a y , November N o v e m b e r 12, 1 2 , 2016 2 0 1 6 SAE S A E ARP4754A A R P 4 7 5 4 A Page P a g e 43 4 3 of o f 115 1 1 5 Once O n c e an a n FDAL F D A L is i s assigned a s s i g n e d to t o the t h e top-level t o p - l e v e l aircraft a i r c r a f t function f u n c t i o n based b a s e d on o n the t h e top-level t o p - l e v e l Failure F a i l u r e Condition C o n d i t i o n severity s e v e r i t y classification, c l a s s i f i c a t i o n , the t h e architecture a r c h i t e c t u r e of o f the t h e system s y s t e m functions f u n c t i o n s involved i n v o l v e d in i n the t h e top-level t o p - l e v e l Failure F a i l u r e Condition C o n d i t i o n are a r e examined e x a m i n e d to t o delineate d e l i n e a t e the t h e Development D e v e l o p m e n t Assurance A s s u r a n c e levels l e v e l s of o f those t h o s e system s y s t e m functions f u n c t i o n s . . If I f it i t can c a n be b e shown s h o w n that t h a t the t h e aircraft a i r c r a f t or o r system s y s t e m architecture a r c h i t e c t u r e provides p r o v i d e s containment c o n t a i n m e n t for f o r the t h e effects e f f e c t s of o f development d e v e l o p m e n t errors e r r o r s by b y two t w o or o r more m o r e independent i n d e p e n d e n t members, m e m b e r s , Development D e v e l o p m e n t Assurance A s s u r a n c e Levels L e v e l s may m a y be b e assigned a s s i g n e d with w i t h consideration c o n s i d e r a t i o n of o f the t h e containment c o n t a i n m e n t provided p r o v i d e d by b y the t h e architecture. a r c h i t e c t u r e . System S y s t e m safety s a f e t y assessment a s s e s s m e n t techniques t e c h n i q u e s are a r e used u s e d to t o identify i d e n t i f y the t h e members m e m b e r s within w i t h i n the t h e Functional F u n c t i o n a l Failure F a i l u r e Sets S e t s (FFSs) ( F F S s ) that t h a t lead l e a d to t o the t h e top-level t o p - l e v e l Failure F a i l u r e Conditions. C o n d i t i o n s . The T h e identification i d e n t i f i c a t i o n of o f the t h e FFS F F S is i s the t h e subject s u b j e c t of o f PSSA P S S A and a n d CMA C M A where w h e r e the t h e independence i n d e p e n d e n c e attributes a t t r i b u t e s are a r e considered c o n s i d e r e d . . A A top-level t o p - l e v e l Failure F a i l u r e Condition C o n d i t i o n may m a y have h a v e more m o r e than t h a n one o n e FFS. F F S . The T h e level l e v e l of o f rigor r i g o r for f o r substantiating s u b s t a n t i a t i n g the t h e independence i n d e p e n d e n c e among a m o n g the t h e members m e m b e r s of o f the t h e FFS F F S is i s the t h e same s a m e FDAL F D A L assigned a s s i g n e d to t o the t h e top-level t o p - l e v e l Failure F a i l u r e Condition C o n d i t i o n per p e r Table T a b l e 2. 2 . The T h e members m e m b e r s within w i t h i n a a given g i v e n FFS F F S may m a y be b e assigned a s s i g n e d their t h e i r own o w n FDALs F D A L s which w h i c h may m a y be b e lower l o w e r than t h a n the t h e top-level t o p - l e v e l Failure F a i l u r e Condition C o n d i t i o n severity s e v e r i t y classification c l a s s i f i c a t i o n provided p r o v i d e d the t h e functional f u n c t i o n a l independence i n d e p e n d e n c e attribute a t t r i b u t e is i s satisfied. s a t i s f i e d . Interactions I n t e r a c t i o n s of o f systems s y s t e m s making m a k i n g up u p an a n aircraft a i r c r a f t function f u n c t i o n need n e e d to t o be b e assessed a s s e s s e d at a t the t h e FDAL F D A L of o f the t h e aircraft a i r c r a f t function, f u n c t i o n , including i n c l u d i n g substantiation s u b s t a n t i a t i o n of o f the t h e asserted a s s e r t e d functional f u n c t i o n a l independence. i n d e p e n d e n c e . Table T a b l e 3 3 provides p r o v i d e s the t h e guideline g u i d e l i n e for f o r assigning a s s i g n i n g FDAL F D A L to t o member(s) m e m b e r ( s ) within w i t h i n a a FFS F F S relative r e l a t i v e to t o the t h e severity s e v e r i t y classification c l a s s i f i c a t i o n of o f a a given g i v e n top-level t o p - l e v e l Failure F a i l u r e Condition. C o n d i t i o n . An A n example e x a m p l e process p r o c e s s of o f entering e n t e r i n g and a n d navigating n a v i g a t i n g through t h r o u g h Table T a b l e 3 3 is i s presented p r e s e n t e d in i n Appendix A p p e n d i x C. C . The T h e process p r o c e s s is i s repeated r e p e a t e d for f o r all a l l top-level t o p - l e v e l Failure F a i l u r e Conditions C o n d i t i o n s for f o r each e a c h function, f u n c t i o n , and a n d then t h e n the t h e most m o s t stringent s t r i n g e n t FDAL F D A L is i s assigned a s s i g n e d to t o that t h a t function f u n c t i o n in i n consideration c o n s i d e r a t i o n of o f its i t s role r o l e in i n all a l l its i t s failure f a i l u r e conditions. c o n d i t i o n s . The T h e choice c h o i c e of o f option o p t i o n 1 1 or o r option o p t i o n 2 2 is i s at a t the t h e discretion d i s c r e t i o n of o f the t h e certification c e r t i f i c a t i o n applicant a p p l i c a n t based b a s e d on o n what w h a t option o p t i o n is i s considered c o n s i d e r e d most m o s t appropriate a p p r o p r i a t e to t o mitigate m i t i g a t e the t h e identified i d e n t i f i e d Failure F a i l u r e Conditions. C o n d i t i o n s . Multiple M u l t i p l e entries e n t r i e s into i n t o Table T a b l e 3 3 are a r e expected e x p e c t e d during d u r i n g the t h e iterative i t e r a t i v e design d e s i g n process; p r o c e s s ; however, h o w e v e r , each e a c h entry e n t r y should s h o u l d link l i n k to t o the t h e top t o p aircraft a i r c r a f t level l e v e l Failure F a i l u r e Condition C o n d i t i o n (i.e. ( i . e . the t h e same s a m e row r o w in i n Table T a b l e 3). 3 ) . The T h e IDAL I D A L assignment a s s i g n m e n t always a l w a y s follows f o l l o w s the t h e FDAL F D A L process. p r o c e s s . When W h e n the t h e system s y s t e m architectures a r c h i t e c t u r e s are a r e refined r e f i n e d down d o w n to t o the t h e item i t e m level, l e v e l , the t h e FDAL F D A L is i s assigned a s s i g n e d to t o a a FFS F F S member m e m b e r using u s i n g Table T a b l e 3. 3 . Care C a r e should s h o u l d be b e made m a d e to t o enter e n t e r Table T a b l e 3 3 at a t the t h e same s a m e row r o w that t h a t was w a s entered e n t e r e d at a t the t h e top-level t o p - l e v e l Failure F a i l u r e Condition. C o n d i t i o n . The T h e assignment a s s i g n m e n t becomes b e c o m e s the t h e IDAL I D A L of o f the t h e related r e l a t e d item. i t e m . This T h i s IDAL I D A L will w i l l be b e used u s e d as a s an a n input i n p u t for f o r the t h e application a p p l i c a t i o n of o f D0-1788/ED-128 D 0 - 1 7 8 8 / E D - 1 2 8 (software ( s o f t w a r e development d e v e l o p m e n t assurance) a s s u r a n c e ) or o r D0-254/ED-80 D 0 - 2 5 4 / E D - 8 0 (electronic ( e l e c t r o n i c hardware h a r d w a r e design d e s i g n assurance) a s s u r a n c e ) . . For F o r IDAL I D A L assignment a s s i g n m e n t the t h e applicant a p p l i c a n t may m a y use u s e option o p t i o n 1 1 or o r option o p t i o n 2 2 of o f the t h e row r o w related r e l a t e d to t o the t h e top-level t o p - l e v e l Failure F a i l u r e Condition C o n d i t i o n classification c l a s s i f i c a t i o n (i.e. ( i . e . same s a m e row r o w as a s FDAL F D A L assignment), a s s i g n m e n t ) , provided p r o v i d e d the t h e FFS F F S has h a s item i t e m development d e v e l o p m e n t independence. i n d e p e n d e n c e . However, H o w e v e r , whichever w h i c h e v e r option o p t i o n is i s chosen c h o s e n the t h e final f i n a l FDAL F D A L and a n d IDAL I D A L combination c o m b i n a t i o n should s h o u l d be b e in i n accordance a c c o r d a n c e with w i t h the t h e general g e n e r a l principles p r i n c i p l e s of o f 5.2.1 5 . 2 . 1 and a n d the t h e general g e n e r a l cases c a s e s presented p r e s e n t e d in i n Section S e c t i o n 5.2.3.3. 5 . 2 . 3 . 3 . granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true} Downloaded D o w n l o a d e d from f r o m SAE S A E International I n t e r n a t i o n a l by b y David D a v i d Merrill, M e r r i l l , Saturday, S a t u r d a y , November N o v e m b e r 12, 1 2 , 2016 2 0 1 6 SAE S A E ARP4754A A R P 4 7 5 4 A Page P a g e 44 4 4 of o f 115 1 1 5 TABLE T A B L E 3 3 - - DEVELOPMENT D E V E L O P M E N T ASSURANCE A S S U R A N C E LEVEL L E V E L ASSIGNMENT A S S I G N M E N T TO T O MEMBERS M E M B E R S OF O F A A FUNCTIONAL F U N C T I O N A L FAILURE F A I L U R E SET S E T DEVELOPMENT D E V E L O P M E N T ASSURANCE A S S U R A N C E LEVEL L E V E L (NOTES ( N O T E S 2 2 & & 4) 4 ) TOP-LEVEL T O P - L E V E L FAILURE F A I L U R E CONDITION C O N D I T I O N CLASSIFICATION C L A S S I F I C A T I O N FUNCTIONAL F U N C T I O N A L FAILURE F A I L U R E SETS S E T S WITH W I T H A A SINGLE S I N G L E MEMBER M E M B E R FUNCTIONAL F U N C T I O N A L FAILURE F A I L U R E SETS S E T S WITH W I T H MULTIPLE M U L T I P L E MEMBERS M E M B E R S OPTION O P T I O N 1 1 (NOTE ( N O T E 3) 3 ) OPTION O P T I O N 2 2 Column C o l u m n 1 1 Column C o l u m n 2 2 Column C o l u m n 3 3 Column C o l u m n 4 4 Catastrophic C a t a s t r o p h i c FDAL F D A L A A (NOTE ( N O T E 1) 1 ) FOAL F O A L A A for f o r one o n e Member, M e m b e r , additional a d d i t i o n a l Member(s) M e m b e r ( s ) contributing c o n t r i b u t i n g to t o the t h e top-level t o p - l e v e l Failure F a i l u r e Condition C o n d i t i o n at a t the t h e level l e v e l associated a s s o c i a t e d with w i t h the t h e most m o s t severe s e v e r e individual i n d i v i d u a l effects e f f e c t s of o f an a n error e r r o r in i n their t h e i r development d e v e l o p m e n t process p r o c e s s for f o r all a l l applicable a p p l i c a b l e top-level t o p - l e v e l Failure F a i l u r e Conditions C o n d i t i o n s (but ( b u t no n o lower l o w e r than t h a n level l e v e l C C for f o r the t h e additional a d d i t i o n a l Members). M e m b e r s ) . FOAL F O A L B B for f o r two t w o of o f the t h e Members M e m b e r s leading l e a d i n g to t o top-level t o p - l e v e l Failure F a i l u r e Condition. C o n d i t i o n . The T h e other o t h e r Member(s) M e m b e r ( s ) at a t the t h e level l e v e l associated a s s o c i a t e d with w i t h the t h e most m o s t severe s e v e r e individual i n d i v i d u a l effects e f f e c t s of o f an a n error e r r o r in i n their t h e i r development d e v e l o p m e n t process p r o c e s s for f o r all a l l applicable a p p l i c a b l e top-level t o p - l e v e l Failure F a i l u r e Conditions C o n d i t i o n s (but ( b u t no n o lower l o w e r than t h a n level l e v e l C C for f o r the t h e additional a d d i t i o n a l Member(s)) M e m b e r ( s ) ) . . Hazardous/ H a z a r d o u s / Severe S e v e r e Major M a j o r FOAL F O A L S S FOAL F O A L B B for f o r one o n e Member, M e m b e r , additional a d d i t i o n a l Member(s) M e m b e r ( s ) contributing c o n t r i b u t i n g to t o the t h e top-level t o p - l e v e l Failure F a i l u r e Condition C o n d i t i o n at a t the t h e level l e v e l associated a s s o c i a t e d with w i t h the t h e most m o s t severe s e v e r e individual i n d i v i d u a l effects e f f e c t s of o f an a n error e r r o r in i n their t h e i r development d e v e l o p m e n t process p r o c e s s for f o r all a l l applicable a p p l i c a b l e top-level t o p - l e v e l Failure F a i l u r e Conditions C o n d i t i o n s (but ( b u t no n o lower l o w e r than t h a n level l e v e l D D for f o r the t h e additional a d d i t i o n a l Members). M e m b e r s ) . FOAL F O A L C C for f o r two t w o of o f the t h e Members M e m b e r s leading l e a d i n g to t o top-level t o p - l e v e l Failure F a i l u r e Condition. C o n d i t i o n . The T h e other o t h e r Members M e m b e r s at a t the t h e level l e v e l associated a s s o c i a t e d with w i t h the t h e most m o s t severe s e v e r e individual i n d i v i d u a l effects e f f e c t s of o f an a n error e r r o r in i n their t h e i r development d e v e l o p m e n t process p r o c e s s for f o r all a l l applicable a p p l i c a b l e top-level t o p - l e v e l Failure F a i l u r e Conditions C o n d i t i o n s (but ( b u t no n o lower l o w e r than t h a n level l e v e l D D for f o r the t h e additional a d d i t i o n a l Members). M e m b e r s ) . Major M a j o r FDAL F D A L C C FOAL F O A L C C for f o r one o n e Member, M e m b e r , additional a d d i t i o n a l Member(s) M e m b e r ( s ) contributing c o n t r i b u t i n g to t o the t h e top-level t o p - l e v e l Failure F a i l u r e Condition C o n d i t i o n at a t the t h e level l e v e l associated a s s o c i a t e d with w i t h the t h e most m o s t severe s e v e r e individual i n d i v i d u a l effects e f f e c t s of o f an a n error e r r o r in i n their t h e i r development d e v e l o p m e n t process p r o c e s s for f o r all a l l applicable a p p l i c a b l e top-level t o p - l e v e l Failure F a i l u r e Conditions. C o n d i t i o n s . FOAL F O A L D D for f o r two t w o of o f the t h e Members M e m b e r s leading l e a d i n g to t o top-level t o p - l e v e l Failure F a i l u r e Condition. C o n d i t i o n . The T h e other o t h e r Members M e m b e r s at a t the t h e level l e v e l associated a s s o c i a t e d with w i t h the t h e most m o s t severe s e v e r e individual i n d i v i d u a l effects e f f e c t s of o f an a n error e r r o r in i n their t h e i r development d e v e l o p m e n t process p r o c e s s for f o r all a l l applicable a p p l i c a b l e top-level t o p - l e v e l Failure F a i l u r e Conditions. C o n d i t i o n s . Minor M i n o r FDAL F D A L D D FOAL F O A L D D for f o r one o n e Member, M e m b e r , additional a d d i t i o n a l Member(s) M e m b e r ( s ) contributing c o n t r i b u t i n g to t o the t h e top-level t o p - l e v e l Failure F a i l u r e Condition C o n d i t i o n at a t the t h e level l e v e l associated a s s o c i a t e d with w i t h the t h e most m o s t severe s e v e r e individual i n d i v i d u a l effects e f f e c t s of o f an a n error e r r o r in i n their t h e i r development d e v e l o p m e n t process p r o c e s s for f o r all a l l applicable a p p l i c a b l e top-level t o p - l e v e l Failure F a i l u r e Conditions. C o n d i t i o n s . No N o Safety S a f e t y Effect E f f e c t FDAL F D A L E E FOAL F O A L E E NOTE N O T E 1: 1 : When W h e n a a FFS F F S has h a s a a single s i n g l e Member M e m b e r and a n d the t h e mitigation m i t i g a t i o n strategy s t r a t e g y for f o r systematic s y s t e m a t i c errors e r r o r s is i s to t o be b e FOAL F O A L A A alone, a l o n e , then t h e n the t h e applicant a p p l i c a n t may m a y be b e required r e q u i r e d to t o substantiate s u b s t a n t i a t e that t h a t the t h e development d e v e l o p m e n t process p r o c e s s for f o r that t h a t Member M e m b e r has h a s sufficient s u f f i c i e n t independent i n d e p e n d e n t validation/verification v a l i d a t i o n / v e r i f i c a t i o n activities, a c t i v i t i e s , techniques t e c h n i q u e s and a n d completion c o m p l e t i o n criteria c r i t e r i a to t o ensure e n s u r e that t h a t potential p o t e n t i a l development d e v e l o p m e n t error(s) e r r o r ( s ) having h a v i n g a a catastrophic c a t a s t r o p h i c effect e f f e c t have h a v e been b e e n removed r e m o v e d or o r mitigated. m i t i g a t e d . NOTE N O T E 2: 2 : It I t is i s necessary n e c e s s a r y to t o stay s t a y in i n the t h e same s a m e row r o w no n o matter m a t t e r the t h e number n u m b e r of o f functional f u n c t i o n a l decompositions d e c o m p o s i t i o n s performed p e r f o r m e d (e.g. ( e . g . for f o r a a Catastrophic C a t a s t r o p h i c Failure F a i l u r e Condition C o n d i t i o n any a n y degree d e g r e e of o f decomposition d e c o m p o s i t i o n from f r o m a a top t o p FOAL F O A L A A FFS F F S should s h o u l d include i n c l u d e at a t least l e a s t one o n e FOAL F O A L A A or o r two t w o FOAL F O A L B B Members). M e m b e r s ) . NOTE N O T E 3: 3 : If I f there t h e r e is i s a a large l a r g e disparity d i s p a r i t y on o n the t h e numerical n u m e r i c a l availability a v a i l a b i l i t y of o f the t h e Members M e m b e r s in i n the t h e Functional F u n c t i o n a l Failure F a i l u r e Set, S e t , the t h e higher h i g h e r level l e v e l FOAL F O A L should s h o u l d generally g e n e r a l l y be b e assigned a s s i g n e d to t o the t h e higher h i g h e r availability a v a i l a b i l i t y Member. M e m b e r . NOTE N O T E 4: 4 : Some S o m e classes c l a s s e s of o f 14CFR 1 4 C F R Part P a r t 23 2 3 /CS-23 / C S - 2 3 aircraft a i r c r a f t have h a v e FDALs F D A L s lower l o w e r than t h a n shown s h o w n in i n Table T a b l e 3. 3 . See S e e the t h e current c u r r e n t FAA F A A AC23 A C 2 3 .1309 . 1 3 0 9 and a n d equivalent e q u i v a l e n t EASA E A S A policy p o l i c y for f o r specific s p e c i f i c guidance. g u i d a n c e . granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true} Downloaded D o w n l o a d e d from f r o m SAE S A E International I n t e r n a t i o n a l by b y David D a v i d Merrill, M e r r i l l , Saturday, S a t u r d a y , November N o v e m b e r 12, 1 2 , 2016 2 0 1 6 SAE S A E ARP4754A A R P 4 7 5 4 A Page P a g e 45 4 5 of o f 115 1 1 5 5.2.3.2.3 5 . 2 . 3 . 2 . 3 FOAL F O A L and a n d IDAL I D A L Assignment A s s i g n m e n t cases c a s e s 5.2.3.2.3.%1% 5 . 2 . 3 . 2 . 3 . % 1 % Case C a s e 1: 1 : Neither N e i t h e r Functional F u n c t i o n a l nor n o r Item I t e m Development D e v e l o p m e n t Independence I n d e p e n d e n c e If I f there t h e r e is i s no n o Functional F u n c t i o n a l Independence I n d e p e n d e n c e and a n d no n o Item I t e m Development D e v e l o p m e n t Independence, I n d e p e n d e n c e , column c o l u m n 2 2 of o f Table T a b l e 3 3 is i s used u s e d to t o assign a s s i g n the t h e FOAL F O A L and a n d IDAL. I D A L . The T h e FOAL F O A L and a n d IDAL I D A L are a r e the t h e same s a m e and a n d are a r e equal e q u a l to t o the t h e top-level t o p - l e v e l function f u n c t i o n FOAL. F O A L . 5.2.3.2.3.%1%Case 5 . 2 . 3 . 2 . 3 . % 1 % C a s e 2: 2 : Functional F u n c t i o n a l Independence I n d e p e n d e n c e and a n d Item I t e m Development D e v e l o p m e n t Independence I n d e p e n d e n c e If I f both b o t h Functional F u n c t i o n a l and a n d Item I t e m Development D e v e l o p m e n t Independence I n d e p e n d e n c e are a r e present, p r e s e n t , first f i r s t assign a s s i g n the t h e FOAL F O A L using u s i n g Table T a b l e 3 3 and a n d then t h e n assign a s s i g n the t h e IDAL I D A L using u s i n g Table T a b l e 3 3 (by ( b y substituting s u b s t i t u t i n g IDAL I D A L to t o FOAL). F O A L ) . Option O p t i o n 1 1 or o r option o p t i o n 2 2 of o f the t h e row r o w related r e l a t e d to t o the t h e top-level t o p - l e v e l Failure F a i l u r e Condition C o n d i t i o n classification c l a s s i f i c a t i o n (i.e. ( i . e . same s a m e row r o w as a s FOAL F O A L assignment) a s s i g n m e n t ) can c a n be b e used u s e d for f o r the t h e IDAL I D A L assignment. a s s i g n m e n t . Review R e v i e w of o f the t h e FFSs F F S s representing r e p r e s e n t i n g combinations c o m b i n a t i o n s of o f errors e r r o r s in i n both b o t h aircraft/system a i r c r a f t / s y s t e m functions f u n c t i o n s and a n d items i t e m s should s h o u l d be b e performed p e r f o r m e d to t o ensure e n s u r e FOAL F O A L and a n d IDAL I D A L assignments a s s i g n m e n t s are a r e compliant c o m p l i a n t with w i t h the t h e general g e n e r a l principles p r i n c i p l e s of o f section s e c t i o n 5.2.1. 5 . 2 . 1 . The T h e purpose p u r p o s e of o f reviewing r e v i e w i n g these t h e s e is i s to t o ensure e n s u r e that t h a t all a l l possible p o s s i b l e combinations c o m b i n a t i o n s of o f errors e r r o r s in i n the t h e Development D e v e l o p m e n t of o f aircraft/system a i r c r a f t / s y s t e m functions f u n c t i o n s and a n d items i t e m s are a r e adequately a d e q u a t e l y mitigated m i t i g a t e d by b y FOAL F O A L and a n d IDAL I D A L assignment a s s i g n m e n t in i n accordance a c c o r d a n c e with w i t h the t h e general g e n e r a l principles. p r i n c i p l e s . The T h e example e x a m p l e shown s h o w n in i n Figure F i g u r e 9 9 and a n d Table T a b l e 4 4 illustrates i l l u s t r a t e s two t w o invalid i n v a l i d IDAL I D A L assignments a s s i g n m e n t s given g i v e n an a n FOAL F O A L assignment a s s i g n m e n t for f o r F1 F 1 and a n d F2 F 2 of o f B B for f o r a a catastrophic c a t a s t r o p h i c failure f a i l u r e condition, c o n d i t i o n , FC2. F C 2 . At A t the t h e end e n d of o f the t h e assignment a s s i g n m e n t process p r o c e s s if i f there t h e r e is i s an a n IDAL I D A L required r e q u i r e d assignment a s s i g n m e n t higher h i g h e r than t h a n the t h e corresponding c o r r e s p o n d i n g FOAL F O A L the t h e applicant a p p l i c a n t should s h o u l d justify j u s t i f y that t h a t the t h e FOAL F O A L does d o e s not n o t have h a v e to t o be b e reassigned r e a s s i g n e d at a t the t h e IDAL I D A L level. l e v e l . (Figure ( F i g u r e 9 9 and a n d Table T a b l e 4 4 include i n c l u d e all a l l possible p o s s i b l e error e r r o r combinations c o m b i n a t i o n s to t o illustrate i l l u s t r a t e the t h e points p o i n t s of o f Case C a s e 2 2 and a n d the t h e general g e n e r a l principles p r i n c i p l e s of o f section s e c t i o n 5.2.1 5 . 2 . 1 and a n d is i s not n o t intended i n t e n d e d to t o illustrate i l l u s t r a t e presentation p r e s e n t a t i o n methodologies.) m e t h o d o l o g i e s . ) Failure F a i l u r e Condition C o n d i t i o n Caused C a u s e d by b y Functional F u n c t i o n a l Failures F a i l u r e s of o f F1 F 1 and a n d F2 F 2 Functional F u n c t i o n a l Failure F a i l u r e of o f F1 F 1 Functional F u n c t i o n a l Failure F a i l u r e of o f F2 F 2 Error E r r o r in i n the t h e Development D e v e l o p m e n t of o f Error E r r o r Function F u n c t i o n in i n the t h e 1Development 1 D e v e l o p m e n t of o f Item I t e m 1Error 1 E r r o r in i n the t h e Development D e v e l o p m e n t of o f Item I t e m 3 3 Error E r r o r in i n the t h e Development D e v e l o p m e n t of o f Function F u n c t i o n 2 2 FIGURE F I G U R E 9 9 - - FUNCTION F U N C T I O N INDEPENDENCE I N D E P E N D E N C E AND A N D ITEM I T E M DEVELOPMENT D E V E L O P M E N T INDEPENDENCE I N D E P E N D E N C E granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true} Downloaded D o w n l o a d e d from f r o m SAE S A E International I n t e r n a t i o n a l by b y David D a v i d Merrill, M e r r i l l , Saturday, S a t u r d a y , November N o v e m b e r 12, 1 2 , 2016 2 0 1 6 SAE S A E ARP4754A A R P 4 7 5 4 A Page P a g e 46 4 6 of o f 115 1 1 5 The T h e minimal m i n i m a l equation e q u a t i o n or o r terms t e r m s identifying i d e n t i f y i n g the t h e FFSs F F S s for f o r the t h e FC2 F C 2 Failure F a i l u r e condition c o n d i t i o n is: i s : • • F1 F 1 Error E r r o r and a n d F2 F 2 Error, E r r o r , or o r • • F1 F 1 Error E r r o r and a n d 13 1 3 Error, E r r o r , or o r • • 11 1 1 Error E r r o r and a n d F2 F 2 Error, E r r o r , or o r • • 11 1 1 Error E r r o r and a n d 13 1 3 Error. E r r o r . TABLE T A B L E 4 4 - - EXAMPLE E X A M P L E ASSURANCE A S S U R A N C E ASSIGNMENT A S S I G N M E N T FOR F O R DESIGN D E S I G N DEPENDENCY D E P E N D E N C Y OF O F MULTIPLE M U L T I P L E FUNCTIONS F U N C T I O N S SAME S A M E FC F C FOAL F O A L IDAL I D A L Comment C o m m e n t Assignment A s s i g n m e n t Assiqnment A s s i q n m e n t F1 F 1 F2 F 2 11 1 1 13 1 3 B B B B Acceptable A c c e p t a b l e Unacceptable: U n a c c e p t a b l e : F1 F 1 level l e v e l B B & & 13 1 3 level l e v e l C C not n o t allowed; a l l o w e d ; also a l s o A A C C B B B B 13 1 3 does d o e s not n o t support s u p p o r t F2 F 2 level l e v e l B B assignment a s s i g n m e n t Unacceptable: U n a c c e p t a b l e : F2 F 2 level l e v e l B B & & 11 1 1 level l e v e l C C not n o t allowed; a l l o w e d ; also a l s o C C A A 11 1 1 does d o e s not n o t suooort s u o o o r t F1 F 1 level l e v e l B B assignment a s s i g n m e n t A A C C Acceptable A c c e p t a b l e Unacceptable: U n a c c e p t a b l e : F2 F 2 level l e v e l C C & & 11 1 1 level l e v e l C C not n o t allowed; a l l o w e d ; also a l s o C C A A A A C C 11 1 1 does d o e s not n o t support s u p p o r t F1 F 1 level l e v e l A A assignment a s s i g n m e n t Unacceptable: U n a c c e p t a b l e : F2 F 2 level l e v e l C C & & 11 1 1 level l e v e l B B not n o t allowed; a l l o w e d ; also a l s o B B B B 11 1 1 level l e v e l B B does d o e s not n o t support s u p p o r t F1 F 1 assignment a s s i g n m e n t Unacceptable: U n a c c e p t a b l e : F1 F 1 level l e v e l C C & & 13 1 3 level l e v e l C C not n o t allowed; a l l o w e d ; also a l s o A A C C 13 1 3 does d o e s not n o t suooort s u o o o r t F2 F 2 level l e v e l A A assignment a s s i g n m e n t C C A A C C A A Acceptable A c c e p t a b l e Unacceptable: U n a c c e p t a b l e : F1 F 1 level l e v e l C C & & 13 1 3 Level L e v e l B B not n o t allowed; a l l o w e d ; also a l s o B B B B 13 1 3 level l e v e l B B does d o e s not n o t support s u p p o r t F2 F 2 assignment a s s i g n m e n t Note: N o t e : Some S o m e of o f the t h e FFSs F F S s in i n Table T a b l e 4 4 represent r e p r e s e n t combinations c o m b i n a t i o n s of o f errors e r r o r s in i n both b o t h aircrafUsystem a i r c r a f U s y s t e m functions f u n c t i o n s and a n d items i t e m s 5.2.3.2.3.3 5 . 2 . 3 . 2 . 3 . 3 Case C a s e 3: 3 : Functional F u n c t i o n a l Independence I n d e p e n d e n c e is i s claimed c l a i m e d but b u t not n o t Item I t e m Development D e v e l o p m e n t Independence I n d e p e n d e n c e If I f independent i n d e p e n d e n t Functions F u n c t i o n s are a r e implemented i m p l e m e n t e d using u s i n g non-independent n o n - i n d e p e n d e n t items i t e m s (or ( o r portions p o r t i o n s of o f the t h e items i t e m s that t h a t are a r e not n o t independent), i n d e p e n d e n t ) , and a n d if i f an a n error e r r o r in i n the t h e development d e v e l o p m e n t of o f the t h e non n o n independent i n d e p e n d e n t items i t e m s can c a n lead l e a d to t o a a common c o m m o n mode m o d e error e r r o r between b e t w e e n some s o m e or o r all a l l of o f the t h e Functions, F u n c t i o n s , then t h e n the t h e IDAL I D A L of o f the t h e "common" " c o m m o n " non n o n independent i n d e p e n d e n t items i t e m s needs n e e d s to t o be b e assigned a s s i g n e d the t h e level l e v e l of o f the t h e highest h i g h e s t FOAL. F O A L . The T h e fault f a u l t tree t r e e in i n Figure F i g u r e 10 1 0 illustrates i l l u s t r a t e s this t h i s condition c o n d i t i o n with w i t h item i t e m b b affecting a f f e c t i n g F1 F 1 and a n d F2 F 2 which w h i c h leads l e a d s to t o the t h e Catastrophic C a t a s t r o p h i c top-level t o p - l e v e l Failure F a i l u r e Condition C o n d i t i o n with w i t h a a FOAL F O A L A A In I n other o t h e r words, w o r d s , if i f the t h e common c o m m o n mode m o d e error e r r o r can c a n lead l e a d directly d i r e c t l y to t o a a top-level t o p - l e v e l Failure F a i l u r e Condition, C o n d i t i o n , the t h e IDAL I D A L of o f the t h e common c o m m o n items i t e m s is i s the t h e FOAL F O A L of o f the t h e top-level t o p - l e v e l Function F u n c t i o n assigned a s s i g n e d based b a s e d on o n the t h e top-level t o p - l e v e l Failure F a i l u r e Condition C o n d i t i o n Classification. C l a s s i f i c a t i o n . In I n the t h e Catastrophic C a t a s t r o p h i c case c a s e presented p r e s e n t e d in i n Figure F i g u r e 10, 1 0 , a a single s i n g l e member m e m b e r FFS F F S is i s made m a d e up u p of o f item i t e m b b and a n d thus t h u s an a n IDAL I D A L A A is i s assigned. a s s i g n e d . The T h e Functions F u n c t i o n s implemented i m p l e m e n t e d in i n the t h e common c o m m o n design d e s i g n should s h o u l d be b e partitioned p a r t i t i o n e d in i n order o r d e r to t o confirm c o n f i r m the t h e Functional F u n c t i o n a l Independence I n d e p e n d e n c e claimed c l a i m e d for f o r FOAL F O A L assignment a s s i g n m e n t and a n d to t o avoid a v o i d an a n error e r r o r in i n the t h e development d e v e l o p m e n t process p r o c e s s of o f one o n e Function F u n c t i o n affecting a f f e c t i n g the t h e other o t h e r Functions F u n c t i o n s through t h r o u g h the t h e common c o m m o n design. d e s i g n . The T h e Development D e v e l o p m e n t Assurance A s s u r a n c e Level L e v e l of o f the t h e partitioning p a r t i t i o n i n g Function F u n c t i o n should s h o u l d be b e assigned a s s i g n e d the t h e FOAL F O A L commensurate c o m m e n s u r a t e with w i t h the t h e most m o s t severe s e v e r e effect e f f e c t of o f an a n error e r r o r in i n its i t s development; d e v e l o p m e n t ; this t h i s would w o u l d be b e no n o lower l o w e r than t h a n the t h e highest h i g h e s t FOAL F O A L of o f the t h e implemented i m p l e m e n t e d Functions. F u n c t i o n s . In I n the t h e Catastrophic C a t a s t r o p h i c Failure F a i l u r e Condition C o n d i t i o n example e x a m p l e case c a s e provided, p r o v i d e d , the t h e independence i n d e p e n d e n c e requirements r e q u i r e m e n t s defined d e f i n e d for f o r F1 F 1 and a n d F2 F 2 would w o u l d be b e an a n example e x a m p l e of o f a a subset s u b s e t of o f requirements r e q u i r e m e n t s of o f F1 F 1 and a n d F2 F 2 having h a v i n g to t o be b e developed d e v e l o p e d at a t FOAL F O A L A A to t o ensure e n s u r e the t h e functional f u n c t i o n a l independence i n d e p e n d e n c e claims c l a i m s of o f F1 F 1 and a n d F2 F 2 are a r e maintained. m a i n t a i n e d . granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true} Downloaded D o w n l o a d e d from f r o m SAE S A E International I n t e r n a t i o n a l by b y David D a v i d Merrill, M e r r i l l , Saturday, S a t u r d a y , November N o v e m b e r 12, 1 2 , 2016 2 0 1 6 SAE S A E ARP4754A A R P 4 7 5 4 A Page P a g e 47 4 7 of o f 115 1 1 5 If I f partitioning p a r t i t i o n i n g is i s not n o t used u s e d or o r if i f its i t s independence i n d e p e n d e n c e cannot c a n n o t be b e substantiated, s u b s t a n t i a t e d , the t h e IDAL I D A L of o f the t h e common c o m m o n design d e s i g n might m i g h t force f o r c e a a reassignment r e a s s i g n m e n t of o f the t h e FOAL F O A L of o f the t h e Functions F u n c t i o n s implemented i m p l e m e n t e d in i n that t h a t design d e s i g n at a t the t h e level l e v e l of o f IDAL I D A L of o f the t h e common c o m m o n design. d e s i g n . This T h i s is i s typically t y p i c a l l y the t h e case c a s e when w h e n the t h e implementation i m p l e m e n t a t i o n layer l a y e r of o f a a Function, F u n c t i o n , or o r part p a r t of o f a a Function, F u n c t i o n , cannot c a n n o t be b e protected p r o t e c t e d by b y the t h e partitioning p a r t i t i o n i n g mechanism m e c h a n i s m (e.g. ( e . g . Implementation I m p l e m e n t a t i o n of o f real r e a l time t i m e sequencing s e q u e n c i n g Functions F u n c t i o n s in i n operating o p e r a t i n g system s y s t e m layer l a y e r or o r in i n micro m i c r o program p r o g r a m layer). l a y e r ) . In I n that t h a t case c a s e the t h e FOAL F O A L of o f the t h e Functions F u n c t i o n s that t h a t cannot c a n n o t be b e protected p r o t e c t e d by b y the t h e partition p a r t i t i o n mechanism m e c h a n i s m will w i l l either e i t h e r need n e e d to t o be b e reassigned r e a s s i g n e d at a t the t h e IDAL I D A L of o f the t h e common c o m m o n item i t e m or o r the t h e upper-level u p p e r - l e v e l Functions F u n c t i o n s may m a y be b e reallocated r e a l l o c a t e d to t o the t h e items i t e m s to t o separate s e p a r a t e the t h e independent i n d e p e n d e n t and a n d common c o m m o n portions p o r t i o n s of o f the t h e design. d e s i g n . IDAL I D A L assignments a s s i g n m e n t s that t h a t reflect r e f l e c t the t h e FOAL F O A L assignment a s s i g n m e n t of o f independent i n d e p e n d e n t aircraft/system a i r c r a f t / s y s t e m functions f u n c t i o n s will w i l l need n e e d to t o substantiate s u b s t a n t i a t e that t h a t their t h e i r development d e v e l o p m e n t have h a v e minimized m i n i m i z e d the t h e sources s o u r c e s of o f common c o m m o n development d e v e l o p m e n t errors e r r o r s across a c r o s s the t h e Functional F u n c t i o n a l Independence I n d e p e n d e n c e boundary. b o u n d a r y . For F o r example, e x a m p l e , if i f two t w o functions f u n c t i o n s (F1 ( F 1 and a n d F2 F 2 in i n Figure F i g u r e 10) 1 0 ) performing p e r f o r m i n g a a FOAL F O A L A A Function F u n c t i o n are a r e performing p e r f o r m i n g Functions F u n c t i o n s established e s t a b l i s h e d as a s independent i n d e p e n d e n t from f r o m one o n e another a n o t h e r and a n d assigned a s s i g n e d a a FOAL F O A L B B (Option ( O p t i o n 2 2 in i n Table T a b l e 3), 3 ) , the t h e functional f u n c t i o n a l requirements r e q u i r e m e n t s are a r e required r e q u i r e d to t o be b e developed d e v e l o p e d to t o an a n FOAL F O A L B B and a n d it i t will w i l l be b e necessary n e c e s s a r y to t o substantiate s u b s t a n t i a t e Functional F u n c t i o n a l Development D e v e l o p m e n t Independence I n d e p e n d e n c e for f o r these t h e s e two t w o functions. f u n c t i o n s . Further, F u r t h e r , the t h e interactions i n t e r a c t i o n s between b e t w e e n the t h e pair p a i r of o f FOAL F O A L B B Functions F u n c t i o n s and a n d interactions i n t e r a c t i o n s between b e t w e e n their t h e i r IDAL I D A L B B items i t e m s (Item ( I t e m 11 1 1 & & Item I t e m 13 1 3 in i n Figure F i g u r e 10) 1 0 ) need n e e d to t o be b e captured c a p t u r e d and a n d validated v a l i d a t e d at a t FOAL F O A L A A under u n d e r the t h e aircraft a i r c r a f t Function F u n c t i o n even e v e n though t h o u g h these t h e s e independent i n d e p e n d e n t aircraft/system a i r c r a f t / s y s t e m functions f u n c t i o n s and a n d items i t e m s are a r e individually i n d i v i d u a l l y level l e v e l B. B . If I f the t h e items i t e m s implementing i m p l e m e n t i n g the t h e Functionally F u n c t i o n a l l y Independent I n d e p e n d e n t FOAL F O A L B B Functions F u n c t i o n s have h a v e any a n y common c o m m o n items i t e m s that t h a t would w o u l d prevent p r e v e n t a a claim c l a i m for f o r Item I t e m Development D e v e l o p m e n t Independence, I n d e p e n d e n c e , an a n IDAL I D A L A A assignment a s s i g n m e n t would w o u l d be b e necessary n e c e s s a r y for f o r at a t least l e a s t the t h e common c o m m o n portion p o r t i o n as a s shown s h o w n as a s Item I t e m 12 1 2 in i n Figure F i g u r e 10. 1 0 . The T h e item i t e m boundaries b o u n d a r i e s may m a y be b e shaped s h a p e d iteratively i t e r a t i v e l y along a l o n g interfaces i n t e r f a c e s that t h a t can c a n be b e used u s e d to t o substantiate s u b s t a n t i a t e the t h e independence, i n d e p e n d e n c e , but b u t any a n y common c o m m o n portion p o r t i o n that t h a t remains r e m a i n s would w o u l d need n e e d to t o be b e assigned a s s i g n e d IDAL I D A L A. A . As A s in i n the t h e case c a s e noted n o t e d above a b o v e of o f completely c o m p l e t e l y independent i n d e p e n d e n t IDAL I D A L B B items, i t e m s , the t h e interactions i n t e r a c t i o n s between b e t w e e n the t h e pair p a i r of o f FOAL F O A L B B Functions F u n c t i o n s and a n d interactions i n t e r a c t i o n s between b e t w e e n their t h e i r IDAL I D A L B B items i t e m s and a n d their t h e i r common c o m m o n IDAL I D A L A A item i t e m need n e e d to t o be b e validated v a l i d a t e d at a t FOAL F O A L A A under u n d e r the t h e complete c o m p l e t e aircraft a i r c r a f t level l e v e l Function F u n c t i o n even e v e n though t h o u g h some s o m e portions p o r t i o n s of o f this t h i s aircraft a i r c r a f t level l e v e l Function F u n c t i o n are a r e individually i n d i v i d u a l l y level l e v e l B. B . Review R e v i e w the t h e FFSs F F S s representing r e p r e s e n t i n g combinations c o m b i n a t i o n s of o f errors e r r o r s in i n both b o t h aircraft/system a i r c r a f t / s y s t e m functions f u n c t i o n s and a n d items i t e m s to t o ensure e n s u r e FOAL F O A L and a n d IDAL I D A L assignments a s s i g n m e n t s are a r e compliant c o m p l i a n t with w i t h the t h e general g e n e r a l principles p r i n c i p l e s of o f section s e c t i o n 5.2.1. 5 . 2 . 1 . The T h e purpose p u r p o s e of o f reviewing r e v i e w i n g these t h e s e is i s to t o ensure e n s u r e that t h a t all a l l possible p o s s i b l e combinations c o m b i n a t i o n s of o f errors e r r o r s in i n the t h e Development D e v e l o p m e n t of o f aircraft/system a i r c r a f t / s y s t e m functions f u n c t i o n s and a n d items i t e m s are a r e adequately a d e q u a t e l y mitigated m i t i g a t e d by b y FOAL F O A L and a n d IDAL I D A L assignment a s s i g n m e n t in i n accordance a c c o r d a n c e with w i t h the t h e general g e n e r a l principles. p r i n c i p l e s . The T h e example e x a m p l e shown s h o w n in i n Figure F i g u r e 10 1 0 and a n d Table T a b l e 5 5 illustrates i l l u s t r a t e s two t w o invalid i n v a l i d IDAL I D A L assignments a s s i g n m e n t s given g i v e n an a n FOAL F O A L assignment a s s i g n m e n t for f o r F1 F 1 and a n d F2 F 2 of o f B. B . (Figure ( F i g u r e 10 1 0 and a n d Table T a b l e 5 5 include i n c l u d e all a l l possible p o s s i b l e error e r r o r combinations c o m b i n a t i o n s to t o illustrate i l l u s t r a t e the t h e points p o i n t s of o f Case C a s e 3 3 and a n d the t h e general g e n e r a l principles p r i n c i p l e s of o f section s e c t i o n 5.2.1 5 . 2 . 1 and a n d is i s not n o t intended i n t e n d e d to t o illustrate i l l u s t r a t e presentation p r e s e n t a t i o n methodologies. m e t h o d o l o g i e s . Independent I n d e p e n d e n t Functions F u n c t i o n s using u s i n g common c o m m o n resources r e s o u r c e s based b a s e d on o n the t h e same s a m e designs d e s i g n s (e ( e .g. . g . computers, c o m p u t e r s , networks, n e t w o r k s , interfaces, i n t e r f a c e s , and a n d IMA) I M A ) are a r e likely l i k e l y to t o require r e q u i r e careful c a r e f u l consideration c o n s i d e r a t i o n so s o these t h e s e are a r e discussed d i s c u s s e d in i n ARP4761 A R P 4 7 6 1 . . granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true} Downloaded D o w n l o a d e d from f r o m SAE S A E International I n t e r n a t i o n a l by b y David D a v i d Merrill, M e r r i l l , Saturday, S a t u r d a y , November N o v e m b e r 12, 1 2 , 2016 2 0 1 6 SAE S A E ARP4754A A R P 4 7 5 4 A Page P a g e 48 4 8 of o f 115 1 1 5 Failure F a i l u r e Condition C o n d i t i o n Caused C a u s e d by b y Functional F u n c t i o n a l Failures F a i l u r e s ofF1 o f F 1 and a n d F2 F 2 Functional F u n c t i o n a l Failure F a i l u r e of o f F1 F 1 Functional F u n c t i o n a l Failure F a i l u r e of o f F2 F 2 Error E r r o r in i n the t h e Anomalous A n o m a l o u s Behavior B e h a v i o r at a t Anomalous A n o m a l o u s Behavior B e h a v i o r at a t Error E r r o r in i n the t h e Development D e v e l o p m e n t of o f Item I t e m Function F u n c t i o n Level L e v e l 1causes 1 c a u s e s Functional F u n c t i o n a l Failure F a i l u r e of o f Item I t e m F1Level F 1 L e v e l causes c a u s e s Functional F u n c t i o n a l Failure F a i l u r e of o f F2Development F 2 D e v e l o p m e n t of o f Function F u n c t i o n 2 2 Error E r r o r in i n the t h e Development D e v e l o p m e n t of o f Item I t e m 1 1 Error E r r o r in i n the t h e Development D e v e l o p m e n t of o f Item I t e m 2 2 Error E r r o r in i n the t h e Error E r r o r in i n the t h e Development D e v e l o p m e n t of o f Item I t e m Development D e v e l o p m e n t 2 2 of o f Item I t e m 3 3 FIGURE F I G U R E 10 1 0 - - DEVELOPMENT D E V E L O P M E N T DEPENDENCY D E P E N D E N C Y OF O F MULTIPLE M U L T I P L E FUNCTIONS F U N C T I O N S IN I N THE T H E SAME S A M E FC F C granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true} Downloaded D o w n l o a d e d from f r o m SAE S A E International I n t e r n a t i o n a l by b y David D a v i d Merrill, M e r r i l l , Saturday, S a t u r d a y , November N o v e m b e r 12, 1 2 , 2016 2 0 1 6 SAE S A E ARP4754A A R P 4 7 5 4 A Page P a g e 49 4 9 of o f 115 1 1 5 The T h e minimal m i n i m a l equation e q u a t i o n or o r terms t e r m s identifying i d e n t i f y i n g the t h e FFSs F F S s for f o r the t h e FC2 F C 2 Failure F a i l u r e condition c o n d i t i o n is: i s : • • F1 F 1 Error E r r o r and a n d F2 F 2 Error, E r r o r , or o r • • F1 F 1 Error E r r o r and a n d 13 1 3 Error, E r r o r , or o r • • 11 1 1 Error E r r o r and a n d F2 F 2 Error, E r r o r , or o r • • 11 1 1 Error E r r o r and a n d 13 1 3 Error, E r r o r , or o r • • 12 1 2 Error. E r r o r . TABLE T A B L E 5 5 - - EXAMPLE E X A M P L E ASSURANCE A S S U R A N C E ASSIGNMENT A S S I G N M E N T FOR F O R DESIGN D E S I G N DEPENDENCY D E P E N D E N C Y OF O F MULTIPLE M U L T I P L E FUNCTIONS F U N C T I O N S SAME S A M E FC F C FOAL F O A L IDAL I D A L Assignment A s s i g n m e n t Comment C o m m e n t Assignment A s s i g n m e n t F1 F 1 F2 F 2 11 1 1 12 1 2 13 1 3 B B A A B B Acceptable A c c e p t a b l e Unacceptable: U n a c c e p t a b l e : the t h e common c o m m o n item i t e m 12 1 2 Level L e v e l B B does d o e s not n o t B B B B B B B B B B support s u p p o r t the t h e top t o p level l e v e l failure f a i l u r e condition. c o n d i t i o n . A A A A C C Unacceptable: U n a c c e p t a b l e : See S e e Case C a s e 2 2 (Table ( T a b l e 4) 4 ) C C A A A A Unacceptable: U n a c c e p t a b l e : See S e e Case C a s e 2 2 (Table ( T a b l e 4) 4 ) A A A A C C Acceptable A c c e p t a b l e Unacceptable: U n a c c e p t a b l e : the t h e common c o m m o n item i t e m 12 1 2 level l e v e l C C does d o e s not n o t A A C C C C A A C C support s u p p o r t the t h e top t o p level l e v e l failure f a i l u r e condition. c o n d i t i o n . C C A A A A Unacceptable: U n a c c e p t a b l e : See S e e Case C a s e 2 2 (Table ( T a b l e 4) 4 ) B B A A B B Unacceptable: U n a c c e p t a b l e : See S e e Case C a s e 2 2 (Table ( T a b l e 4) 4 ) A A A A C C Unacceptable: U n a c c e p t a b l e : See S e e Case C a s e 2 2 (Table ( T a b l e 4) 4 ) Unacceptable: U n a c c e p t a b l e : the t h e common c o m m o n item i t e m 12 1 2 level l e v e l C C does d o e s not n o t C C C C A A C C A A support s u p p o r t the t h e top t o p level l e v e l failure f a i l u r e condition. c o n d i t i o n . C C A A A A Acceptable A c c e p t a b l e B B A A B B Unacceptable: U n a c c e p t a b l e : See S e e Case C a s e 2 2 (Table ( T a b l e 4) 4 ) Note: N o t e : Additional A d d i t i o n a l cases c a s e s could c o u l d be b e evaluated e v a l u a t e d but b u t are a r e not n o t shown; s h o w n ; the t h e common c o m m o n item i t e m 12 1 2 has h a s to t o be b e Level L e v e l A A to t o support s u p p o r t the t h e top t o p level l e v e l hazard. h a z a r d . 5.2.3.2.3.4 5 . 2 . 3 . 2 . 3 . 4 Case C a s e 4: 4 : No N o functional f u n c t i o n a l independence i n d e p e n d e n c e but b u t Item I t e m development d e v e l o p m e n t independence i n d e p e n d e n c e The T h e top-level t o p - l e v e l function f u n c t i o n is i s created c r e a t e d in i n one o n e system s y s t e m function f u n c t i o n which w h i c h is i s decomposed d e c o m p o s e d into i n t o multiple m u l t i p l e items i t e m s that t h a t are a r e independent i n d e p e n d e n t from f r o m one o n e another. a n o t h e r . The T h e system s y s t e m function f u n c t i o n FOAL F O A L is i s assigned a s s i g n e d the t h e top t o p function f u n c t i o n FOAL F O A L as a s per p e r Table T a b l e 2. 2 . The T h e item i t e m IDALs I D A L s are a r e assigned a s s i g n e d using u s i n g either e i t h e r option o p t i o n 1 1 or o r option o p t i o n 2 2 in i n the t h e row r o w corresponding c o r r e s p o n d i n g to t o the t h e Top-Level T o p - L e v e l Failure F a i l u r e Condition C o n d i t i o n Classification C l a s s i f i c a t i o n in i n Table T a b l e 3. 3 . Note: N o t e : Each E a c h independent i n d e p e n d e n t item's i t e m ' s failure f a i l u r e alone a l o n e should s h o u l d not n o t lead l e a d to t o the t h e top t o p failure f a i l u r e condition. c o n d i t i o n . 5.2.3.3 5 . 2 . 3 . 3 IDAL I D A L Assignment A s s i g n m e n t Additional A d d i t i o n a l Considerations C o n s i d e r a t i o n s When W h e n applying a p p l y i n g the t h e IDAL I D A L process p r o c e s s to t o a a given g i v e n aircraft/system a i r c r a f t / s y s t e m architecture, a r c h i t e c t u r e , the t h e architecture a r c h i t e c t u r e should s h o u l d be b e reviewed r e v i e w e d in i n the t h e context c o n t e x t of o f the t h e following f o l l o w i n g Cases: C a s e s : • • Components C o m p o n e n t s that t h a t can c a n be b e fully f u l l y assured a s s u r e d by b y a a combination c o m b i n a t i o n of o f testing t e s t i n g and a n d analysis, a n a l y s i s , relative r e l a t i v e to t o their t h e i r requirements r e q u i r e m e n t s and a n d identified i d e n t i f i e d Failure F a i l u r e Conditions C o n d i t i o n s may m a y be b e considered c o n s i d e r e d to t o provide p r o v i d e a a level l e v e l of o f confidence c o n f i d e n c e equivalent e q u i v a l e n t to t o IDAL I D A L A, A , provided p r o v i d e d the t h e design d e s i g n has h a s been b e e n validated v a l i d a t e d and a n d verified. v e r i f i e d . This T h i s can c a n be b e useful u s e f u l when w h e n considering c o n s i d e r i n g their t h e i r role r o l e in i n relation r e l a t i o n to t o other o t h e r Items I t e m s or o r functions f u n c t i o n s in i n a a system s y s t e m to t o assign a s s i g n the t h e FDALs F D A L s and a n d IDALs I D A L s for f o r the t h e functions f u n c t i o n s and a n d items i t e m s within w i t h i n that t h a t system. s y s t e m . Examples E x a m p l e s include i n c l u d e mechanical m e c h a n i c a l components, c o m p o n e n t s , electro-mechanical e l e c t r o - m e c h a n i c a l devices, d e v i c e s , electro e l e c t r o valves, v a l v e s , or o r servo s e r v o valves. v a l v e s . granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true} Downloaded D o w n l o a d e d from f r o m SAE S A E International I n t e r n a t i o n a l by b y David D a v i d Merrill, M e r r i l l , Saturday, S a t u r d a y , November N o v e m b e r 12, 1 2 , 2016 2 0 1 6 SAE S A E ARP4754A A R P 4 7 5 4 A Page P a g e 50 5 0 of o f 115 1 1 5 • • Independent I n d e p e n d e n t Functions F u n c t i o n s together t o g e t h e r addressing a d d r e s s i n g a a Catastrophic C a t a s t r o p h i c or o r Hazardous H a z a r d o u s Failure F a i l u r e Condition C o n d i t i o n and a n d using u s i n g common c o m m o n resources r e s o u r c e s based b a s e d on o n the t h e same s a m e COTS C O T S designs d e s i g n s (e.g. ( e . g . computers, c o m p u t e r s , networks, n e t w o r k s , interfaces) i n t e r f a c e s ) may m a y require r e q u i r e additional a d d i t i o n a l consideration c o n s i d e r a t i o n (e.g ( e . g configuration c o n f i g u r a t i o n control, c o n t r o l , software s o f t w a r e testing t e s t i n g on o n target t a r g e t processors) p r o c e s s o r s ) . . A A traditional t r a d i t i o n a l case c a s e of o f Functional F u n c t i o n a l and a n d Item I t e m Development D e v e l o p m e n t Independence I n d e p e n d e n c e is i s whereby w h e r e b y independent i n d e p e n d e n t functions f u n c t i o n s are a r e implemented i m p l e m e n t e d in i n designs d e s i g n s that t h a t are a r e independent i n d e p e n d e n t from f r o m one o n e another. a n o t h e r . 5.2.4 5 . 2 . 4 FDAL F D A L Assignment A s s i g n m e n t Taking T a k i n g Credit C r e d i t for f o r External E x t e r n a l Events E v e n t s For F o r systems s y s t e m s that t h a t provide p r o v i d e protection p r o t e c t i o n against a g a i n s t an a n external e x t e r n a l event e v e n t to t o the t h e aircraft a i r c r a f t design, d e s i g n , (e.g. ( e . g . cargo c a r g o fire), f i r e ) , the t h e following f o l l o w i n g guidelines g u i d e l i n e s may m a y be b e applied a p p l i e d in i n cases c a s e s where w h e r e no n o existing e x i s t i n g guidance g u i d a n c e material m a t e r i a l prescribing p r e s c r i b i n g the t h e associated a s s o c i a t e d FDAL F D A L exist. e x i s t . In I n addition a d d i t i o n to t o Failure F a i l u r e Conditions C o n d i t i o n s related r e l a t e d to t o erroneous e r r o n e o u s operation o p e r a t i o n or o r activation a c t i v a t i o n of o f the t h e protection p r o t e c t i o n Function, F u n c t i o n , there t h e r e are a r e at a t least l e a s t two t w o failure f a i l u r e conditions c o n d i t i o n s to t o consider: c o n s i d e r : • • Loss L o s s of o f protection p r o t e c t i o n combined c o m b i n e d with w i t h the t h e external e x t e r n a l event: e v e n t : The T h e FHA F H A (per ( p e r sec s e c 5.1.1) 5 . 1 . 1 ) needs n e e d s to t o consider c o n s i d e r the t h e classification c l a s s i f i c a t i o n . . The T h e FDAL F D A L of o f the t h e protection p r o t e c t i o n Function F u n c t i o n protecting p r o t e c t i n g against a g a i n s t the t h e external e x t e r n a l event e v e n t can c a n be b e assigned a s s i g n e d based b a s e d on o n Figure F i g u r e 11. 1 1 . If I f the t h e loss l o s s of o f a a protection p r o t e c t i o n Function F u n c t i o n combined c o m b i n e d with w i t h the t h e external e x t e r n a l event e v e n t is i s Catastrophic C a t a s t r o p h i c or o r Hazardous/Severe H a z a r d o u s / S e v e r e Major, M a j o r , the t h e FDAL F D A L for f o r the t h e protection p r o t e c t i o n Function F u n c t i o n alone a l o n e should s h o u l d be b e at a t least l e a s t Level L e v e l C. C . • • Loss L o s s of o f protection p r o t e c t i o n alone: a l o n e : The T h e FHA F H A (per ( p e r sec s e c 5.1.1) 5 . 1 . 1 ) should s h o u l d consider c o n s i d e r the t h e classification c l a s s i f i c a t i o n to t o reflect r e f l e c t the t h e reduction r e d u c t i o n of o f safety s a f e t y margins m a r g i n s (none, ( n o n e , slight, s l i g h t , significant s i g n i f i c a n t or o r large) l a r g e ) and a n d impact i m p a c t on o n crew c r e w workload w o r k l o a d . . Table T a b l e 3 3 does d o e s not n o t apply a p p l y when w h e n there t h e r e is i s only o n l y a a single s i n g l e function f u n c t i o n to t o protect p r o t e c t against a g a i n s t an a n external e x t e r n a l event. e v e n t . If I f the t h e Function F u n c t i o n is i s implemented i m p l e m e n t e d with w i t h multiple m u l t i p l e items i t e m s then t h e n remain r e m a i n in i n the t h e Table T a b l e 3 3 row r o w corresponding c o r r e s p o n d i n g to t o Failure F a i l u r e Condition C o n d i t i o n of o f the t h e loss l o s s of o f protection p r o t e c t i o n combined c o m b i n e d with w i t h the t h e external e x t e r n a l event. e v e n t . When W h e n the t h e loss l o s s of o f protection p r o t e c t i o n alone a l o n e has h a s no n o effect e f f e c t on o n the t h e aircraft a i r c r a f t or o r crew c r e w capability c a p a b i l i t y to t o safely s a f e l y complete c o m p l e t e the t h e mission m i s s i o n (often ( o f t e n it i t is i s a a latent l a t e n t failure), f a i l u r e ) , the t h e level l e v e l of o f reduction r e d u c t i o n in i n safety s a f e t y margin m a r g i n can c a n be b e evaluated e v a l u a t e d considering c o n s i d e r i n g the t h e expected e x p e c t e d probability p r o b a b i l i t y of o f the t h e external e x t e r n a l event e v e n t under u n d e r protection: p r o t e c t i o n : the t h e more m o r e frequent f r e q u e n t the t h e external e x t e r n a l event e v e n t is, i s , the t h e higher h i g h e r the t h e reduction r e d u c t i o n in i n safety s a f e t y margin m a r g i n when w h e n the t h e protection p r o t e c t i o n is i s lost. l o s t . Figure F i g u r e 11 1 1 illustrates i l l u s t r a t e s the t h e relationship r e l a t i o n s h i p between b e t w e e n these t h e s e different d i f f e r e n t attributes a t t r i b u t e s and a n d provides p r o v i d e s guidelines g u i d e l i n e s on o n FDAL F D A L allocation a l l o c a t i o n when w h e n considering c o n s i d e r i n g the t h e loss l o s s of o f a a protection p r o t e c t i o n Function F u n c t i o n (availability ( a v a i l a b i l i t y failure) f a i l u r e ) . . Some S o m e flight f l i g h t phases p h a s e s occur o c c u r only o n l y occasionally, o c c a s i o n a l l y , and a n d these t h e s e phases p h a s e s may m a y arise a r i s e in i n the t h e FHA F H A only o n l y when w h e n needed n e e d e d to t o differentiate d i f f e r e n t i a t e flight f l i g h t conditions. c o n d i t i o n s . The T h e circumstances c i r c u m s t a n c e s or o r frequency f r e q u e n c y of o f any a n y applicable a p p l i c a b l e conditional c o n d i t i o n a l flight f l i g h t phase p h a s e may m a y be b e considered c o n s i d e r e d as a s a a mitigating m i t i g a t i n g factor f a c t o r when w h e n determining d e t e r m i n i n g the t h e FDAL F D A L provided p r o v i d e d that t h a t the t h e conditional c o n d i t i o n a l flight f l i g h t phase p h a s e is i s itself i t s e l f independent i n d e p e n d e n t of o f the t h e Function, F u n c t i o n , or o r system s y s t e m whose w h o s e FDAL F D A L is i s being b e i n g assigned. a s s i g n e d . Abnormal A b n o r m a l flight f l i g h t conditions c o n d i t i o n s like l i k e an a n impending i m p e n d i n g stall s t a l l (flying ( f l y i n g beyond b e y o n d stick s t i c k shaker), s h a k e r ) , overspeed, o v e r s p e e d , or o r an a n emergency e m e r g e n c y descent d e s c e n t may m a y affect a f f e c t the t h e FDAL F D A L assignment a s s i g n m e n t and a n d would w o u l d also a l s o be b e reflected r e f l e c t e d in i n the t h e associated a s s o c i a t e d Failure F a i l u r e Conditions C o n d i t i o n s in i n the t h e FHA F H A Operations O p e r a t i o n s and a n d operational o p e r a t i o n a l flight f l i g h t phases p h a s e s that t h a t are a r e intentionally i n t e n t i o n a l l y performed p e r f o r m e d (e.g. ( e . g . autoland a u t o l a n d or o r ETOPS E T O P S segments) s e g m e n t s ) would w o u l d not n o t be b e able a b l e to t o include i n c l u d e this t h i s consideration c o n s i d e r a t i o n in i n its i t s FDAL F D A L justification j u s t i f i c a t i o n . . In I n this t h i s case, c a s e , the t h e applicant a p p l i c a n t should s h o u l d substantiate s u b s t a n t i a t e to t o the t h e Certification C e r t i f i c a t i o n Authorities A u t h o r i t i e s that t h a t the t h e applicant's a p p l i c a n t ' s proposed p r o p o s e d development d e v e l o p m e n t assurance a s s u r a n c e process p r o c e s s meets m e e t s an a n acceptable a c c e p t a b l e level l e v e l of o f safety. s a f e t y . granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true} Downloaded D o w n l o a d e d from f r o m SAE S A E International I n t e r n a t i o n a l by b y David D a v i d Merrill, M e r r i l l , Saturday, S a t u r d a y , November N o v e m b e r 12, 1 2 , 2016 2 0 1 6 SAE S A E ARP4754A A R P 4 7 5 4 A Page P a g e 51 5 1 of o f 115 1 1 5 Protection P r o t e c t i o n Function F u n c t i o n FOAL F O A L J J Assignment A s s i g n m e n t A A B B - - -------------, - - - - - - - - - - - - - , • • C C - - ·------------------ · - - - - - - - - - - - - - - - - - - . . . . -- - - 1 1 16-4 1 6 - 4 16- 1 6 - 10- 1 0 - 16- 1 6 - 10- 1 0 - 10- 1 0 - 0-3 0 - 3 5 5 6 6 7 7 8 8 9 9 Probability P r o b a b i l i t y of o f the t h e external e x t e r n a l event e v e n t Legend: L e g e n d : CAT C A T Top T o p Level L e v e l Failure F a i l u r e HAZ H A Z Top T o p Level L e v e l Failure F a i l u r e FIGURE F I G U R E 11 1 1 - - PROTECTION P R O T E C T I O N FUNCTION F U N C T I O N FOAL F O A L ASSIGNMENT A S S I G N M E N T AS A S A A FUNCTION F U N C T I O N OF O F PROBABILITY P R O B A B I L I T Y OF O F AN A N EXTERNAL E X T E R N A L EVENT E V E N T 5.3 5 . 3 Requirements R e q u i r e m e n t s Capture C a p t u r e Requirements, R e q u i r e m e n t s , together t o g e t h e r with w i t h related r e l a t e d hazards, h a z a r d s , provide p r o v i d e the t h e common c o m m o n basis b a s i s for f o r the t h e integral i n t e g r a l processes. p r o c e s s e s . Because B e c a u s e the t h e hazards h a z a r d s may m a y have h a v e different d i f f e r e n t levels l e v e l s of o f importance, i m p o r t a n c e , the t h e allocation a l l o c a t i o n of o f requirements, r e q u i r e m e n t s , through t h r o u g h system s y s t e m architecture, a r c h i t e c t u r e , has h a s significant s i g n i f i c a n t impact i m p a c t on o n the t h e ease e a s e of o f substantiating s u b s t a n t i a t i n g certification. c e r t i f i c a t i o n . The T h e top t o p level l e v e l process p r o c e s s in i n the t h e aircraft a i r c r a f t development d e v e l o p m e n t cycle c y c l e includes i n c l u d e s the t h e identification i d e n t i f i c a t i o n of o f aircraft a i r c r a f t functions f u n c t i o n s and a n d the t h e requirements r e q u i r e m e n t s associated a s s o c i a t e d with w i t h these t h e s e functions. f u n c t i o n s . The T h e aircraft a i r c r a f t functions, f u n c t i o n s , including i n c l u d i n g functional f u n c t i o n a l interfaces i n t e r f a c e s and a n d corresponding c o r r e s p o n d i n g safety s a f e t y requirements, r e q u i r e m e n t s , form f o r m the t h e basis b a s i s for f o r establishing e s t a b l i s h i n g the t h e system s y s t e m architecture. a r c h i t e c t u r e . Selection S e l e c t i o n of o f the t h e architecture a r c h i t e c t u r e establishes e s t a b l i s h e s additional a d d i t i o n a l requirements r e q u i r e m e n t s necessary n e c e s s a r y to t o implement i m p l e m e n t that t h a t architecture. a r c h i t e c t u r e . At A t each e a c h phase p h a s e of o f the t h e requirements r e q u i r e m e n t s identification i d e n t i f i c a t i o n and a n d allocation a l l o c a t i o n process p r o c e s s (i.e., ( i . e . , system s y s t e m and a n d item) i t e m ) both b o t h additional a d d i t i o n a l detail d e t a i l for f o r existing e x i s t i n g requirements r e q u i r e m e n t s and a n d new n e w derived d e r i v e d requirements r e q u i r e m e n t s are a r e identified. i d e n t i f i e d . Choices C h o i c e s made m a d e and a n d problems p r o b l e m s encountered e n c o u n t e r e d during d u r i n g implementation i m p l e m e n t a t i o n are a r e a a primary p r i m a r y source s o u r c e for f o r derived d e r i v e d requirements r e q u i r e m e n t s and a n d may m a y lead l e a d to t o identification i d e n t i f i c a t i o n of o f new n e w system s y s t e m safety s a f e t y requirements. r e q u i r e m e n t s . Detailed D e t a i l e d design d e s i g n activities a c t i v i t i e s will w i l l invariably i n v a r i a b l y introduce i n t r o d u c e new n e w requirements r e q u i r e m e n t s or o r modify m o d i f y existing e x i s t i n g requirements. r e q u i r e m e n t s . Requirements R e q u i r e m e n t s may m a y be b e captured c a p t u r e d in i n different d i f f e r e n t formats, f o r m a t s , textual t e x t u a l or o r graphical g r a p h i c a l being b e i n g the t h e most m o s t common. c o m m o n . Irrespective I r r e s p e c t i v e of o f the t h e format, f o r m a t , requirement r e q u i r e m e n t development d e v e l o p m e n t plans p l a n s and a n d standards s t a n d a r d s should s h o u l d be b e developed d e v e l o p e d to t o establish e s t a b l i s h consistency c o n s i s t e n c y across a c r o s s the t h e requirement r e q u i r e m e n t set s e t and a n d ensure e n s u r e communication c o m m u n i c a t i o n across a c r o s s the t h e development d e v e l o p m e n t team t e a m of o f requirement r e q u i r e m e n t capture c a p t u r e expectations. e x p e c t a t i o n s . This T h i s is i s particularly p a r t i c u l a r l y important i m p o r t a n t when w h e n using u s i n g graphical g r a p h i c a l or o r model m o d e l requirement r e q u i r e m e n t capture c a p t u r e formats. f o r m a t s . When W h e n graphical g r a p h i c a l requirement r e q u i r e m e n t capture c a p t u r e is i s planned, p l a n n e d , the t h e following f o l l o w i n g topics t o p i c s should s h o u l d also a l s o be b e included: i n c l u d e d : • • Identify I d e n t i f y the t h e use u s e of o f models/modeling, m o d e l s / m o d e l i n g , • • Identify I d e n t i f y the t h e intended i n t e n d e d tools t o o l s and a n d their t h e i r usage u s a g e during d u r i n g the t h e development, d e v e l o p m e n t , • • Define D e f i n e modeling m o d e l i n g standards s t a n d a r d s and a n d libraries, l i b r a r i e s , in i n order o r d e r to t o establish e s t a b l i s h a a common c o m m o n understanding u n d e r s t a n d i n g of o f the t h e use u s e of o f the t h e models; m o d e l s ; based b a s e d on o n the t h e modeling m o d e l i n g language l a n g u a g e to t o be b e used. u s e d . Model M o d e l contents c o n t e n t s should s h o u l d be b e in i n a a readable r e a d a b l e graphical g r a p h i c a l form. f o r m . Means M e a n s should s h o u l d be b e provided p r o v i d e d to t o unambiguously u n a m b i g u o u s l y identify i d e n t i f y symbols s y m b o l s or o r names n a m e s relative r e l a t i v e to t o the t h e actual a c t u a l signals s i g n a l s and a n d interfaces i n t e r f a c e s represented. r e p r e s e n t e d . The T h e model m o d e l should s h o u l d be b e developed d e v e l o p e d in i n a a layered l a y e r e d manner. m a n n e r . For F o r example, e x a m p l e , subsets s u b s e t s of o f model m o d e l elements e l e m e n t s which w h i c h may m a y be b e used u s e d more m o r e than t h a n once o n c e may m a y be b e handled h a n d l e d and a n d represented r e p r e s e n t e d either e i t h e r as a s a a unit u n i t or o r as a s the t h e full f u l l contents. c o n t e n t s . granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true} Downloaded D o w n l o a d e d from f r o m SAE S A E International I n t e r n a t i o n a l by b y David D a v i d Merrill, M e r r i l l , Saturday, S a t u r d a y , November N o v e m b e r 12, 1 2 , 2016 2 0 1 6 SAE S A E ARP4754A A R P 4 7 5 4 A Page P a g e 52 5 2 of o f 115 1 1 5 Models M o d e l s used u s e d to t o capture c a p t u r e requirements r e q u i r e m e n t s and a n d then t h e n directly d i r e c t l y used u s e d to t o produce p r o d u c e embedded e m b e d d e d code c o d e (Software ( S o f t w a r e or o r HDL) H D L ) come c o m e within w i t h i n the t h e scope s c o p e of o f D0-1788/ED-128 D 0 - 1 7 8 8 / E D - 1 2 8 and a n d D0-254/ED-80 D 0 - 2 5 4 / E D - 8 0 , , from f r o m the t h e time t i m e that t h a t certification c e r t i f i c a t i o n credit c r e d i t is i s to t o be b e taken t a k e n until u n t i l the t h e software s o f t w a r e or o r hardware h a r d w a r e is i s returned r e t u r n e d to t o the t h e system s y s t e m processes p r o c e s s e s for f o r system s y s t e m verification. v e r i f i c a t i o n . 5.3.1 5 . 3 . 1 Types T y p e s of o f Requirements R e q u i r e m e n t s The T h e requirements r e q u i r e m e n t s associated a s s o c i a t e d with w i t h a a given g i v e n function f u n c t i o n define d e f i n e the t h e way w a y the t h e function f u n c t i o n acts a c t s in i n its i t s environment e n v i r o n m e n t and a n d include i n c l u d e the t h e definition d e f i n i t i o n of o f the t h e user/machine u s e r / m a c h i n e interface. i n t e r f a c e . The T h e types t y p e s of o f requirements r e q u i r e m e n t s detailed d e t a i l e d below b e l o w should s h o u l d be b e considered c o n s i d e r e d at a t various v a r i o u s phases p h a s e s of o f the t h e development d e v e l o p m e n t activities a c t i v i t i e s (i.e., ( i . e . , aircraft, a i r c r a f t , system s y s t e m and a n d item). i t e m ) . There T h e r e may m a y be b e requirements r e q u i r e m e n t s that t h a t address a d d r e s s strictly s t r i c t l y business b u s i n e s s or o r economic e c o n o m i c issues i s s u e s and a n d do d o not n o t impact i m p a c t safety s a f e t y or o r certification c e r t i f i c a t i o n requirements. r e q u i r e m e n t s . 5.3.1.1 5 . 3 . 1 . 1 Safety S a f e t y Requirements R e q u i r e m e n t s The T h e safety s a f e t y requirements r e q u i r e m e n t s for f o r aircraft a i r c r a f t and a n d system-level s y s t e m - l e v e l functions f u n c t i o n s include i n c l u d e minimum m i n i m u m performance p e r f o r m a n c e constraints c o n s t r a i n t s for f o r both b o t h availability a v a i l a b i l i t y and a n d integrity i n t e g r i t y of o f the t h e function. f u n c t i o n . These T h e s e safety s a f e t y requirements r e q u i r e m e n t s should s h o u l d be b e determined d e t e r m i n e d by b y conducting c o n d u c t i n g a a safety s a f e t y assessment a s s e s s m e n t consistent c o n s i s t e n t with w i t h the t h e processes p r o c e s s e s in i n section s e c t i o n 5.1. 5 . 1 . Safety S a f e t y requirements r e q u i r e m e n t s for f o r aircraft a i r c r a f t and a n d system s y s t e m functions f u n c t i o n s are a r e determined d e t e r m i n e d by b y identifying i d e n t i f y i n g and a n d classifying c l a s s i f y i n g associated a s s o c i a t e d functional f u n c t i o n a l Failure F a i l u r e Conditions. C o n d i t i o n s . All A l l functions f u n c t i o n s have h a v e associated a s s o c i a t e d failure f a i l u r e modes m o d e s and a n d associated a s s o c i a t e d aircraft a i r c r a f t effects, e f f e c t s , even e v e n if i f the t h e classification c l a s s i f i c a t i o n is i s "No " N o safety s a f e t y effect." e f f e c t . " Safety S a f e t y related r e l a t e d functional f u n c t i o n a l failure f a i l u r e modes m o d e s may m a y have h a v e either e i t h e r contributory c o n t r i b u t o r y or o r direct d i r e c t effects e f f e c t s upon u p o n aircraft a i r c r a f t safety. s a f e t y . Requirements R e q u i r e m e n t s that t h a t are a r e defined d e f i n e d to t o prevent p r e v e n t failure f a i l u r e conditions c o n d i t i o n s or o r to t o provide p r o v i d e safety s a f e t y related r e l a t e d functions f u n c t i o n s should s h o u l d be b e uniquely u n i q u e l y identified i d e n t i f i e d and a n d traceable t r a c e a b l e through t h r o u g h the t h e levels l e v e l s of o f development. d e v e l o p m e n t . This T h i s will w i l l ensure e n s u r e visibility v i s i b i l i t y of o f the t h e safety s a f e t y requirements r e q u i r e m e n t s at a t the t h e software s o f t w a r e and a n d electronic e l e c t r o n i c hardware h a r d w a r e design d e s i g n level. l e v e l . 5.3.1.2 5 . 3 . 1 . 2 Functional F u n c t i o n a l Requirements R e q u i r e m e n t s Functional F u n c t i o n a l requirements r e q u i r e m e n t s are a r e those t h o s e necessary n e c e s s a r y to t o obtain o b t a i n the t h e desired d e s i r e d performance p e r f o r m a n c e of o f the t h e system s y s t e m under u n d e r the t h e conditions c o n d i t i o n s specified. s p e c i f i e d . They T h e y are a r e a a combination c o m b i n a t i o n of o f customer c u s t o m e r desires, d e s i r e s , operational o p e r a t i o n a l constraints, c o n s t r a i n t s , regulatory r e g u l a t o r y restrictions, r e s t r i c t i o n s , and a n d implementation i m p l e m e n t a t i o n realities. r e a l i t i e s . These T h e s e requirements r e q u i r e m e n t s define d e f i n e all a l l significant s i g n i f i c a n t aspects a s p e c t s of o f the t h e system s y s t e m under u n d e r cons c o n s ideration. i d e r a t i o n . Regardless R e g a r d l e s s of o f the t h e original o r i g i n a l source, s o u r c e , all a l l functions f u n c t i o n s should s h o u l d be b e evaluated e v a l u a t e d for f o r their t h e i r safety s a f e t y related r e l a t e d attributes. a t t r i b u t e s . 5.3.1.2.1 5 . 3 . 1 . 2 . 1 Customer C u s t o m e r Requirements R e q u i r e m e n t s Customer C u s t o m e r requirements r e q u i r e m e n t s will w i l l vary v a r y with w i t h the t h e type t y p e of o f aircraft, a i r c r a f t , the t h e specific s p e c i f i c function f u n c t i o n or o r the t h e type t y p e of o f system s y s t e m under u n d e r consideration c o n s i d e r a t i o n . . Requirements R e q u i r e m e n t s may m a y include i n c l u d e those t h o s e associated a s s o c i a t e d with w i t h the t h e operator's o p e r a t o r ' s intended i n t e n d e d payload, p a y l o a d , route r o u t e system, s y s t e m , operating o p e r a t i n g practices, p r a c t i c e s , maintenance m a i n t e n a n c e concepts, c o n c e p t s , and a n d desired d e s i r e d features. f e a t u r e s . 5.3.1.2.2 5 . 3 . 1 . 2 . 2 Operational O p e r a t i o n a l Requirements R e q u i r e m e n t s Operational O p e r a t i o n a l requirements r e q u i r e m e n t s define d e f i n e the t h e interfaces i n t e r f a c e s between b e t w e e n the t h e flight f l i g h t crew c r e w and a n d each e a c h funct f u n c t ional i o n a l system, s y s t e m , the t h e maintenance m a i n t e n a n c e crew c r e w and a n d each e a c h aircraft a i r c r a f t system, s y s t e m , and a n d various v a r i o u s other o t h e r aircraft a i r c r a f t support s u p p o r t people p e o p l e and a n d related r e l a t e d functions f u n c t i o n s or o r equipment. e q u i p m e n t . Actions, A c t i o n s , decisions, d e c i s i o n s , information i n f o r m a t i o n requirements r e q u i r e m e n t s and a n d timing t i m i n g constitute c o n s t i t u t e the t h e bulk b u l k of o f the t h e operational o p e r a t i o n a l requirements. r e q u i r e m e n t s . Both B o t h normal n o r m a l and a n d non n o n normal n o r m a l circumstances c i r c u m s t a n c e s need n e e d to t o be b e considered c o n s i d e r e d when w h e n defining d e f i n i n g operational o p e r a t i o n a l requirements. r e q u i r e m e n t s . 5.3.1.2.3 5 . 3 . 1 . 2 . 3 Performance P e r f o r m a n c e Requirements R e q u i r e m e n t s Performance P e r f o r m a n c e requirements r e q u i r e m e n t s define d e f i n e those t h o s e attributes a t t r i b u t e s of o f the t h e function f u n c t i o n or o r system s y s t e m that t h a t make m a k e it i t useful u s e f u l to t o the t h e aircraft a i r c r a f t and a n d its i t s operation. o p e r a t i o n . In I n addition a d d i t i o n to t o defining d e f i n i n g the t h e type t y p e of o f performance p e r f o r m a n c e expected, e x p e c t e d , performance p e r f o r m a n c e requirements r e q u i r e m e n t s include i n c l u d e function f u n c t i o n specifics s p e c i f i c s such s u c h as: a s : accuracy, a c c u r a c y , fidelity f i d e l i t y , , range, r a n g e , resolution, r e s o l u t i o n , speed, s p e e d , and a n d response r e s p o n s e times. t i m e s . 5.3.1.2.4 5 . 3 . 1 . 2 . 4 Physical P h y s i c a l and a n d Installation I n s t a l l a t i o n Requirements R e q u i r e m e n t s Physical P h y s i c a l and a n d installation i n s t a l l a t i o n requirements r e q u i r e m e n t s relate r e l a t e the t h e physical p h y s i c a l attributes a t t r i b u t e s of o f the t h e system s y s t e m to t o the t h e aircraft a i r c r a f t environment. e n v i r o n m e n t . They T h e y may m a y include: i n c l u d e : size, s i z e , mounting m o u n t i n g provisions, p r o v i s i o n s , power, p o w e r , cooling, c o o l i n g , environmental e n v i r o n m e n t a l restrictions, r e s t r i c t i o n s , visibility v i s i b i l i t y , , access, a c c e s s , adjustment, a d j u s t m e n t , handling, h a n d l i n g , and a n d storage. s t o r a g e . Production P r o d u c t i o n constraints c o n s t r a i n t s may m a y also a l s o play p l a y a a role r o l e in i n establishing e s t a b l i s h i n g these t h e s e requirements. r e q u i r e m e n t s . granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true} Downloaded D o w n l o a d e d from f r o m SAE S A E International I n t e r n a t i o n a l by b y David D a v i d Merrill, M e r r i l l , Saturday, S a t u r d a y , November N o v e m b e r 12, 1 2 , 2016 2 0 1 6 SAE S A E ARP4754A A R P 4 7 5 4 A Page P a g e 53 5 3 of o f 115 1 1 5 5.3.1.2.5 5 . 3 . 1 . 2 . 5 Maintainability M a i n t a i n a b i l i t y Requirements R e q u i r e m e n t s Maintainability M a i n t a i n a b i l i t y requirements r e q u i r e m e n t s include i n c l u d e scheduled s c h e d u l e d and a n d unscheduled u n s c h e d u l e d maintenance m a i n t e n a n c e requirements r e q u i r e m e n t s and a n d any a n y links l i n k s to t o specific s p e c i f i c safety-related s a f e t y - r e l a t e d functions. f u n c t i o n s . Factors F a c t o r s such s u c h as a s the t h e percent p e r c e n t of o f failure f a i l u r e detection d e t e c t i o n or o r the t h e percent p e r c e n t of o f fault f a u l t isolat i s o l a t ion i o n may m a y also a l s o be b e important. i m p o r t a n t . Provisions P r o v i s i o n s for f o r external e x t e r n a l test t e s t equipment e q u i p m e n t signals s i g n a l s and a n d connections c o n n e c t i o n s should s h o u l d be b e defined d e f i n e d in i n these t h e s e requirements. r e q u i r e m e n t s . 5.3.1.2.6 5 . 3 . 1 . 2 . 6 Interface I n t e r f a c e Requirements R e q u i r e m e n t s Interface I n t e r f a c e requirements r e q u i r e m e n t s include i n c l u d e the t h e physical p h y s i c a l system s y s t e m and a n d item i t e m interconnections i n t e r c o n n e c t i o n s along a l o n g with w i t h the t h e relevant r e l e v a n t characteristics c h a r a c t e r i s t i c s of o f the t h e specific s p e c i f i c information i n f o r m a t i o n communicated. c o m m u n i c a t e d . The T h e interfaces i n t e r f a c e s should s h o u l d be b e defined d e f i n e d with w i t h all a l l inputs i n p u t s having h a v i n g a a source s o u r c e and a n d all a l l output o u t p u t destinations d e s t i n a t i o n s defined. d e f i n e d . The T h e interface i n t e r f a c e descriptions d e s c r i p t i o n s should s h o u l d fully f u l l y describe d e s c r i b e the t h e behavior b e h a v i o r of o f the t h e signals. s i g n a l s . 5.3.1.3 5 . 3 . 1 . 3 Additional A d d i t i o n a l Certification C e r t i f i c a t i o n Requirements R e q u i r e m e n t s Additional A d d i t i o n a l functions, f u n c t i o n s , functional f u n c t i o n a l attributes a t t r i b u t e s , , or o r implementations i m p l e m e n t a t i o n s may m a y be b e required r e q u i r e d by b y airworthiness a i r w o r t h i n e s s regulations r e g u l a t i o n s or o r may m a y be b e necessary n e c e s s a r y to t o show s h o w compliance c o m p l i a n c e with w i t h airworthiness a i r w o r t h i n e s s regulations. r e g u l a t i o n s . Requirements R e q u i r e m e n t s of o f this t h i s type t y p e should s h o u l d be b e defined d e f i n e d and a n d agreed a g r e e d upon u p o n with w i t h the t h e appropriate a p p r o p r i a t e certification c e r t i f i c a t i o n authorities. a u t h o r i t i e s . 5.3.1.4 5 . 3 . 1 . 4 Derived D e r i v e d Requirements R e q u i r e m e n t s At A t each e a c h phase p h a s e of o f the t h e development d e v e l o p m e n t activity, a c t i v i t y , decisions d e c i s i o n s are a r e made m a d e as a s to t o how h o w particular p a r t i c u l a r requirements r e q u i r e m e n t s or o r groups g r o u p s of o f requirements r e q u i r e m e n t s are a r e to t o be b e met. m e t . The T h e consequences c o n s e q u e n c e s of o f these t h e s e design d e s i g n choices c h o i c e s become b e c o m e requirements r e q u i r e m e n t s for f o r the t h e next n e x t phase p h a s e of o f the t h e development. d e v e l o p m e n t . Since S i n c e these t h e s e requirements r e q u i r e m e n t s result r e s u l t from f r o m the t h e design d e s i g n process p r o c e s s itself, i t s e l f , they t h e y may m a y not n o t be b e uniquely u n i q u e l y related r e l a t e d to t o a a higher- h i g h e r - level l e v e l requirement r e q u i r e m e n t and a n d are a r e referred r e f e r r e d to t o as a s derived d e r i v e d requirements. r e q u i r e m e n t s . Derived D e r i v e d requirements r e q u i r e m e n t s should s h o u l d be b e examined e x a m i n e d to t o determine d e t e r m i n e which w h i c h aircraft-level a i r c r a f t - l e v e l function f u n c t i o n (or ( o r functions) f u n c t i o n s ) they t h e y support s u p p o r t so s o that t h a t the t h e appropriate a p p r o p r i a t e Failure F a i l u r e Condition C o n d i t i o n classification c l a s s i f i c a t i o n can c a n be b e assigned a s s i g n e d and a n d the t h e requirement r e q u i r e m e n t validated. v a l i d a t e d . While W h i l e derived d e r i v e d requirements r e q u i r e m e n t s will w i l l not n o t impact i m p a c t the t h e higher-level h i g h e r - l e v e l requirements, r e q u i r e m e n t s , some s o m e may m a y have h a v e implications i m p l i c a t i o n s at a t higher h i g h e r levels. l e v e l s . Derived D e r i v e d requirements r e q u i r e m e n t s should s h o u l d be b e reviewed r e v i e w e d from f r o m a a safety s a f e t y perspective p e r s p e c t i v e (i.e. ( i . e . impact i m p a c t to t o safety s a f e t y analyses) a n a l y s e s ) at a t progressively p r o g r e s s i v e l y higher h i g h e r system s y s t e m levels l e v e l s until u n t i l it i t is i s determined d e t e r m i n e d that t h a t no n o further f u r t h e r impact i m p a c t is i s propagated. p r o p a g a t e d . For F o r example, e x a m p l e , derived d e r i v e d requirements r e q u i r e m e n t s may m a y result r e s u l t from f r o m the t h e decision d e c i s i o n to t o select s e l e c t a a separate s e p a r a t e power p o w e r supply s u p p l y for f o r equipment e q u i p m e n t performing p e r f o r m i n g a a specific s p e c i f i c function. f u n c t i o n . The T h e requirements r e q u i r e m e n t s for f o r the t h e power p o w e r supply s u p p l y , , including i n c l u d i n g the t h e safety s a f e t y requirements, r e q u i r e m e n t s , are a r e derived d e r i v e d requirements. r e q u i r e m e n t s . The T h e Failure F a i l u r e Condition C o n d i t i o n resulting r e s u l t i n g from f r o m the t h e fault f a u l t or o r failure f a i l u r e of o f the t h e function f u n c t i o n supported s u p p o r t e d by b y the t h e power p o w e r supply s u p p l y determines d e t e r m i n e s the t h e necessary n e c e s s a r y development d e v e l o p m e n t assurance a s s u r a n c e level. l e v e l . Derived D e r i v e d requirements r e q u i r e m e n t s may m a y also a l s o result r e s u l t from f r o m architecture a r c h i t e c t u r e choices. c h o i c e s . For F o r example, e x a m p l e , selecting s e l e c t i n g a a triplex t r i p l e x architecture a r c h i t e c t u r e for f o r achieving a c h i e v i n g a a high h i g h integrity i n t e g r i t y functional f u n c t i o n a l objective o b j e c t i v e would w o u l d have h a v e different d i f f e r e n t consequences c o n s e q u e n c e s and a n d different d i f f e r e n t derived d e r i v e d requirements r e q u i r e m e n t s from f r o m selection s e l e c t i o n of o f a a dual d u a l monitored m o n i t o r e d architecture a r c h i t e c t u r e for f o r achievement a c h i e v e m e n t of o f the t h e same s a m e objective. o b j e c t i v e . Derived D e r i v e d requirements r e q u i r e m e n t s may m a y result r e s u l t from f r o m a a design d e s i g n decision d e c i s i o n to t o isolate i s o l a t e function f u n c t i o n implementations i m p l e m e n t a t i o n s having h a v i n g more m o r e severe s e v e r e Failure F a i l u r e Condition C o n d i t i o n classifications c l a s s i f i c a t i o n s from f r o m the t h e failure f a i l u r e effects e f f e c t s of o f systems s y s t e m s having h a v i n g less l e s s severe s e v e r e Failure F a i l u r e Condition C o n d i t i o n classifications. c l a s s i f i c a t i o n s . Derived D e r i v e d requirements r e q u i r e m e n t s also a l s o include i n c l u d e those t h o s e defining d e f i n i n g the t h e electronic e l e c t r o n i c hardware-software h a r d w a r e - s o f t w a r e interface. i n t e r f a c e . Some S o m e of o f these t h e s e requirements r e q u i r e m e n t s may m a y be b e significant s i g n i f i c a n t at a t the t h e system s y s t e m level. l e v e l . The T h e remainder, r e m a i n d e r , dealing d e a l i n g with w i t h detailed d e t a i l e d aspects a s p e c t s of o f the t h e electronic e l e c t r o n i c hardware-software h a r d w a r e - s o f t w a r e interface, i n t e r f a c e , may m a y be b e handled h a n d l e d under u n d e r the t h e guidance g u i d a n c e of o f D0-1788/ED-128 D 0 - 1 7 8 8 / E D - 1 2 8 and a n d D0-254/ED-80. D 0 - 2 5 4 / E D - 8 0 . Derived D e r i v e d requirements r e q u i r e m e n t s should s h o u l d be b e captured c a p t u r e d and a n d treated t r e a t e d in i n a a manner m a n n e r consistent c o n s i s t e n t with w i t h other o t h e r requirements r e q u i r e m e n t s applicable a p p l i c a b l e at a t that t h a t development d e v e l o p m e n t phase. p h a s e . Derived D e r i v e d requirements r e q u i r e m e n t s should s h o u l d include i n c l u d e rationale r a t i o n a l e and/or a n d / o r references r e f e r e n c e s to t o applicable a p p l i c a b l e design d e s i g n standards. s t a n d a r d s . granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true} Downloaded D o w n l o a d e d from f r o m SAE S A E International I n t e r n a t i o n a l by b y David D a v i d Merrill, M e r r i l l , Saturday, S a t u r d a y , November N o v e m b e r 12, 1 2 , 2016 2 0 1 6 SAE S A E ARP4754A A R P 4 7 5 4 A Page P a g e 54 5 4 of o f 115 1 1 5 5.3.1.5 5 . 3 . 1 . 5 Re-use R e - u s e of o f Existing E x i s t i n g Certificated C e r t i f i c a t e d Systems S y s t e m s and a n d Items I t e m s Systems S y s t e m s and a n d items i t e m s which w h i c h have h a v e been b e e n used u s e d on o n other o t h e r aircraft a i r c r a f t are a r e often o f t e n reused r e u s e d in i n new n e w or o r derivative d e r i v a t i v e aircraft. a i r c r a f t . The T h e maturity m a t u r i t y of o f these t h e s e systems s y s t e m s and a n d items i t e m s has h a s benefit, b e n e f i t , but b u t it i t should s h o u l d not n o t be b e assumed a s s u m e d that t h a t they t h e y meet m e e t the t h e requirements r e q u i r e m e n t s of o f the t h e new n e w installation. i n s t a l l a t i o n . Even E v e n if i f no n o design d e s i g n changes c h a n g e s are a r e to t o be b e made m a d e to t o the t h e system s y s t e m or o r item, i t e m , the t h e requirements r e q u i r e m e n t s to t o which w h i c h the t h e system s y s t e m or o r item i t e m was w a s certificated c e r t i f i c a t e d should s h o u l d be b e validated v a l i d a t e d according a c c o r d i n g to t o the t h e new n e w application, a p p l i c a t i o n , and a n d modified m o d i f i e d as a s necessary. n e c e s s a r y . Any A n y derived d e r i v e d requirements, r e q u i r e m e n t s , assumptions, a s s u m p t i o n s , compatibility c o m p a t i b i l i t y of o f the t h e interfaces i n t e r f a c e s and a n d the t h e operational o p e r a t i o n a l environment e n v i r o n m e n t should s h o u l d be b e validated v a l i d a t e d as a s well. w e l l . Care C a r e should s h o u l d be b e taken t a k e n in i n interface i n t e r f a c e definitions d e f i n i t i o n s that t h a t may m a y be b e broad b r o a d and a n d may m a y have h a v e been b e e n met m e t in i n an a n earlier e a r l i e r application a p p l i c a t i o n but b u t may m a y not n o t be b e met m e t in i n the t h e re-use r e - u s e instance i n s t a n c e due d u e to t o things t h i n g s like l i k e different d i f f e r e n t cable c a b l e loading l o a d i n g or o r bus b u s termination t e r m i n a t i o n conventions. c o n v e n t i o n s . Verification V e r i f i c a t i o n activities a c t i v i t i e s should s h o u l d then t h e n be b e carried c a r r i e d out o u t against a g a i n s t these t h e s e requirements, r e q u i r e m e n t s , including i n c l u d i n g integration i n t e g r a t i o n with w i t h the t h e aircraft a i r c r a f t as a s required. r e q u i r e d . 5.3.2 5 . 3 . 2 Deriving D e r i v i n g Safety-related S a f e t y - r e l a t e d Requirements R e q u i r e m e n t s from f r o m the t h e Safety S a f e t y Analyses A n a l y s e s The T h e types t y p e s of o f safety-related s a f e t y - r e l a t e d requirements r e q u i r e m e n t s for f o r each e a c h function, f u n c t i o n , whether w h e t h e r at a t the t h e aircraft, a i r c r a f t , system s y s t e m or o r item i t e m level, l e v e l , are a r e typically t y p i c a l l y the t h e independence i n d e p e n d e n c e requirements, r e q u i r e m e n t s , probabilistic p r o b a b i l i s t i c availability a v a i l a b i l i t y and a n d integrity i n t e g r i t y requirements, r e q u i r e m e n t s , no n o single s i n g l e failure f a i l u r e criteria, c r i t e r i a , monitor m o n i t o r performance p e r f o r m a n c e requirements, r e q u i r e m e n t s , safety s a f e t y or o r protective p r o t e c t i v e features, f e a t u r e s , development d e v e l o p m e n t assurance a s s u r a n c e levels, l e v e l s , and a n d operational o p e r a t i o n a l and a n d maintenance m a i n t e n a n c e limitations. l i m i t a t i o n s . The T h e probabilistic p r o b a b i l i s t i c requirements r e q u i r e m e n t s are a r e typically t y p i c a l l y handled h a n d l e d through t h r o u g h a a budgeting b u d g e t i n g process. p r o c e s s . For F o r a a given g i v e n function, f u n c t i o n , safety s a f e t y requirements r e q u i r e m e n t s are a r e derived d e r i v e d using u s i n g the t h e results r e s u l t s of o f the t h e safety s a f e t y assessments a s s e s s m e n t s . . These T h e s e safety s a f e t y requirements r e q u i r e m e n t s are a r e usually u s u a l l y a a straightforward s t r a i g h t f o r w a r d assignment a s s i g n m e n t from f r o m failure f a i l u r e categories c a t e g o r i e s based b a s e d on o n the t h e consequences c o n s e q u e n c e s of o f that t h a t function's f u n c t i o n ' s failure. f a i l u r e . There T h e r e are a r e circumstances c i r c u m s t a n c e s when w h e n some s o m e combinations c o m b i n a t i o n s need n e e d to t o be b e considered, c o n s i d e r e d , however, h o w e v e r , and a n d these t h e s e need n e e d to t o be b e selected s e l e c t e d in i n a a manner m a n n e r that t h a t covers c o v e r s needed n e e d e d combinations c o m b i n a t i o n s without w i t h o u t having h a v i n g to t o consider c o n s i d e r an a n exponentially e x p o n e n t i a l l y increasing i n c r e a s i n g number n u m b e r of o f irrelevant i r r e l e v a n t combinations c o m b i n a t i o n s : : Combinations C o m b i n a t i o n s should s h o u l d be b e considered c o n s i d e r e d when w h e n there t h e r e are a r e common c o m m o n resources r e s o u r c e s used u s e d for f o r multiple m u l t i p l e functions. f u n c t i o n s . The T h e relevant r e l e v a n t combinations c o m b i n a t i o n s are a r e identified i d e n t i f i e d and a n d the t h e analyses a n a l y s e s repeated r e p e a t e d to t o derive d e r i v e requirements r e q u i r e m e n t s for f o r the t h e identified i d e n t i f i e d functional f u n c t i o n a l combinations. c o m b i n a t i o n s . With W i t h increasingly i n c r e a s i n g l y shared s h a r e d resources r e s o u r c e s used u s e d in i n aircraft a i r c r a f t architectures, a r c h i t e c t u r e s , this t h i s case c a s e occurs o c c u r s often. o f t e n . Combinations C o m b i n a t i o n s should s h o u l d also a l s o be b e considered c o n s i d e r e d when w h e n there t h e r e are a r e sibling s i b l i n g functions f u n c t i o n s whose w h o s e parent p a r e n t function f u n c t i o n has h a s a a more m o r e severe s e v e r e effect e f f e c t category c a t e g o r y than t h a n any a n y one o n e child. c h i l d . A A typical t y p i c a l case c a s e would w o u l d occur o c c u r when w h e n multiple m u l t i p l e systems s y s t e m s working w o r k i n g together t o g e t h e r or o r in i n complementary c o m p l e m e n t a r y ways w a y s satisfy s a t i s f y an a n aircraft a i r c r a f t function. f u n c t i o n . 5.3.3 5 . 3 . 3 Capturing C a p t u r i n g Maintenance M a i n t e n a n c e Requirements R e q u i r e m e n t s for f o r In-service I n - s e r v i c e Use U s e Once O n c e the t h e requirements r e q u i r e m e n t s used u s e d for f o r developing d e v e l o p i n g the t h e aircraft a i r c r a f t are a r e captured, c a p t u r e d , it i t is i s prudent p r u d e n t to t o ensure e n s u r e that t h a t the t h e level l e v e l of o f safety s a f e t y established e s t a b l i s h e d for f o r certification c e r t i f i c a t i o n is i s maintained m a i n t a i n e d during d u r i n g the t h e life l i f e of o f the t h e aircraft a i r c r a f t through t h r o u g h development d e v e l o p m e n t of o f appropr a p p r o p r iate i a t e maintenance m a i n t e n a n c e requirements. r e q u i r e m e n t s . These T h e s e requirements r e q u i r e m e n t s can c a n then t h e n be b e included i n c l u d e d in i n the t h e Instructions I n s t r u c t i o n s for f o r Continued C o n t i n u e d Airworthiness A i r w o r t h i n e s s (ICA). ( I C A ) . The T h e periodic p e r i o d i c maintenance, m a i n t e n a n c e , inspection, i n s p e c t i o n , or o r overhaul o v e r h a u l that t h a t are a r e required r e q u i r e d to t o maintain m a i n t a i n the t h e integrity i n t e g r i t y of o f the t h e system s y s t e m or o r to t o maintain m a i n t a i n the t h e safety s a f e t y protection p r o t e c t i o n features f e a t u r e s should s h o u l d be b e captured c a p t u r e d as a s ICA. I C A . Depending D e p e n d i n g on o n their t h e i r criticality, c r i t i c a l i t y , some s o m e ICAs I C A s may m a y need n e e d a a higher h i g h e r level l e v e l of o f visibility v i s i b i l i t y and a n d protection p r o t e c t i o n against a g a i n s t inadvertent i n a d v e r t e n t deletion d e l e t i o n or o r modification; m o d i f i c a t i o n ; in i n such s u c h case c a s e include i n c l u d e them t h e m in i n the t h e Airworthiness A i r w o r t h i n e s s Limitations L i m i t a t i o n s Section S e c t i o n of o f the t h e maintenance m a i n t e n a n c e manual, m a n u a l , as a s appropriate. a p p r o p r i a t e . 5.4 5 . 4 Requirements R e q u i r e m e n t s Validation V a l i d a t i o n Validation V a l i d a t i o n of o f requirements r e q u i r e m e n t s is i s the t h e process p r o c e s s of o f ensuring e n s u r i n g that t h a t the t h e specified s p e c i f i e d requirements r e q u i r e m e n t s are a r e sufficiently s u f f i c i e n t l y correct c o r r e c t and a n d complete c o m p l e t e so s o that t h a t the t h e product p r o d u c t will w i l l meet m e e t the t h e needs n e e d s of o f customers, c u s t o m e r s , users, u s e r s , suppliers, s u p p l i e r s , maintainers m a i n t a i n e r s and a n d certification c e r t i f i c a t i o n authorities, a u t h o r i t i e s , as a s well w e l l as a s aircraft, a i r c r a f t , system s y s t e m and a n d item i t e m developers d e v e l o p e r s (e.g. ( e . g . flight f l i g h t crews, c r e w s , as a s users, u s e r s , may m a y have h a v e a a need n e e d for f o r a a certain c e r t a i n system s y s t e m behavior b e h a v i o r for f o r thrust t h r u s t control c o n t r o l and a n d a a level l e v e l of o f performance p e r f o r m a n c e for f o r that t h a t behavior. b e h a v i o r . Certification C e r t i f i c a t i o n authorities a u t h o r i t i e s may m a y have h a v e a a need n e e d for f o r a a constraint c o n s t r a i n t on o n undesired u n d e s i r e d operating o p e r a t i n g behaviors). b e h a v i o r s ) . While W h i l e the t h e format f o r m a t of o f the t h e validation v a l i d a t i o n effort e f f o r t is i s left l e f t to t o the t h e developer, d e v e l o p e r , a a structured s t r u c t u r e d process p r o c e s s should s h o u l d be b e defined d e f i n e d in i n the t h e validation v a l i d a t i o n plan p l a n (see ( s e e 5.4.7.1). 5 . 4 . 7 . 1 ) . Given G i v e n the t h e importance i m p o r t a n c e of o f effectively e f f e c t i v e l y capturing c a p t u r i n g requirements r e q u i r e m e n t s that t h a t will w i l l satisfy s a t i s f y these t h e s e needs, n e e d s , the t h e following f o l l o w i n g guidelines g u i d e l i n e s may m a y be b e helpful: h e l p f u l : • • Identify I d e n t i f y the t h e requirement r e q u i r e m e n t interfaces i n t e r f a c e s (i.e. ( i . e . with w i t h the t h e aircraft, a i r c r a f t , with w i t h other o t h e r systems, s y s t e m s , with w i t h items, i t e m s , with w i t h people, p e o p l e , with w i t h processes), p r o c e s s e s ) , granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true} Downloaded D o w n l o a d e d from f r o m SAE S A E International I n t e r n a t i o n a l by b y David D a v i d Merrill, M e r r i l l , Saturday, S a t u r d a y , November N o v e m b e r 12, 1 2 , 2016 2 0 1 6 SAE S A E ARP4754A A R P 4 7 5 4 A Page P a g e 55 5 5 of o f 115 1 1 5 • • Identify I d e n t i f y the t h e individuals i n d i v i d u a l s that t h a t have h a v e a a primary p r i m a r y interest i n t e r e s t in i n an a n interface i n t e r f a c e or o r a a need n e e d for f o r an a n interface, i n t e r f a c e , • • Interfaces I n t e r f a c e s should s h o u l d be b e formalized f o r m a l i z e d through t h r o u g h agreements a g r e e m e n t s (e.g. ( e . g . statement s t a t e m e n t of o f work, w o r k , plan, p l a n , manual, m a n u a l , requirements r e q u i r e m e n t s document, d o c u m e n t , interface i n t e r f a c e document, d o c u m e n t , legal l e g a l contract), c o n t r a c t ) , • • The T h e agreement a g r e e m e n t should s h o u l d define d e f i n e the t h e ground-rules g r o u n d - r u l e s so s o an a n interface i n t e r f a c e can c a n be b e realized r e a l i z e d (who ( w h o owns o w n s which w h i c h side s i d e of o f the t h e interface; i n t e r f a c e ; what w h a t is i s the t h e means m e a n s of o f identifying i d e n t i f y i n g problems p r o b l e m s and a n d correcting c o r r e c t i n g them; t h e m ; what w h a t is i s the t h e format f o r m a t or o r constraints c o n s t r a i n t s associated a s s o c i a t e d with w i t h the t h e interface?), i n t e r f a c e ? ) , • • The T h e agreement a g r e e m e n t should s h o u l d define d e f i n e the t h e interface i n t e r f a c e behaviors b e h a v i o r s that t h a t are a r e to t o be b e provided p r o v i d e d when w h e n an a n input i n p u t is i s received, r e c e i v e d , • • The T h e agreement a g r e e m e n t should s h o u l d define d e f i n e the t h e background b a c k g r o u n d and a n d context c o n t e x t of o f interfaces, i n t e r f a c e s , to t o the t h e extent e x t e n t necessary n e c e s s a r y to t o assess a s s e s s if i f it i t is i s appropriate, a p p r o p r i a t e , • • The T h e provider p r o v i d e r of o f data d a t a should s h o u l d have h a v e visibility v i s i b i l i t y to t o how h o w the t h e interface i n t e r f a c e is i s going g o i n g to t o be b e used u s e d to t o help h e l p insure i n s u r e along a l o n g with w i t h the t h e user u s e r of o f the t h e data d a t a that t h a t it i t is i s fit f i t for f o r purpose, p u r p o s e , • • Extra E x t r a rigor r i g o r should s h o u l d be b e applied a p p l i e d when w h e n crossing c r o s s i n g organizational o r g a n i z a t i o n a l or o r corporate c o r p o r a t e boundaries. b o u n d a r i e s . (see ( s e e section s e c t i o n 5.3.1.1 5 . 3 . 1 . 1 and a n d 5.3.1.2 5 . 3 . 1 . 2 for f o r guidelines) g u i d e l i n e s ) • • An A n independent i n d e p e n d e n t reviewer r e v i e w e r should s h o u l d challenge c h a l l e n g e the t h e assumptions a s s u m p t i o n s and a n d interpretations i n t e r p r e t a t i o n s of o f captured c a p t u r e d requirements r e q u i r e m e n t s with w i t h the t h e requirement r e q u i r e m e n t originator, o r i g i n a t o r , ideally i d e a l l y as a s they t h e y are a r e being b e i n g captured, c a p t u r e d , in i n order o r d e r to t o ensure e n s u r e that t h a t these t h e s e requirements r e q u i r e m e n t s have h a v e the t h e same s a m e meaning m e a n i n g for f o r the t h e requirement r e q u i r e m e n t originators o r i g i n a t o r s and a n d recipients. r e c i p i e n t s . • • Non-complex N o n - c o m p l e x items i t e m s may m a y be b e considered c o n s i d e r e d as a s meeting m e e t i n g IDAL I D A L A A rigor r i g o r when w h e n they t h e y are a r e fully f u l l y assured a s s u r e d by b y a a combination c o m b i n a t i o n of o f testing t e s t i n g and a n d analysis, a n a l y s i s , however h o w e v e r requirements r e q u i r e m e n t s for f o r these t h e s e items i t e m s should s h o u l d be b e validated v a l i d a t e d with w i t h the t h e rigor r i g o r corresponding c o r r e s p o n d i n g to t o the t h e FOAL F O A L of o f the t h e function. f u n c t i o n . Ideally, I d e a l l y , requirements r e q u i r e m e n t s should s h o u l d be b e validated v a l i d a t e d before b e f o r e the t h e design d e s i g n implementation i m p l e m e n t a t i o n commences. c o m m e n c e s . However, H o w e v e r , in i n practice, p r a c t i c e , particularly p a r t i c u l a r l y for f o r complex c o m p l e x and a n d integrated i n t e g r a t e d systems, s y s t e m s , the t h e validation v a l i d a t i o n of o f requirements r e q u i r e m e n t s may m a y not n o t be b e possible p o s s i b l e until u n t i l the t h e system s y s t e m implementation i m p l e m e n t a t i o n is i s available a v a i l a b l e and a n d can c a n be b e tested t e s t e d in i n its i t s operational o p e r a t i o n a l context. c o n t e x t . In I n consequence, c o n s e q u e n c e , validation v a l i d a t i o n is i s normally n o r m a l l y a a staged s t a g e d process p r o c e s s continuing c o n t i n u i n g through t h r o u g h the t h e development d e v e l o p m e n t cycle. c y c l e . At A t each e a c h stage s t a g e the t h e validation v a l i d a t i o n activity a c t i v i t y provides p r o v i d e s increasing i n c r e a s i n g confidence c o n f i d e n c e in i n the t h e correctness c o r r e c t n e s s and a n d completeness c o m p l e t e n e s s of o f the t h e requirements. r e q u i r e m e n t s . The T h e validation v a l i d a t i o n process p r o c e s s at a t each e a c h level l e v e l of o f the t h e requirements r e q u i r e m e n t s hierarchy h i e r a r c h y should s h o u l d involve i n v o l v e all a l l relevant r e l e v a n t technical t e c h n i c a l disciplines, d i s c i p l i n e s , including i n c l u d i n g the t h e safety s a f e t y assessment a s s e s s m e n t process. p r o c e s s . Experience E x p e r i e n c e indicates i n d i c a t e s that t h a t careful c a r e f u l attention a t t e n t i o n to t o requirements r e q u i r e m e n t s development d e v e l o p m e n t and a n d validat v a l i d a t ion i o n can c a n identify i d e n t i f y subtle s u b t l e errors e r r o r s or o r omissions o m i s s i o n s early e a r l y in i n the t h e development d e v e l o p m e n t cycle c y c l e and a n d reduce r e d u c e exposure e x p o s u r e to t o subsequent s u b s e q u e n t redesign r e d e s i g n or o r inadequate i n a d e q u a t e system s y s t e m performance. p e r f o r m a n c e . Testing T e s t i n g may m a y simultaneously s i m u l t a n e o u s l y serve s e r v e the t h e purposes p u r p o s e s of o f verification v e r i f i c a t i o n as a s well w e l l as a s validation v a l i d a t i o n when w h e n the t h e system s y s t e m implementation i m p l e m e n t a t i o n is i s used u s e d as a s part p a r t of o f the t h e requirements r e q u i r e m e n t s validation v a l i d a t i o n process. p r o c e s s . One O n e purpose p u r p o s e of o f this t h i s activity a c t i v i t y is i s to t o check c h e c k that t h a t the t h e requirements r e q u i r e m e n t s are a r e met m e t by b y the t h e implemented i m p l e m e n t e d system, s y s t e m , while w h i l e a a separate s e p a r a t e purpose p u r p o s e is i s checking c h e c k i n g that t h a t the t h e requirements r e q u i r e m e n t s are a r e appropriate a p p r o p r i a t e to t o the t h e context c o n t e x t in i n which w h i c h the t h e system s y s t e m is i s operating. o p e r a t i n g . Such S u c h dual d u a l purposes p u r p o s e s should s h o u l d be b e reflected r e f l e c t e d by b y coordination c o o r d i n a t i o n of o f the t h e verification v e r i f i c a t i o n and a n d validation v a l i d a t i o n plans. p l a n s . 5.4.1 5 . 4 . 1 Process P r o c e s s Objectives O b j e c t i v e s Ensuring E n s u r i n g correctness c o r r e c t n e s s and a n d completeness c o m p l e t e n e s s of o f requirements r e q u i r e m e n t s are a r e the t h e objectives o b j e c t i v e s of o f the t h e requirements r e q u i r e m e n t s validation v a l i d a t i o n process p r o c e s s (i.e. ( i . e . Are A r e we w e building b u i l d i n g the t h e right r i g h t aircraft?) a i r c r a f t ? ) . . Examination E x a m i n a t i o n of o f requirements r e q u i r e m e n t s to t o ensure e n s u r e they t h e y are a r e both b o t h necessary n e c e s s a r y and a n d sufficient s u f f i c i e n t is i s a a key k e y aspect a s p e c t of o f validation. v a l i d a t i o n . A A further f u r t h e r objective o b j e c t i v e of o f the t h e validation v a l i d a t i o n process p r o c e s s is i s to t o limit l i m i t the t h e potential p o t e n t i a l for f o r unintended u n i n t e n d e d functions f u n c t i o n s in i n the t h e system s y s t e m or o r for f o r unintended u n i n t e n d e d functions f u n c t i o n s to t o be b e induced i n d u c e d in i n interfacing i n t e r f a c i n g systems. s y s t e m s . granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true} Downloaded D o w n l o a d e d from f r o m SAE S A E International I n t e r n a t i o n a l by b y David D a v i d Merrill, M e r r i l l , Saturday, S a t u r d a y , November N o v e m b e r 12, 1 2 , 2016 2 0 1 6 SAE S A E ARP4754A A R P 4 7 5 4 A Page P a g e 56 5 6 of o f 115 1 1 5 5.4.2 5 . 4 . 2 Validation V a l i d a t i o n Process P r o c e s s Model M o d e l Requirements R e q u i r e m e n t s and a n d assumptions a s s u m p t i o n s should s h o u l d be b e validated v a l i d a t e d at a t each e a c h hierarchical h i e r a r c h i c a l level l e v e l of o f requirements r e q u i r e m e n t s definition. d e f i n i t i o n . This T h i s includes i n c l u d e s validation v a l i d a t i o n of o f requirements r e q u i r e m e n t s at a t the t h e aircraft a i r c r a f t function, f u n c t i o n , system s y s t e m and a n d item i t e m levels l e v e l s as a s well w e l l as a s validation v a l i d a t i o n of o f the t h e FHA F H A The T h e relationship r e l a t i o n s h i p of o f validation v a l i d a t i o n to t o system s y s t e m development d e v e l o p m e n t is i s shown s h o w n in i n Figure F i g u r e 5. 5 . An A n expanded e x p a n d e d validation v a l i d a t i o n process p r o c e s s model m o d e l is i s shown s h o w n in i n Figure F i g u r e 12. 1 2 . Inputs I n p u t s to t o the t h e validation v a l i d a t i o n process p r o c e s s may m a y include i n c l u d e a a description d e s c r i p t i o n of o f the t h e system s y s t e m (including ( i n c l u d i n g the t h e operating o p e r a t i n g environment), e n v i r o n m e n t ) , the t h e system s y s t e m requirements, r e q u i r e m e n t s , a a definition d e f i n i t i o n of o f system s y s t e m architecture, a r c h i t e c t u r e , and a n d the t h e development d e v e l o p m e n t assurance a s s u r a n c e level. l e v e l . - - I I I I I I I I I I I I I I I I I I I I I I I I Ji J i DESIGN D E S I G N PROCESS P R O C E S S a a I I VALIDATION V A L I D A T I O N PLAN P L A N - - ------ - - - - - - 5.4.7.1 5 . 4 . 7 . 1 -- - - MATRIX M A T R I X (INITIAL) ( I N I T I A L ) ,, , , CORRECTNESS C O R R E C T N E S S & & COMPLETENESS C O M P L E T E N E S S CHECKS C H E C K S 5.4.3 5 . 4 . 3 & & 5.4.4 5 . 4 . 4 MATRIX M A T R I X 5.4.7.2 5 . 4 . 7 . 2 5.4.7.2 5 . 4 . 7 . 2 (FINAL)....... ( F I N A L ) . . . . . . . VALIDATION V A L I D A T I O N SUMMARY S U M M A R Y 5.4.7.3 5 . 4 . 7 . 3 j j I I h h •• • • I I ASSUMPTIONS A S S U M P T I O N S CUSTOMER/CERTIFICATI C U S T O M E R / C E R T I F I C A T I ON O N REQUIREMENTS, R E Q U I R E M E N T S , INDUSTRY I N D U S T R Y STANDARDS S T A N D A R D S _J _ J - - VALIDATION V A L I D A T I O N RIGOR R I G O R 5.4.5 5 . 4 . 5 EXPERIENCE E X P E R I E N C E DEVELOPMENT D E V E L O P M E N T BASED B A S E D PROCESS P R O C E S S DATA D A T A VALIDATION V A L I D A T I O N PROCESS P R O C E S S ARP4754 A R P 4 7 5 4 FIG F I G Sll/2009 S l l / 2 0 0 9 KNOWLEDGE K N O W L E D G E FIGURE F I G U R E 12 1 2 - - VALIDATION V A L I D A T I O N PROCESS P R O C E S S MODEL M O D E L An A n overview o v e r v i e w of o f the t h e requirements r e q u i r e m e n t s validation v a l i d a t i o n process p r o c e s s is i s outlined o u t l i n e d below. b e l o w . These T h e s e processes p r o c e s s e s may m a y be b e used u s e d for f o r validation v a l i d a t i o n at a t the t h e various v a r i o u s hierarchical h i e r a r c h i c a l levels. l e v e l s . These T h e s e processes p r o c e s s e s may m a y be b e used u s e d to t o support s u p p o r t certification c e r t i f i c a t i o n . . a. a . Validation V a l i d a t i o n Plan: P l a n : The T h e validation v a l i d a t i o n plan p l a n should s h o u l d define d e f i n e the t h e specific s p e c i f i c methods m e t h o d s to t o be b e used u s e d for f o r validation v a l i d a t i o n of o f requirements, r e q u i r e m e n t s , data d a t a that t h a t will w i l l be b e collected, c o l l e c t e d , data d a t a storage s t o r a g e requirements, r e q u i r e m e n t s , and a n d validation v a l i d a t i o n schedule. s c h e d u l e . (Additional ( A d d i t i o n a l information i n f o r m a t i o n on o n validation v a l i d a t i o n planning p l a n n i n g is i s provided p r o v i d e d in i n 5.4.7.1 5 . 4 . 7 . 1 and a n d 5.4.6). 5 . 4 . 6 ) . granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true} Downloaded D o w n l o a d e d from f r o m SAE S A E International I n t e r n a t i o n a l by b y David D a v i d Merrill, M e r r i l l , Saturday, S a t u r d a y , November N o v e m b e r 12, 1 2 , 2016 2 0 1 6 SAE S A E ARP4754A A R P 4 7 5 4 A Page P a g e 57 5 7 of o f 115 1 1 5 b. b . Determination D e t e r m i n a t i o n of o f Validation V a l i d a t i o n Rigor: R i g o r : Once O n c e the t h e development d e v e l o p m e n t assurance a s s u r a n c e levels l e v e l s have h a v e been b e e n assigned a s s i g n e d and a n d validated v a l i d a t e d by b y the t h e safety s a f e t y assessment a s s e s s m e n t processes, p r o c e s s e s , the t h e necessary n e c e s s a r y rigor r i g o r of o f validation v a l i d a t i o n is i s then t h e n applied a p p l i e d to t o the t h e requirement r e q u i r e m e n t (see ( s e e 5.4.5). 5 . 4 . 5 ) . c. c . Correctness C o r r e c t n e s s and a n d Completeness C o m p l e t e n e s s Checks: C h e c k s : Correctness C o r r e c t n e s s is i s the t h e degree d e g r e e to t o which w h i c h an a n individual i n d i v i d u a l requirement r e q u i r e m e n t is i s unambiguous, u n a m b i g u o u s , verifiable, v e r i f i a b l e , consistent c o n s i s t e n t with w i t h other o t h e r requirements r e q u i r e m e n t s and a n d necessary n e c e s s a r y for f o r the t h e requirement r e q u i r e m e n t set. s e t . Completeness C o m p l e t e n e s s is i s the t h e degree d e g r e e to t o which w h i c h a a set s e t of o f correct c o r r e c t requirements, r e q u i r e m e n t s , when w h e n met m e t by b y a a system, s y s t e m , satisfy s a t i s f y the t h e interests i n t e r e s t s of o f customers, c u s t o m e r s , users, u s e r s , maintainers, m a i n t a i n e r s , certification c e r t i f i c a t i o n authorities a u t h o r i t i e s as a s well w e l l as a s aircraft, a i r c r a f t , system s y s t e m and a n d item i t e m developers d e v e l o p e r s under u n d e r all a l l modes m o d e s of o f operation o p e r a t i o n and a n d lifecycle l i f e c y c l e phases p h a s e s for f o r the t h e defined d e f i n e d operating o p e r a t i n g environment. e n v i r o n m e n t . (Additional ( A d d i t i o n a l information i n f o r m a t i o n on o n these t h e s e checks c h e c k s is i s provided p r o v i d e d in i n 5.4.3 5 . 4 . 3 and a n d 5.4.4). 5 . 4 . 4 ) . d. d . Management M a n a g e m e n t and a n d Validation V a l i d a t i o n of o f Assumptions: A s s u m p t i o n s : In I n the t h e majority m a j o r i t y of o f system s y s t e m development d e v e l o p m e n t programs, p r o g r a m s , a a number n u m b e r of o f assumptions a s s u m p t i o n s (or ( o r judgments) j u d g m e n t s ) are a r e made m a d e that t h a t are a r e not n o t directly d i r e c t l y provable p r o v a b l e at a t the t h e time t i m e the t h e information i n f o r m a t i o n is i s needed. n e e d e d . The T h e existence e x i s t e n c e of o f such s u c h assumptions a s s u m p t i o n s is i s not, n o t , by b y itself, i t s e l f , a a certification c e r t i f i c a t i o n concern, c o n c e r n , provided p r o v i d e d that t h a t the t h e consequences c o n s e q u e n c e s of o f an a n incorrect i n c o r r e c t assumption a s s u m p t i o n are a r e assessed a s s e s s e d and a n d documented. d o c u m e n t e d . However, H o w e v e r , the t h e possibilities p o s s i b i l i t i e s for f o r miscommunication m i s c o m m u n i c a t i o n about a b o u t the t h e basis b a s i s and a n d scope s c o p e of o f such s u c h assumptions a s s u m p t i o n s are a r e numerous n u m e r o u s and a n d the t h e related r e l a t e d consequences c o n s e q u e n c e s can c a n jeopardize j e o p a r d i z e satisfactory s a t i s f a c t o r y implementation i m p l e m e n t a t i o n of o f safety s a f e t y requirements. r e q u i r e m e n t s . Thus, T h u s , assumptions a s s u m p t i o n s (either ( e i t h e r explicit e x p l i c i t or o r implicit) i m p l i c i t ) should s h o u l d be b e identified i d e n t i f i e d and a n d their t h e i r reasonableness r e a s o n a b l e n e s s and a n d rationale r a t i o n a l e established e s t a b l i s h e d based b a s e d on o n the t h e specific s p e c i f i c system s y s t e m and a n d its i t s development d e v e l o p m e n t assurance a s s u r a n c e level. l e v e l . Assumptions A s s u m p t i o n s may m a y be b e used u s e d early e a r l y in i n the t h e development d e v e l o p m e n t process p r o c e s s as a s a a substitute s u b s t i t u t e for f o r more m o r e explicit e x p l i c i t knowledge k n o w l e d g e that t h a t will w i l l be b e available a v a i l a b l e later. l a t e r . Aircraft A i r c r a f t and a n d system s y s t e m development d e v e l o p m e n t is i s iterative i t e r a t i v e and a n d concurrent c o n c u r r e n t and a n d is i s not n o t only o n l y top t o p down d o w n but b u t may m a y have h a v e bottom- b o t t o m - up u p influences. i n f l u e n c e s . Also, A l s o , all a l l interfacing i n t e r f a c i n g systems s y s t e m s and a n d items i t e m s within w i t h i n the t h e system s y s t e m may m a y not n o t be b e at a t the t h e same s a m e development d e v e l o p m e n t phase p h a s e to t o support s u p p o r t the t h e system s y s t e m design d e s i g n process. p r o c e s s . Requirements R e q u i r e m e n t s may m a y have h a v e to t o be b e based b a s e d on o n assumptions a s s u m p t i o n s rather r a t h e r than t h a n on o n traceable t r a c e a b l e requirements r e q u i r e m e n t s for f o r work w o r k to t o progress p r o g r e s s on o n a a particular p a r t i c u l a r system. s y s t e m . In I n these t h e s e cases, c a s e s , validation v a l i d a t i o n consists c o n s i s t s of o f showing s h o w i n g that t h a t the t h e explicit e x p l i c i t knowledge k n o w l e d g e or o r acceptable a c c e p t a b l e rationale r a t i o n a l e was w a s indeed i n d e e d obtained o b t a i n e d and a n d that t h a t any a n y inconsistencies i n c o n s i s t e n c i e s between b e t w e e n the t h e explicit e x p l i c i t knowledge k n o w l e d g e and a n d the t h e related r e l a t e d assumption a s s u m p t i o n were w e r e resolved. r e s o l v e d . Any A n y requirements r e q u i r e m e n t s based b a s e d on o n assumed a s s u m e d parent p a r e n t requirements r e q u i r e m e n t s should s h o u l d be b e identified i d e n t i f i e d and a n d should s h o u l d be b e traced t r a c e d back. b a c k . Requirements R e q u i r e m e n t s based b a s e d on o n assumed a s s u m e d higher h i g h e r level l e v e l requirements r e q u i r e m e n t s should s h o u l d be b e resolved r e s o l v e d by b y the t h e time t i m e of o f certification c e r t i f i c a t i o n . . The T h e process p r o c e s s of o f validation v a l i d a t i o n of o f assumptions a s s u m p t i o n s focuses f o c u s e s on o n ensuring e n s u r i n g that t h a t assumptions a s s u m p t i o n s are: a r e : • • Explicitly E x p l i c i t l y stated, s t a t e d , • • Appropriately A p p r o p r i a t e l y disseminated, d i s s e m i n a t e d , • • Justified J u s t i f i e d by b y supporting s u p p o r t i n g data. d a t a . The T h e processes p r o c e s s e s used u s e d to t o validate v a l i d a t e assumptions a s s u m p t i o n s may m a y include: i n c l u d e : reviews, r e v i e w s , analyses, a n a l y s e s , and a n d tests. t e s t s . Where W h e r e the t h e consequences c o n s e q u e n c e s of o f an a n erroneous e r r o n e o u s assumption a s s u m p t i o n appear a p p e a r to t o have h a v e significant s i g n i f i c a n t potential p o t e n t i a l to t o reduce r e d u c e safety, s a f e t y , one o n e possible p o s s i b l e validation v a l i d a t i o n strategy s t r a t e g y consists c o n s i s t s of o f showing s h o w i n g how h o w the t h e system s y s t e m design, d e s i g n , in i n fact, f a c t , limits l i m i t s or o r bounds b o u n d s the t h e achievable a c h i e v a b l e consequences c o n s e q u e n c e s of o f an a n assumption a s s u m p t i o n error. e r r o r . granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true} Downloaded D o w n l o a d e d from f r o m SAE S A E International I n t e r n a t i o n a l by b y David D a v i d Merrill, M e r r i l l , Saturday, S a t u r d a y , November N o v e m b e r 12, 1 2 , 2016 2 0 1 6 SAE S A E ARP4754A A R P 4 7 5 4 A Page P a g e 58 5 8 of o f 115 1 1 5 The T h e remainder r e m a i n d e r of o f this t h i s section s e c t i o n provides p r o v i d e s guidance g u i d a n c e for f o r identifying i d e n t i f y i n g and a n d judging j u d g i n g the t h e reasonableness r e a s o n a b l e n e s s of o f assumptions. a s s u m p t i o n s . To T o facilitate f a c i l i t a t e this t h i s purpose, p u r p o s e , assumptions a s s u m p t i o n s are a r e categorized c a t e g o r i z e d below. b e l o w . Operational O p e r a t i o n a l I I environmental e n v i r o n m e n t a l assumptions a s s u m p t i o n s associated a s s o c i a t e d with w i t h air a i r traffic, t r a f f i c , maintenance, m a i n t e n a n c e , cargo, c a r g o , personnel, p e r s o n n e l , flight f l i g h t dynamics, d y n a m i c s , ATC A T C systems, s y s t e m s , performance, p e r f o r m a n c e , operational o p e r a t i o n a l procedures p r o c e d u r e s and a n d passengers p a s s e n g e r s (e.g. ( e . g . exposure e x p o s u r e times, t i m e s , traffic t r a f f i c densities, d e n s i t i e s , maintenance m a i n t e n a n c e intervals, i n t e r v a l s , performance p e r f o r m a n c e limitations) l i m i t a t i o n s ) should s h o u l d be b e considered. c o n s i d e r e d . Frequently F r e q u e n t l y it i t is i s difficult d i f f i c u l t or o r not n o t possible p o s s i b l e to t o agree a g r e e on o n the t h e requirements r e q u i r e m e n t s with w i t h the t h e primary p r i m a r y owners o w n e r s of o f these t h e s e systems. s y s t e m s . This T h i s may m a y require r e q u i r e the t h e aircraft a i r c r a f t designer d e s i g n e r to t o make m a k e assumptions a s s u m p t i o n s about a b o u t the t h e operational o p e r a t i o n a l context. c o n t e x t . Other O t h e r individuals, i n d i v i d u a l s , or o r documents d o c u m e n t s and/or a n d / o r standards, s t a n d a r d s , may m a y act a c t on o n behalf b e h a l f of o f these t h e s e system s y s t e m owners o w n e r s when w h e n agreeing a g r e e i n g on o n the t h e operational o p e r a t i o n a l context. c o n t e x t . For F o r example, e x a m p l e , the t h e regulatory r e g u l a t o r y authorities a u t h o r i t i e s may m a y represent r e p r e s e n t the t h e interests i n t e r e s t s of o f the t h e air a i r traffic t r a f f i c control c o n t r o l system s y s t e m not n o t only o n l y in i n regulation r e g u l a t i o n but b u t also a l s o agreeing a g r e e i n g on o n an a n assumption a s s u m p t i o n about a b o u t the t h e level l e v e l of o f traffic t r a f f i c density. d e n s i t y . Design D e s i g n assumptions a s s u m p t i o n s associated a s s o c i a t e d with w i t h Crew C r e w interface, i n t e r f a c e , system s y s t e m interface i n t e r f a c e and a n d reliability r e l i a b i l i t y should s h o u l d be b e considered. c o n s i d e r e d . Accepting A c c e p t i n g assumptions a s s u m p t i o n s in i n this t h i s area a r e a may m a y be b e accomplished a c c o m p l i s h e d by b y review r e v i e w against a g a i n s t existing e x i s t i n g industry i n d u s t r y experience e x p e r i e n c e and a n d practice. p r a c t i c e . • • The T h e crew c r e w interface i n t e r f a c e assumptions a s s u m p t i o n s may m a y include i n c l u d e the t h e interaction i n t e r a c t i o n of o f the t h e crew c r e w with w i t h the t h e equipment e q u i p m e n t and a n d the t h e operational o p e r a t i o n a l environment e n v i r o n m e n t under u n d e r normal n o r m a l and a n d emergency e m e r g e n c y conditions, c o n d i t i o n s , crew c r e w member m e m b e r performance p e r f o r m a n c e characteristics c h a r a c t e r i s t i c s (e.g., ( e . g . , response r e s p o n s e times, t i m e s , display d i s p l a y interpretation, i n t e r p r e t a t i o n , physical p h y s i c a l limitations), l i m i t a t i o n s ) , and a n d crew c r e w interaction. i n t e r a c t i o n . Some S o m e examples e x a m p l e s of o f assumptions a s s u m p t i o n s about a b o u t the t h e crew c r e w interface i n t e r f a c e are: a r e : crew c r e w response r e s p o n s e times t i m e s to t o various v a r i o u s types t y p e s of o f messages, m e s s a g e s , event e v e n t recognition r e c o g n i t i o n times t i m e s (e.g., ( e . g . , recognition r e c o g n i t i o n of o f hardovers), h a r d o v e r s ) , decision d e c i s i o n making m a k i n g strategies, s t r a t e g i e s , the t h e discrimination d i s c r i m i n a t i o n accuracy a c c u r a c y on o n the t h e basis b a s i s of o f physical p h y s i c a l shape, s h a p e , visual v i s u a l form, f o r m , color, c o l o r , or o r dynamic d y n a m i c performance. p e r f o r m a n c e . • • System S y s t e m interface i n t e r f a c e assumptions a s s u m p t i o n s may m a y address a d d r e s s issues i s s u e s associated a s s o c i a t e d with w i t h the t h e meaning m e a n i n g or o r logical l o g i c a l interpretation i n t e r p r e t a t i o n of o f the t h e data d a t a exchanged e x c h a n g e d (e.g., ( e . g . , format, f o r m a t , integrity, i n t e g r i t y , latency, l a t e n c y , resolution) r e s o l u t i o n ) or o r they t h e y may m a y focus f o c u s on o n the t h e physical p h y s i c a l characteristics c h a r a c t e r i s t i c s of o f the t h e data d a t a signal s i g n a l (e.g., ( e . g . , voltage v o l t a g e levels, l e v e l s , impedance, i m p e d a n c e , signal s i g n a l to t o noise n o i s e ratio). r a t i o ) . Some S o m e examples e x a m p l e s of o f assumptions a s s u m p t i o n s about a b o u t the t h e system s y s t e m interface i n t e r f a c e include i n c l u d e the t h e probability p r o b a b i l i t y of o f misreads m i s r e a d s of o f data d a t a bus b u s information, i n f o r m a t i o n , correct c o r r e c t processing p r o c e s s i n g of o f fault f a u l t data d a t a by b y all a l l related r e l a t e d interfacing i n t e r f a c i n g systems, s y s t e m s , fault f a u l t containment, c o n t a i n m e n t , and a n d characteristics c h a r a c t e r i s t i c s of o f incorrect i n c o r r e c t inputs. i n p u t s . • • Reliability R e l i a b i l i t y topics t o p i c s for f o r which w h i c h assumptions a s s u m p t i o n s are a r e often o f t e n made m a d e may m a y include: i n c l u d e : the t h e adequacy a d e q u a c y of o f failure f a i l u r e rate r a t e modeling m o d e l i n g over o v e r the t h e life l i f e cycle, c y c l e , dispatch d i s p a t c h inoperative i n o p e r a t i v e considerations, c o n s i d e r a t i o n s , the t h e adequacy a d e q u a c y of o f scheduled s c h e d u l e d maintenance m a i n t e n a n c e tasks t a s k s and a n d their t h e i r frequency, f r e q u e n c y , the t h e adequacy a d e q u a c y of o f parts p a r t s derating, d e r a t i n g , consideration c o n s i d e r a t i o n of o f potential p o t e n t i a l failure f a i l u r e latency l a t e n c y and a n d exposure e x p o s u r e periods, p e r i o d s , the t h e completeness c o m p l e t e n e s s of o f the t h e failure f a i l u r e modes m o d e s analysis, a n a l y s i s , the t h e adequacy a d e q u a c y of o f test t e s t data d a t a to t o establish e s t a b l i s h or o r demonstrate d e m o n s t r a t e MTBF M T B F predictions p r e d i c t i o n s and a n d the t h e applicability a p p l i c a b i l i t y of o f in-service i n - s e r v i c e proven p r o v e n parts. p a r t s . Serviceability S e r v i c e a b i l i t y assumptions a s s u m p t i o n s usually u s u a l l y assume a s s u m e that t h a t provisions p r o v i s i o n s for f o r service s e r v i c e and a n d repair r e p a i r do d o not n o t degrade d e g r a d e safety. s a f e t y . This T h i s assumption a s s u m p t i o n may m a y be b e validated v a l i d a t e d by b y review r e v i e w of o f service s e r v i c e and a n d maintenance m a i n t e n a n c e procedures, p r o c e d u r e s , and a n d associated a s s o c i a t e d equipment. e q u i p m e n t . Installation I n s t a l l a t i o n assumptions a s s u m p t i o n s (e.g. ( e . g . separation, s e p a r a t i o n , isolation, i s o l a t i o n , cable c a b l e binding, b i n d i n g , wire w i r e sizing, s i z i n g , environment, e n v i r o n m e n t , power p o w e r hook-up, h o o k - u p , circuit c i r c u i t breaker b r e a k e r sizing, s i z i n g , ventilation, v e n t i l a t i o n , drainage, d r a i n a g e , sources s o u r c e s of o f contamination, c o n t a m i n a t i o n , mount m o u n t integrity, i n t e g r i t y , grounding g r o u n d i n g and a n d shielding) s h i e l d i n g ) should s h o u l d be b e considered. c o n s i d e r e d . Validating V a l i d a t i n g assumptions a s s u m p t i o n s in i n this t h i s area a r e a may m a y be b e accomplished a c c o m p l i s h e d by b y review r e v i e w against a g a i n s t industry i n d u s t r y standards s t a n d a r d s and a n d practice, p r a c t i c e , selective s e l e c t i v e testing t e s t i n g and/or a n d / o r inspections i n s p e c t i o n s of o f mockup, m o c k u p , prototype, p r o t o t y p e , or o r production p r o d u c t i o n drawings/hardware d r a w i n g s / h a r d w a r e . . The T h e means m e a n s of o f managing m a n a g i n g assumptions a s s u m p t i o n s during d u r i n g the t h e design d e s i g n process p r o c e s s should s h o u l d be b e defined d e f i n e d in i n the t h e validation v a l i d a t i o n plan. p l a n . e. e . Validation V a l i d a t i o n Matrix: M a t r i x : The T h e validation v a l i d a t i o n process p r o c e s s includes i n c l u d e s preparation p r e p a r a t i o n of o f a a validation v a l i d a t i o n matrix m a t r i x (see ( s e e 5.4.7.2) 5 . 4 . 7 . 2 ) that t h a t references r e f e r e n c e s requirements r e q u i r e m e n t s and a n d validation v a l i d a t i o n results, r e s u l t s , including, i n c l u d i n g , as a s appropriate, a p p r o p r i a t e , those t h o s e for f o r hardware/software h a r d w a r e / s o f t w a r e performance, p e r f o r m a n c e , derived d e r i v e d requirements, r e q u i r e m e n t s , environmental e n v i r o n m e n t a l and a n d operational o p e r a t i o n a l considerations, c o n s i d e r a t i o n s , requirements r e q u i r e m e n t s based b a s e d on o n assumptions a s s u m p t i o n s and a n d supporting s u p p o r t i n g data. d a t a . The T h e source s o u r c e of o f each e a c h requirement r e q u i r e m e n t should s h o u l d be b e identifiable. i d e n t i f i a b l e . This T h i s matrix m a t r i x should s h o u l d be b e updated u p d a t e d regularly r e g u l a r l y during d u r i n g the t h e development d e v e l o p m e n t and a n d included i n c l u d e d in i n the t h e validation v a l i d a t i o n summary s u m m a r y . . f. f . Validation V a l i d a t i o n Summary: S u m m a r y : Data D a t a describing d e s c r i b i n g the t h e process, p r o c e s s , as a s well w e l l as a s the t h e results. r e s u l t s . (see ( s e e 5.4.7.3). 5 . 4 . 7 . 3 ) . granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true} Downloaded D o w n l o a d e d from f r o m SAE S A E International I n t e r n a t i o n a l by b y David D a v i d Merrill, M e r r i l l , Saturday, S a t u r d a y , November N o v e m b e r 12, 1 2 , 2016 2 0 1 6 SAE S A E ARP4754A A R P 4 7 5 4 A Page P a g e 59 5 9 of o f 115 1 1 5 5.4.3 5 . 4 . 3 Correctness C o r r e c t n e s s Checks C h e c k s During D u r i n g the t h e validation v a l i d a t i o n process p r o c e s s both b o t h the t h e correctness c o r r e c t n e s s of o f Failure F a i l u r e Condition C o n d i t i o n classification c l a s s i f i c a t i o n and a n d the t h e correctness c o r r e c t n e s s of o f the t h e stated s t a t e d requirements r e q u i r e m e n t s content c o n t e n t should s h o u l d be b e reviewed r e v i e w e d and a n d justified j u s t i f i e d . . Correctness C o r r e c t n e s s checks c h e c k s should s h o u l d be b e carried c a r r i e d out o u t at a t each e a c h level l e v e l of o f the t h e requirements r e q u i r e m e n t s hierarchy. h i e r a r c h y . The T h e following f o l l o w i n g questions q u e s t i o n s may m a y help h e l p assess a s s e s s correctness c o r r e c t n e s s of o f requirements. r e q u i r e m e n t s . This T h i s list l i s t should s h o u l d be b e tailored t a i l o r e d and a n d expanded e x p a n d e d for f o r the t h e specific s p e c i f i c application. a p p l i c a t i o n . a. a . Is I s the t h e requirement r e q u i r e m e n t correctly c o r r e c t l y stated? s t a t e d ? (e.g.) ( e . g . ) (1) ( 1 ) Does D o e s the t h e requirement r e q u i r e m e n t have h a v e a a unique u n i q u e interpretation i n t e r p r e t a t i o n (unambiguous)? ( u n a m b i g u o u s ) ? (2) ( 2 ) Is I s it i t identifiable i d e n t i f i a b l e as a s a a requirement? r e q u i r e m e n t ? (3) ( 3 ) Is I s the t h e requirement r e q u i r e m e n t redundant? r e d u n d a n t ? (4) ( 4 ) Does D o e s the t h e requirement r e q u i r e m e n t conflict c o n f l i c t with w i t h others? o t h e r s ? (5) ( 5 ) Does D o e s the t h e requirement r e q u i r e m e n t contain c o n t a i n errors e r r o r s of o f fact? f a c t ? (6) ( 6 ) Is I s it i t physically p h y s i c a l l y possible p o s s i b l e to t o meet m e e t the t h e requirement? r e q u i r e m e n t ? (7) ( 7 ) Is I s the t h e statement s t a t e m e n t of o f the t h e requirement r e q u i r e m e n t expressed, e x p r e s s e d , where w h e r e possible, p o s s i b l e , in i n terms t e r m s of o f what, w h a t , when, w h e n , and a n d "how " h o w well", w e l l " , rather r a t h e r than t h a n "how " h o w to"? t o " ? (8) ( 8 ) Is I s there t h e r e enough e n o u g h information i n f o r m a t i o n available a v a i l a b l e to t o allow a l l o w a a future f u t u r e change c h a n g e to t o be b e made m a d e completely c o m p l e t e l y and a n d consistently c o n s i s t e n t l y with w i t h visibility v i s i b i l i t y to t o the t h e impact i m p a c t on o n those t h o s e with w i t h an a n interest i n t e r e s t in i n or o r interface i n t e r f a c e with w i t h the t h e system? s y s t e m ? (9) ( 9 ) Does D o e s the t h e requirement r e q u i r e m e n t include i n c l u d e specific s p e c i f i c tolerances? t o l e r a n c e s ? (10) ( 1 0 ) Is I s the t h e requirement r e q u i r e m e n t verifiable v e r i f i a b l e as a s described d e s c r i b e d in i n section s e c t i o n 5.5? 5 . 5 ? (11) ( 1 1 ) If I f it i t is i s a a derived d e r i v e d requirement r e q u i r e m e n t is i s it i t supported s u p p o r t e d by b y a a rationale? r a t i o n a l e ? (12) ( 1 2 ) Is I s the t h e source(s) s o u r c e ( s ) of o f the t h e requirement r e q u i r e m e n t identified i d e n t i f i e d and a n d correct? c o r r e c t ? (13) ( 1 3 ) Does D o e s the t h e requirement r e q u i r e m e n t contain c o n t a i n multiple m u l t i p l e characteristics c h a r a c t e r i s t i c s that t h a t may m a y be b e better b e t t e r listed l i s t e d as a s separate s e p a r a t e requirements? r e q u i r e m e n t s ? b. b . Is I s the t h e requirement r e q u i r e m e n t necessary n e c e s s a r y for f o r the t h e requirements r e q u i r e m e n t s set s e t to t o be b e complete? c o m p l e t e ? c. c . Is I s the t h e requirement r e q u i r e m e n t set s e t better b e t t e r suited s u i t e d to t o be b e combined c o m b i n e d into i n t o a a single s i n g l e requirement? r e q u i r e m e n t ? d. d . Does D o e s the t h e requirement r e q u i r e m e n t set s e t correctly c o r r e c t l y reflect r e f l e c t the t h e safety s a f e t y analyses? a n a l y s e s ? (1) ( 1 ) Are A r e all a l l derived d e r i v e d requirements r e q u i r e m e n t s from f r o m safety s a f e t y assessments a s s e s s m e n t s included? i n c l u d e d ? (2) ( 2 ) Are A r e all a l l system s y s t e m failure f a i l u r e conditions c o n d i t i o n s identified i d e n t i f i e d and a n d classified c l a s s i f i e d correctly? c o r r e c t l y ? (3) ( 3 ) Is I s the t h e impact i m p a c t of o f unsafe u n s a f e design d e s i g n or o r design d e s i g n errors e r r o r s considered? c o n s i d e r e d ? (4) ( 4 ) Are A r e reliability, r e l i a b i l i t y , availability a v a i l a b i l i t y , , and a n d fault f a u l t tolerance t o l e r a n c e requirements r e q u i r e m e n t s included? i n c l u d e d ? granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true} Downloaded D o w n l o a d e d from f r o m SAE S A E International I n t e r n a t i o n a l by b y David D a v i d Merrill, M e r r i l l , Saturday, S a t u r d a y , November N o v e m b e r 12, 1 2 , 2016 2 0 1 6 SAE S A E ARP4754A A R P 4 7 5 4 A Page P a g e 60 6 0 of o f 115 1 1 5 5.4.4 5 . 4 . 4 Completeness C o m p l e t e n e s s Checks C h e c k s The T h e completeness c o m p l e t e n e s s of o f a a set s e t of o f requirements r e q u i r e m e n t s by b y its i t s nature n a t u r e may m a y be b e difficult d i f f i c u l t to t o prove. p r o v e . As A s a a basis b a s i s for f o r performing p e r f o r m i n g a a completeness c o m p l e t e n e s s check c h e c k of o f requirements, r e q u i r e m e n t s , it i t is i s possible p o s s i b l e to t o use u s e the t h e list l i s t of o f possible p o s s i b l e types t y p e s of o f requirements r e q u i r e m e n t s (see ( s e e 5.3.1). 5 . 3 . 1 ) . Individuals I n d i v i d u a l s with w i t h a a generally g e n e r a l l y stated s t a t e d need n e e d for f o r the t h e system s y s t e m may m a y have h a v e unstated u n s t a t e d or o r unanticipated u n a n t i c i p a t e d specific s p e c i f i c needs n e e d s and a n d expectations. e x p e c t a t i o n s . Completeness C o m p l e t e n e s s is i s viewed v i e w e d as a s a a probable p r o b a b l e outcome o u t c o m e of o f following f o l l o w i n g a a validation v a l i d a t i o n process p r o c e s s that t h a t may m a y include i n c l u d e a a combination c o m b i n a t i o n of o f templates t e m p l a t e s and a n d checklists, c h e c k l i s t s , as a s well w e l l as a s the t h e involvement i n v o l v e m e n t of o f actual a c t u a l customers, c u s t o m e r s , users, u s e r s , maintainers, m a i n t a i n e r s , certification c e r t i f i c a t i o n authorities a u t h o r i t i e s and a n d developers. d e v e l o p e r s . The T h e specific s p e c i f i c validation v a l i d a t i o n process p r o c e s s for f o r assessing a s s e s s i n g completeness c o m p l e t e n e s s should s h o u l d be b e defined d e f i n e d in i n the t h e validation v a l i d a t i o n plan p l a n (see ( s e e 5.4.7.1). 5 . 4 . 7 . 1 ) . 5.4.4.1 5 . 4 . 4 . 1 Templates T e m p l a t e s and a n d Checklists C h e c k l i s t s A A template t e m p l a t e in i n the t h e form f o r m of o f a a standard s t a n d a r d specification s p e c i f i c a t i o n format, f o r m a t , based b a s e d on o n lessons l e s s o n s learned, l e a r n e d , may m a y reveal r e v e a l omissions o m i s s i o n s and a n d help h e l p prevent p r e v e n t incomplete i n c o m p l e t e requirements. r e q u i r e m e n t s . Checklists C h e c k l i s t s may m a y be b e used u s e d by b y authors a u t h o r s and a n d reviewers r e v i e w e r s for f o r completeness c o m p l e t e n e s s checks. c h e c k s . The T h e checklist c h e c k l i s t should s h o u l d cover c o v e r all a l l areas a r e a s that t h a t have h a v e a a primary p r i m a r y interest i n t e r e s t in i n the t h e system s y s t e m and a n d their t h e i r applicable a p p l i c a b l e interfaces i n t e r f a c e s to t o insure i n s u r e that t h a t their t h e i r needs n e e d s and a n d expectations e x p e c t a t i o n s will w i l l be b e satisfied. s a t i s f i e d . The T h e following f o l l o w i n g material m a t e r i a l provides p r o v i d e s assistance a s s i s t a n c e in i n developing d e v e l o p i n g checklist c h e c k l i s t questions q u e s t i o n s for f o r assessing a s s e s s i n g the t h e completeness c o m p l e t e n e s s at a t each e a c h hierarchical h i e r a r c h i c a l level l e v e l of o f requirements. r e q u i r e m e n t s . This T h i s list l i s t should s h o u l d be b e tailored t a i l o r e d for f o r the t h e specific s p e c i f i c application. a p p l i c a t i o n . a. a . Is I s it i t apparent a p p a r e n t from f r o m the t h e traceability t r a c e a b i l i t y and a n d supporting s u p p o r t i n g rationale r a t i o n a l e that t h a t the t h e requirement(s) r e q u i r e m e n t ( s ) will w i l l satisfy s a t i s f y the t h e parent p a r e n t requirement? r e q u i r e m e n t ? b. b . Are A r e all a l l owners o w n e r s of o f interfacing i n t e r f a c i n g systems s y s t e m s or o r processes p r o c e s s e s represented r e p r e s e n t e d in i n the t h e systems s y s t e m s requirements r e q u i r e m e n t s set? s e t ? (1) ( 1 ) All A l l Higher H i g h e r level l e v e l functions f u n c t i o n s allocated a l l o c a t e d to t o this t h i s system s y s t e m fully f u l l y covered. c o v e r e d . (2) ( 2 ) Safety S a f e t y requirements r e q u i r e m e n t s represented r e p r e s e n t e d (3) ( 3 ) Regulatory R e g u l a t o r y standards s t a n d a r d s and a n d guidance g u i d a n c e represented r e p r e s e n t e d (4) ( 4 ) Industry I n d u s t r y and a n d company c o m p a n y design d e s i g n standards s t a n d a r d s represented r e p r e s e n t e d (5) ( 5 ) Flight F l i g h t operations o p e r a t i o n s and a n d maintenance m a i n t e n a n c e scenarios s c e n a r i o s represented r e p r e s e n t e d c. c . Are A r e all a l l interfaces i n t e r f a c e s to t o other o t h e r systems, s y s t e m s , people p e o p l e and a n d processes p r o c e s s e s identified? i d e n t i f i e d ? d. d . Are A r e the t h e constraints c o n s t r a i n t s (e.g. ( e . g . protocol, p r o t o c o l , mounting m o u n t i n g configuration, c o n f i g u r a t i o n , and a n d timing) t i m i n g ) associated a s s o c i a t e d with w i t h each e a c h interface i n t e r f a c e defined d e f i n e d in i n sufficient s u f f i c i e n t detail d e t a i l for f o r the t h e interface i n t e r f a c e to t o be b e realized? r e a l i z e d ? e. e . Are A r e the t h e system, s y s t e m , people p e o p l e or o r process p r o c e s s behaviors b e h a v i o r s that t h a t result r e s u l t from f r o m an a n interface, i n t e r f a c e , agreed a g r e e d to t o and a n d captured c a p t u r e d as a s requirements r e q u i r e m e n t s on o n both b o t h sides s i d e s of o f the t h e interface? i n t e r f a c e ? For F o r example e x a m p l e an a n engine e n g i n e system s y s t e m may m a y provide p r o v i d e data d a t a to t o a a flight f l i g h t display d i s p l a y system. s y s t e m . How H o w that t h a t data d a t a is i s used u s e d in i n the t h e flight f l i g h t display d i s p l a y system s y s t e m and a n d how h o w the t h e crew c r e w may m a y respond r e s p o n d to t o that t h a t data d a t a should s h o u l d be b e agreed a g r e e d to t o as a s an a n interface i n t e r f a c e requirement r e q u i r e m e n t with w i t h the t h e engine e n g i n e control c o n t r o l system s y s t e m owner. o w n e r . Another A n o t h e r example e x a m p l e is i s the t h e flight f l i g h t crews c r e w s input i n p u t to t o the t h e throttle, t h r o t t l e , the t h e throttles t h r o t t l e s input i n p u t to t o the t h e engine e n g i n e which w h i c h results r e s u l t s in i n engine e n g i n e thrust t h r u s t behavior. b e h a v i o r . The T h e expected e x p e c t e d thrust t h r u s t behavior b e h a v i o r should s h o u l d be b e agreed a g r e e d to t o and a n d captured c a p t u r e d as a s requirements r e q u i r e m e n t s with w i t h the t h e flight f l i g h t crew c r e w or o r those t h o s e that t h a t represent r e p r e s e n t flight f l i g h t crews c r e w s in i n general. g e n e r a l . f. f . For F o r a a required r e q u i r e d behavior, b e h a v i o r , should s h o u l d there t h e r e be b e an a n associated a s s o c i a t e d prohibited p r o h i b i t e d behavior b e h a v i o r defined d e f i n e d and a n d if i f yes, y e s , is i s the t h e prohibited p r o h i b i t e d behavior b e h a v i o r defined? d e f i n e d ? g. g . Is I s the t h e functional f u n c t i o n a l requirements r e q u i r e m e n t s set s e t fully f u l l y allocated a l l o c a t e d and a n d traced t r a c e d to t o the t h e system s y s t e m architecture? a r c h i t e c t u r e ? h. h . Does D o e s the t h e functional f u n c t i o n a l allocation a l l o c a t i o n clearly c l e a r l y allocate a l l o c a t e between b e t w e e n electronic e l e c t r o n i c hardware h a r d w a r e and a n d software s o f t w a r e in i n the t h e system s y s t e m architecture? a r c h i t e c t u r e ? i. i . Are A r e assumptions a s s u m p t i o n s adequately a d e q u a t e l y defined d e f i n e d and a n d addressed? a d d r e s s e d ? granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true} Downloaded D o w n l o a d e d from f r o m SAE S A E International I n t e r n a t i o n a l by b y David D a v i d Merrill, M e r r i l l , Saturday, S a t u r d a y , November N o v e m b e r 12, 1 2 , 2016 2 0 1 6 SAE S A E ARP4754A A R P 4 7 5 4 A Page P a g e 61 6 1 of o f 115 1 1 5 5.4.4.2 5 . 4 . 4 . 2 User, U s e r , Operator O p e r a t o r and a n d Maintainer M a i n t a i n e r Involvement I n v o l v e m e n t One O n e of o f the t h e difficulties d i f f i c u l t i e s in i n achieving a c h i e v i n g a a complete c o m p l e t e set s e t of o f requirements r e q u i r e m e n t s is i s users u s e r s don't d o n ' t always a l w a y s know k n o w what w h a t behaviors b e h a v i o r s they t h e y do d o or o r don't d o n ' t want w a n t from f r o m a a system. s y s t e m . This T h i s is i s particularly p a r t i c u l a r l y true t r u e with w i t h new n e w or o r novel n o v e l features. f e a t u r e s . There T h e r e are a r e a a number n u m b e r of o f means m e a n s of o f eliciting e l i c i t i n g requirements r e q u i r e m e n t s from f r o m users. u s e r s . The T h e early e a r l y capture c a p t u r e of o f operation o p e r a t i o n and a n d maintenance m a i n t e n a n c e scenarios s c e n a r i o s as a s well w e l l as a s prototyping p r o t o t y p i n g are a r e example e x a m p l e means m e a n s of o f eliciting e l i c i t i n g requirements. r e q u i r e m e n t s . These T h e s e are a r e not n o t proposed p r o p o s e d as a s the t h e best b e s t means m e a n s but b u t are a r e suggested s u g g e s t e d as a s ways w a y s that t h a t have h a v e been b e e n beneficial b e n e f i c i a l in i n identifying i d e n t i f y i n g missing m i s s i n g requirements r e q u i r e m e n t s (see ( s e e 5.3). 5 . 3 ) . a. a . Operation O p e r a t i o n and a n d Maintenance M a i n t e n a n c e Scenarios S c e n a r i o s An A n effective e f f e c t i v e means m e a n s of o f identifying i d e n t i f y i n g missing m i s s i n g requirements r e q u i r e m e n t s early e a r l y in i n the t h e design d e s i g n process p r o c e s s is i s writing w r i t i n g down d o w n scenarios s c e n a r i o s of o f how h o w a a system s y s t e m should s h o u l d function f u n c t i o n to t o accomplish a c c o m p l i s h a a desired d e s i r e d goal g o a l in i n response r e s p o n s e to t o inputs i n p u t s from f r o m users u s e r s of o f that t h a t system. s y s t e m . One O n e example e x a m p l e of o f how h o w scenarios s c e n a r i o s may m a y be b e used u s e d is i s to t o define d e f i n e the t h e procedures p r o c e d u r e s for f o r the t h e operating o p e r a t i n g and a n d maintenance m a i n t e n a n c e manuals m a n u a l s early e a r l y in i n the t h e development d e v e l o p m e n t process. p r o c e s s . This T h i s provides p r o v i d e s visibility v i s i b i l i t y of o f how h o w the t h e system s y s t e m is i s proposed p r o p o s e d to t o work w o r k in i n different d i f f e r e n t operational o p e r a t i o n a l scenarios s c e n a r i o s to t o users u s e r s that t h a t interact i n t e r a c t with w i t h the t h e system. s y s t e m . Such S u c h visibility v i s i b i l i t y may m a y aid a i d in i n the t h e identification i d e n t i f i c a t i o n of o f missing m i s s i n g desired d e s i r e d behaviors b e h a v i o r s or o r protection p r o t e c t i o n features f e a t u r e s that t h a t should s h o u l d be b e captured c a p t u r e d in i n the t h e scenarios s c e n a r i o s and a n d subsequently s u b s e q u e n t l y in i n the t h e requirements. r e q u i r e m e n t s . In I n such s u c h a a scenario, s c e n a r i o , the t h e user u s e r may m a y be b e another a n o t h e r system s y s t e m but b u t typically t y p i c a l l y the t h e users u s e r s are a r e people. p e o p l e . A A number n u m b e r of o f scenarios s c e n a r i o s may m a y have h a v e to t o be b e explored e x p l o r e d for f o r a a given g i v e n function f u n c t i o n to t o describe d e s c r i b e the t h e behavior b e h a v i o r under u n d e r different d i f f e r e n t conditions c o n d i t i o n s and a n d operating o p e r a t i n g modes. m o d e s . Each E a c h scenario s c e n a r i o examines e x a m i n e s a a sequence s e q u e n c e of o f steps s t e p s from f r o m the t h e users u s e r s initiating i n i t i a t i n g action, a c t i o n , through t h r o u g h each e a c h action a c t i o n step s t e p taken t a k e n by b y an a n identified i d e n t i f i e d system s y s t e m or o r person p e r s o n on o n the t h e way w a y to t o the t h e end e n d goal. g o a l . The T h e scenarios s c e n a r i o s should s h o u l d not n o t only o n l y cover c o v e r the t h e possible p o s s i b l e operating o p e r a t i n g environments e n v i r o n m e n t s and a n d operating o p e r a t i n g modes m o d e s but b u t should s h o u l d cover c o v e r anomalous a n o m a l o u s operating o p e r a t i n g conditions c o n d i t i o n s as a s well. w e l l . Possible P o s s i b l e misbehaviors m i s b e h a v i o r s would w o u l d be b e considered c o n s i d e r e d for f o r each e a c h step s t e p in i n a a scenario. s c e n a r i o . How H o w this t h i s misbehavior m i s b e h a v i o r is i s to t o be b e managed m a n a g e d or o r protected p r o t e c t e d against a g a i n s t would w o u l d be b e defined d e f i n e d and a n d may m a y itself i t s e l f be b e another a n o t h e r scenario. s c e n a r i o . Scenarios S c e n a r i o s may m a y also a l s o be b e used u s e d to t o agree a g r e e on o n the t h e functional f u n c t i o n a l allocation a l l o c a t i o n (see ( s e e 4.1.2) 4 . 1 . 2 ) as a s each e a c h interacting i n t e r a c t i n g system's s y s t e m ' s behavior b e h a v i o r is i s described d e s c r i b e d in i n each e a c h step. s t e p . The T h e pilot p i l o t starting s t a r t i n g an a n engine e n g i n e would w o u l d be b e an a n example e x a m p l e of o f a a scenario. s c e n a r i o . The T h e main m a i n scenario s c e n a r i o would w o u l d be b e to t o describe d e s c r i b e the t h e actions a c t i o n s that t h a t a a pilot p i l o t would w o u l d take t a k e to t o initiate i n i t i a t e a a start, s t a r t , the t h e subsequent s u b s e q u e n t actions a c t i o n s taken t a k e n by b y each e a c h of o f the t h e cooperating c o o p e r a t i n g systems, s y s t e m s , all a l l the t h e way w a y to t o an a n engine e n g i n e achieving a c h i e v i n g idle. i d l e . Additional A d d i t i o n a l scenarios s c e n a r i o s may m a y include i n c l u d e starter s t a r t e r assisted a s s i s t e d air a i r starts s t a r t s and a n d windmill w i n d m i l l starts. s t a r t s . Scenarios S c e n a r i o s associated a s s o c i a t e d with w i t h anomalous a n o m a l o u s conditions c o n d i t i o n s may m a y begin b e g i n with w i t h a a pilot p i l o t incorrectly i n c o r r e c t l y initiating i n i t i a t i n g a a start s t a r t and a n d how h o w the t h e cooperating c o o p e r a t i n g systems s y s t e m s are a r e to t o respond; r e s p o n d ; as a s well w e l l as a s a a possible p o s s i b l e anomaly a n o m a l y of o f the t h e engine e n g i n e stalling s t a l l i n g during d u r i n g a a start. s t a r t . The T h e stalled s t a l l e d start s t a r t may m a y be b e covered c o v e r e d by b y a a scenario s c e n a r i o that t h a t defines d e f i n e s the t h e steps s t e p s that t h a t a a system s y s t e m or o r person p e r s o n are a r e to t o take t a k e to t o secure s e c u r e the t h e engine e n g i n e start. s t a r t . There T h e r e are a r e a a number n u m b e r of o f methods m e t h o d s for f o r developing d e v e l o p i n g and a n d documenting d o c u m e n t i n g scenarios s c e n a r i o s (e.g. ( e . g . state s t a t e diagram, d i a g r a m , timeline t i m e l i n e diagrams). d i a g r a m s ) . The T h e particular p a r t i c u l a r approach a p p r o a c h is i s left l e f t to t o the t h e developer. d e v e l o p e r . b. b . Prototyping P r o t o t y p i n g or o r Modeling M o d e l i n g Prototypes P r o t o t y p e s are a r e models m o d e l s of o f the t h e desired d e s i r e d system s y s t e m that t h a t may m a y be b e hardware h a r d w a r e and/or a n d / o r software s o f t w a r e based, b a s e d , and a n d may m a y or o r may m a y not n o t be b e development d e v e l o p m e n t versions v e r s i o n s of o f the t h e system. s y s t e m . Prototypes P r o t o t y p e s permit p e r m i t users u s e r s of o f a a system s y s t e m to t o interact i n t e r a c t with w i t h a a proposed p r o p o s e d model m o d e l of o f the t h e system s y s t e m to t o uncover u n c o v e r missing m i s s i n g requirements, r e q u i r e m e n t s , behaviors b e h a v i o r s of o f the t h e system s y s t e m that t h a t should s h o u l d be b e prohibited, p r o h i b i t e d , and a n d potential p o t e n t i a l problems p r o b l e m s with w i t h user u s e r interaction. i n t e r a c t i o n . How H o w well w e l l the t h e prototype p r o t o t y p e represents r e p r e s e n t s the t h e actual a c t u a l system s y s t e m may m a y drive d r i v e the t h e likelihood l i k e l i h o o d of o f identifying i d e n t i f y i n g missing m i s s i n g requirements. r e q u i r e m e n t s . The T h e tools t o o l s used u s e d to t o create c r e a t e prototypes p r o t o t y p e s should s h o u l d minimize m i n i m i z e development d e v e l o p m e n t time. t i m e . The T h e model m o d e l should s h o u l d be b e developed d e v e l o p e d in i n a a structured s t r u c t u r e d manner. m a n n e r . For F o r example, e x a m p l e , subsets s u b s e t s of o f model m o d e l elements e l e m e n t s which w h i c h may m a y be b e used u s e d more m o r e than t h a n once o n c e may m a y be b e handled h a n d l e d and a n d represented r e p r e s e n t e d either e i t h e r as a s a a unit u n i t or o r as a s the t h e full f u l l contents. c o n t e n t s . Model M o d e l use u s e for f o r requirements r e q u i r e m e n t s validation v a l i d a t i o n typically t y p i c a l l y uses u s e s a a model m o d e l of o f the t h e environment e n v i r o n m e n t of o f a a system s y s t e m being b e i n g developed, d e v e l o p e d , which w h i c h is i s interfaced i n t e r f a c e d to t o a a prototype p r o t o t y p e of o f a a design d e s i g n solution s o l u t i o n for f o r those t h o s e requirements. r e q u i r e m e n t s . An A n environment e n v i r o n m e n t model m o d e l that t h a t is i s representative r e p r e s e n t a t i v e of o f the t h e environment e n v i r o n m e n t of o f the t h e system s y s t e m being b e i n g developed, d e v e l o p e d , provides p r o v i d e s a a high h i g h degree d e g r e e of o f functional f u n c t i o n a l coverage c o v e r a g e in i n exercising e x e r c i s i n g either e i t h e r a a simulated s i m u l a t e d or o r real r e a l system. s y s t e m . granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true} Downloaded D o w n l o a d e d from f r o m SAE S A E International I n t e r n a t i o n a l by b y David D a v i d Merrill, M e r r i l l , Saturday, S a t u r d a y , November N o v e m b e r 12, 1 2 , 2016 2 0 1 6 SAE S A E ARP4754A A R P 4 7 5 4 A Page P a g e 62 6 2 of o f 115 1 1 5 5.4.5 5 . 4 . 5 Validation V a l i d a t i o n Rigor R i g o r The T h e level l e v e l of o f validation v a l i d a t i o n rigor r i g o r is i s determined d e t e r m i n e d by b y the t h e function f u n c t i o n development d e v e l o p m e n t assurance a s s u r a n c e level(s) l e v e l ( s ) for f o r the t h e aircraft a i r c r a f t or o r system s y s t e m (FOAL) ( F O A L ) and a n d item i t e m development d e v e l o p m e n t assurance a s s u r a n c e level(s) l e v e l ( s ) for f o r the t h e item i t e m (IDAL). ( I D A L ) . Requirement R e q u i r e m e n t validation v a l i d a t i o n methods m e t h o d s are a r e identified i d e n t i f i e d in i n 5.4.6 5 . 4 . 6 and a n d their t h e i r acceptable a c c e p t a b l e use u s e is i s described d e s c r i b e d in i n 5.4.6.1. 5 . 4 . 6 . 1 . The T h e application a p p l i c a t i o n of o f independence i n d e p e n d e n c e in i n the t h e validation v a l i d a t i o n process p r o c e s s is i s also a l s o dependent d e p e n d e n t upon u p o n the t h e development d e v e l o p m e n t assurance a s s u r a n c e level. l e v e l . This T h i s independence i n d e p e n d e n c e needs n e e d s to t o be b e applied a p p l i e d between b e t w e e n requirements r e q u i r e m e n t s capture c a p t u r e (5.3) ( 5 . 3 ) and a n d the t h e validation v a l i d a t i o n activities a c t i v i t i e s in i n section s e c t i o n 5.4. 5 . 4 . The T h e validation v a l i d a t i o n plan p l a n (see ( s e e 5.4.7.1) 5 . 4 . 7 . 1 ) should s h o u l d include i n c l u d e a a description d e s c r i p t i o n of o f the t h e validation v a l i d a t i o n activities a c t i v i t i e s to t o which w h i c h independence i n d e p e n d e n c e is i s applied. a p p l i e d . The T h e most m o s t common c o m m o n means m e a n s of o f achieving a c h i e v i n g independence i n d e p e n d e n c e in i n requirements r e q u i r e m e n t s validation v a l i d a t i o n is i s an a n independent i n d e p e n d e n t review r e v i e w of o f requirement r e q u i r e m e n t data d a t a and a n d supporting s u p p o r t i n g rationale r a t i o n a l e to t o determine d e t e r m i n e if i f there t h e r e is i s sufficient s u f f i c i e n t evidence e v i d e n c e to t o argue a r g u e the t h e correctness c o r r e c t n e s s of o f a a requirement r e q u i r e m e n t and a n d the t h e completeness c o m p l e t e n e s s of o f a a set s e t of o f requirements. r e q u i r e m e n t s . These T h e s e include i n c l u d e engineering e n g i n e e r i n g reviews r e v i e w s (see ( s e e 5.4.6 5 . 4 . 6 f) f ) and a n d reviews r e v i e w s by b y customers, c u s t o m e r s , users, u s e r s , maintainers m a i n t a i n e r s and a n d certification c e r t i f i c a t i o n authorities a u t h o r i t i e s and a n d item i t e m developers d e v e l o p e r s (see ( s e e 5.4.4.2). 5 . 4 . 4 . 2 ) . Although A l t h o u g h all a l l validation v a l i d a t i o n methods m e t h o d s may m a y not n o t directly d i r e c t l y lend l e n d themselves t h e m s e l v e s to t o independence, i n d e p e n d e n c e , e.g. e . g . analysis, a n a l y s i s , scenarios, s c e n a r i o s , similarity s i m i l a r i t y and a n d requirements r e q u i r e m e n t s tracing, t r a c i n g , the t h e outcomes o u t c o m e s of o f these t h e s e validation v a l i d a t i o n method m e t h o d activities a c t i v i t i e s and a n d their t h e i r appropriateness a p p r o p r i a t e n e s s are a r e reviewable r e v i e w a b l e and a n d should s h o u l d be b e done d o n e with w i t h independence i n d e p e n d e n c e where w h e r e indicated i n d i c a t e d by b y the t h e development d e v e l o p m e n t assurance a s s u r a n c e level l e v e l (see ( s e e Appendix A p p e n d i x A). A ) . 5.4.6 5 . 4 . 6 Validation V a l i d a t i o n Methods M e t h o d s Several S e v e r a l methods m e t h o d s may m a y be b e needed n e e d e d to t o support s u p p o r t validation. v a l i d a t i o n . These T h e s e methods m e t h o d s include: i n c l u d e : traceability, t r a c e a b i l i t y , analysis, a n a l y s i s , modeling, m o d e l i n g , test, t e s t , similarity, s i m i l a r i t y , and a n d engineering e n g i n e e r i n g review. r e v i e w . Validation V a l i d a t i o n should s h o u l d consider c o n s i d e r both b o t h intended i n t e n d e d and a n d unintended u n i n t e n d e d functions f u n c t i o n s . . Intended I n t e n d e d function f u n c t i o n requirements r e q u i r e m e n t s validation v a l i d a t i o n involves i n v o l v e s evaluation e v a l u a t i o n against a g a i n s t objective o b j e c t i v e pass/fail p a s s / f a i l criteria. c r i t e r i a . Vigilance V i g i l a n c e during d u r i n g all a l l analysis a n a l y s i s and a n d testing t e s t i n g can c a n be b e used u s e d to t o identify i d e n t i f y unintended u n i n t e n d e d system/item s y s t e m / i t e m operations o p e r a t i o n s or o r side-effects s i d e - e f f e c t s . . While W h i l e the t h e absence a b s e n c e of o f unintended u n i n t e n d e d functions f u n c t i o n s can c a n not n o t be b e validated v a l i d a t e d directly, d i r e c t l y , ad a d hoc h o c testing t e s t i n g and a n d targeted t a r g e t e d analyses a n a l y s e s can c a n be b e used u s e d to t o reduce r e d u c e the t h e probability p r o b a b i l i t y of o f their t h e i r presence. p r e s e n c e . a. a . Traceability T r a c e a b i l i t y (Bi-directional ( B i - d i r e c t i o n a l flow f l o w of o f requirements): r e q u i r e m e n t s ) : Traceability T r a c e a b i l i t y is i s an a n essential e s s e n t i a l component c o m p o n e n t of o f validation v a l i d a t i o n of o f the t h e aircraft, a i r c r a f t , systems s y s t e m s and a n d item i t e m requirements r e q u i r e m e n t s . . The T h e requirement r e q u i r e m e n t should s h o u l d either e i t h e r be b e traceable t r a c e a b l e to t o a a parent p a r e n t requirement, r e q u i r e m e n t , or o r by b y identification i d e n t i f i c a t i o n of o f the t h e specific s p e c i f i c design d e s i g n decision d e c i s i o n or o r data d a t a from f r o m which w h i c h the t h e requirement r e q u i r e m e n t was w a s derived. d e r i v e d . Traceability T r a c e a b i l i t y by b y itself i t s e l f may m a y be b e sufficient s u f f i c i e n t to t o demonstrate d e m o n s t r a t e that t h a t a a lower l o w e r level l e v e l requirement r e q u i r e m e n t satisfies s a t i s f i e s a a higher h i g h e r level l e v e l requirement r e q u i r e m e n t with w i t h regards r e g a r d s to t o completeness c o m p l e t e n e s s . . However, H o w e v e r , where w h e r e additional a d d i t i o n a l value v a l u e has h a s been b e e n added a d d e d through t h r o u g h design d e s i g n decisions d e c i s i o n s or o r detail, d e t a i l , additional a d d i t i o n a l rationale r a t i o n a l e should s h o u l d be b e captured. c a p t u r e d . This T h i s rationale r a t i o n a l e should s h o u l d document d o c u m e n t how h o w the t h e lower l o w e r level l e v e l requirement(s) r e q u i r e m e n t ( s ) satisfy s a t i s f y the t h e parent p a r e n t requirement. r e q u i r e m e n t . Some S o m e lower l o w e r level l e v e l requirements r e q u i r e m e n t s may m a y not n o t be b e traceable t r a c e a b l e to t o a a parent p a r e n t requirement r e q u i r e m e n t (i.e ( i . e . . derived d e r i v e d requirements); r e q u i r e m e n t s ) ; these t h e s e requirements r e q u i r e m e n t s should s h o u l d have h a v e rationale r a t i o n a l e to t o document d o c u m e n t their t h e i r validity v a l i d i t y . . Untraced U n t r a c e d requirements r e q u i r e m e n t s should s h o u l d be b e reviewed r e v i e w e d to t o determine d e t e r m i n e whether w h e t h e r they t h e y are: a r e : • • derived d e r i v e d as a s part p a r t of o f the t h e development d e v e l o p m e n t process p r o c e s s (see ( s e e Section S e c t i o n 5.3.1.4) 5 . 3 . 1 . 4 ) or o r , , • • developed d e v e l o p e d from f r o m a a missing m i s s i n g parent p a r e n t requirement r e q u i r e m e n t that t h a t may m a y be b e added a d d e d or, o r , • • assumptions a s s u m p t i o n s that t h a t need n e e d to t o be b e managed m a n a g e d (see ( s e e Section S e c t i o n 5.4.2 5 . 4 . 2 (d)). ( d ) ) . b. b . Analysis: A n a l y s i s : A A wide w i d e range r a n g e of o f analysis a n a l y s i s methods m e t h o d s and a n d techniques t e c h n i q u e s may m a y be b e used u s e d to t o determine d e t e r m i n e requirements r e q u i r e m e n t s acceptability a c c e p t a b i l i t y . . Several S e v e r a l specific s p e c i f i c safety-related s a f e t y - r e l a t e d analysis a n a l y s i s methods m e t h o d s are a r e described d e s c r i b e d in i n ARP4761 A R P 4 7 6 1 . . Early E a r l y discussion d i s c u s s i o n with w i t h regulatory r e g u l a t o r y authorities a u t h o r i t i e s on o n the t h e acceptability a c c e p t a b i l i t y of o f the t h e FHA F H A and a n d PSSAs P S S A s will w i l l assist a s s i s t in i n the t h e validation v a l i d a t i o n of o f the t h e safety-related s a f e t y - r e l a t e d requirements. r e q u i r e m e n t s . c. c . Modeling: M o d e l i n g : Models M o d e l s of o f systems/items s y s t e m s / i t e m s may m a y be b e used u s e d to t o validate v a l i d a t e the t h e requirements. r e q u i r e m e n t s . granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true} Downloaded D o w n l o a d e d from f r o m SAE S A E International I n t e r n a t i o n a l by b y David D a v i d Merrill, M e r r i l l , Saturday, S a t u r d a y , November N o v e m b e r 12, 1 2 , 2016 2 0 1 6 SAE S A E ARP4754A A R P 4 7 5 4 A Page P a g e 63 6 3 of o f 115 1 1 5 d. d . Test: T e s t : Special S p e c i a l tests, t e s t s , simulations, s i m u l a t i o n s , or o r demonstrations d e m o n s t r a t i o n s may m a y be b e used u s e d to t o validate v a l i d a t e requirements. r e q u i r e m e n t s . These T h e s e activities a c t i v i t i e s may m a y occur o c c u r at a t anytime a n y t i m e during d u r i n g development d e v e l o p m e n t based b a s e d on o n availability a v a i l a b i l i t y of o f mock-ups, m o c k - u p s , prototypes, p r o t o t y p e s , simulations s i m u l a t i o n s or o r actual a c t u a l hardware h a r d w a r e and a n d software. s o f t w a r e . Care C a r e should s h o u l d be b e exercised e x e r c i s e d to t o ensure e n s u r e any a n y simulation s i m u l a t i o n is i s sufficiently s u f f i c i e n t l y representative r e p r e s e n t a t i v e of o f the t h e actual a c t u a l system, s y s t e m , its i t s interfaces, i n t e r f a c e s , and a n d the t h e installation i n s t a l l a t i o n environment. e n v i r o n m e n t . Item I t e m verification v e r i f i c a t i o n tests t e s t s may m a y also a l s o be b e used u s e d to t o support s u p p o r t validation v a l i d a t i o n of o f the t h e requirements r e q u i r e m e n t s derived d e r i v e d to t o design d e s i g n the t h e item. i t e m . e. e . Similarity S i m i l a r i t y (Experience) ( E x p e r i e n c e ) This T h i s method m e t h o d allows a l l o w s validation v a l i d a t i o n of o f a a requirement r e q u i r e m e n t by b y comparison c o m p a r i s o n to t o the t h e requirements r e q u i r e m e n t s of o f similar s i m i l a r certificated c e r t i f i c a t e d systems s y s t e m s . . The T h e similarity s i m i l a r i t y argument a r g u m e n t gains g a i n s strength s t r e n g t h as a s the t h e period p e r i o d of o f experience e x p e r i e n c e with w i t h the t h e system s y s t e m increases. i n c r e a s e s . Arguments A r g u m e n t s of o f similarity s i m i l a r i t y should s h o u l d not n o t be b e used u s e d until u n t i l there t h e r e is i s adequate a d e q u a t e confidence c o n f i d e n c e that t h a t the t h e period p e r i o d of o f experience e x p e r i e n c e is i s satisfactory s a t i s f a c t o r y . . Similarity S i m i l a r i t y may m a y be b e claimed c l a i m e d if: i f : • • The T h e two t w o systems/items s y s t e m s / i t e m s have h a v e the t h e same s a m e function f u n c t i o n and a n d Failure F a i l u r e Condition C o n d i t i o n classification, c l a s s i f i c a t i o n , and a n d operate o p e r a t e in i n the t h e same s a m e environment e n v i r o n m e n t with w i t h similar s i m i l a r usage, u s a g e , • • The T h e two t w o systems/items s y s t e m s / i t e m s perform p e r f o r m similar s i m i l a r functions f u n c t i o n s in i n equivalent e q u i v a l e n t environments. e n v i r o n m e n t s . f. f . Engineering E n g i n e e r i n g Review R e v i e w Application A p p l i c a t i o n of o f personal p e r s o n a l experience e x p e r i e n c e through t h r o u g h reviews, r e v i e w s , inspections i n s p e c t i o n s and a n d demonstrations d e m o n s t r a t i o n s can c a n support s u p p o r t determination d e t e r m i n a t i o n of o f completeness c o m p l e t e n e s s (see ( s e e 5.4.4) 5 . 4 . 4 ) and a n d correctness c o r r e c t n e s s (see ( s e e 5.4.3). 5 . 4 . 3 ) . The T h e properly p r o p e r l y justified j u s t i f i e d rationale r a t i o n a l e or o r logic l o g i c should s h o u l d be b e documented. d o c u m e n t e d . A A collaborative c o l l a b o r a t i v e review r e v i e w of o f requirements r e q u i r e m e n t s is i s an a n effective e f f e c t i v e means m e a n s of o f validating v a l i d a t i n g derived d e r i v e d requirements r e q u i r e m e n t s in i n cases c a s e s where w h e r e the t h e system s y s t e m is i s similar s i m i l a r to t o previous p r e v i o u s systems s y s t e m s within w i t h i n the t h e experience e x p e r i e n c e of o f the t h e reviewers, r e v i e w e r s , prior p r i o r to t o the t h e opportunity o p p o r t u n i t y to t o test t e s t the t h e implementation i m p l e m e n t a t i o n during d u r i n g verification. v e r i f i c a t i o n . The T h e reviews r e v i e w s should s h o u l d be b e documented d o c u m e n t e d including i n c l u d i n g the t h e review r e v i e w participants p a r t i c i p a n t s and a n d their t h e i r roles. r o l e s . The T h e value v a l u e of o f the t h e review r e v i e w will w i l l depend d e p e n d on o n the t h e care c a r e taken t a k e n with w i t h the t h e review r e v i e w and a n d the t h e experience e x p e r i e n c e level l e v e l of o f the t h e reviewers. r e v i e w e r s . 5.4.6.1 5 . 4 . 6 . 1 Recommended R e c o m m e n d e d Methods M e t h o d s Table T a b l e 6 6 identifies i d e n t i f i e s validation v a l i d a t i o n methods m e t h o d s and a n d data d a t a as a s a a function f u n c t i o n of o f the t h e allocated a l l o c a t e d development d e v e l o p m e n t assurance a s s u r a n c e level l e v e l A-E. A - E . For F o r example, e x a m p l e , to t o validate v a l i d a t e requirements r e q u i r e m e n t s to t o level l e v e l A A or o r B, B , analysis, a n a l y s i s , tests t e s t s of o f intended i n t e n d e d function, f u n c t i o n , and a n d directly d i r e c t l y applicable a p p l i c a b l e similarity s i m i l a r i t y may m a y be b e used u s e d to t o establish e s t a b l i s h correctness c o r r e c t n e s s and a n d completeness c o m p l e t e n e s s . . Validation V a l i d a t i o n of o f some s o m e requirements r e q u i r e m e n t s may m a y use u s e one o n e method m e t h o d for f o r correctness c o r r e c t n e s s checks c h e c k s and a n d another a n o t h e r method m e t h o d for f o r completeness c o m p l e t e n e s s checks. c h e c k s . granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true} Downloaded D o w n l o a d e d from f r o m SAE S A E International I n t e r n a t i o n a l by b y David D a v i d Merrill, M e r r i l l , Saturday, S a t u r d a y , November N o v e m b e r 12, 1 2 , 2016 2 0 1 6 SAE S A E ARP4754A A R P 4 7 5 4 A Page P a g e 64 6 4 of o f 115 1 1 5 TABLE T A B L E 6 6 - - REQUIREMENTS R E Q U I R E M E N T S VALIDATION V A L I D A T I O N METHODS M E T H O D S AND A N D DATA D A T A Methods M e t h o d s and a n d Data D a t a (see ( s e e 5.4.6.a-f 5 . 4 . 6 . a - f and a n d 5.4.7) 5 . 4 . 7 ) Development D e v e l o p m e n t Assurance A s s u r a n c e Level L e v e l - - A A and a n d B B Development D e v e l o p m e n t Assurance A s s u r a n c e Level L e v e l - - C C Development D e v e l o p m e n t Assurance A s s u r a n c e Level L e v e l - - D D Development D e v e l o p m e n t Assurance A s s u r a n c e Level L e v e l - - E E PASNPSSA P A S N P S S A R R R R A A N N Validation V a l i d a t i o n Plan P l a n R R R R A A N N Validation V a l i d a t i o n Matrix M a t r i x R R R R A A N N Validation V a l i d a t i o n Summary S u m m a r y R R R R A A N N Requirements R e q u i r e m e n t s Traceability T r a c e a b i l i t y (Non-Der ( N o n - D e r ived i v e d Requirements) R e q u i r e m e n t s ) Requirements R e q u i r e m e n t s Rationale R a t i o n a l e (Derived ( D e r i v e d Requirements) R e q u i r e m e n t s ) R R R R A A N N R R R R A A N N Analysis, A n a l y s i s , Modeling, M o d e l i n g , or o r Test T e s t R R A A N N One O n e Similarity S i m i l a r i t y (Service ( S e r v i c e Experience) E x p e r i e n c e ) A A A A N N recommended r e c o m m e n d e d Engineering E n g i n e e r i n g Review R e v i e w R R A A N N Note: N o t e : R R - - Recommended R e c o m m e n d e d for f o r certification, c e r t i f i c a t i o n , A A - - As A s negotiated n e g o t i a t e d for f o r certification, c e r t i f i c a t i o n , N N - - Not N o t required r e q u i r e d for f o r certification c e r t i f i c a t i o n For F o r each e a c h requirement, r e q u i r e m e n t , a a combination c o m b i n a t i o n of o f the t h e recommended r e c o m m e n d e d and a n d allowable a l l o w a b l e methods m e t h o d s necessary n e c e s s a r y to t o establish e s t a b l i s h the t h e required r e q u i r e d confidence c o n f i d e n c e in i n the t h e validation v a l i d a t i o n of o f that t h a t requirement r e q u i r e m e n t , , should s h o u l d be b e identified i d e n t i f i e d and a n d then t h e n applied. a p p l i e d . 5.4.7 5 . 4 . 7 Validat V a l i d a t ion i o n Data D a t a 5.4.7.1 5 . 4 . 7 . 1 Validation V a l i d a t i o n Plan P l a n A A requirements r e q u i r e m e n t s validat v a l i d a t ion i o n plan p l a n should s h o u l d be b e in i n place p l a c e throughout t h r o u g h o u t the t h e development d e v e l o p m e n t process. p r o c e s s . This T h i s plan p l a n should s h o u l d outline o u t l i n e how h o w the t h e requirements r e q u i r e m e n t s will w i l l be b e shown s h o w n to t o be b e complete c o m p l e t e and a n d correct c o r r e c t and a n d how h o w the t h e assumptions a s s u m p t i o n s will w i l l be b e managed. m a n a g e d . The T h e plan p l a n should s h o u l d include i n c l u d e descriptions d e s c r i p t i o n s of: o f : a. a . The T h e methods m e t h o d s to t o be b e used. u s e d . b. b . The T h e data d a t a to t o be b e gathered g a t h e r e d or o r generated. g e n e r a t e d . c. c . What W h a t should s h o u l d be b e recorded r e c o r d e d (such ( s u c h as: a s : summaries, s u m m a r i e s , reviews, r e v i e w s , or o r investigations) i n v e s t i g a t i o n s ) . . d. d . The T h e means m e a n s for f o r timely t i m e l y access a c c e s s to t o requirements r e q u i r e m e n t s validation v a l i d a t i o n information. i n f o r m a t i o n . e. e . How H o w the t h e status s t a t u s of o f validation v a l i d a t i o n will w i l l be b e maintained, m a i n t a i n e d , or o r managed, m a n a g e d , when w h e n changes c h a n g e s are a r e made m a d e to t o requirements. r e q u i r e m e n t s . f. f . Roles R o l e s and a n d responsibilities r e s p o n s i b i l i t i e s associated a s s o c i a t e d with w i t h the t h e validation. v a l i d a t i o n . g. g . A A schedule s c h e d u l e of o f key k e y validation v a l i d a t i o n activities. a c t i v i t i e s . h. h . The T h e means m e a n s of o f managing m a n a g i n g assumptions a s s u m p t i o n s at a t the t h e different d i f f e r e n t design d e s i g n levels l e v e l s and a n d phases p h a s e s of o f development. d e v e l o p m e n t . i. i . The T h e means m e a n s to t o be b e used u s e d to t o provide p r o v i d e independence i n d e p e n d e n c e of o f the t h e requirements r e q u i r e m e n t s definition d e f i n i t i o n from f r o m the t h e validation v a l i d a t i o n activities. a c t i v i t i e s . granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true} Downloaded D o w n l o a d e d from f r o m SAE S A E International I n t e r n a t i o n a l by b y David D a v i d Merrill, M e r r i l l , Saturday, S a t u r d a y , November N o v e m b e r 12, 1 2 , 2016 2 0 1 6 SAE S A E ARP4754A A R P 4 7 5 4 A Page P a g e 65 6 5 of o f 115 1 1 5 Aspects A s p e c t s of o f the t h e validation v a l i d a t i o n process p r o c e s s that t h a t may m a y also a l s o serve s e r v e as a s part p a r t of o f verification v e r i f i c a t i o n should s h o u l d be b e coordinated c o o r d i n a t e d with w i t h the t h e verification v e r i f i c a t i o n plan. p l a n . 5.4.7.2 5 . 4 . 7 . 2 Validation V a l i d a t i o n Tracking T r a c k i n g A A validation v a l i d a t i o n matrix m a t r i x or o r other o t h e r adequate a d e q u a t e approach a p p r o a c h is i s desirable d e s i r a b l e to t o track t r a c k the t h e status s t a t u s of o f the t h e requirements r e q u i r e m e n t s validation v a l i d a t i o n process. p r o c e s s . The T h e level l e v e l of o f detail d e t a i l should s h o u l d depend d e p e n d upon u p o n the t h e development d e v e l o p m e n t assurance a s s u r a n c e level l e v e l of o f the t h e function f u n c t i o n addressed a d d r e s s e d by b y the t h e requirement r e q u i r e m e n t and a n d should s h o u l d be b e described d e s c r i b e d in i n the t h e validation v a l i d a t i o n plan. p l a n . It I t is i s recommended r e c o m m e n d e d that t h a t a a preliminary p r e l i m i n a r y tracking t r a c k i n g process p r o c e s s be b e described d e s c r i b e d in i n the t h e certification c e r t i f i c a t i o n plan, p l a n , and a n d that t h a t it i t should s h o u l d be b e updated u p d a t e d as a s required. r e q u i r e d . The T h e final f i n a l data d a t a should s h o u l d be b e included i n c l u d e d in i n the t h e validation v a l i d a t i o n summary s u m m a r y . . The T h e specific s p e c i f i c format f o r m a t is i s up u p to t o the t h e applicant, a p p l i c a n t , but b u t it i t should s h o u l d at a t least l e a s t contain: c o n t a i n : a. a . Requirement, R e q u i r e m e n t , b. b . Source S o u r c e of o f the t h e Requirement, R e q u i r e m e n t , c. c . Associated A s s o c i a t e d Function(s), F u n c t i o n ( s ) , d. d . Development D e v e l o p m e n t Assurance A s s u r a n c e Level, L e v e l , e. e . Validation V a l i d a t i o n Method(s) M e t h o d ( s ) Applied, A p p l i e d , f. f . Validation V a l i d a t i o n Supporting S u p p o r t i n g Evidence E v i d e n c e Reference(s), R e f e r e n c e ( s ) , g. g . Validation V a l i d a t i o n Conclusion C o n c l u s i o n (Valid/Not ( V a l i d / N o t valid) v a l i d ) . . 5.4.7.3 5 . 4 . 7 . 3 Validation V a l i d a t i o n Summary S u m m a r y The T h e validation v a l i d a t i o n summary s u m m a r y should s h o u l d provide p r o v i d e assurance a s s u r a n c e that t h a t the t h e requirements r e q u i r e m e n t s were w e r e properly p r o p e r l y validated. v a l i d a t e d . The T h e summary s u m m a r y should s h o u l d include: i n c l u d e : a. a . A A reference r e f e r e n c e to t o the t h e validation v a l i d a t i o n plan p l a n and a n d a a description d e s c r i p t i o n of o f any a n y significant s i g n i f i c a n t deviations d e v i a t i o n s from f r o m the t h e plan. p l a n . b. b . The T h e validation v a l i d a t i o n matrix, m a t r i x , as a s described d e s c r i b e d in i n 5.4.7.2. 5 . 4 . 7 . 2 . c. c . Identification I d e n t i f i c a t i o n of o f supporting s u p p o r t i n g data d a t a or o r data d a t a sources s o u r c e s (see ( s e e 5.4.7.2). 5 . 4 . 7 . 2 ) . 5.5 5 . 5 Implementation I m p l e m e n t a t i o n Verification V e r i f i c a t i o n The T h e purpose p u r p o s e of o f verification v e r i f i c a t i o n is i s to t o ascertain a s c e r t a i n that t h a t each e a c h level l e v e l of o f the t h e implementation i m p l e m e n t a t i o n meets m e e t s its i t s specified s p e c i f i e d requirements. r e q u i r e m e n t s . The T h e verification v e r i f i c a t i o n process p r o c e s s ensures e n s u r e s that t h a t the t h e system s y s t e m implementation i m p l e m e n t a t i o n satisfies s a t i s f i e s the t h e validated v a l i d a t e d requirements. r e q u i r e m e n t s . Verification V e r i f i c a t i o n consists c o n s i s t s of o f inspections, i n s p e c t i o n s , reviews, r e v i e w s , analyses, a n a l y s e s , tests, t e s t s , and a n d service s e r v i c e experience e x p e r i e n c e applied a p p l i e d in i n accordance a c c o r d a n c e with w i t h a a verification v e r i f i c a t i o n plan. p l a n . These T h e s e activities a c t i v i t i e s are a r e described d e s c r i b e d in i n the t h e paragraphs p a r a g r a p h s that t h a t follow. f o l l o w . 5.5.1 5 . 5 . 1 Verification V e r i f i c a t i o n Process P r o c e s s Objectives O b j e c t i v e s The T h e verification v e r i f i c a t i o n process: p r o c e s s : a. a . Confirms C o n f i r m s that t h a t the t h e intended i n t e n d e d functions f u n c t i o n s have h a v e been b e e n correctly c o r r e c t l y implemented. i m p l e m e n t e d . b. b . Confirms C o n f i r m s that t h a t the t h e requirements r e q u i r e m e n t s have h a v e been b e e n satisfied s a t i s f i e d (Have ( H a v e we w e built b u i l t the t h e aircraft a i r c r a f t right?). r i g h t ? ) . c. c . Ensures E n s u r e s that t h a t the t h e safety s a f e t y analysis a n a l y s i s remains r e m a i n s valid v a l i d for f o r the t h e system s y s t e m as a s implemented. i m p l e m e n t e d . granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true} Downloaded D o w n l o a d e d from f r o m SAE S A E International I n t e r n a t i o n a l by b y David D a v i d Merrill, M e r r i l l , Saturday, S a t u r d a y , November N o v e m b e r 12, 1 2 , 2016 2 0 1 6 SAE S A E ARP4754A A R P 4 7 5 4 A Page P a g e 66 6 6 of o f 115 1 1 5 5.5.2 5 . 5 . 2 Verification V e r i f i c a t i o n Process P r o c e s s Model M o d e l Figure F i g u r e 13 1 3 shows s h o w s an a n overview o v e r v i e w of o f a a generic g e n e r i c process p r o c e s s model m o d e l for f o r verification v e r i f i c a t i o n at a t each e a c h level l e v e l of o f system s y s t e m implementation. i m p l e m e n t a t i o n . The T h e verification v e r i f i c a t i o n process p r o c e s s is i s composed c o m p o s e d of o f three t h r e e distinct d i s t i n c t elements e l e m e n t s described d e s c r i b e d as a s follows: f o l l o w s : a. a . Planning: P l a n n i n g : Includes I n c l u d e s planning p l a n n i n g for f o r the t h e resources r e s o u r c e s required, r e q u i r e d , the t h e sequence s e q u e n c e of o f activities, a c t i v i t i e s , the t h e data d a t a to t o be b e produced, p r o d u c e d , collation c o l l a t i o n of o f required r e q u i r e d information, i n f o r m a t i o n , selection s e l e c t i o n of o f specific s p e c i f i c activities a c t i v i t i e s and a n d assessment a s s e s s m e n t criteria, c r i t e r i a , and a n d generation g e n e r a t i o n of o f verification-specific v e r i f i c a t i o n - s p e c i f i c hardware h a r d w a r e or o r software s o f t w a r e (see ( s e e paragraph p a r a g r a p h 5.5.3). 5 . 5 . 3 ) . b. b . Methods: M e t h o d s : Includes I n c l u d e s the t h e activity a c t i v i t y in i n which w h i c h the t h e verification v e r i f i c a t i o n methods m e t h o d s are a r e employed e m p l o y e d (see ( s e e paragraph p a r a g r a p h 5.5.5). 5 . 5 . 5 ) . c. c . Data: D a t a : Includes I n c l u d e s evidence e v i d e n c e of o f the t h e results r e s u l t s developed d e v e l o p e d in i n the t h e process p r o c e s s (see ( s e e paragraph p a r a g r a p h 5.5.6). 5 . 5 . 6 ) . Level L e v e l of o f verification v e r i f i c a t i o n is i s determined d e t e r m i n e d by b y the t h e FOAL F O A L and a n d IDAL I D A L (see ( s e e paragraph p a r a g r a p h 5.5.3). 5 . 5 . 3 ) . The T h e inputs i n p u t s to t o the t h e verification v e r i f i c a t i o n process p r o c e s s include i n c l u d e the t h e set s e t of o f documented d o c u m e n t e d requirements r e q u i r e m e n t s for f o r the t h e implemented i m p l e m e n t e d aircraft, a i r c r a f t , system s y s t e m or o r item i t e m and a n d a a complete c o m p l e t e description d e s c r i p t i o n of o f the t h e system s y s t e m or o r item i t e m to t o be b e verified. v e r i f i e d . More M o r e than t h a n one o n e verification v e r i f i c a t i o n method m e t h o d may m a y be b e necessary n e c e s s a r y to t o substantiate s u b s t a n t i a t e compliance c o m p l i a n c e with w i t h the t h e requirements. r e q u i r e m e n t s . For F o r example, e x a m p l e , an a n analysis a n a l y s i s may m a y be b e required r e q u i r e d in i n conjunction c o n j u n c t i o n with w i t h a a physical p h y s i c a l test t e s t to t o assure a s s u r e that t h a t worst w o r s t case c a s e issues i s s u e s have h a v e been b e e n covered. c o v e r e d . During D u r i n g the t h e process p r o c e s s of o f verifying v e r i f y i n g intended i n t e n d e d functions, f u n c t i o n s , any a n y anomalies a n o m a l i e s recognized r e c o g n i z e d (such ( s u c h as a s an a n unintended u n i n t e n d e d function f u n c t i o n or o r incorrect i n c o r r e c t performance) p e r f o r m a n c e ) should s h o u l d be b e reported r e p o r t e d so s o that t h a t they t h e y can c a n be b e reviewed r e v i e w e d and a n d dispositioned d i s p o s i t i o n e d . . Checking C h e c k i n g the t h e verification v e r i f i c a t i o n process, p r o c e s s , design d e s i g n implementation i m p l e m e n t a t i o n process p r o c e s s or o r requirement r e q u i r e m e n t definition d e f i n i t i o n process p r o c e s s may m a y be b e warranted w a r r a n t e d to t o identify i d e n t i f y the t h e source s o u r c e of o f the t h e anomaly. a n o m a l y . It I t should s h o u l d be b e mentioned m e n t i o n e d that t h a t verification v e r i f i c a t i o n is i s a a process p r o c e s s which w h i c h due d u e to t o the t h e iterative i t e r a t i v e nature n a t u r e of o f the t h e development d e v e l o p m e n t process p r o c e s s may m a y appear a p p e a r repeatedly r e p e a t e d l y during d u r i n g the t h e design d e s i g n process p r o c e s s (see ( s e e Figure F i g u r e 6 6 "Aircraft " A i r c r a f t Function F u n c t i o n Implementation I m p l e m e n t a t i o n Process" P r o c e s s " in i n section s e c t i o n 4.2). 4 . 2 ) . granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true} Downloaded D o w n l o a d e d from f r o m SAE S A E International I n t e r n a t i o n a l by b y David D a v i d Merrill, M e r r i l l , Saturday, S a t u r d a y , November N o v e m b e r 12, 1 2 , 2016 2 0 1 6 SAE S A E ARP4754A A R P 4 7 5 4 A Page P a g e 67 6 7 of o f 115 1 1 5 Design D e s i g n Process P r o c e s s Implementation I m p l e m e n t a t i o n Verification V e r i f i c a t i o n Plan P l a n 5.5.4 5 . 5 . 4 l l Design D e s i g n Requirements R e q u i r e m e n t s & & DevelopmentData D e v e l o p m e n t D a t a Assurance A s s u r a n c e Level L e v e l .... . . . . Verification V e r i f i c a t i o n Matrix M a t r i x (Initial) ( I n i t i a l ) 5.5.6.3 5 . 5 . 6 . 3 Methods M e t h o d s .... . . . . 5.5.5 5 . 5 . 5 ·-·· · - · · · · -- - - - - Jl J l j j Developme D e v e l o p m e - - nt n t Process P r o c e s s Verification V e r i f i c a t i o n P!ocess P ! o c e s s - - ·-·· · - · · I+ I + .a•-· . a • - · Matrix M a t r i x Verification V e r i f i c a t i o n Summary S u m m a r y 5.5.6. 5 . 5 . 6 . (Final) ( F i n a l ) f----+, f - - - - + , 5.5.6.3 5 . 5 . 6 . 3 Anom'ali A n o m ' a l i I I es e s FIGURE F I G U R E 13 1 3 - - VERIFICATION V E R I F I C A T I O N PROCESS P R O C E S S MODEL M O D E L 5.5.3 5 . 5 . 3 Verification V e r i f i c a t i o n Rigor R i g o r The T h e level l e v e l of o f verification v e r i f i c a t i o n rigor r i g o r is i s determined d e t e r m i n e d by b y the t h e function f u n c t i o n development d e v e l o p m e n t assurance a s s u r a n c e level(s) l e v e l ( s ) for f o r the t h e aircraft a i r c r a f t or o r system s y s t e m (FOAL) ( F O A L ) and a n d the t h e item i t e m development d e v e l o p m e n t assurance a s s u r a n c e level(s) l e v e l ( s ) for f o r the t h e item i t e m (IDAL). ( I D A L ) . Additional A d d i t i o n a l verification v e r i f i c a t i o n rigor r i g o r commensurate c o m m e n s u r a t e with w i t h the t h e development d e v e l o p m e n t assurance a s s u r a n c e level, l e v e l , ie. i e . independence, i n d e p e n d e n c e , needs n e e d s to t o be b e applied a p p l i e d between b e t w e e n the t h e aircraft a i r c r a f t or o r system s y s t e m design d e s i g n implementation i m p l e m e n t a t i o n in i n section s e c t i o n 4.6 4 . 6 and a n d the t h e verification v e r i f i c a t i o n activities a c t i v i t i e s in i n section s e c t i o n 5.5. 5 . 5 . The T h e most m o s t common c o m m o n means m e a n s of o f achieving a c h i e v i n g independence i n d e p e n d e n c e in i n verification v e r i f i c a t i o n is i s independent i n d e p e n d e n t development d e v e l o p m e n t of o f the t h e verification v e r i f i c a t i o n methods m e t h o d s described d e s c r i b e d in i n section s e c t i o n 5.5.5 5 . 5 . 5 (e.g. ( e . g . individuals i n d i v i d u a l s or o r groups g r o u p s not n o t involved i n v o l v e d in i n the t h e aircraft a i r c r a f t or o r system s y s t e m design d e s i g n generate g e n e r a t e the t h e verification v e r i f i c a t i o n methods). m e t h o d s ) . The T h e verification v e r i f i c a t i o n plan p l a n (see ( s e e 5.5.4) 5 . 5 . 4 ) should s h o u l d include i n c l u d e a a description d e s c r i p t i o n of o f the t h e verification v e r i f i c a t i o n activities a c t i v i t i e s to t o which w h i c h independence i n d e p e n d e n c e is i s applied. a p p l i e d . Appendix A p p e n d i x A A highlights h i g h l i g h t s the t h e specific s p e c i f i c verification v e r i f i c a t i o n objectives o b j e c t i v e s appropriate a p p r o p r i a t e to t o the t h e development d e v e l o p m e n t assurance a s s u r a n c e level. l e v e l . 5.5.4 5 . 5 . 4 Verification V e r i f i c a t i o n Planning P l a n n i n g The T h e purpose p u r p o s e of o f this t h i s phase p h a s e is i s to t o define d e f i n e the t h e processes p r o c e s s e s and a n d criteria c r i t e r i a to t o be b e applied a p p l i e d when w h e n showing s h o w i n g how h o w the t h e implementation i m p l e m e n t a t i o n satisfies s a t i s f i e s its i t s requirements. r e q u i r e m e n t s . The T h e following f o l l o w i n g activities a c t i v i t i e s should s h o u l d be b e performed p e r f o r m e d during d u r i n g the t h e planning p l a n n i n g phase: p h a s e : a. a . Identification I d e n t i f i c a t i o n of o f the t h e roles r o l e s and a n d responsibilities r e s p o n s i b i l i t i e s associated a s s o c i a t e d with w i t h conducting c o n d u c t i n g the t h e verification v e r i f i c a t i o n activities a c t i v i t i e s and a n d a a description d e s c r i p t i o n of o f independence i n d e p e n d e n c e between b e t w e e n design d e s i g n and a n d verification v e r i f i c a t i o n activities. a c t i v i t i e s . b. b . Identification I d e n t i f i c a t i o n of o f the t h e system s y s t e m or o r item i t e m configuration, c o n f i g u r a t i o n , including i n c l u d i n g the t h e definition d e f i n i t i o n of o f any a n y special s p e c i a l test t e s t equipment, e q u i p m e n t , facilities, f a c i l i t i e s , and a n d any a n y special s p e c i a l hardware h a r d w a r e or o r software s o f t w a r e features f e a t u r e s to t o be b e verified. v e r i f i e d . c. c . Definition D e f i n i t i o n of o f the t h e specific s p e c i f i c verification v e r i f i c a t i o n methods m e t h o d s to t o be b e employed e m p l o y e d to t o show s h o w compliance c o m p l i a n c e with w i t h each e a c h requirement r e q u i r e m e n t based b a s e d on o n the t h e development d e v e l o p m e n t assurance a s s u r a n c e level. l e v e l . granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true} Downloaded D o w n l o a d e d from f r o m SAE S A E International I n t e r n a t i o n a l by b y David D a v i d Merrill, M e r r i l l , Saturday, S a t u r d a y , November N o v e m b e r 12, 1 2 , 2016 2 0 1 6 SAE S A E ARP4754A A R P 4 7 5 4 A Page P a g e 68 6 8 of o f 115 1 1 5 d. d . Definition D e f i n i t i o n of o f the t h e criteria c r i t e r i a to t o be b e used u s e d to t o assess a s s e s s the t h e evidence e v i d e n c e resulting r e s u l t i n g from f r o m each e a c h verification v e r i f i c a t i o n method m e t h o d applied a p p l i e d (i.e. ( i . e . success s u c c e s s criteria) c r i t e r i a ) . . e. e . Identification I d e n t i f i c a t i o n of o f system s y s t e m verification v e r i f i c a t i o n credit c r e d i t taken t a k e n from f r o m hardware h a r d w a r e or o r software s o f t w a r e verification v e r i f i c a t i o n activities, a c t i v i t i e s , f. f . Identification I d e n t i f i c a t i o n of o f key k e y verification v e r i f i c a t i o n activities a c t i v i t i e s and a n d sequence s e q u e n c e of o f any a n y dependent d e p e n d e n t activities, a c t i v i t i e s , g. g . Identification I d e n t i f i c a t i o n of o f verification v e r i f i c a t i o n data. d a t a . 5.5.5 5 . 5 . 5 Verification V e r i f i c a t i o n Methods M e t h o d s The T h e purpose p u r p o s e of o f these t h e s e activities a c t i v i t i e s is i s to t o verify v e r i f y that t h a t the t h e implementation i m p l e m e n t a t i o n satisfies s a t i s f i e s its i t s requirements r e q u i r e m e n t s including i n c l u d i n g the t h e intended i n t e n d e d operating o p e r a t i n g environment. e n v i r o n m e n t . Four F o u r basic b a s i c methods m e t h o d s may m a y be b e employed e m p l o y e d in i n the t h e verification v e r i f i c a t i o n of o f the t h e aircraft a i r c r a f t and a n d any a n y system s y s t e m or o r item: i t e m : a. a . Inspection I n s p e c t i o n or o r Review, R e v i e w , b. b . Analysis, A n a l y s i s , c. c . Test T e s t or o r Demonstration, D e m o n s t r a t i o n , d. d . Service S e r v i c e Experience. E x p e r i e n c e . Each E a c h of o f these t h e s e methods m e t h o d s is i s discussed d i s c u s s e d in i n the t h e paragraphs p a r a g r a p h s that t h a t follow. f o l l o w . 5.5.5.1 5 . 5 . 5 . 1 Inspection I n s p e c t i o n or o r Review R e v i e w Inspection I n s p e c t i o n or o r review r e v i e w consists c o n s i s t s of o f visual v i s u a l examinations e x a m i n a t i o n s of o f process p r o c e s s documents, d o c u m e n t s , drawings, d r a w i n g s , hardware, h a r d w a r e , or o r software s o f t w a r e to t o verify v e r i f y that t h a t requirements r e q u i r e m e n t s have h a v e been b e e n satisfied. s a t i s f i e d . Generally, G e n e r a l l y , a a checklist c h e c k l i s t or o r similar s i m i l a r aid a i d is i s used. u s e d . Inspection I n s p e c t i o n that t h a t the t h e system s y s t e m or o r item i t e m meets m e e t s established e s t a b l i s h e d physical p h y s i c a l implementation i m p l e m e n t a t i o n and a n d workmanship w o r k m a n s h i p is i s a a typical t y p i c a l type t y p e of o f inspection/review. i n s p e c t i o n / r e v i e w . 5.5.5.2 5 . 5 . 5 . 2 Analysis A n a l y s i s An A n analysis a n a l y s i s provides p r o v i d e s evidence e v i d e n c e of o f compliance c o m p l i a n c e by b y performing p e r f o r m i n g a a detailed d e t a i l e d examination e x a m i n a t i o n (e.g., ( e . g . , functionality, f u n c t i o n a l i t y , performance, p e r f o r m a n c e , safety) s a f e t y ) of o f a a system s y s t e m or o r item. i t e m . Evaluations E v a l u a t i o n s of o f how h o w the t h e system s y s t e m or o r item i t e m is i s expected e x p e c t e d to t o perform p e r f o r m in i n normal n o r m a l and a n d non-normal n o n - n o r m a l conditions c o n d i t i o n s should s h o u l d be b e included. i n c l u d e d . Analysis A n a l y s i s methods m e t h o d s include, i n c l u d e , but b u t are a r e not n o t limited l i m i t e d to, t o , those t h o s e described d e s c r i b e d in i n the t h e following f o l l o w i n g paragraphs. p a r a g r a p h s . 5.5.5.3 5 . 5 . 5 . 3 Modeling M o d e l i n g Modeling M o d e l i n g of o f complex c o m p l e x systems s y s t e m s typically t y p i c a l l y consists c o n s i s t s of o f a a combination c o m b i n a t i o n of o f computation c o m p u t a t i o n and a n d test; t e s t ; however, h o w e v e r , modeling m o d e l i n g deterministic d e t e r m i n i s t i c systems s y s t e m s behavior b e h a v i o r may m a y also a l s o be b e entirely e n t i r e l y computational. c o m p u t a t i o n a l . Modeling M o d e l i n g may m a y be b e used u s e d for f o r system s y s t e m parameter p a r a m e t e r evaluation, e v a l u a t i o n , to t o provide p r o v i d e early e a r l y system s y s t e m information, i n f o r m a t i o n , or o r other o t h e r purposes. p u r p o s e s . 5.5.5.3.1 5 . 5 . 5 . 3 . 1 Coverage C o v e r a g e Analysis A n a l y s i s Coverage C o v e r a g e analysis a n a l y s i s is i s performed p e r f o r m e d to t o determine d e t e r m i n e the t h e degree d e g r e e to t o which w h i c h the t h e requirements r e q u i r e m e n t s are a r e addressed a d d r e s s e d throughout t h r o u g h o u t the t h e development d e v e l o p m e n t and a n d verification v e r i f i c a t i o n activities. a c t i v i t i e s . This T h i s is i s typically t y p i c a l l y implemented i m p l e m e n t e d using u s i n g some s o m e form f o r m of o f traceability t r a c e a b i l i t y . . 5.5.5.4 5 . 5 . 5 . 4 Testing T e s t i n g or o r Demonstration D e m o n s t r a t i o n Testing T e s t i n g provides p r o v i d e s repeatable r e p e a t a b l e evidence e v i d e n c e of o f correctness c o r r e c t n e s s by b y exercising e x e r c i s i n g a a system s y s t e m or o r item i t e m to t o verify v e r i f y that t h a t the t h e requirements r e q u i r e m e n t s are a r e satisfied. s a t i s f i e d . Test T e s t readiness r e a d i n e s s reviews r e v i e w s establish e s t a b l i s h the t h e applicability a p p l i c a b i l i t y of o f the t h e test t e s t cases c a s e s to t o system s y s t e m or o r item i t e m requirements r e q u i r e m e n t s . . Testing T e s t i n g has h a s the t h e following f o l l o w i n g two t w o objectives: o b j e c t i v e s : a. a . To T o demonstrate d e m o n s t r a t e that t h a t the t h e system s y s t e m or o r item i t e m implementation i m p l e m e n t a t i o n performs p e r f o r m s its i t s intended i n t e n d e d functions. f u n c t i o n s . Testing T e s t i n g an a n intended i n t e n d e d function f u n c t i o n involves i n v o l v e s evaluation e v a l u a t i o n against a g a i n s t objective o b j e c t i v e pass/fail p a s s / f a i l criteria c r i t e r i a established e s t a b l i s h e d by b y the t h e requirements. r e q u i r e m e n t s . granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true} Downloaded D o w n l o a d e d from f r o m SAE S A E International I n t e r n a t i o n a l by b y David D a v i d Merrill, M e r r i l l , Saturday, S a t u r d a y , November N o v e m b e r 12, 1 2 , 2016 2 0 1 6 SAE S A E ARP4754A A R P 4 7 5 4 A Page P a g e 69 6 9 of o f 115 1 1 5 b. b . To T o provide p r o v i d e confidence c o n f i d e n c e that t h a t the t h e implemented i m p l e m e n t e d system s y s t e m does d o e s not n o t perform p e r f o r m unintended u n i n t e n d e d functions f u n c t i o n s (i.e., ( i . e . , not n o t consciously c o n s c i o u s l y part p a r t of o f the t h e design) d e s i g n ) that t h a t impact i m p a c t safety. s a f e t y . Ad A d hoc h o c testing, t e s t i n g , and a n d special s p e c i a l vigilance v i g i l a n c e during d u r i n g normal n o r m a l testing, t e s t i n g , may m a y be b e used u s e d to t o identify i d e n t i f y unintended u n i n t e n d e d system s y s t e m or o r item i t e m operation o p e r a t i o n or o r side-effects. s i d e - e f f e c t s . It I t should s h o u l d be b e noted n o t e d that t h a t complete c o m p l e t e absence a b s e n c e of o f unintended u n i n t e n d e d function f u n c t i o n can c a n never n e v e r be b e established e s t a b l i s h e d by b y test. t e s t . Tests T e s t s are a r e performed p e r f o r m e d on o n all a l l or o r part p a r t of o f the t h e physical p h y s i c a l system s y s t e m or o r item i t e m or o r an a n appropriate a p p r o p r i a t e validated v a l i d a t e d model m o d e l using u s i n g procedures p r o c e d u r e s documented d o c u m e n t e d in i n sufficient s u f f i c i e n t detail d e t a i l so s o that t h a t a a second s e c o n d party p a r t y could c o u l d reproduce r e p r o d u c e the t h e test t e s t results. r e s u l t s . Problems P r o b l e m s uncovered u n c o v e r e d during d u r i n g testing t e s t i n g should s h o u l d be b e reported, r e p o r t e d , corrective c o r r e c t i v e action a c t i o n tracked, t r a c k e d , and a n d the t h e modified m o d i f i e d system(s) s y s t e m ( s ) and/or a n d / o r item(s) i t e m ( s ) retested. r e t e s t e d . For F o r each e a c h test t e s t or o r group g r o u p of o f tests, t e s t s , the t h e following f o l l o w i n g should s h o u l d be b e specified: s p e c i f i e d : a. a . Required R e q u i r e d input i n p u t variability v a r i a b i l i t y should s h o u l d be b e considered c o n s i d e r e d in i n setting s e t t i n g the t h e test t e s t criteria. c r i t e r i a . b. b . Actions A c t i o n s required r e q u i r e d and a n d action a c t i o n order o r d e r if i f time t i m e dependent. d e p e n d e n t . c. c . The T h e purpose p u r p o s e or o r rationale r a t i o n a l e for f o r the t h e test(s). t e s t ( s ) . d. d . The T h e requirements r e q u i r e m e n t s covered c o v e r e d by b y the t h e test(s). t e s t ( s ) . e. e . Expected E x p e c t e d results r e s u l t s and a n d the t h e tolerances t o l e r a n c e s associated a s s o c i a t e d with w i t h those t h o s e results. r e s u l t s . Test T e s t result r e s u l t data d a t a should s h o u l d contain c o n t a i n the t h e following f o l l o w i n g : : a. a . The T h e version v e r s i o n of o f the t h e test t e s t specification s p e c i f i c a t i o n used. u s e d . b. b . The T h e version v e r s i o n of o f the t h e system s y s t e m or o r item i t e m being b e i n g tested. t e s t e d . c. c . The T h e version v e r s i o n or o r reference r e f e r e n c e standard s t a n d a r d for f o r tools t o o l s and a n d equipment e q u i p m e n t used, u s e d , together t o g e t h e r with w i t h applicable a p p l i c a b l e calibration c a l i b r a t i o n data. d a t a . d. d . The T h e results r e s u l t s of o f each e a c h test t e s t including i n c l u d i n g a a PASS P A S S or o r FAIL F A I L declaration. d e c l a r a t i o n . e. e . The T h e discrepancy d i s c r e p a n c y between b e t w e e n expected e x p e c t e d and a n d actual a c t u a l results. r e s u l t s . f. f . A A statement s t a t e m e n t of o f success s u c c e s s or o r failure f a i l u r e of o f the t h e testing t e s t i n g process p r o c e s s including i n c l u d i n g its i t s relationship r e l a t i o n s h i p to t o the t h e verification v e r i f i c a t i o n program. p r o g r a m . 5.5.5.4.1 5 . 5 . 5 . 4 . 1 Test T e s t Facilities F a c i l i t i e s Functionality F u n c t i o n a l i t y may m a y be b e provided p r o v i d e d in i n a a system s y s t e m test t e s t facility f a c i l i t y which w h i c h will w i l l improve i m p r o v e the t h e probability p r o b a b i l i t y of o f detecting d e t e c t i n g incorrect i n c o r r e c t or o r unintended u n i n t e n d e d functions. f u n c t i o n s . a. a . The T h e hardware h a r d w a r e and a n d software s o f t w a r e under u n d e r test t e s t are a r e present p r e s e n t in i n the t h e facility f a c i l i t y and a n d representative r e p r e s e n t a t i v e software s o f t w a r e and a n d hardware. h a r d w a r e . b. b . A A model m o d e l of o f the t h e environment e n v i r o n m e n t may m a y be b e used u s e d to t o set s e t inputs i n p u t s to t o the t h e system s y s t e m under u n d e r test t e s t in i n a a way w a y that t h a t is i s representative r e p r e s e n t a t i v e of o f actual a c t u a l service, s e r v i c e , using u s i n g representations r e p r e s e n t a t i o n s of o f user u s e r control c o n t r o l inputs. i n p u t s . c. c . A A model m o d e l of o f the t h e environment e n v i r o n m e n t may m a y receive r e c e i v e the t h e outputs o u t p u t s of o f the t h e system s y s t e m under u n d e r test t e s t and a n d calculate c a l c u l a t e and a n d present p r e s e n t the t h e system s y s t e m behavior b e h a v i o r in i n terms t e r m s of o f the t h e high h i g h level l e v e l requirements. r e q u i r e m e n t s . d. d . The T h e behavior b e h a v i o r of o f the t h e system s y s t e m under u n d e r test t e s t is i s made m a d e plainly p l a i n l y visible v i s i b l e in i n terms t e r m s of o f high h i g h level l e v e l parameters. p a r a m e t e r s . e. e . The T h e high h i g h level l e v e l manual m a n u a l inputs i n p u t s are a r e made m a d e repeatable r e p e a t a b l e to t o facilitate f a c i l i t a t e regression r e g r e s s i o n testing. t e s t i n g . f. f . Significant S i g n i f i c a n t events e v e n t s such s u c h as a s failure f a i l u r e or o r warning w a r n i n g messages, m e s s a g e s , and a n d failures f a i l u r e s to t o meet m e e t high h i g h level l e v e l requirements r e q u i r e m e n t s are a r e annunciated a n n u n c i a t e d and a n d logged. l o g g e d . Provision P r o v i s i o n of o f the t h e above a b o v e functionality f u n c t i o n a l i t y allows a l l o w s developmental d e v e l o p m e n t a l testing t e s t i n g for f o r risk r i s k reduction r e d u c t i o n using u s i n g the t h e models m o d e l s to t o generate g e n e r a t e the t h e test t e s t results r e s u l t s and a n d interpret i n t e r p r e t the t h e results r e s u l t s with w i t h a a very v e r y high h i g h productivity p r o d u c t i v i t y , , and a n d a a manageable m a n a g e a b l e means m e a n s to t o perform p e r f o r m unexpected u n e x p e c t e d results. r e s u l t s . granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true} Downloaded D o w n l o a d e d from f r o m SAE S A E International I n t e r n a t i o n a l by b y David D a v i d Merrill, M e r r i l l , Saturday, S a t u r d a y , November N o v e m b e r 12, 1 2 , 2016 2 0 1 6 SAE S A E ARP4754A A R P 4 7 5 4 A Page P a g e 70 7 0 of o f 115 1 1 5 5.5.5.5 5 . 5 . 5 . 5 Similarity S i m i l a r i t y I I Service S e r v i c e Experience E x p e r i e n c e Verification V e r i f i c a t i o n credit c r e d i t may m a y be b e derived d e r i v e d from f r o m design d e s i g n and a n d installation i n s t a l l a t i o n appraisals a p p r a i s a l s and a n d evidence e v i d e n c e of o f satisfactory s a t i s f a c t o r y service s e r v i c e experience e x p e r i e n c e on o n other o t h e r aircraft a i r c r a f t using u s i n g the t h e same s a m e or o r other o t h e r systems s y s t e m s that t h a t are a r e similar s i m i l a r in i n their t h e i r relevant r e l e v a n t attributes. a t t r i b u t e s . This T h i s method m e t h o d should s h o u l d use u s e documented d o c u m e n t e d experience e x p e r i e n c e along a l o n g with w i t h engineering e n g i n e e r i n g and a n d operational o p e r a t i o n a l judgment j u d g m e n t to t o demonstrate d e m o n s t r a t e that t h a t no n o significant s i g n i f i c a n t failures f a i l u r e s remain r e m a i n unresolved u n r e s o l v e d in i n these t h e s e installations. i n s t a l l a t i o n s . See S e e section s e c t i o n 6.5 6 . 5 for f o r more m o r e detail. d e t a i l . 5.5.5.6 5 . 5 . 5 . 6 Recommended R e c o m m e n d e d Verification V e r i f i c a t i o n Methods M e t h o d s Table T a b l e 7 7 lists l i s t s a a variety v a r i e t y of o f recommended r e c o m m e n d e d and a n d allowable a l l o w a b l e verification v e r i f i c a t i o n methods m e t h o d s and a n d data d a t a as a s a a function f u n c t i o n of o f the t h e development d e v e l o p m e n t assurance a s s u r a n c e level. l e v e l . The T h e necessary n e c e s s a r y scope s c o p e and a n d coverage c o v e r a g e associated a s s o c i a t e d with w i t h these t h e s e methods m e t h o d s and a n d data d a t a also a l s o depends d e p e n d s on o n the t h e development d e v e l o p m e n t assurance a s s u r a n c e level l e v e l and, a n d , if i f known, k n o w n , may m a y be b e further f u r t h e r influenced i n f l u e n c e d by b y the t h e specific s p e c i f i c related r e l a t e d fault f a u l t condition. c o n d i t i o n . For F o r example, e x a m p l e , an a n implementation i m p l e m e n t a t i o n being b e i n g verified v e r i f i e d to t o level l e v e l A A or o r level l e v e l B B may m a y involve i n v o l v e inspection i n s p e c t i o n or o r review r e v i e w and a n d analysis, a n a l y s i s , and a n d should s h o u l d involve i n v o l v e some s o m e form f o r m of o f test. t e s t . The T h e extent e x t e n t to t o which w h i c h each e a c h method m e t h o d needs n e e d s to t o be b e applied a p p l i e d or o r data d a t a developed d e v e l o p e d will w i l l be b e the t h e result r e s u l t of o f agreement a g r e e m e n t with w i t h the t h e certification c e r t i f i c a t i o n authorities, a u t h o r i t i e s , based b a s e d on o n the t h e specific s p e c i f i c system s y s t e m to t o be b e certificated. c e r t i f i c a t e d . TABLE T A B L E ? ? - - VERIFICATION V E R I F I C A T I O N METHODS M E T H O D S AND A N D DATA D A T A Methods M e t h o d s and a n d Data D a t a (see ( s e e paragraphs p a r a g r a p h s 5.5.5 5 . 5 . 5 and a n d 5.5.6) 5 . 5 . 6 ) Development D e v e l o p m e n t Assurance A s s u r a n c e Level L e v e l A A and a n d B B C C D D E E Verification V e r i f i c a t i o n Matrix M a t r i x R R R R A A N N Verification V e r i f i c a t i o n Plan P l a n R R R R A A N N Verification V e r i f i c a t i o n Procedures P r o c e d u r e s R R R R A A N N Verification V e r i f i c a t i o n Summary S u m m a r y R R R R A A N N ASA/SSA A S A / S S A (note ( n o t e 3) 3 ) R R R R A A N N Inspection, I n s p e c t i o n , Review, R e v i e w , Analysis, A n a l y s i s , or o r Test T e s t (note ( n o t e 1) 1 ) R R (Test ( T e s t and a n d one o n e or o r more m o r e of o f others) o t h e r s ) R R (One ( O n e or o r more) m o r e ) A A N N (note ( n o t e 2) 2 ) Test, T e s t , unintended u n i n t e n d e d function f u n c t i o n R R A A A A N N Service S e r v i c e Experience E x p e r i e n c e A A A A A A A A Note: N o t e : R R - - Recommended R e c o m m e n d e d for f o r certification, c e r t i f i c a t i o n , A A - - As A s negotiated n e g o t i a t e d for f o r certification, c e r t i f i c a t i o n , N N - - Not N o t required r e q u i r e d for f o r certification c e r t i f i c a t i o n NOTE N O T E 1: 1 : These T h e s e methods m e t h o d s provide p r o v i d e similar s i m i l a r degrees d e g r e e s of o f verification. v e r i f i c a t i o n . The T h e selection s e l e c t i o n of o f which w h i c h methods m e t h o d s will w i l l be b e most m o s t useful u s e f u l may m a y depend d e p e n d on o n the t h e specific s p e c i f i c system s y s t e m architecture a r c h i t e c t u r e or o r the t h e specific s p e c i f i c function(s) f u n c t i o n ( s ) implemented. i m p l e m e n t e d . D0-1788/ED-128 D 0 - 1 7 8 8 / E D - 1 2 8 and a n d D0- D 0 - 254/ED- 2 5 4 / E D - 80 8 0 define d e f i n e applicable a p p l i c a b l e tests t e s t s for f o r software s o f t w a r e and a n d electronic e l e c t r o n i c hardware h a r d w a r e depending d e p e n d i n g on o n the t h e IDAL. I D A L . NOTE N O T E 2: 2 : As A s necessary n e c e s s a r y to t o show s h o w installation i n s t a l l a t i o n and a n d environmental e n v i r o n m e n t a l compatibility c o m p a t i b i l i t y . . NOTE N O T E 3: 3 : The T h e ASA/SSA A S A / S S A report r e p o r t (paragraph ( p a r a g r a p h 5.1) 5 . 1 ) is i s included i n c l u d e d in i n this t h i s table t a b l e since s i n c e it i t is i s directly d i r e c t l y related r e l a t e d to t o the t h e third t h i r d objective o b j e c t i v e of o f the t h e verification v e r i f i c a t i o n process p r o c e s s (paragraph ( p a r a g r a p h 5.5.1). 5 . 5 . 1 ) . 5.5.6 5 . 5 . 6 Verification V e r i f i c a t i o n Data D a t a The T h e purpose p u r p o s e of o f verificat v e r i f i c a t ion i o n data d a t a is i s to t o provide p r o v i d e evidence e v i d e n c e that t h a t the t h e verification v e r i f i c a t i o n process p r o c e s s was w a s conducted. c o n d u c t e d . This T h i s evidence e v i d e n c e may m a y be b e required r e q u i r e d for f o r compliance c o m p l i a n c e substantiation s u b s t a n t i a t i o n in i n accordance a c c o r d a n c e with w i t h Table T a b l e 7 7 and a n d to t o support s u p p o r t certification c e r t i f i c a t i o n data d a t a requirements. r e q u i r e m e n t s . A A reasonable r e a s o n a b l e approach a p p r o a c h is i s to t o maintain m a i n t a i n a a verification v e r i f i c a t i o n matrix m a t r i x during d u r i n g development d e v e l o p m e n t and a n d to t o produce p r o d u c e a a verification v e r i f i c a t i o n summary s u m m a r y report. r e p o r t . granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true} Downloaded D o w n l o a d e d from f r o m SAE S A E International I n t e r n a t i o n a l by b y David D a v i d Merrill, M e r r i l l , Saturday, S a t u r d a y , November N o v e m b e r 12, 1 2 , 2016 2 0 1 6 SAE S A E ARP4754A A R P 4 7 5 4 A Page P a g e 71 7 1 of o f 115 1 1 5 Requirements R e q u i r e m e n t s for f o r software s o f t w a r e verification v e r i f i c a t i o n are a r e included i n c l u d e d in i n D0-1788/ED-128 D 0 - 1 7 8 8 / E D - 1 2 8 and a n d for f o r electronic e l e c t r o n i c hardware h a r d w a r e verification v e r i f i c a t i o n in i n D0- D 0 - 254/ED-80 2 5 4 / E D - 8 0 . . A A summary s u m m a r y of o f software s o f t w a r e and a n d hardware h a r d w a r e verification v e r i f i c a t i o n should s h o u l d be b e included i n c l u d e d in i n the t h e verification v e r i f i c a t i o n data d a t a of o f the t h e system s y s t e m in i n which w h i c h it i t is i s embedded. e m b e d d e d . 5.5.6.1 5 . 5 . 6 . 1 Verification V e r i f i c a t i o n Plan P l a n The T h e verification v e r i f i c a t i o n plan p l a n establishes e s t a b l i s h e s the t h e strategies s t r a t e g i e s to t o show s h o w how h o w the t h e aircraft a i r c r a f t and a n d system s y s t e m implementation i m p l e m e n t a t i o n satisfy s a t i s f y their t h e i r requirements. r e q u i r e m e n t s . A A typical t y p i c a l verification v e r i f i c a t i o n plan p l a n might m i g h t include: i n c l u d e : a. a . Roles R o l e s and a n d responsibilities r e s p o n s i b i l i t i e s associated a s s o c i a t e d with w i t h conducting c o n d u c t i n g the t h e verification v e r i f i c a t i o n activities. a c t i v i t i e s . b. b . A A description d e s c r i p t i o n of o f the t h e degree d e g r e e of o f independence i n d e p e n d e n c e of o f the t h e design d e s i g n and a n d verification v e r i f i c a t i o n activities. a c t i v i t i e s . c. c . Application A p p l i c a t i o n of o f verification v e r i f i c a t i o n method(s). m e t h o d ( s ) . d. d . Verification V e r i f i c a t i o n data d a t a to t o be b e produced. p r o d u c e d . e. e . Sequence S e q u e n c e of o f dependent d e p e n d e n t activities. a c t i v i t i e s . f. f . A A schedule s c h e d u l e of o f key k e y verification v e r i f i c a t i o n activities. a c t i v i t i e s . g. g . Identification I d e n t i f i c a t i o n of o f system s y s t e m verification v e r i f i c a t i o n credit c r e d i t taken t a k e n from f r o m item i t e m (hardware ( h a r d w a r e or o r software) s o f t w a r e ) verification v e r i f i c a t i o n activities. a c t i v i t i e s . Some S o m e aspects a s p e c t s of o f the t h e verification v e r i f i c a t i o n process p r o c e s s may m a y also a l s o support s u p p o r t validation v a l i d a t i o n of o f specific s p e c i f i c requirements r e q u i r e m e n t s and a n d should s h o u l d be b e coordinated c o o r d i n a t e d with w i t h the t h e validation v a l i d a t i o n plan. p l a n . 5.5.6.2 5 . 5 . 6 . 2 Verification V e r i f i c a t i o n Procedures P r o c e d u r e s and a n d Results R e s u l t s Data D a t a describing d e s c r i b i n g the t h e verification v e r i f i c a t i o n procedures p r o c e d u r e s together t o g e t h e r with w i t h the t h e results r e s u l t s achieved a c h i e v e d provides p r o v i d e s the t h e evidence e v i d e n c e necessary n e c e s s a r y to t o establish e s t a b l i s h the t h e appropriateness a p p r o p r i a t e n e s s of o f the t h e verification v e r i f i c a t i o n effort. e f f o r t . 5.5.6.3 5 . 5 . 6 . 3 Verification V e r i f i c a t i o n Matrix M a t r i x A A verification v e r i f i c a t i o n matrix m a t r i x or o r an a n equivalent e q u i v a l e n t tracking t r a c k i n g document d o c u m e n t should s h o u l d be b e produced p r o d u c e d to t o track t r a c k the t h e status s t a t u s of o f the t h e verification v e r i f i c a t i o n process. p r o c e s s . The T h e level l e v e l of o f detail d e t a i l of o f this t h i s matrix m a t r i x should s h o u l d depend d e p e n d on o n the t h e development d e v e l o p m e n t assurance a s s u r a n c e level l e v e l of o f the t h e system s y s t e m or o r item i t e m being b e i n g verified v e r i f i e d . . While W h i l e the t h e specific s p e c i f i c format f o r m a t may m a y be b e determined d e t e r m i n e d by b y the t h e applicant, a p p l i c a n t , it i t should s h o u l d contain, c o n t a i n , at a t least: l e a s t : a. a . Requirement, R e q u i r e m e n t , b. b . Associated A s s o c i a t e d Function, F u n c t i o n , c. c . Verification V e r i f i c a t i o n Method(s) M e t h o d ( s ) Applied, A p p l i e d , d. d . Verification V e r i f i c a t i o n Procedure P r o c e d u r e and a n d results r e s u l t s reference(s), r e f e r e n c e ( s ) , e. e . Verification V e r i f i c a t i o n Conclusion C o n c l u s i o n (i.e. ( i . e . Pass P a s s or o r Fail, F a i l , verification v e r i f i c a t i o n coverage c o v e r a g e summary) s u m m a r y ) . . 5.5.6.4 5 . 5 . 6 . 4 Verification V e r i f i c a t i o n Summary S u m m a r y The T h e verification v e r i f i c a t i o n summary s u m m a r y provides p r o v i d e s visibility v i s i b i l i t y for f o r the t h e evidence e v i d e n c e used u s e d to t o show s h o w that t h a t the t h e aircraft, a i r c r a f t , system s y s t e m or o r item i t e m implementation i m p l e m e n t a t i o n satisfies s a t i s f i e s its i t s requirements. r e q u i r e m e n t s . The T h e summary s u m m a r y should s h o u l d include: i n c l u d e : a. a . A A reference r e f e r e n c e to t o the t h e verification v e r i f i c a t i o n plan p l a n and a n d a a description d e s c r i p t i o n of o f any a n y significant s i g n i f i c a n t deviations d e v i a t i o n s from f r o m the t h e plan. p l a n . b. b . The T h e development d e v e l o p m e n t assurance a s s u r a n c e level l e v e l allocated. a l l o c a t e d . c. c . The T h e verification v e r i f i c a t i o n matrix m a t r i x as a s described d e s c r i b e d in i n paragraph p a r a g r a p h 5.5.6.3. 5 . 5 . 6 . 3 . granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true} Downloaded D o w n l o a d e d from f r o m SAE S A E International I n t e r n a t i o n a l by b y David D a v i d Merrill, M e r r i l l , Saturday, S a t u r d a y , November N o v e m b e r 12, 1 2 , 2016 2 0 1 6 SAE S A E ARP4754A A R P 4 7 5 4 A Page P a g e 72 7 2 of o f 115 1 1 5 d. d . A A description d e s c r i p t i o n of o f any a n y open o p e n problem p r o b l e m reports r e p o r t s and a n d an a n assessment a s s e s s m e n t of o f the t h e related r e l a t e d impact i m p a c t on o n safety. s a f e t y . e. e . Identification I d e n t i f i c a t i o n of o f supporting s u p p o r t i n g data d a t a or o r data d a t a sources s o u r c e s (see ( s e e paragraph p a r a g r a p h 5.6 5 . 6 for f o r supporting s u p p o r t i n g data d a t a criteria). c r i t e r i a ) . f. f . Verification V e r i f i c a t i o n coverage c o v e r a g e summary s u m m a r y . . 5.6 5 . 6 Configuration C o n f i g u r a t i o n Management M a n a g e m e n t This T h i s section s e c t i o n discusses d i s c u s s e s the t h e objectives o b j e c t i v e s and a n d activities a c t i v i t i e s of o f the t h e system s y s t e m configuration c o n f i g u r a t i o n management m a n a g e m e n t process. p r o c e s s . It I t is i s applicable a p p l i c a b l e to t o the t h e system, s y s t e m , item(s) i t e m ( s ) that t h a t make m a k e up u p the t h e system, s y s t e m , certain c e r t a i n facilities f a c i l i t i e s and a n d tools, t o o l s , and a n d the t h e required r e q u i r e d certification c e r t i f i c a t i o n data. d a t a . Figure F i g u r e 14 1 4 presents p r e s e n t s an a n overall o v e r a l l Configuration C o n f i g u r a t i o n Management M a n a g e m e n t Process P r o c e s s Model. M o d e l . The T h e existence e x i s t e n c e of o f an a n independent i n d e p e n d e n t entity e n t i t y or o r organization o r g a n i z a t i o n to t o perform p e r f o r m the t h e configuration c o n f i g u r a t i o n management m a n a g e m e n t activities a c t i v i t i e s should s h o u l d not n o t be b e implied i m p l i e d by b y the t h e title t i t l e or o r content c o n t e n t of o f this t h i s section. s e c t i o n . Data D a t a and a n d records r e c o r d s need n e e d to t o meet m e e t the t h e following f o l l o w i n g criteria c r i t e r i a if i f they t h e y are a r e to t o be b e used u s e d to t o support s u p p o r t certification c e r t i f i c a t i o n : : a. a . The T h e data d a t a and a n d records r e c o r d s should s h o u l d be b e retrievable r e t r i e v a b l e for f o r later l a t e r reference. r e f e r e n c e . b. b . The T h e source s o u r c e of o f the t h e data d a t a generated, g e n e r a t e d , such s u c h as a s by b y analysis a n a l y s i s or o r test, t e s t , and a n d the t h e methods m e t h o d s used, u s e d , should s h o u l d be b e sufficiently s u f f i c i e n t l y controlled c o n t r o l l e d so s o as a s to t o allow a l l o w regeneration r e g e n e r a t i o n of o f the t h e same s a m e data. d a t a . This T h i s provides p r o v i d e s archived a r c h i v e d evidence e v i d e n c e for f o r future f u t u r e enhancements, e n h a n c e m e n t s , problem p r o b l e m resolution, r e s o l u t i o n , and a n d review r e v i e w by b y certification c e r t i f i c a t i o n authorities. a u t h o r i t i e s . 5.6.1 5 . 6 . 1 Configuration C o n f i g u r a t i o n Management M a n a g e m e n t Process P r o c e s s Objectives O b j e c t i v e s The T h e objectives o b j e c t i v e s of o f the t h e configuration c o n f i g u r a t i o n management m a n a g e m e n t process p r o c e s s are a r e to t o provide: p r o v i d e : a. a . Establishment E s t a b l i s h m e n t of o f a a configuration c o n f i g u r a t i o n management m a n a g e m e n t plan. p l a n . b. b . Establishment E s t a b l i s h m e n t of o f configuration, c o n f i g u r a t i o n , which w h i c h includes: i n c l u d e s : (1) ( 1 ) System S y s t e m and a n d item i t e m requirements, r e q u i r e m e n t s , (2) ( 2 ) Applicable A p p l i c a b l e certification c e r t i f i c a t i o n data d a t a (Table ( T a b l e 9), 9 ) , (3) ( 3 ) Facilities, F a c i l i t i e s , tools, t o o l s , and a n d any a n y other o t h e r data, d a t a , where w h e r e configuration c o n f i g u r a t i o n is i s essential e s s e n t i a l to t o establishing e s t a b l i s h i n g development d e v e l o p m e n t assurance a s s u r a n c e for f o r requirements r e q u i r e m e n t s substantiation s u b s t a n t i a t i o n compliance, c o m p l i a n c e , (4) ( 4 ) Any A n y other o t h e r data d a t a that t h a t uniquely u n i q u e l y identifies i d e n t i f i e s the t h e system s y s t e m and/or a n d / o r item i t e m versions v e r s i o n s during d u r i n g development, d e v e l o p m e n t , production p r o d u c t i o n and a n d operation. o p e r a t i o n . c. c . Technical T e c h n i c a l and a n d administrative a d m i n i s t r a t i v e control c o n t r o l by: b y : (1) ( 1 ) Identifying I d e n t i f y i n g modification m o d i f i c a t i o n status s t a t u s and a n d change c h a n g e control c o n t r o l of o f a a system s y s t e m configuration c o n f i g u r a t i o n in i n relation r e l a t i o n to t o a a configuration c o n f i g u r a t i o n baseline. b a s e l i n e . (2) ( 2 ) Providing P r o v i d i n g controls c o n t r o l s to t o ensure e n s u r e that: t h a t : Changes C h a n g e s are a r e recorded, r e c o r d e d , approved a p p r o v e d and a n d implemented, i m p l e m e n t e d , Identified I d e n t i f i e d problems p r o b l e m s and a n d their t h e i r resolution r e s o l u t i o n are a r e recorded. r e c o r d e d . d. d . Assurance A s s u r a n c e that t h a t physical p h y s i c a l archiving, a r c h i v i n g , recovery, r e c o v e r y , and a n d control c o n t r o l are a r e maintained m a i n t a i n e d for f o r relevant r e l e v a n t system s y s t e m data. d a t a . Configuration C o n f i g u r a t i o n management m a n a g e m e n t is i s both b o t h a a system s y s t e m development d e v e l o p m e n t and a n d a a certification c e r t i f i c a t i o n activity. a c t i v i t y . A A configuration c o n f i g u r a t i o n baseline b a s e l i n e should s h o u l d be b e established e s t a b l i s h e d at a t the t h e time t i m e in i n the t h e system s y s t e m development d e v e l o p m e n t process p r o c e s s where w h e r e requirements r e q u i r e m e n t s compliance c o m p l i a n c e substantiation s u b s t a n t i a t i o n is i s first f i r s t desired. d e s i r e d . The T h e traceability t r a c e a b i l i t y of o f the t h e final f i n a l proposed p r o p o s e d configuration c o n f i g u r a t i o n to t o that t h a t configuration c o n f i g u r a t i o n baseline b a s e l i n e is i s a a necessary n e c e s s a r y element e l e m e n t of o f demonstrating d e m o n s t r a t i n g development d e v e l o p m e n t assurance. a s s u r a n c e . granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true} Downloaded D o w n l o a d e d from f r o m SAE S A E International I n t e r n a t i o n a l by b y David D a v i d Merrill, M e r r i l l , Saturday, S a t u r d a y , November N o v e m b e r 12, 1 2 , 2016 2 0 1 6 SAE S A E ARP4754A A R P 4 7 5 4 A Page P a g e 73 7 3 of o f 115 1 1 5 NEW N E W DESIGNS D E S I G N S DESIGN D E S I G N DERIVATIVES D E R I V A T I V E S CONFIGURATION C O N F I G U R A T I O N MANAGEMENT M A N A G E M E N T PLAN P L A N 5.6.2.1 5 . 6 . 2 . 1 CONFIGURATION C O N F I G U R A T I O N BASELINE B A S E L I N E ESTABLISHMENT E S T A B L I S H M E N T CHANGE C H A N G E CONTROL C O N T R O L & & PROBLEM P R O B L E M REPORTING R E P O R T I N G 5.6.2.4 5 . 6 . 2 . 4 5.6.2.2/5.6.2.3 5 . 6 . 2 . 2 / 5 . 6 . 2 . 3 INTERIM I N T E R I M CONFIGURATIONS C O N F I G U R A T I O N S ..J . . J w w 1- 1 - w w IX I X Cz C z <( < ( CC C C & & PR P R w w >:c > : c 0 0 IX I X <( < ( DESIGN D E S I G N COMPLETION C O M P L E T I O N CONFIGURATION C O N F I G U R A T I O N ARCHIVE A R C H I V E 5.6.2.5 5 . 6 . 2 . 5 FIGURE F I G U R E 14 1 4 - - CONFIGURATION C O N F I G U R A T I O N MANAGEMENT M A N A G E M E N T PROCESS P R O C E S S MODEL M O D E L 5.6.2 5 . 6 . 2 Configuration C o n f i g u r a t i o n Management M a n a g e m e n t Process P r o c e s s Activities A c t i v i t i e s : : The T h e configuration c o n f i g u r a t i o n management m a n a g e m e n t process p r o c e s s shown s h o w n in i n Figure F i g u r e 14 1 4 includes: i n c l u d e s : a. a . Configuration C o n f i g u r a t i o n management m a n a g e m e n t plan, p l a n , b. b . Configuration C o n f i g u r a t i o n identification, i d e n t i f i c a t i o n , c. c . Baseline B a s e l i n e establishment, e s t a b l i s h m e n t , d. d . Change C h a n g e control c o n t r o l and a n d problem p r o b l e m reporting, r e p o r t i n g , e. e . Archiving A r c h i v i n g and a n d retrieval r e t r i e v a l activities. a c t i v i t i e s . Continuity C o n t i n u i t y of o f these t h e s e activities a c t i v i t i e s significantly s i g n i f i c a n t l y enhances e n h a n c e s their t h e i r effectiveness e f f e c t i v e n e s s and a n d the t h e credibility c r e d i b i l i t y of o f the t h e overall o v e r a l l configuration c o n f i g u r a t i o n management m a n a g e m e n t process. p r o c e s s . For F o r certification c e r t i f i c a t i o n purposes, p u r p o s e s , evidence e v i d e n c e of o f a a continuous c o n t i n u o u s configuration c o n f i g u r a t i o n management m a n a g e m e n t process p r o c e s s may m a y include, i n c l u d e , but b u t is i s not n o t limited l i m i t e d to, t o , historical h i s t o r i c a l records r e c o r d s or o r successive s u c c e s s i v e reports r e p o r t s from f r o m these t h e s e activities. a c t i v i t i e s . granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true} Downloaded D o w n l o a d e d from f r o m SAE S A E International I n t e r n a t i o n a l by b y David D a v i d Merrill, M e r r i l l , Saturday, S a t u r d a y , November N o v e m b e r 12, 1 2 , 2016 2 0 1 6 SAE S A E ARP4754A A R P 4 7 5 4 A Page P a g e 74 7 4 of o f 115 1 1 5 5.6.2.1 5 . 6 . 2 . 1 Configuration C o n f i g u r a t i o n Management M a n a g e m e n t Plan P l a n The T h e Configuration C o n f i g u r a t i o n Management M a n a g e m e n t Plan P l a n (CMP) ( C M P ) establishes e s t a b l i s h e s the t h e methods m e t h o d s to t o be b e used u s e d to t o achieve a c h i e v e the t h e objectives o b j e c t i v e s of o f the t h e configuration c o n f i g u r a t i o n management m a n a g e m e n t process p r o c e s s throughout t h r o u g h o u t the t h e system s y s t e m development d e v e l o p m e n t life l i f e cycle. c y c l e . The T h e CMP C M P should s h o u l d be b e created c r e a t e d and a n d agreed a g r e e d to t o by b y the t h e aviation a v i a t i o n authority, a u t h o r i t y , when w h e n necessary. n e c e s s a r y . The T h e plan p l a n should s h o u l d include i n c l u d e a a description d e s c r i p t i o n of o f the t h e configuration c o n f i g u r a t i o n management m a n a g e m e n t environment e n v i r o n m e n t including i n c l u d i n g procedures, p r o c e d u r e s , tools, t o o l s , methods, m e t h o d s , standards, s t a n d a r d s , organizational o r g a n i z a t i o n a l responsibilities r e s p o n s i b i l i t i e s and a n d interfaces. i n t e r f a c e s . A A description d e s c r i p t i o n of o f the t h e activities a c t i v i t i e s presented p r e s e n t e d in i n section s e c t i o n 5.6.2.2 5 . 6 . 2 . 2 through t h r o u g h 5.6.2.5 5 . 6 . 2 . 5 should s h o u l d also a l s o be b e included. i n c l u d e d . 5.6.2.2 5 . 6 . 2 . 2 Configuration C o n f i g u r a t i o n Identification I d e n t i f i c a t i o n The T h e objective o b j e c t i v e of o f the t h e configuration c o n f i g u r a t i o n identification i d e n t i f i c a t i o n activity a c t i v i t y is i s to t o unambiguously u n a m b i g u o u s l y and a n d uniquely u n i q u e l y label l a b e l each e a c h Configuration C o n f i g u r a t i o n Item I t e m so s o that t h a t a a basis b a s i s is i s established e s t a b l i s h e d for f o r control c o n t r o l and a n d reference. r e f e r e n c e . The T h e set s e t of o f Configuration C o n f i g u r a t i o n Items I t e m s should s h o u l d be b e recorded r e c o r d e d as a s part p a r t of o f the t h e archiving a r c h i v i n g and a n d retrieval r e t r i e v a l activity. a c t i v i t y . 5.6.2.3 5 . 6 . 2 . 3 Configuration C o n f i g u r a t i o n Baseline B a s e l i n e Establishment E s t a b l i s h m e n t The T h e objective o b j e c t i v e of o f the t h e configuration c o n f i g u r a t i o n baseline b a s e l i n e establishment e s t a b l i s h m e n t activity a c t i v i t y is i s to t o create c r e a t e and a n d maintain m a i n t a i n control c o n t r o l of o f and a n d traceability t r a c e a b i l i t y of o f Configuration C o n f i g u r a t i o n Items. I t e m s . Guidelines G u i d e l i n e s include: i n c l u d e : a. a . A A baseline b a s e l i n e should s h o u l d be b e established e s t a b l i s h e d for f o r Configuration C o n f i g u r a t i o n Items I t e m s used u s e d for f o r requirements r e q u i r e m e n t s compliance c o m p l i a n c e substantiation s u b s t a n t i a t i o n . . b. b . Once O n c e a a baseline b a s e l i n e is i s established e s t a b l i s h e d it i t should s h o u l d be b e archived, a r c h i v e d , protected p r o t e c t e d and a n d subject s u b j e c t to t o change c h a n g e control c o n t r o l procedures. p r o c e d u r e s . c. c . Change C h a n g e control c o n t r o l activity a c t i v i t y should s h o u l d be b e followed f o l l o w e d when w h e n developing d e v e l o p i n g a a derivative d e r i v a t i v e baseline b a s e l i n e from f r o m an a n established e s t a b l i s h e d baseline. b a s e l i n e . d. d . A A derivative d e r i v a t i v e baseline b a s e l i n e should s h o u l d be b e traceable t r a c e a b l e to t o the t h e previous p r e v i o u s baseline. b a s e l i n e . The T h e design d e s i g n completion c o m p l e t i o n configuration c o n f i g u r a t i o n in i n Figure F i g u r e 14 1 4 is i s typically t y p i c a l l y that t h a t configuration c o n f i g u r a t i o n used u s e d for f o r entry e n t r y into i n t o service s e r v i c e or o r certification c e r t i f i c a t i o n . . 5.6.2.4 5 . 6 . 2 . 4 Change C h a n g e Control C o n t r o l and a n d Problem P r o b l e m Reporting R e p o r t i n g The T h e objective o b j e c t i v e of o f change c h a n g e control c o n t r o l (CC) ( C C ) and a n d problem p r o b l e m reporting r e p o r t i n g (PR) ( P R ) is i s to t o record r e c o r d changes c h a n g e s or o r issues i s s u e s identified i d e n t i f i e d during d u r i n g review, r e v i e w , testing t e s t i n g or o r service s e r v i c e and a n d their t h e i r resolutions. r e s o l u t i o n s . The T h e following f o l l o w i n g guidelines g u i d e l i n e s highlight h i g h l i g h t the t h e aspects a s p e c t s of o f change c h a n g e control c o n t r o l and a n d problem p r o b l e m reporting r e p o r t i n g that t h a t are a r e significant s i g n i f i c a n t in i n demonstrating d e m o n s t r a t i n g development d e v e l o p m e n t assurance: a s s u r a n c e : a. a . Means M e a n s should s h o u l d be b e established e s t a b l i s h e d to t o document d o c u m e n t changes c h a n g e s and a n d the t h e resolution r e s o l u t i o n of o f problems, p r o b l e m s , b. b . Change C h a n g e control c o n t r o l should s h o u l d ensure e n s u r e that t h a t any a n y change c h a n g e to t o a a system/item s y s t e m / i t e m is i s appropriately a p p r o p r i a t e l y identified i d e n t i f i e d by b y a a change c h a n g e to t o its i t s configuration c o n f i g u r a t i o n identification, i d e n t i f i c a t i o n , c. c . Change C h a n g e control c o n t r o l should s h o u l d ensure e n s u r e that t h a t changes c h a n g e s to t o a a system/item s y s t e m / i t e m require r e q u i r e applicable a p p l i c a b l e changes c h a n g e s to t o the t h e documentation d o c u m e n t a t i o n associated a s s o c i a t e d with w i t h the t h e system/item, s y s t e m / i t e m , d. d . Change C h a n g e control c o n t r o l should s h o u l d preserve p r e s e r v e the t h e integrity i n t e g r i t y of o f a a system s y s t e m I I item i t e m by b y providing p r o v i d i n g protection p r o t e c t i o n against a g a i n s t unauthorized u n a u t h o r i z e d change. c h a n g e . 5.6.2.5 5 . 6 . 2 . 5 Archive A r c h i v e and a n d Retrieval R e t r i e v a l The T h e objective o b j e c t i v e of o f the t h e archive a r c h i v e and a n d retrieval r e t r i e v a l activity a c t i v i t y is i s to t o ensure e n s u r e that t h a t the t h e Configuration C o n f i g u r a t i o n Items I t e m s can c a n be b e retrieved. r e t r i e v e d . Data D a t a retention r e t e n t i o n procedures p r o c e d u r e s should s h o u l d be b e established e s t a b l i s h e d to t o satisfy s a t i s f y airworthiness a i r w o r t h i n e s s requirements. r e q u i r e m e n t s . The T h e following f o l l o w i n g guidelines g u i d e l i n e s are a r e provided: p r o v i d e d : a. a . Data D a t a associated a s s o c i a t e d with w i t h the t h e system s y s t e m or o r item i t e m should s h o u l d be b e retrievable r e t r i e v a b l e from f r o m a a controlled c o n t r o l l e d source s o u r c e (for ( f o r example, e x a m p l e , the t h e organization o r g a n i z a t i o n or o r company c o m p a n y that t h a t developed d e v e l o p e d the t h e system) s y s t e m ) . . granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true} Downloaded D o w n l o a d e d from f r o m SAE S A E International I n t e r n a t i o n a l by b y David D a v i d Merrill, M e r r i l l , Saturday, S a t u r d a y , November N o v e m b e r 12, 1 2 , 2016 2 0 1 6 SAE S A E ARP4754A A R P 4 7 5 4 A Page P a g e 75 7 5 of o f 115 1 1 5 b. b . Procedures P r o c e d u r e s should s h o u l d be b e established e s t a b l i s h e d to t o ensure e n s u r e the t h e integrity i n t e g r i t y of o f the t h e stored s t o r e d data d a t a for f o r as a s long l o n g as a s may m a y be b e required. r e q u i r e d . These T h e s e procedures p r o c e d u r e s should s h o u l d include: i n c l u d e : (1) ( 1 ) Ensuring E n s u r i n g that t h a t no n o unauthorized u n a u t h o r i z e d changes c h a n g e s can c a n be b e made. m a d e . (2) ( 2 ) Selecting S e l e c t i n g storage s t o r a g e media m e d i a that t h a t minimize m i n i m i z e regeneration r e g e n e r a t i o n errors e r r o r s or o r deterioration d e t e r i o r a t i o n . . (3) ( 3 ) Exercising E x e r c i s i n g and/or a n d / o r refreshing r e f r e s h i n g archived a r c h i v e d data d a t a at a t a a frequency f r e q u e n c y compatible c o m p a t i b l e with w i t h the t h e storage s t o r a g e life l i f e of o f the t h e medium. m e d i u m . (4) ( 4 ) Storing S t o r i n g duplicate d u p l i c a t e copies c o p i e s in i n physically p h y s i c a l l y separate s e p a r a t e archives a r c h i v e s that t h a t minimize m i n i m i z e the t h e risk r i s k of o f loss l o s s in i n the t h e event e v e n t of o f a a disaster. d i s a s t e r . 5.6.2.6 5 . 6 . 2 . 6 Data D a t a Control C o n t r o l Categories C a t e g o r i e s The T h e development d e v e l o p m e n t life l i f e cycle c y c l e data d a t a of o f a a Configuration C o n f i g u r a t i o n Item I t e m can c a n be b e assigned a s s i g n e d one o n e of o f two t w o categories: c a t e g o r i e s : System S y s t e m Control C o n t r o l category c a t e g o r y 1 1 (SC1) ( S C 1 ) or o r System S y s t e m Control C o n t r o l category c a t e g o r y 2 2 (SC2). ( S C 2 ) . These T h e s e categories c a t e g o r i e s differ d i f f e r by b y virtue v i r t u e of o f the t h e configuration c o n f i g u r a t i o n management m a n a g e m e n t controls c o n t r o l s placed p l a c e d on o n the t h e data. d a t a . Table T a b l e 8 8 allocates a l l o c a t e s the t h e configuration c o n f i g u r a t i o n control c o n t r o l process p r o c e s s activities a c t i v i t i e s to t o the t h e two t w o data d a t a control c o n t r o l categories c a t e g o r i e s . . An A n "X" " X " in i n a a Table T a b l e 8 8 SC1 S C 1 or o r SC2 S C 2 column c o l u m n indicates i n d i c a t e s that t h a t the t h e configuration c o n f i g u r a t i o n management m a n a g e m e n t objectives o b j e c t i v e s apply a p p l y to t o the t h e system s y s t e m life l i f e cycle c y c l e data d a t a for f o r that t h a t category. c a t e g o r y . SC2 S C 2 activities a c t i v i t i e s form f o r m a a sub-set s u b - s e t of o f SC1 S C 1 activities. a c t i v i t i e s . Appendix A p p e n d i x A A identifies i d e n t i f i e s the t h e usage u s a g e of o f the t h e control c o n t r o l category c a t e g o r y mapping m a p p i n g for f o r system s y s t e m development d e v e l o p m e n t life l i f e cycle c y c l e data d a t a by b y system s y s t e m development d e v e l o p m e n t assurance a s s u r a n c e level. l e v e l . The T h e configuration c o n f i g u r a t i o n management m a n a g e m e n t objectives o b j e c t i v e s identified i d e n t i f i e d by b y SC1 S C 1 and a n d SC2 S C 2 should s h o u l d be b e applied a p p l i e d as a s identified i d e n t i f i e d in i n Appendix A p p e n d i x A A for f o r each e a c h data d a t a type. t y p e . TABLE T A B L E 8 8 - - CM C M ACTIVITIES A C T I V I T I E S TO T O CONTROL C O N T R O L CATEGORY C A T E G O R Y MAPPING M A P P I N G CM C M Process P r o c e s s Activity A c t i v i t y Section S e c t i o n Reference R e f e r e n c e SC1 S C 1 SC2 S C 2 5.7 5 . 7 Process P r o c e s s Assurance A s s u r a n c e Confiquration C o n f i q u r a t i o n Identification I d e n t i f i c a t i o n .6.2.2 . 6 . 2 . 2 X X X X Confiquration C o n f i q u r a t i o n Baseline(s) B a s e l i n e ( s ) Establishment E s t a b l i s h m e n t .6.2.3 . 6 . 2 . 3 X X Problem P r o b l e m Reportinq R e p o r t i n q .6.2.4a . 6 . 2 . 4 a X X Chanqe C h a n q e Control C o n t r o l - - lnteqritv l n t e q r i t v assurance a s s u r a n c e .6.2.4d . 6 . 2 . 4 d X X X X Chanqe C h a n q e Control C o n t r o l - - Trackinq T r a c k i n q .6.2.4b,c . 6 . 2 . 4 b , c X X Confiquration C o n f i q u r a t i o n Index I n d e x Establishment E s t a b l i s h m e n t .8.4.2 . 8 . 4 . 2 X X X X Archive A r c h i v e and a n d Retrieval R e t r i e v a l .6.2.5 . 6 . 2 . 5 X X X X This T h i s section s e c t i o n describes d e s c r i b e s the t h e activities a c t i v i t i e s that t h a t ensure e n s u r e that t h a t the t h e development d e v e l o p m e n t assurance a s s u r a n c e activities a c t i v i t i e s are a r e maintained m a i n t a i n e d and a n d followed f o l l o w e d . . The T h e process p r o c e s s assurance a s s u r a n c e activities a c t i v i t i e s described d e s c r i b e d are a r e not n o t intended i n t e n d e d to t o imply i m p l y or o r impose i m p o s e specific s p e c i f i c organizational o r g a n i z a t i o n a l structures s t r u c t u r e s or o r responsibilities. r e s p o n s i b i l i t i e s . However, H o w e v e r , process p r o c e s s assurance a s s u r a n c e should s h o u l d have h a v e a a level l e v e l of o f independence i n d e p e n d e n c e from f r o m the t h e development d e v e l o p m e n t process. p r o c e s s . 5.7.1 5 . 7 . 1 Process P r o c e s s Objectives O b j e c t i v e s The T h e objectives o b j e c t i v e s of o f the t h e process p r o c e s s assurance a s s u r a n c e activities a c t i v i t i e s are: a r e : a. a . To T o ensure e n s u r e the t h e necessary n e c e s s a r y plans p l a n s are a r e developed, d e v e l o p e d , and a n d then t h e n maintained m a i n t a i n e d for f o r all a l l aspects a s p e c t s of o f aircraft, a i r c r a f t , system s y s t e m and a n d item i t e m development. d e v e l o p m e n t . b. b . To T o ensure e n s u r e development d e v e l o p m e n t activities a c t i v i t i e s and a n d processes p r o c e s s e s are a r e conducted c o n d u c t e d in i n accordance a c c o r d a n c e with w i t h those t h o s e plans. p l a n s . c. c . To T o establish e s t a b l i s h evidence e v i d e n c e that t h a t the t h e activities a c t i v i t i e s and a n d processes p r o c e s s e s adhered a d h e r e d to t o the t h e plans. p l a n s . granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true} Downloaded D o w n l o a d e d from f r o m SAE S A E International I n t e r n a t i o n a l by b y David D a v i d Merrill, M e r r i l l , Saturday, S a t u r d a y , November N o v e m b e r 12, 1 2 , 2016 2 0 1 6 SAE S A E ARP4754A A R P 4 7 5 4 A Page P a g e 76 7 6 of o f 115 1 1 5 5.7.2 5 . 7 . 2 Process P r o c e s s Assurance A s s u r a n c e Plan P l a n The T h e Process P r o c e s s Assurance A s s u r a n c e Plan P l a n describes d e s c r i b e s the t h e means m e a n s to t o assure a s s u r e that t h a t the t h e practices p r a c t i c e s and a n d procedures p r o c e d u r e s to t o be b e applied a p p l i e d during d u r i n g system s y s t e m development d e v e l o p m e n t are a r e followed f o l l o w e d . . Particular P a r t i c u l a r emphasis e m p h a s i s should s h o u l d be b e placed p l a c e d on o n the t h e certification-related c e r t i f i c a t i o n - r e l a t e d activities. a c t i v i t i e s . The T h e following f o l l o w i n g issues i s s u e s should s h o u l d be b e considered c o n s i d e r e d when w h e n producing p r o d u c i n g the t h e Process P r o c e s s Assurance A s s u r a n c e Plan: P l a n : a. a . The T h e scope s c o p e and a n d content c o n t e n t of o f the t h e other o t h e r project p r o j e c t plans p l a n s (development, ( d e v e l o p m e n t , certification, c e r t i f i c a t i o n , validation, v a l i d a t i o n , verificat v e r i f i c a t ion, i o n , and a n d configuration c o n f i g u r a t i o n management) m a n a g e m e n t ) are a r e consistent c o n s i s t e n t with w i t h the t h e development d e v e l o p m e n t assurance a s s u r a n c e level l e v e l of o f the t h e aircraft a i r c r a f t function, f u n c t i o n , system s y s t e m or o r item. i t e m . b. b . Project P r o j e c t communications, c o m m u n i c a t i o n s , coordination c o o r d i n a t i o n and a n d sequencing, s e q u e n c i n g , and a n d progress p r o g r e s s monitoring m o n i t o r i n g mechanisms m e c h a n i s m s are a r e defined. d e f i n e d . c. c . Change C h a n g e control, c o n t r o l , operational, o p e r a t i o n a l , and a n d maintenance m a i n t e n a n c e procedures p r o c e d u r e s are a r e defined. d e f i n e d . d. d . Sufficient S u f f i c i e n t project p r o j e c t review r e v i e w opportunities o p p o r t u n i t i e s are a r e defined d e f i n e d to t o best b e s t achieve a c h i e v e the t h e timely t i m e l y detection d e t e c t i o n of o f development d e v e l o p m e n t errors. e r r o r s . e. e . Sufficient S u f f i c i e n t coordination c o o r d i n a t i o n with w i t h the t h e certification c e r t i f i c a t i o n authorities a u t h o r i t i e s is i s planned. p l a n n e d . 5.7.3 5 . 7 . 3 Project P r o j e c t Plan P l a n Reviews R e v i e w s The T h e following f o l l o w i n g issues i s s u e s should s h o u l d be b e considered c o n s i d e r e d when w h e n assessing a s s e s s i n g the t h e project p r o j e c t plans: p l a n s : a. a . Applicable A p p l i c a b l e procedures p r o c e d u r e s and a n d practices p r a c t i c e s are a r e documented. d o c u m e n t e d . b. b . Defined D e f i n e d communication c o m m u n i c a t i o n practices p r a c t i c e s ensure e n s u r e the t h e timely t i m e l y exchange e x c h a n g e of o f information i n f o r m a t i o n between b e t w e e n the t h e applicable a p p l i c a b l e processes p r o c e s s e s and a n d affected a f f e c t e d personnel. p e r s o n n e l . c. c . Procedures P r o c e d u r e s for f o r plan p l a n updates u p d a t e s due d u e to t o process, p r o c e s s , schedule, s c h e d u l e , or o r technical t e c h n i c a l changes c h a n g e s are a r e defined. d e f i n e d . d. d . Plan P l a n updates u p d a t e s are a r e appropriately a p p r o p r i a t e l y tracked t r a c k e d and a n d controlled. c o n t r o l l e d . 5.7.4 5 . 7 . 4 Evidence E v i d e n c e of o f Process P r o c e s s Assurance A s s u r a n c e Evidence E v i d e n c e of o f conformance c o n f o r m a n c e with w i t h the t h e project p r o j e c t plans p l a n s can c a n include: i n c l u d e : a. a . Dated D a t e d and a n d approved a p p r o v e d project p r o j e c t plans. p l a n s . b. b . Reports, R e p o r t s , metrics, m e t r i c s , and a n d summaries s u m m a r i e s of o f reviews, r e v i e w s , as a s required r e q u i r e d by b y the t h e plans. p l a n s . c. c . Actual A c t u a l data d a t a developed d e v e l o p e d from f r o m design, d e s i g n , verification, v e r i f i c a t i o n , validation, v a l i d a t i o n , configuration c o n f i g u r a t i o n management, m a n a g e m e n t , and a n d certification c e r t i f i c a t i o n activities. a c t i v i t i e s . d. d . Confirmation C o n f i r m a t i o n (e.g., ( e . g . , completed c o m p l e t e d checklists c h e c k l i s t s and a n d meeting m e e t i n g minutes) m i n u t e s ) of o f timely t i m e l y process p r o c e s s assurance a s s u r a n c e reviews. r e v i e w s . 5.8 5 . 8 Certification C e r t i f i c a t i o n and a n d Regulatory R e g u l a t o r y Authority A u t h o r i t y Coordination C o o r d i n a t i o n The T h e objective o b j e c t i v e of o f the t h e certification c e r t i f i c a t i o n process p r o c e s s is i s to t o substantiate s u b s t a n t i a t e that t h a t the t h e aircraft a i r c r a f t and a n d its i t s systems s y s t e m s comply c o m p l y with w i t h applicable a p p l i c a b l e requirements. r e q u i r e m e n t s . In I n most m o s t situations s i t u a t i o n s the t h e aircraft a i r c r a f t certification c e r t i f i c a t i o n is i s accomplished a c c o m p l i s h e d through t h r o u g h compliance c o m p l i a n c e with w i t h a a series s e r i e s of o f certification c e r t i f i c a t i o n plans p l a n s (including ( i n c l u d i n g references r e f e r e n c e s to t o plans p l a n s for f o r equipment e q u i p m e n t qualification) q u a l i f i c a t i o n ) . . Planning P l a n n i n g and a n d coordination c o o r d i n a t i o n are a r e vital v i t a l to: t o : establish e s t a b l i s h effective e f f e c t i v e communications c o m m u n i c a t i o n s between b e t w e e n the t h e applicant a p p l i c a n t and a n d the t h e certification c e r t i f i c a t i o n authority, a u t h o r i t y , reach r e a c h agreement a g r e e m e n t on o n the t h e intended i n t e n d e d means m e a n s of o f showing s h o w i n g that t h a t the t h e aircraft, a i r c r a f t , its i t s systems s y s t e m s and a n d items i t e m s meet m e e t specific s p e c i f i c regulatory r e g u l a t o r y requirements, r e q u i r e m e n t s , and a n d industry i n d u s t r y standards. s t a n d a r d s . granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true} Downloaded D o w n l o a d e d from f r o m SAE S A E International I n t e r n a t i o n a l by b y David D a v i d Merrill, M e r r i l l , Saturday, S a t u r d a y , November N o v e m b e r 12, 1 2 , 2016 2 0 1 6 SAE S A E ARP4754A A R P 4 7 5 4 A Page P a g e 77 7 7 of o f 115 1 1 5 5.8.1 5 . 8 . 1 Certification C e r t i f i c a t i o n Planning P l a n n i n g Certification C e r t i f i c a t i o n planning p l a n n i n g separates s e p a r a t e s the t h e regulatory r e g u l a t o r y aspects a s p e c t s of o f the t h e overall o v e r a l l development d e v e l o p m e n t process p r o c e s s into i n t o manageable m a n a g e a b l e tasks t a s k s that t h a t can c a n be b e accomplished a c c o m p l i s h e d in i n a a logical l o g i c a l and a n d sequential s e q u e n t i a l manner. m a n n e r . The T h e certification c e r t i f i c a t i o n plan p l a n describes d e s c r i b e s the t h e certification c e r t i f i c a t i o n project, p r o j e c t , identifies i d e n t i f i e s the t h e certification c e r t i f i c a t i o n basis b a s i s (applicable ( a p p l i c a b l e regulations r e g u l a t i o n s and a n d any a n y special s p e c i a l conditions c o n d i t i o n s which w h i c h may m a y apply), a p p l y ) , outlines o u t l i n e s the t h e means m e a n s by b y which w h i c h the t h e applicant a p p l i c a n t expects e x p e c t s to t o demonstrate d e m o n s t r a t e compliance c o m p l i a n c e and a n d provides p r o v i d e s a a schedule s c h e d u l e for f o r the t h e project. p r o j e c t . Depending D e p e n d i n g on o n the t h e complexity c o m p l e x i t y and a n d extent e x t e n t of o f the t h e certification c e r t i f i c a t i o n project, p r o j e c t , there t h e r e may m a y be b e a a single s i n g l e certification c e r t i f i c a t i o n plan p l a n for f o r the t h e project p r o j e c t or o r a a top-level t o p - l e v e l plan p l a n for f o r the t h e aircraft a i r c r a f t and a n d a a set s e t of o f related r e l a t e d plans p l a n s for f o r each e a c h of o f the t h e aircraft a i r c r a f t systems. s y s t e m s . The T h e certification c e r t i f i c a t i o n plan(s) p l a n ( s ) for f o r the t h e project p r o j e c t is i s prepared p r e p a r e d by b y the t h e applicant a p p l i c a n t and a n d agreed a g r e e d to t o by b y the t h e certification c e r t i f i c a t i o n authority a u t h o r i t y . . The T h e certification c e r t i f i c a t i o n plan p l a n for f o r an a n aircraft a i r c r a f t or o r installation i n s t a l l a t i o n of o f a a system s y s t e m includes i n c l u d e s the t h e definition d e f i n i t i o n of o f the t h e processes p r o c e s s e s and a n d requirements r e q u i r e m e n t s to t o be b e used u s e d for f o r development d e v e l o p m e n t assurance, a s s u r a n c e , and a n d identifies i d e n t i f i e s the t h e proposed p r o p o s e d means m e a n s of o f compliance c o m p l i a n c e with w i t h the t h e regulations. r e g u l a t i o n s . Since S i n c e many m a n y of o f the t h e development d e v e l o p m e n t assurance a s s u r a n c e activities a c t i v i t i e s occur o c c u r well w e l l before b e f o r e an a n implementation i m p l e m e n t a t i o n is i s available, a v a i l a b l e , early e a r l y coordination c o o r d i n a t i o n with w i t h the t h e certification c e r t i f i c a t i o n authorities a u t h o r i t i e s is i s recommended. r e c o m m e n d e d . An A n early e a r l y certification c e r t i f i c a t i o n plan p l a n may m a y be b e missing m i s s i n g significant s i g n i f i c a n t detail, d e t a i l , necessitating n e c e s s i t a t i n g subsequent s u b s e q u e n t updates. u p d a t e s . Even E v e n so, s o , early e a r l y coordination c o o r d i n a t i o n and a n d approval a p p r o v a l of o f the t h e plan p l a n is i s strongly s t r o n g l y encouraged e n c o u r a g e d . . Early E a r l y certification c e r t i f i c a t i o n planning p l a n n i n g can c a n minimize m i n i m i z e the t h e effects e f f e c t s of o f misinterpretations m i s i n t e r p r e t a t i o n s of o f internal i n t e r n a l requirements, r e q u i r e m e n t s , industry i n d u s t r y standards, s t a n d a r d s , regulations r e g u l a t i o n s and a n d advisory a d v i s o r y materials. m a t e r i a l s . 5.8.2 5 . 8 . 2 Agreement A g r e e m e n t on o n the t h e Proposed P r o p o s e d Means M e a n s of o f Compliance C o m p l i a n c e The T h e applicant a p p l i c a n t proposes p r o p o s e s a a means m e a n s of o f compliance c o m p l i a n c e that t h a t defines d e f i n e s how h o w the t h e development d e v e l o p m e n t of o f the t h e aircraft, a i r c r a f t , system s y s t e m or o r item i t e m will w i l l satisfy s a t i s f y the t h e applicable a p p l i c a b l e certification c e r t i f i c a t i o n basis. b a s i s . The T h e applicant a p p l i c a n t should: s h o u l d : a. a . Submit S u b m i t plans p l a n s to t o the t h e certification c e r t i f i c a t i o n authority a u t h o r i t y for f o r review r e v i e w before b e f o r e relevant r e l e v a n t development d e v e l o p m e n t activities a c t i v i t i e s occur. o c c u r . If I f additional a d d i t i o n a l substantiating s u b s t a n t i a t i n g data d a t a concerning c o n c e r n i n g the t h e plans p l a n s or o r means m e a n s of o f compliance c o m p l i a n c e is i s requested, r e q u e s t e d , it i t should s h o u l d be b e submitted s u b m i t t e d in i n time t i m e to t o allow a l l o w meaningful m e a n i n g f u l review. r e v i e w . b. b . Resolve R e s o l v e issues i s s u e s identified i d e n t i f i e d by b y the t h e certification c e r t i f i c a t i o n authority a u t h o r i t y concerning c o n c e r n i n g the t h e means m e a n s by b y which w h i c h the t h e aircraft a i r c r a f t system s y s t e m will w i l l be b e shown s h o w n to t o comply c o m p l y with w i t h airworthiness a i r w o r t h i n e s s requirements. r e q u i r e m e n t s . c. c . Obtain O b t a i n agreement a g r e e m e n t with w i t h the t h e certification c e r t i f i c a t i o n authority a u t h o r i t y on o n the t h e plans. p l a n s . 5.8.3 5 . 8 . 3 Compliance C o m p l i a n c e Substantiation S u b s t a n t i a t i o n The T h e certification c e r t i f i c a t i o n data d a t a is i s the t h e evidence e v i d e n c e that t h a t the t h e aircraft, a i r c r a f t , system s y s t e m or o r item i t e m satisfies s a t i s f i e s airworthiness a i r w o r t h i n e s s requirements. r e q u i r e m e n t s . This T h i s includes i n c l u d e s both b o t h the t h e data d a t a that t h a t are a r e submitted s u b m i t t e d to t o the t h e certification c e r t i f i c a t i o n authority a u t h o r i t y and a n d the t h e data d a t a required r e q u i r e d to t o be b e retained r e t a i n e d . . The T h e certification c e r t i f i c a t i o n authority a u t h o r i t y determines d e t e r m i n e s the t h e adequacy a d e q u a c y of o f the t h e data d a t a for f o r showing s h o w i n g regulatory r e g u l a t o r y compliance. c o m p l i a n c e . The T h e applicant a p p l i c a n t should s h o u l d develop d e v e l o p a a certification c e r t i f i c a t i o n summary s u m m a r y to t o describe d e s c r i b e how h o w it i t was w a s determined d e t e r m i n e d that t h a t the t h e system, s y s t e m , as a s installed i n s t a l l e d on o n the t h e aircraft, a i r c r a f t , or o r the t h e aircraft a i r c r a f t itself i t s e l f (as ( a s appropriate) a p p r o p r i a t e ) complies c o m p l i e s with w i t h the t h e agreed a g r e e d certification c e r t i f i c a t i o n plan. p l a n . The T h e certification c e r t i f i c a t i o n summary s u m m a r y I I compliance c o m p l i a n c e report r e p o r t should s h o u l d provide p r o v i d e an a n outline o u t l i n e of o f the t h e results r e s u l t s of o f the t h e activities a c t i v i t i e s established e s t a b l i s h e d in i n the t h e certification c e r t i f i c a t i o n plan. p l a n . Any A n y deviation d e v i a t i o n from f r o m the t h e agreed a g r e e d plan p l a n should s h o u l d be b e described d e s c r i b e d together t o g e t h e r with w i t h rationale r a t i o n a l e to t o substantiate s u b s t a n t i a t e the t h e deviation. d e v i a t i o n . In I n addition a d d i t i o n to t o addressing a d d r e s s i n g the t h e content c o n t e n t of o f the t h e certification c e r t i f i c a t i o n plan, p l a n , the t h e certification c e r t i f i c a t i o n summary s u m m a r y should s h o u l d include: i n c l u d e : a. a . A A statement s t a t e m e n t of o f compliance c o m p l i a n c e to t o the t h e airworthiness a i r w o r t h i n e s s requirements. r e q u i r e m e n t s . b. b . An A n outline o u t l i n e of o f any a n y open o p e n problem p r o b l e m reports r e p o r t s that t h a t impact i m p a c t functionality f u n c t i o n a l i t y or o r safety. s a f e t y . 5.8.4 5 . 8 . 4 Certification C e r t i f i c a t i o n Data D a t a Possible P o s s i b l e aircraft a i r c r a f t and a n d system s y s t e m certification c e r t i f i c a t i o n data, d a t a , as a s appropriate, a p p r o p r i a t e , is i s listed l i s t e d in i n Table T a b l e 9. 9 . Table T a b l e 9 9 includes i n c l u d e s a a cross-reference c r o s s - r e f e r e n c e to t o sections s e c t i o n s of o f this t h i s document d o c u m e n t where w h e r e related r e l a t e d information, i n f o r m a t i o n , including i n c l u d i n g information i n f o r m a t i o n about a b o u t the t h e development d e v e l o p m e n t assurance a s s u r a n c e level, l e v e l , can c a n be b e found. f o u n d . granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true} Downloaded D o w n l o a d e d from f r o m SAE S A E International I n t e r n a t i o n a l by b y David D a v i d Merrill, M e r r i l l , Saturday, S a t u r d a y , November N o v e m b e r 12, 1 2 , 2016 2 0 1 6 SAE S A E ARP4754A A R P 4 7 5 4 A Page P a g e 78 7 8 of o f 115 1 1 5 TABLE T A B L E 9 9 - - CERTIFICATION C E R T I F I C A T I O N DATA D A T A CROSS C R O S S REFERENCE R E F E R E N C E Certification C e r t i f i c a t i o n Data D a t a Cross C r o s s Reference R e f e r e n c e Description D e s c r i p t i o n Paragraph P a r a g r a p h Certification C e r t i f i c a t i o n Plan P l a n 5.8.4.1 5 . 8 . 4 . 1 Development D e v e l o p m e n t Plan P l a n 5.8.4.3 5 . 8 . 4 . 3 Design D e s i g n Description D e s c r i p t i o n 5.8.4.4 5 . 8 . 4 . 4 Validat V a l i d a t ion i o n Plan P l a n 5.4.7.1 5 . 4 . 7 . 1 Verificat V e r i f i c a t ion i o n Plan P l a n 5.5.6.1 5 . 5 . 6 . 1 Configuration C o n f i g u r a t i o n Management M a n a g e m e n t Plan P l a n 5.6.2.1 5 . 6 . 2 . 1 Process P r o c e s s Assurance A s s u r a n c e Plan P l a n 5.7.2 5 . 7 . 2 Configurat C o n f i g u r a t ion i o n Index I n d e x 5.8.4.2 5 . 8 . 4 . 2 Functional F u n c t i o n a l Hazard H a z a r d Assessment A s s e s s m e n t 5.1.1 5 . 1 . 1 Preliminary P r e l i m i n a r y Aircraft A i r c r a f t I I System S y s t e m Safety S a f e t y Assessment A s s e s s m e n t 5.1.2 5 . 1 . 2 Aircraft A i r c r a f t I I System S y s t e m Safety S a f e t y Assessment A s s e s s m e n t 5.1.3 5 . 1 . 3 Common C o m m o n Cause C a u s e Analysis A n a l y s i s 5.1.4 5 . 1 . 4 Validat V a l i d a t ion i o n Data D a t a 5.4.7 5 . 4 . 7 Verification V e r i f i c a t i o n Data D a t a 5.5.5 5 . 5 . 5 Evidence E v i d e n c e of o f Configuration C o n f i g u r a t i o n Management M a n a g e m e n t 5.6.2 5 . 6 . 2 Evidence E v i d e n c e of o f Process P r o c e s s Assurance A s s u r a n c e 5.7.4 5 . 7 . 4 Certification C e r t i f i c a t i o n Summary S u m m a r y I I Compliance C o m p l i a n c e Report R e p o r t 5.8.3 5 . 8 . 3 All A l l certification c e r t i f i c a t i o n data d a t a in i n the t h e above a b o v e table t a b l e should s h o u l d be b e generated g e n e r a t e d as a s required. r e q u i r e d . The T h e certification c e r t i f i c a t i o n data d a t a to t o be b e submitted s u b m i t t e d to t o the t h e certification c e r t i f i c a t i o n authority a u t h o r i t y includes i n c l u d e s the t h e certification c e r t i f i c a t i o n plan, p l a n , certification c e r t i f i c a t i o n summary, s u m m a r y , and a n d configuration c o n f i g u r a t i o n index. i n d e x . The T h e certification c e r t i f i c a t i o n data d a t a described d e s c r i b e d in i n this t h i s document d o c u m e n t does d o e s not n o t imply i m p l y a a requirement r e q u i r e m e n t for f o r specific s p e c i f i c arrangement a r r a n g e m e n t or o r grouping g r o u p i n g of o f data d a t a or o r delivery d e l i v e r y format f o r m a t (such ( s u c h as a s paper, p a p e r , computer c o m p u t e r files, f i l e s , or o r remote r e m o t e terminal t e r m i n a l displays). d i s p l a y s ) . Whatever W h a t e v e r form f o r m is i s selected s e l e c t e d by b y the t h e applicant a p p l i c a n t should s h o u l d provide p r o v i d e for f o r efficient e f f i c i e n t retrieval r e t r i e v a l and a n d review r e v i e w by b y the t h e certification c e r t i f i c a t i o n authority a u t h o r i t y as a s required r e q u i r e d by b y regulations r e g u l a t i o n s and a n d laws l a w s in i n effect e f f e c t governing g o v e r n i n g in-service i n - s e r v i c e aircraft. a i r c r a f t . Appendix A p p e n d i x A A highlights h i g h l i g h t s certification c e r t i f i c a t i o n data d a t a recommendations r e c o m m e n d a t i o n s by b y Development D e v e l o p m e n t Assurance A s s u r a n c e Level. L e v e l . 5.8.4.1 5 . 8 . 4 . 1 Certification C e r t i f i c a t i o n Plan P l a n The T h e certification c e r t i f i c a t i o n plan p l a n for f o r an a n aircraft, a i r c r a f t , or o r installing i n s t a l l i n g a a system s y s t e m or o r component c o m p o n e n t on o n an a n aircraft a i r c r a f t should s h o u l d address a d d r e s s both b o t h the t h e system s y s t e m and a n d the t h e aircraft a i r c r a f t environment e n v i r o n m e n t within w i t h i n which w h i c h the t h e system s y s t e m will w i l l be b e used. u s e d . The T h e amount a m o u n t of o f detail d e t a i l contained c o n t a i n e d in i n the t h e plan p l a n should s h o u l d vary v a r y depending d e p e n d i n g on o n the t h e classification c l a s s i f i c a t i o n of o f the t h e associated a s s o c i a t e d aircraft a i r c r a f t hazard(s). h a z a r d ( s ) . Each E a c h plan p l a n should s h o u l d include: i n c l u d e : a. a . A A functional f u n c t i o n a l and a n d operational o p e r a t i o n a l description d e s c r i p t i o n of o f the t h e system s y s t e m and a n d the t h e aircraft a i r c r a f t on o n which w h i c h the t h e system s y s t e m will w i l l be b e installed. i n s t a l l e d . Hardware H a r d w a r e and a n d software s o f t w a r e should s h o u l d be b e addressed a d d r e s s e d in i n this t h i s description. d e s c r i p t i o n . This T h i s description d e s c r i p t i o n should s h o u l d establish e s t a b l i s h the t h e functional, f u n c t i o n a l , physical, p h y s i c a l , and a n d information i n f o r m a t i o n relationship r e l a t i o n s h i p between b e t w e e n the t h e system s y s t e m and a n d other o t h e r aircraft a i r c r a f t systems s y s t e m s and a n d functions f u n c t i o n s . . b. b . A A statement s t a t e m e n t of o f the t h e relationship r e l a t i o n s h i p of o f this t h i s certification c e r t i f i c a t i o n plan p l a n to t o any a n y other o t h e r relevant r e l e v a n t certification c e r t i f i c a t i o n plan(s). p l a n ( s ) . c. c . A A summary s u m m a r y of o f the t h e functional f u n c t i o n a l hazard h a z a r d assessment a s s e s s m e n t (aircraft ( a i r c r a f t hazards, h a z a r d s , Failure F a i l u r e Conditions, C o n d i t i o n s , and a n d classification) c l a s s i f i c a t i o n ) . . d. d . A A summary s u m m a r y of o f the t h e preliminary p r e l i m i n a r y aircraft/system a i r c r a f t / s y s t e m safety s a f e t y assessment a s s e s s m e n t (aircraft/system ( a i r c r a f t / s y s t e m safety s a f e t y objectives o b j e c t i v e s and a n d preliminary p r e l i m i n a r y system s y s t e m development d e v e l o p m e n t assurance a s s u r a n c e levels). l e v e l s ) . granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true} Downloaded D o w n l o a d e d from f r o m SAE S A E International I n t e r n a t i o n a l by b y David D a v i d Merrill, M e r r i l l , Saturday, S a t u r d a y , November N o v e m b e r 12, 1 2 , 2016 2 0 1 6 SAE S A E ARP4754A A R P 4 7 5 4 A Page P a g e 79 7 9 of o f 115 1 1 5 e. e . A A description d e s c r i p t i o n of o f any a n y novel n o v e l or o r unique u n i q u e design d e s i g n features f e a t u r e s that t h a t are a r e planned p l a n n e d to t o be b e used u s e d in i n meeting m e e t i n g the t h e safety s a f e t y objectives. o b j e c t i v e s . f. f . A A description d e s c r i p t i o n of o f the t h e new n e w technologies t e c h n o l o g i e s or o r new n e w technology t e c h n o l o g y applications a p p l i c a t i o n s to t o be b e implemented. i m p l e m e n t e d . g. g . The T h e system s y s t e m certification c e r t i f i c a t i o n basis b a s i s including i n c l u d i n g any a n y special s p e c i a l conditions. c o n d i t i o n s . h. h . The T h e proposed p r o p o s e d methods m e t h o d s of o f showing s h o w i n g compliance c o m p l i a n c e with w i t h the t h e certification c e r t i f i c a t i o n basis, b a s i s , including i n c l u d i n g an a n outline o u t l i n e of o f the t h e anticipated a n t i c i p a t e d development d e v e l o p m e n t assurance a s s u r a n c e processes p r o c e s s e s (safety ( s a f e t y assessment, a s s e s s m e n t , validation, v a l i d a t i o n , verification, v e r i f i c a t i o n , configuration c o n f i g u r a t i o n management m a n a g e m e n t , , and a n d process p r o c e s s assurance) a s s u r a n c e ) . . i. i . A A list l i s t of o f the t h e data d a t a to t o be b e submitted s u b m i t t e d and a n d the t h e data d a t a to t o be b e retained r e t a i n e d under u n d e r configuration c o n f i g u r a t i o n control. c o n t r o l . j j . . The T h e approximate a p p r o x i m a t e sequence s e q u e n c e and a n d schedule s c h e d u l e for f o r certification c e r t i f i c a t i o n events. e v e n t s . k. k . Identification I d e n t i f i c a t i o n of o f the t h e personnel p e r s o n n e l or o r specific s p e c i f i c organization o r g a n i z a t i o n responsible r e s p o n s i b l e for f o r certification c e r t i f i c a t i o n coordination. c o o r d i n a t i o n . 5.8.4.2 5 . 8 . 4 . 2 Configuration C o n f i g u r a t i o n Index I n d e x The T h e system s y s t e m configuration c o n f i g u r a t i o n index i n d e x identifies i d e n t i f i e s all a l l of o f the t h e configuration c o n f i g u r a t i o n items i t e m s that, t h a t , together, t o g e t h e r , comprise c o m p r i s e the t h e system. s y s t e m . In I n addition a d d i t i o n the t h e configuration c o n f i g u r a t i o n index i n d e x identifies i d e n t i f i e s procedures p r o c e d u r e s and a n d limitations l i m i t a t i o n s that t h a t are a r e integral i n t e g r a l to t o system s y s t e m safety s a f e t y . . Any A n y system s y s t e m design d e s i g n features f e a t u r e s or o r capabilities c a p a b i l i t i e s provided p r o v i d e d in i n excess e x c e s s of o f those t h o s e required r e q u i r e d to t o establish e s t a b l i s h system s y s t e m safety s a f e t y under u n d e r the t h e applicable a p p l i c a b l e regulations r e g u l a t i o n s should s h o u l d be b e identified. i d e n t i f i e d . A A typical t y p i c a l system s y s t e m configuration c o n f i g u r a t i o n index i n d e x will w i l l include i n c l u d e the t h e following f o l l o w i n g information: i n f o r m a t i o n : a. a . Configuration C o n f i g u r a t i o n identification i d e n t i f i c a t i o n of o f each e a c h system s y s t e m item, i t e m , b. b . Assoc A s s o c iated i a t e d item i t e m configuration c o n f i g u r a t i o n identification i d e n t i f i c a t i o n (hardware/software) ( h a r d w a r e / s o f t w a r e ) , , c. c . Interconnection I n t e r c o n n e c t i o n of o f items, i t e m s , d. d . Required R e q u i r e d interfaces i n t e r f a c e s with w i t h other o t h e r systems, s y s t e m s , e. e . Safety-related S a f e t y - r e l a t e d operational o p e r a t i o n a l or o r maintenance m a i n t e n a n c e procedures p r o c e d u r e s and a n d limitations. l i m i t a t i o n s . When W h e n applicable, a p p l i c a b l e , information i n f o r m a t i o n describing d e s c r i b i n g permissible p e r m i s s i b l e interchangeability i n t e r c h a n g e a b i l i t y or o r intermixability i n t e r m i x a b i l i t y of o f alternate a l t e r n a t e items i t e m s within w i t h i n the t h e system s y s t e m should s h o u l d be b e included. i n c l u d e d . 5.8.4.3 5 . 8 . 4 . 3 Development D e v e l o p m e n t Plan P l a n The T h e development d e v e l o p m e n t plan p l a n should s h o u l d identify i d e n t i f y the t h e top-level t o p - l e v e l processes p r o c e s s e s planned p l a n n e d for f o r use, u s e , the t h e key k e y events e v e n t s that t h a t mark m a r k the t h e planned p l a n n e d development d e v e l o p m e n t cycle, c y c l e , and a n d the t h e organizational o r g a n i z a t i o n a l structure s t r u c t u r e and a n d key k e y individual i n d i v i d u a l responsibilities r e s p o n s i b i l i t i e s supporting s u p p o r t i n g the t h e development. d e v e l o p m e n t . The T h e processes p r o c e s s e s and a n d events e v e n t s should s h o u l d be b e described d e s c r i b e d in i n sufficient s u f f i c i e n t detail d e t a i l to t o establish e s t a b l i s h their t h e i r relative r e l a t i v e significance s i g n i f i c a n c e to t o the t h e aircraft/system a i r c r a f t / s y s t e m development d e v e l o p m e n t , , their t h e i r relative r e l a t i v e timing t i m i n g and a n d interdependencies, i n t e r d e p e n d e n c i e s , and a n d the t h e nature n a t u r e of o f the t h e results r e s u l t s expected e x p e c t e d at a t event e v e n t or o r process p r o c e s s completion. c o m p l e t i o n . For F o r complex c o m p l e x systems, s y s t e m s , it i t is i s advisable a d v i s a b l e to t o provide p r o v i d e descriptions d e s c r i p t i o n s of o f the t h e specific s p e c i f i c development d e v e l o p m e n t processes p r o c e s s e s that t h a t are a r e planned p l a n n e d to t o manage m a n a g e this t h i s complexity c o m p l e x i t y at a t the t h e aircraft/system a i r c r a f t / s y s t e m level. l e v e l . This T h i s development d e v e l o p m e n t plan p l a n should s h o u l d provide p r o v i d e suffic s u f f i c ient i e n t detail d e t a i l to t o achieve a c h i e v e a a mutual m u t u a l understanding u n d e r s t a n d i n g of o f the t h e key k e y elements e l e m e n t s and a n d their t h e i r relationships. r e l a t i o n s h i p s . 5.8.4.4 5 . 8 . 4 . 4 Design D e s i g n Description D e s c r i p t i o n A A design d e s i g n description d e s c r i p t i o n may m a y also a l s o need n e e d to t o be b e provided p r o v i d e d to t o facilitate f a c i l i t a t e a a common c o m m o n understanding u n d e r s t a n d i n g of: o f : the t h e intended i n t e n d e d aircraft-level a i r c r a f t - l e v e l functionality f u n c t i o n a l i t y provided p r o v i d e d or o r supported s u p p o r t e d by b y the t h e system(s) s y s t e m ( s ) , , the t h e anticipated a n t i c i p a t e d system s y s t e m operating o p e r a t i n g environment(s) e n v i r o n m e n t ( s ) , , and a n d the t h e specific s p e c i f i c intended i n t e n d e d capabilities c a p a b i l i t i e s of o f the t h e system(s) s y s t e m ( s ) as a s installed i n s t a l l e d on o n the t h e aircraft. a i r c r a f t . granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true} Downloaded D o w n l o a d e d from f r o m SAE S A E International I n t e r n a t i o n a l by b y David D a v i d Merrill, M e r r i l l , Saturday, S a t u r d a y , November N o v e m b e r 12, 1 2 , 2016 2 0 1 6 SAE S A E ARP4754A A R P 4 7 5 4 A Page P a g e 80 8 0 of o f 115 1 1 5 The T h e description d e s c r i p t i o n should s h o u l d also a l s o identify i d e n t i f y primary p r i m a r y fault f a u l t or o r failure f a i l u r e containment c o n t a i n m e n t means. m e a n s . New N e w or o r novel n o v e l design d e s i g n elements e l e m e n t s should s h o u l d be b e identified; i d e n t i f i e d ; along a l o n g with w i t h specific s p e c i f i c architectural a r c h i t e c t u r a l features f e a t u r e s and a n d design d e s i g n elements e l e m e n t s that t h a t perform p e r f o r m a a specific s p e c i f i c role r o l e in i n establishing e s t a b l i s h i n g or o r maintaining m a i n t a i n i n g aircraft a i r c r a f t system s y s t e m safety. s a f e t y . 6. 6 . MODIFICATIONS M O D I F I C A T I O N S TO T O AIRCRAFT A I R C R A F T OR O R SYSTEMS S Y S T E M S The T h e objective o b j e c t i v e of o f this t h i s section s e c t i o n is i s to t o describe d e s c r i b e how h o w the t h e material m a t e r i a l in i n this t h i s document d o c u m e n t could c o u l d be b e applied a p p l i e d when w h e n modifying m o d i f y i n g an a n item, i t e m , system s y s t e m or o r aircraft. a i r c r a f t . One O n e of o f the t h e goals g o a l s of o f the t h e development d e v e l o p m e n t and a n d safety s a f e t y assessment a s s e s s m e n t processes p r o c e s s e s is i s to t o maintain, m a i n t a i n , or o r improve i m p r o v e on, o n , the t h e existing e x i s t i n g safety s a f e t y level l e v e l provided p r o v i d e d by b y the t h e original o r i g i n a l certification c e r t i f i c a t i o n basis. b a s i s . Thus, T h u s , a a modification m o d i f i c a t i o n needs n e e d s to t o be b e controlled c o n t r o l l e d in i n such s u c h a a way w a y that t h a t the t h e effects e f f e c t s of o f a a modification m o d i f i c a t i o n are a r e known, k n o w n , fully f u l l y validated v a l i d a t e d and a n d verified. v e r i f i e d . A A modification m o d i f i c a t i o n to t o an a n item, i t e m , system s y s t e m or o r aircraft a i r c r a f t may m a y be b e undertaken u n d e r t a k e n for f o r a a number n u m b e r of o f reasons, r e a s o n s , ranging r a n g i n g from f r o m adding a d d i n g new n e w functionality f u n c t i o n a l i t y to t o responding r e s p o n d i n g to t o a a required r e q u i r e d corrective c o r r e c t i v e action. a c t i o n . The T h e modification m o d i f i c a t i o n process p r o c e s s should s h o u l d form f o r m part p a r t of o f an a n overall o v e r a l l safety s a f e t y management m a n a g e m e n t program. p r o g r a m . Differences D i f f e r e n c e s exist e x i s t between b e t w e e n the t h e U.S. U . S . and a n d European E u r o p e a n approaches a p p r o a c h e s to t o assuring a s s u r i n g modifications m o d i f i c a t i o n s to t o aircraft a i r c r a f t and a n d systems. s y s t e m s . Differences D i f f e r e n c e s are a r e highlighted h i g h l i g h t e d in i n this t h i s section s e c t i o n where w h e r e deemed d e e m e d necessary. n e c e s s a r y . The T h e certification c e r t i f i c a t i o n basis b a s i s defines d e f i n e s the t h e applicable a p p l i c a b l e requirements, r e q u i r e m e n t s , regulations, r e g u l a t i o n s , special s p e c i a l conditions, c o n d i t i o n s , and a n d other o t h e r appropriate a p p r o p r i a t e regulatory r e g u l a t o r y material. m a t e r i a l . An A n aircraft a i r c r a f t receives r e c e i v e s its i t s Type T y p e Certificate C e r t i f i c a t e (TC), ( T C ) , when w h e n an a n applicant a p p l i c a n t has h a s demonstrated d e m o n s t r a t e d to t o a a certification c e r t i f i c a t i o n authority a u t h o r i t y that t h a t the t h e aircraft a i r c r a f t has h a s been b e e n designed d e s i g n e d in i n accordance a c c o r d a n c e with w i t h the t h e requirements r e q u i r e m e n t s and a n d regulations r e g u l a t i o n s that t h a t were w e r e applicable a p p l i c a b l e to t o aircraft a i r c r a f t as a s identified i d e n t i f i e d within w i t h i n the t h e type t y p e certification c e r t i f i c a t i o n basis. b a s i s . The T h e holder h o l d e r of o f the t h e type t y p e certificate c e r t i f i c a t e may m a y make m a k e changes c h a n g e s to t o the t h e type t y p e design. d e s i g n . Depending D e p e n d i n g on o n the t h e type t y p e certificate c e r t i f i c a t e holder's h o l d e r ' s individual i n d i v i d u a l aviation a v i a t i o n authority a u t h o r i t y rules, r u l e s , this t h i s may m a y be b e conducted c o n d u c t e d as a s a a TC T C Modification, M o d i f i c a t i o n , or o r as a s an a n Amended A m e n d e d Type T y p e Certificate C e r t i f i c a t e (ATC) ( A T C ) modification. m o d i f i c a t i o n . When W h e n introducing i n t r o d u c i n g an a n item, i t e m , system s y s t e m or o r aircraft a i r c r a f t modification, m o d i f i c a t i o n , the t h e potential p o t e n t i a l effects e f f e c t s in i n the t h e certification c e r t i f i c a t i o n basis b a s i s should s h o u l d be b e assessed a s s e s s e d and a n d classified c l a s s i f i e d as a s either e i t h e r "minor'' " m i n o r ' ' or o r "major'', " m a j o r ' ' , as a s defined d e f i n e d in i n the t h e relevant r e l e v a n t paragraph p a r a g r a p h of o f 14 1 4 CFR/ C F R / IR I R Part P a r t 21. 2 1 . Approval A p p r o v a l of o f the t h e modification m o d i f i c a t i o n classification c l a s s i f i c a t i o n should s h o u l d be b e obtained o b t a i n e d from f r o m the t h e relevant r e l e v a n t airworthiness a i r w o r t h i n e s s authority a u t h o r i t y . . If I f the t h e applicant a p p l i c a n t for f o r a a "major'' " m a j o r ' ' modification m o d i f i c a t i o n is i s not n o t the t h e type t y p e certificate c e r t i f i c a t e holder, h o l d e r , this t h i s will w i l l usually u s u a l l y require r e q u i r e a a Supplemental S u p p l e m e n t a l Type T y p e Certificate C e r t i f i c a t e (STC) ( S T C ) application a p p l i c a t i o n to t o be b e made. m a d e . The T h e TC T C modification m o d i f i c a t i o n I I ATC A T C I I STC S T C is i s issued i s s u e d when w h e n the t h e applicant a p p l i c a n t has h a s demonstrated d e m o n s t r a t e d to t o a a certification c e r t i f i c a t i o n authority a u t h o r i t y that t h a t the t h e design d e s i g n change c h a n g e will w i l l ensure e n s u r e that t h a t the t h e modified m o d i f i e d aircraft a i r c r a f t will w i l l continue c o n t i n u e to t o be b e in i n compliance c o m p l i a n c e with w i t h the t h e requirements r e q u i r e m e n t s I I regulations r e g u l a t i o n s that t h a t are a r e applicable a p p l i c a b l e to t o that t h a t aircraft. a i r c r a f t . There T h e r e is i s also a l s o a a regulatory r e g u l a t o r y process p r o c e s s for f o r authorization a u t h o r i z a t i o n of o f equipment. e q u i p m e n t . This T h i s process p r o c e s s is i s known k n o w n as a s a a (European) ( E u r o p e a n ) Technical T e c h n i c a l Standard S t a n d a r d Order O r d e r (TSO ( T S O I I ETSO). E T S O ) . It I t allows a l l o w s equipment e q u i p m e n t to t o be b e integrated i n t e g r a t e d into i n t o several s e v e r a l aircraft a i r c r a f t types. t y p e s . A A TSO T S O /ETSO / E T S O approval a p p r o v a l signifies s i g n i f i e s a a minimum m i n i m u m performance p e r f o r m a n c e standard s t a n d a r d for f o r the t h e equipment. e q u i p m e n t . Integration I n t e g r a t i o n of o f the t h e equipment e q u i p m e n t into i n t o an a n aircraft a i r c r a f t system s y s t e m is i s undertaken u n d e r t a k e n through t h r o u g h the t h e appropriate a p p r o p r i a t e TC, T C , ATC A T C or o r STC S T C processes. p r o c e s s e s . If I f approval a p p r o v a l is i s sought s o u g h t for f o r a a change c h a n g e to t o a a TSO/ETSO T S O / E T S O item i t e m it i t should s h o u l d be b e assessed a s s e s s e d and a n d classified c l a s s i f i e d as a s either e i t h e r "minor" " m i n o r " or o r "major", " m a j o r " , as a s indicated i n d i c a t e d above. a b o v e . The T h e TSO T S O I I ETSO E T S O holder h o l d e r can c a n approve a p p r o v e Minor M i n o r changes c h a n g e s (as ( a s an a n appropriately a p p r o p r i a t e l y approved a p p r o v e d production p r o d u c t i o n organization, o r g a n i z a t i o n , e.g. e . g . IR I R Part P a r t 21 2 1 Subpart S u b p a r t G G POA, P O A , with w i t h agreed a g r e e d "alternative" " a l t e r n a t i v e " design d e s i g n procedures) p r o c e d u r e s ) without w i t h o u t need n e e d for f o r any a n y further f u r t h e r involvement i n v o l v e m e n t of o f the t h e authorities. a u t h o r i t i e s . However, H o w e v e r , all a l l "major'' " m a j o r ' ' modifications m o d i f i c a t i o n s should s h o u l d be b e submitted s u b m i t t e d to t o the t h e relevant r e l e v a n t airworthiness a i r w o r t h i n e s s authority a u t h o r i t y for f o r approval. a p p r o v a l . 6.1 6 . 1 Modification M o d i f i c a t i o n Process P r o c e s s Overview O v e r v i e w The T h e applicant a p p l i c a n t proposes p r o p o s e s a a method m e t h o d or o r means m e a n s of o f compliance c o m p l i a n c e that t h a t defines d e f i n e s how h o w it i t will w i l l be b e demonstrated d e m o n s t r a t e d that t h a t the t h e modified m o d i f i e d item, i t e m , system s y s t e m or o r aircraft a i r c r a f t satisfies s a t i s f i e s the t h e certification c e r t i f i c a t i o n basis. b a s i s . Since S i n c e it i t is i s possible p o s s i b l e that t h a t the t h e certification c e r t i f i c a t i o n basis b a s i s may m a y change c h a n g e from f r o m the t h e original o r i g i n a l type t y p e certification, c e r t i f i c a t i o n , it i t will w i l l be b e necessary n e c e s s a r y to t o assess a s s e s s the t h e proposed p r o p o s e d means m e a n s of o f showing s h o w i n g compliance c o m p l i a n c e to t o ensure e n s u r e compatibility c o m p a t i b i l i t y with w i t h the t h e agreed a g r e e d certification c e r t i f i c a t i o n basis. b a s i s . Note N o t e that t h a t these t h e s e methods m e t h o d s or o r means m e a n s of o f compliance c o m p l i a n c e for f o r modifying m o d i f y i n g aircraft a i r c r a f t do d o not n o t deviate d e v i a t e from f r o m the t h e established e s t a b l i s h e d item i t e m or o r system s y s t e m development d e v e l o p m e n t process p r o c e s s as a s represented r e p r e s e n t e d in i n the t h e previous p r e v i o u s sections s e c t i o n s of o f this t h i s document. d o c u m e n t . The T h e objectives o b j e c t i v e s of o f a a modification m o d i f i c a t i o n process p r o c e s s are a r e to: t o : a. a . Develop D e v e l o p a a modification m o d i f i c a t i o n management m a n a g e m e n t process p r o c e s s and a n d co-ordinate c o - o r d i n a t e it i t with w i t h all a l l stakeholders, s t a k e h o l d e r s , b. b . Perform P e r f o r m modifications m o d i f i c a t i o n s using u s i n g the t h e approved a p p r o v e d process, p r o c e s s , c. c . Conduct C o n d u c t and a n d document d o c u m e n t an a n initial i n i t i a l modification m o d i f i c a t i o n impact i m p a c t analysis, a n a l y s i s , d. d . Determine D e t e r m i n e a a classification c l a s s i f i c a t i o n for f o r the t h e modification m o d i f i c a t i o n (i.e. ( i . e . "minor " m i n o r I I major''), m a j o r ' ' ) , e. e . ntegrate n t e g r a t e the t h e modification m o d i f i c a t i o n into i n t o the t h e item, i t e m , system s y s t e m and a n d aircraft a i r c r a f t as a s required, r e q u i r e d , granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true} Downloaded D o w n l o a d e d from f r o m SAE S A E International I n t e r n a t i o n a l by b y David D a v i d Merrill, M e r r i l l , Saturday, S a t u r d a y , November N o v e m b e r 12, 1 2 , 2016 2 0 1 6 SAE S A E ARP4754A A R P 4 7 5 4 A Page P a g e 81 8 1 of o f 115 1 1 5 f. f . Conduct C o n d u c t and a n d document d o c u m e n t a a modification m o d i f i c a t i o n accomplishment a c c o m p l i s h m e n t summary s u m m a r y I I compliance c o m p l i a n c e substantiation, s u b s t a n t i a t i o n , g. g . Maintain M a i n t a i n configuration c o n f i g u r a t i o n control c o n t r o l of o f data d a t a related r e l a t e d to t o the t h e modification, m o d i f i c a t i o n , see s e e Section S e c t i o n 5.6. 5 . 6 . 6.2 6 . 2 Modification M o d i f i c a t i o n Management M a n a g e m e n t Process P r o c e s s The T h e modification m o d i f i c a t i o n management m a n a g e m e n t process p r o c e s s provides p r o v i d e s a a structured s t r u c t u r e d means m e a n s to t o control c o n t r o l and a n d co-ordinate c o - o r d i n a t e activities a c t i v i t i e s between b e t w e e n stakeholders. s t a k e h o l d e r s . For F o r example, e x a m p l e , the t h e applicant, a p p l i c a n t , system s y s t e m integrator i n t e g r a t o r and a n d item i t e m developer d e v e l o p e r would w o u l d each e a c h need n e e d a a defined d e f i n e d modification m o d i f i c a t i o n management m a n a g e m e n t process p r o c e s s that t h a t is i s coordinated c o o r d i n a t e d with w i t h the t h e modification m o d i f i c a t i o n process p r o c e s s of o f other o t h e r stakeholders s t a k e h o l d e r s . . The T h e process p r o c e s s documentation d o c u m e n t a t i o n should s h o u l d include: i n c l u d e : a. a . Description D e s c r i p t i o n (why, ( w h y , what, w h a t , how h o w and a n d schedule) s c h e d u l e ) of o f the t h e proposed p r o p o s e d modifications m o d i f i c a t i o n s to t o items, i t e m s , systems s y s t e m s or o r the t h e aircraft, a i r c r a f t , b. b . Results R e s u l t s of o f an a n initial i n i t i a l modification m o d i f i c a t i o n impact i m p a c t analysis, a n a l y s i s , c. c . The T h e proposed p r o p o s e d modification m o d i f i c a t i o n implementation i m p l e m e n t a t i o n strategy, s t r a t e g y , d. d . Implementation I m p l e m e n t a t i o n and a n d integration i n t e g r a t i o n of o f the t h e modification m o d i f i c a t i o n using u s i n g the t h e agreed a g r e e d implementation i m p l e m e n t a t i o n strategy, s t r a t e g y , e. e . Results R e s u l t s of o f verification v e r i f i c a t i o n activities a c t i v i t i e s on o n the t h e implemented i m p l e m e n t e d modification, m o d i f i c a t i o n , f. f . Results R e s u l t s of o f the t h e final f i n a l modification m o d i f i c a t i o n accomplishment a c c o m p l i s h m e n t summary s u m m a r y activities, a c t i v i t i e s , g. g . Updates U p d a t e s to t o the t h e aircraft a i r c r a f t configuration c o n f i g u r a t i o n management m a n a g e m e n t data d a t a on o n any a n y modified m o d i f i e d item i t e m or o r system, s y s t e m , see s e e section s e c t i o n 5.6. 5 . 6 . 6.3 6 . 3 Modification M o d i f i c a t i o n Impact I m p a c t Analysis A n a l y s i s When W h e n a a modification m o d i f i c a t i o n is i s proposed p r o p o s e d to t o an a n item, i t e m , system s y s t e m or o r aircraft a i r c r a f t an a n initial i n i t i a l impact i m p a c t analysis a n a l y s i s should s h o u l d be b e performed p e r f o r m e d and a n d should s h o u l d include i n c l u d e an a n evaluation e v a l u a t i o n of o f the t h e impact i m p a c t of o f the t h e modification m o d i f i c a t i o n on o n the t h e original o r i g i n a l safety s a f e t y assessments a s s e s s m e n t s . . For F o r instance, i n s t a n c e , if i f an a n aircraft a i r c r a f t level l e v e l modification m o d i f i c a t i o n is i s proposed, p r o p o s e d , the t h e validity v a l i d i t y of o f the t h e assumptions a s s u m p t i o n s made m a d e for f o r the t h e architectural a r c h i t e c t u r a l forms f o r m s used, u s e d , the t h e development d e v e l o p m e n t assurance a s s u r a n c e level l e v e l allocations a l l o c a t i o n s and a n d its i t s installation i n s t a l l a t i o n should s h o u l d be b e reviewed. r e v i e w e d . The T h e following f o l l o w i n g are a r e examples e x a m p l e s of o f areas a r e a s that t h a t could c o u l d adversely a d v e r s e l y affect a f f e c t aircraft a i r c r a f t safety s a f e t y or o r operation: o p e r a t i o n : • • Safety S a f e t y related r e l a t e d information i n f o r m a t i o n is i s changed. c h a n g e d . For F o r example: e x a m p l e : Failure F a i l u r e condition c o n d i t i o n classification(s) c l a s s i f i c a t i o n ( s ) changed c h a n g e d or o r added, a d d e d , Development D e v e l o p m e n t Assurance A s s u r a n c e Level L e v e l Safety S a f e t y margins m a r g i n s are a r e reduced, r e d u c e d , Architectural A r c h i t e c t u r a l Assumptions, A s s u m p t i o n s , Validity V a l i d i t y of o f the t h e environmental e n v i r o n m e n t a l qualification q u a l i f i c a t i o n test t e s t results r e s u l t s is i s affected, a f f e c t e d , V&V V & V methods m e t h o d s or o r procedures p r o c e d u r e s are a r e modified. m o d i f i e d . • • Operational O p e r a t i o n a l or o r procedural p r o c e d u r a l characteristics c h a r a c t e r i s t i c s are a r e changed. c h a n g e d . For F o r example: e x a m p l e : Aircraft A i r c r a f t operational o p e r a t i o n a l or o r airworthiness a i r w o r t h i n e s s characteristics, c h a r a c t e r i s t i c s , Flight F l i g h t crew c r e w procedures, p r o c e d u r e s , Increased I n c r e a s e d pilot p i l o t workload, w o r k l o a d , Situational S i t u a t i o n a l awareness, a w a r e n e s s , warnings, w a r n i n g s , cautions c a u t i o n s or o r advisories, a d v i s o r i e s , Displayed D i s p l a y e d information i n f o r m a t i o n to t o make m a k e flight f l i g h t decisions. d e c i s i o n s . granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true} Downloaded D o w n l o a d e d from f r o m SAE S A E International I n t e r n a t i o n a l by b y David D a v i d Merrill, M e r r i l l , Saturday, S a t u r d a y , November N o v e m b e r 12, 1 2 , 2016 2 0 1 6 SAE S A E ARP4754A A R P 4 7 5 4 A Page P a g e 82 8 2 of o f 115 1 1 5 The T h e primary p r i m a r y result r e s u l t of o f the t h e initial i n i t i a l impact i m p a c t analysis a n a l y s i s should s h o u l d be b e the t h e Failure F a i l u r e Condition C o n d i t i o n classification(s) c l a s s i f i c a t i o n ( s ) and a n d the t h e system(s) s y s t e m ( s ) impacted i m p a c t e d by b y the t h e proposed p r o p o s e d modification. m o d i f i c a t i o n . Additionally A d d i t i o n a l l y the t h e impact i m p a c t analysis a n a l y s i s identifies i d e n t i f i e s the t h e change c h a n g e classification c l a s s i f i c a t i o n (i.e. ( i . e . "major/minor" " m a j o r / m i n o r " change) c h a n g e ) . . The T h e modification m o d i f i c a t i o n impact i m p a c t analysis a n a l y s i s should s h o u l d be b e confirmed c o n f i r m e d or o r updated u p d a t e d once o n c e verification v e r i f i c a t i o n activities a c t i v i t i e s have h a v e been b e e n completed. c o m p l e t e d . Results R e s u l t s of o f these t h e s e analyses a n a l y s e s should s h o u l d be b e reflected r e f l e c t e d in: i n : a. a . The T h e appropriate a p p r o p r i a t e certification c e r t i f i c a t i o n documentation d o c u m e n t a t i o n , , b. b . The T h e verification v e r i f i c a t i o n activities a c t i v i t i e s needed n e e d e d to t o assure a s s u r e that t h a t no n o adverse a d v e r s e effects e f f e c t s are a r e introduced i n t r o d u c e d during d u r i n g the t h e modification m o d i f i c a t i o n process, p r o c e s s , c. c . The T h e modification m o d i f i c a t i o n summary s u m m a r y in i n which w h i c h the t h e impact i m p a c t of o f the t h e implemented i m p l e m e n t e d modifications m o d i f i c a t i o n s is i s confirmed. c o n f i r m e d . A A rationale r a t i o n a l e for f o r the t h e level l e v e l of o f re-analysis r e - a n a l y s i s undertaken u n d e r t a k e n should s h o u l d be b e provided p r o v i d e d based b a s e d on o n factors f a c t o r s such s u c h as a s the t h e operational o p e r a t i o n a l history h i s t o r y and a n d the t h e required r e q u i r e d level l e v e l of o f assurance a s s u r a n c e of o f the t h e item, i t e m , system s y s t e m or o r aircraft a i r c r a f t being b e i n g modified. m o d i f i e d . It I t may m a y be b e necessary n e c e s s a r y to t o repeat r e p e a t a a significant s i g n i f i c a n t part p a r t of o f the t h e safety s a f e t y assessment a s s e s s m e n t process p r o c e s s as a s a a result r e s u l t of o f a a modification. m o d i f i c a t i o n . In I n particular, p a r t i c u l a r , if i f the t h e item i t e m or o r system s y s t e m being b e i n g modified m o d i f i e d was w a s included i n c l u d e d within w i t h i n a a Common C o m m o n Cause C a u s e Analysis A n a l y s i s to t o demonstrate d e m o n s t r a t e full f u l l independence i n d e p e n d e n c e from f r o m other o t h e r items i t e m s or o r systems, s y s t e m s , in i n order o r d e r to t o substantiate s u b s t a n t i a t e a a lower l o w e r development d e v e l o p m e n t assurance a s s u r a n c e level l e v e l assignment a s s i g n m e n t prior p r i o r to t o initial i n i t i a l certification, c e r t i f i c a t i o n , that t h a t CCA C C A will w i l l require r e q u i r e re-investigation r e - i n v e s t i g a t i o n to t o ensure e n s u r e that t h a t its i t s conclusion c o n c l u s i o n remains r e m a i n s valid. v a l i d . Modification, M o d i f i c a t i o n , including i n c l u d i n g modification m o d i f i c a t i o n impact i m p a c t analysis a n a l y s i s and a n d the t h e design d e s i g n activities a c t i v i t i e s working w o r k i n g towards t o w a r d s an a n acceptable a c c e p t a b l e implementation i m p l e m e n t a t i o n of o f a a modification, m o d i f i c a t i o n , is i s an a n iterative i t e r a t i v e process. p r o c e s s . The T h e initial i n i t i a l impact i m p a c t analysis a n a l y s i s may m a y have h a v e to t o be b e revisited r e v i s i t e d a a number n u m b e r of o f times t i m e s before b e f o r e the t h e final f i n a l confirmatory c o n f i r m a t o r y impact i m p a c t analysis a n a l y s i s can c a n be b e produced. p r o d u c e d . 6.4 6 . 4 Modification M o d i f i c a t i o n Categor C a t e g o r ization i z a t i o n and a n d Administration A d m i n i s t r a t i o n Aviation A v i a t i o n Author A u t h o r ity i t y requirements r e q u i r e m e n t s and a n d regulations r e g u l a t i o n s categorize c a t e g o r i z e aircraft a i r c r a f t modifications m o d i f i c a t i o n s into i n t o either e i t h e r "minor " m i n o r or o r major'' m a j o r ' ' changes. c h a n g e s . These T h e s e changes c h a n g e s need n e e d to t o be b e managed m a n a g e d via v i a the t h e processes p r o c e s s e s identified i d e n t i f i e d above. a b o v e . However, H o w e v e r , for f o r any a n y modification m o d i f i c a t i o n it i t will w i l l be b e shown s h o w n that: t h a t : a. a . The T h e modified m o d i f i e d item, i t e m , system s y s t e m or o r aircraft a i r c r a f t meets m e e t s the t h e applicable a p p l i c a b l e certification c e r t i f i c a t i o n requirements, r e q u i r e m e n t s , regulations r e g u l a t i o n s and a n d specifications s p e c i f i c a t i o n s and a n d environmental e n v i r o n m e n t a l requirements, r e q u i r e m e n t s , b. b . Any A n y airworthiness a i r w o r t h i n e s s provisions p r o v i s i o n s not n o t complied c o m p l i e d with w i t h are a r e compensated c o m p e n s a t e d for f o r by b y factors f a c t o r s that t h a t provide p r o v i d e an a n equivalent e q u i v a l e n t level l e v e l of o f safety s a f e t y and, a n d , c. c . No N o feature f e a t u r e or o r characteristic c h a r a c t e r i s t i c makes m a k e s the t h e item, i t e m , system s y s t e m or o r aircraft a i r c r a f t unsafe u n s a f e for f o r the t h e uses u s e s for f o r which w h i c h certification c e r t i f i c a t i o n is i s requested. r e q u e s t e d . 6.5 6 . 5 Evidence E v i d e n c e for f o r Acceptability A c c e p t a b i l i t y of o f a a Modification: M o d i f i c a t i o n : If I f credit c r e d i t is i s sought s o u g h t for f o r development d e v e l o p m e n t assurance a s s u r a n c e activities a c t i v i t i e s performed p e r f o r m e d on o n a a previously p r e v i o u s l y qualified q u a l i f i e d item i t e m or o r certificated c e r t i f i c a t e d system s y s t e m "baseline", " b a s e l i n e " , the t h e proposed p r o p o s e d item i t e m or o r system s y s t e m and a n d its i t s certification c e r t i f i c a t i o n data d a t a should s h o u l d be b e traceable t r a c e a b l e to t o that t h a t baseline. b a s e l i n e . In I n some s o m e cases, c a s e s , such s u c h evidence e v i d e n c e may m a y not n o t be b e adequate. a d e q u a t e . The T h e following f o l l o w i n g paragraphs p a r a g r a p h s provide p r o v i d e guidelines g u i d e l i n e s for: f o r : a. a . Supplement S u p p l e m e n t ing i n g the t h e existing e x i s t i n g certification c e r t i f i c a t i o n data d a t a to t o support s u p p o r t certification c e r t i f i c a t i o n of o f modifications m o d i f i c a t i o n s to t o existing e x i s t i n g items i t e m s or o r systems s y s t e m s or o r new n e w installations i n s t a l l a t i o n s of o f previously p r e v i o u s l y qualified q u a l i f i e d items i t e m s or o r systems, s y s t e m s , b. b . Using U s i n g service s e r v i c e history h i s t o r y obtained o b t a i n e d from f r o m an a n installation i n s t a l l a t i o n on o n one o n e aircraft a i r c r a f t type t y p e to t o support s u p p o r t the t h e qualification q u a l i f i c a t i o n of o f that t h a t item i t e m or o r system s y s t e m certification c e r t i f i c a t i o n on o n a a different d i f f e r e n t aircraft a i r c r a f t type t y p e or o r a a similar s i m i l a r item i t e m or o r system s y s t e m on o n the t h e same s a m e aircraft a i r c r a f t type. t y p e . To T o supplement s u p p l e m e n t existing e x i s t i n g certification c e r t i f i c a t i o n data, d a t a , the t h e applicant a p p l i c a n t may: m a y : a. a . Evaluate E v a l u a t e the t h e data d a t a available a v a i l a b l e from f r o m the t h e previous p r e v i o u s certification c e r t i f i c a t i o n to t o determine d e t e r m i n e which w h i c h certification c e r t i f i c a t i o n objectives o b j e c t i v e s are a r e satisfied s a t i s f i e d for f o r the t h e new n e w application a p p l i c a t i o n and a n d which w h i c h objectives o b j e c t i v e s require r e q u i r e additional a d d i t i o n a l considerat c o n s i d e r a t ion. i o n . This T h i s activity a c t i v i t y forms f o r m s part p a r t of o f the t h e modification m o d i f i c a t i o n impact i m p a c t analysis, a n a l y s i s , b. b . Use U s e reverse r e v e r s e engineering, e n g i n e e r i n g , where w h e r e all a l l assumptions a s s u m p t i o n s can c a n be b e verified, v e r i f i e d , to t o develop d e v e l o p certification c e r t i f i c a t i o n data d a t a necessary n e c e s s a r y to t o satisfy s a t i s f y the t h e certification c e r t i f i c a t i o n objectives o b j e c t i v e s for f o r the t h e new n e w application, a p p l i c a t i o n , granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true} Downloaded D o w n l o a d e d from f r o m SAE S A E International I n t e r n a t i o n a l by b y David D a v i d Merrill, M e r r i l l , Saturday, S a t u r d a y , November N o v e m b e r 12, 1 2 , 2016 2 0 1 6 SAE S A E ARP4754A A R P 4 7 5 4 A Page P a g e 83 8 3 of o f 115 1 1 5 c. c . Use U s e service s e r v i c e history h i s t o r y in i n accordance a c c o r d a n c e with w i t h the t h e guidelines g u i d e l i n e s below b e l o w to t o satisfy s a t i s f y the t h e certification c e r t i f i c a t i o n requirements, r e q u i r e m e n t s , d. d . Specify S p e c i f y the t h e strategy s t r a t e g y for f o r accomplishing a c c o m p l i s h i n g compliance c o m p l i a n c e with w i t h this t h i s document d o c u m e n t in i n the t h e Certification C e r t i f i c a t i o n Plan. P l a n . 6.5.1 6 . 5 . 1 Use U s e of o f Service S e r v i c e History H i s t o r y Service S e r v i c e history h i s t o r y may m a y be b e used u s e d to t o support s u p p o r t certification c e r t i f i c a t i o n of o f a a new n e w I I modified m o d i f i e d item i t e m or o r system s y s t e m if i f an a n analysis a n a l y s i s shows s h o w s the t h e history h i s t o r y to t o be b e applicable a p p l i c a b l e and a n d changes c h a n g e s to t o the t h e referenced r e f e r e n c e d item i t e m or o r system s y s t e m configuration c o n f i g u r a t i o n have h a v e been b e e n appropriately a p p r o p r i a t e l y controlled c o n t r o l l e d and a n d documented. d o c u m e n t e d . This T h i s method m e t h o d allows a l l o w s validation v a l i d a t i o n of o f a a requirement r e q u i r e m e n t by b y comparison c o m p a r i s o n to t o the t h e requirements r e q u i r e m e n t s of o f similar s i m i l a r in-service i n - s e r v i c e items i t e m s or o r systems. s y s t e m s . The T h e similarity s i m i l a r i t y argument a r g u m e n t gains g a i n s strength s t r e n g t h as a s the t h e applicable a p p l i c a b l e period p e r i o d of o f service s e r v i c e experience e x p e r i e n c e increases. i n c r e a s e s . Arguments A r g u m e n t s of o f similarity s i m i l a r i t y should s h o u l d not n o t be b e used u s e d until u n t i l any a n y significant s i g n i f i c a n t problems p r o b l e m s experienced e x p e r i e n c e d in i n service s e r v i c e have h a v e been b e e n understood u n d e r s t o o d and a n d resolved. r e s o l v e d . Considerations C o n s i d e r a t i o n s for f o r the t h e use u s e of o f service s e r v i c e history h i s t o r y include: i n c l u d e : • • The T h e applicant a p p l i c a n t should s h o u l d propose, p r o p o s e , in i n the t h e Certification C e r t i f i c a t i o n Plan, P l a n , how h o w service s e r v i c e history h i s t o r y will w i l l be b e used u s e d (e.g., ( e . g . , the t h e amount a m o u n t of o f service s e r v i c e experience e x p e r i e n c e available a v a i l a b l e and a n d a a description d e s c r i p t i o n of o f how h o w the t h e service s e r v i c e data d a t a will w i l l be b e analyzed) a n a l y z e d ) . . • • The T h e applicant a p p l i c a n t should s h o u l d conduct c o n d u c t an a n analysis a n a l y s i s to t o determine d e t e r m i n e the t h e extent e x t e n t to t o which w h i c h the t h e service s e r v i c e history h i s t o r y is i s applicable. a p p l i c a b l e . Such S u c h an a n analysis a n a l y s i s should s h o u l d show s h o w that: t h a t : a. a . Problem P r o b l e m reporting r e p o r t i n g procedures p r o c e d u r e s during d u r i n g the t h e period p e r i o d of o f applicable a p p l i c a b l e service s e r v i c e history h i s t o r y were w e r e sufficient s u f f i c i e n t to t o provide p r o v i d e an a n appropriate a p p r o p r i a t e cross-section c r o s s - s e c t i o n of o f in i n service s e r v i c e problems, p r o b l e m s , b. b . Changes C h a n g e s to t o the t h e referenced r e f e r e n c e d item i t e m or o r system s y s t e m during d u r i n g the t h e service s e r v i c e history h i s t o r y period p e r i o d did d i d not n o t materially m a t e r i a l l y alter a l t e r the t h e safety s a f e t y or o r performance p e r f o r m a n c e of o f the t h e item i t e m or o r system, s y s t e m , c. c . Actual A c t u a l usage u s a g e of o f the t h e referenced r e f e r e n c e d item i t e m or o r system s y s t e m during d u r i n g the t h e service s e r v i c e history h i s t o r y period p e r i o d was w a s consistent c o n s i s t e n t with w i t h the t h e intended i n t e n d e d usage u s a g e for f o r the t h e new n e w or o r modified m o d i f i e d item i t e m or o r system. s y s t e m . If I f the t h e operational o p e r a t i o n a l environments e n v i r o n m e n t s of o f the t h e existing e x i s t i n g and a n d proposed p r o p o s e d applications a p p l i c a t i o n s differ, d i f f e r , additional a d d i t i o n a l validation v a l i d a t i o n and a n d verification v e r i f i c a t i o n activities a c t i v i t i e s related r e l a t e d to t o the t h e differences d i f f e r e n c e s should s h o u l d be b e conducted. c o n d u c t e d . • • The T h e applicant a p p l i c a n t should s h o u l d analyze a n a l y z e any a n y reported r e p o r t e d safety-related s a f e t y - r e l a t e d problems, p r o b l e m s , together t o g e t h e r with w i t h their t h e i r causes c a u s e s and a n d corrective c o r r e c t i v e actions, a c t i o n s , and a n d establish e s t a b l i s h whether w h e t h e r or o r not n o t they t h e y are a r e relevant r e l e v a n t to t o the t h e proposed p r o p o s e d item i t e m or o r system, s y s t e m , modification, m o d i f i c a t i o n , or o r application. a p p l i c a t i o n . 6.6 6 . 6 Considerations C o n s i d e r a t i o n s for f o r Modifications M o d i f i c a t i o n s Modifications M o d i f i c a t i o n s to t o existing e x i s t i n g aircraft, a i r c r a f t , system s y s t e m or o r item i t e m may m a y take t a k e various v a r i o u s forms, f o r m s , including i n c l u d i n g addition, a d d i t i o n , deletion, d e l e t i o n , or o r change c h a n g e to t o the t h e functionality f u n c t i o n a l i t y of o f an a n item i t e m or o r system. s y s t e m . Example E x a m p l e modifications m o d i f i c a t i o n s are: a r e : • • Introducing I n t r o d u c i n g a a new n e w aircraft-level a i r c r a f t - l e v e l function. f u n c t i o n . • • Replacing R e p l a c i n g one o n e item i t e m or o r system s y s t e m with w i t h another a n o t h e r on o n an a n existing e x i s t i n g aircraft. a i r c r a f t . • • Adapting A d a p t i n g an a n existing e x i s t i n g item i t e m or o r system s y s t e m to t o a a different d i f f e r e n t aircraft a i r c r a f t type. t y p e . • • Modification M o d i f i c a t i o n to t o Item I t e m or o r System S y s t e m without w i t h o u t adding a d d i n g a a function. f u n c t i o n . Since S i n c e most m o s t systems s y s t e m s implement i m p l e m e n t multiple m u l t i p l e functions, f u n c t i o n s , it i t is i s likely l i k e l y that t h a t a a specific s p e c i f i c modification m o d i f i c a t i o n for f o r such s u c h a a system s y s t e m would w o u l d involve i n v o l v e more m o r e than t h a n one o n e of o f these t h e s e forms. f o r m s . Example E x a m p l e modifications m o d i f i c a t i o n s are a r e discussed d i s c u s s e d below b e l o w with w i t h regards r e g a r d s to t o the t h e process p r o c e s s introduced i n t r o d u c e d in i n Sections S e c t i o n s 6.1 6 . 1 and a n d 6.2. 6 . 2 . 6.6.1 6 . 6 . 1 Introducing I n t r o d u c i n g a a New N e w Aircraft-Level A i r c r a f t - L e v e l Function F u n c t i o n Considerations C o n s i d e r a t i o n s for f o r addressing a d d r e s s i n g the t h e introduction i n t r o d u c t i o n of o f a a new n e w aircraft-level a i r c r a f t - l e v e l function f u n c t i o n include: i n c l u d e : • • The T h e applicant a p p l i c a n t should s h o u l d develop d e v e l o p the t h e new n e w aircraft a i r c r a f t function f u n c t i o n in i n accordance a c c o r d a n c e with w i t h the t h e guidelines g u i d e l i n e s provided p r o v i d e d in i n this t h i s document. d o c u m e n t . In I n the t h e modification m o d i f i c a t i o n impact i m p a c t analysis a n a l y s i s emphasis e m p h a s i s should s h o u l d be b e given g i v e n to t o the t h e following: f o l l o w i n g : The T h e Functional F u n c t i o n a l Hazard H a z a r d Assessment A s s e s s m e n t should s h o u l d address a d d r e s s the t h e Failure F a i l u r e Conditions C o n d i t i o n s and a n d associated a s s o c i a t e d hazards h a z a r d s for f o r the t h e new n e w function f u n c t i o n and a n d identify i d e n t i f y the t h e safety s a f e t y objectives o b j e c t i v e s for f o r the t h e items i t e m s or o r systems s y s t e m s to t o be b e modified. m o d i f i e d . granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true} Downloaded D o w n l o a d e d from f r o m SAE S A E International I n t e r n a t i o n a l by b y David D a v i d Merrill, M e r r i l l , Saturday, S a t u r d a y , November N o v e m b e r 12, 1 2 , 2016 2 0 1 6 SAE S A E ARP4754A A R P 4 7 5 4 A Page P a g e 84 8 4 of o f 115 1 1 5 The T h e FHA F H A should s h o u l d also a l s o identify i d e n t i f y the t h e manner m a n n e r in i n which w h i c h other o t h e r items, i t e m s , systems s y s t e m s and a n d functions f u n c t i o n s are a r e affected a f f e c t e d by b y the t h e introduction i n t r o d u c t i o n of o f the t h e new n e w aircraft a i r c r a f t function. f u n c t i o n . This T h i s may m a y be b e achieved a c h i e v e d by b y conducting c o n d u c t i n g analysis a n a l y s i s on o n functional f u n c t i o n a l interactions i n t e r a c t i o n s and a n d interdependencies, i n t e r d e p e n d e n c i e s , and a n d by b y determining d e t e r m i n i n g the t h e degree d e g r e e to t o which w h i c h the t h e aircraft a i r c r a f t function f u n c t i o n is i s integrated i n t e g r a t e d with w i t h other o t h e r aircraft a i r c r a f t functions. f u n c t i o n s . This T h i s analysis a n a l y s i s then t h e n forms f o r m s the t h e basis b a s i s of o f the t h e classification c l a s s i f i c a t i o n of o f the t h e proposed p r o p o s e d modification. m o d i f i c a t i o n . The T h e modification m o d i f i c a t i o n implementation i m p l e m e n t a t i o n strategy s t r a t e g y should s h o u l d incorporate i n c o r p o r a t e actions a c t i o n s to t o substantiate s u b s t a n t i a t e the t h e interactions i n t e r a c t i o n s with w i t h other o t h e r items, i t e m s , systems s y s t e m s and a n d functions. f u n c t i o n s . • • If I f credit c r e d i t is i s sought s o u g h t for f o r development d e v e l o p m e n t assurance a s s u r a n c e activities a c t i v i t i e s performed p e r f o r m e d on o n a a previously p r e v i o u s l y certificated c e r t i f i c a t e d "baseline" " b a s e l i n e " aircraft a i r c r a f t or o r system, s y s t e m , the t h e proposed p r o p o s e d system s y s t e m or o r item i t e m and a n d its i t s certification c e r t i f i c a t i o n data d a t a should s h o u l d be b e traceable t r a c e a b l e to t o that t h a t baseline. b a s e l i n e . • • If I f certification c e r t i f i c a t i o n data d a t a is i s not n o t available a v a i l a b l e to t o the t h e applicant a p p l i c a n t for f o r unmodified u n m o d i f i e d areas a r e a s of o f the t h e aircraft a i r c r a f t on o n which w h i c h the t h e aircraft a i r c r a f t function f u n c t i o n is i s reliant, r e l i a n t , the t h e modification m o d i f i c a t i o n impact i m p a c t analysis a n a l y s i s should s h o u l d identify i d e n t i f y the t h e assumptions a s s u m p t i o n s that t h a t were w e r e made m a d e about a b o u t those t h o s e areas a r e a s to t o support s u p p o r t the t h e results r e s u l t s of o f the t h e safety s a f e t y assessment a s s e s s m e n t process. p r o c e s s . The T h e modification m o d i f i c a t i o n implementation i m p l e m e n t a t i o n strategy s t r a t e g y should s h o u l d incorporate i n c o r p o r a t e actions a c t i o n s to t o substantiate s u b s t a n t i a t e the t h e assumptions. a s s u m p t i o n s . • • The T h e applicant a p p l i c a n t has h a s the t h e option o p t i o n to t o repeat r e p e a t all a l l the t h e elements e l e m e n t s of o f the t h e safety s a f e t y assessment a s s e s s m e n t process p r o c e s s relating r e l a t i n g to t o the t h e un-modified u n - m o d i f i e d function(s) f u n c t i o n ( s ) if i f necessary n e c e s s a r y . . When W h e n a a new n e w function f u n c t i o n is i s introduced i n t r o d u c e d into i n t o an a n aircraft a i r c r a f t it i t is i s considered c o n s i d e r e d to t o be b e a a configuration c o n f i g u r a t i o n change c h a n g e to t o the t h e aircraft. a i r c r a f t . 6.6.2 6 . 6 . 2 Replacing R e p l a c i n g Item I t e m or o r System S y s t e m With W i t h Another A n o t h e r on o n an a n Existing E x i s t i n g Aircraft A i r c r a f t Installing I n s t a l l i n g a a replacement r e p l a c e m e n t item i t e m or o r system s y s t e m in i n a a previously p r e v i o u s l y certificated c e r t i f i c a t e d aircraft a i r c r a f t type t y p e may m a y change c h a n g e the t h e implementation i m p l e m e n t a t i o n of o f an a n aircraft a i r c r a f t function f u n c t i o n or o r functions f u n c t i o n s without w i t h o u t adding a d d i n g a a new n e w aircraft-level a i r c r a f t - l e v e l function. f u n c t i o n . The T h e replacement r e p l a c e m e n t item i t e m or o r system s y s t e m may m a y be b e installed i n s t a l l e d for f o r a a number n u m b e r of o f reasons r e a s o n s including: i n c l u d i n g : replacement r e p l a c e m e n t of o f obsolescent o b s o l e s c e n t equipment, e q u i p m e n t , improvement i m p r o v e m e n t of o f reliability r e l i a b i l i t y or o r integrity, i n t e g r i t y , equipment e q u i p m e n t has h a s enhanced e n h a n c e d or o r additional a d d i t i o n a l functionality f u n c t i o n a l i t y or o r in i n compliance c o m p l i a n c e with w i t h a a regulatory r e g u l a t o r y mandate. m a n d a t e . Considerations C o n s i d e r a t i o n s for f o r addressing a d d r e s s i n g the t h e installation i n s t a l l a t i o n of o f replacement r e p l a c e m e n t item i t e m or o r system s y s t e m in i n previously p r e v i o u s l y certificated c e r t i f i c a t e d aircraft a i r c r a f t type t y p e include: i n c l u d e : • • The T h e applicant a p p l i c a n t should s h o u l d develop d e v e l o p the t h e replacement r e p l a c e m e n t item i t e m or o r system s y s t e m in i n accordance a c c o r d a n c e with w i t h the t h e guidelines g u i d e l i n e s provided p r o v i d e d in i n this t h i s document. d o c u m e n t . In I n the t h e modification m o d i f i c a t i o n impact i m p a c t analysis, a n a l y s i s , emphasis e m p h a s i s should s h o u l d be b e given g i v e n to t o the t h e following: f o l l o w i n g : The T h e Functional F u n c t i o n a l Hazard H a z a r d Assessment A s s e s s m e n t (FHA) ( F H A ) should s h o u l d address a d d r e s s the t h e Failure F a i l u r e Conditions C o n d i t i o n s and a n d associated a s s o c i a t e d hazards h a z a r d s for f o r the t h e replacement r e p l a c e m e n t item i t e m or o r system s y s t e m and a n d identify i d e n t i f y the t h e safety s a f e t y objectives o b j e c t i v e s for f o r the t h e items i t e m s or o r systems s y s t e m s to t o be b e modified. m o d i f i e d . The T h e FHA F H A should s h o u l d also a l s o identify i d e n t i f y the t h e manner m a n n e r in i n which w h i c h other o t h e r items, i t e m s , systems s y s t e m s and a n d functions f u n c t i o n s are a r e affected a f f e c t e d by b y the t h e introduction i n t r o d u c t i o n of o f the t h e replacement. r e p l a c e m e n t . This T h i s may m a y be b e achieved a c h i e v e d by b y conducting c o n d u c t i n g analysis a n a l y s i s on o n functional f u n c t i o n a l interactions i n t e r a c t i o n s and a n d interdependencies, i n t e r d e p e n d e n c i e s , and a n d by b y determining d e t e r m i n i n g the t h e degree d e g r e e to t o which w h i c h the t h e aircraft a i r c r a f t function(s) f u n c t i o n ( s ) performed p e r f o r m e d by b y the t h e replacement r e p l a c e m e n t is i s integrated i n t e g r a t e d with w i t h other o t h e r aircraft a i r c r a f t functions f u n c t i o n s . . This T h i s analysis a n a l y s i s then t h e n forms f o r m s the t h e basis b a s i s of o f the t h e classification c l a s s i f i c a t i o n of o f the t h e proposed p r o p o s e d modification. m o d i f i c a t i o n . The T h e implementation i m p l e m e n t a t i o n strategy s t r a t e g y should s h o u l d incorporate i n c o r p o r a t e actions a c t i o n s to t o substantiate s u b s t a n t i a t e the t h e interactions i n t e r a c t i o n s with w i t h other o t h e r functions f u n c t i o n s and a n d systems. s y s t e m s . • • The T h e modification m o d i f i c a t i o n impact i m p a c t analysis a n a l y s i s should s h o u l d consider: c o n s i d e r : Installation I n s t a l l a t i o n design d e s i g n of o f the t h e replacement r e p l a c e m e n t item i t e m or o r system; s y s t e m ; - - Areas A r e a s on o n which w h i c h the t h e replacement r e p l a c e m e n t item i t e m or o r system s y s t e m is i s reliant; r e l i a n t ; - - Availability A v a i l a b i l i t y of o f certification c e r t i f i c a t i o n data d a t a for f o r the t h e item i t e m or o r system s y s t e m being b e i n g replaced; r e p l a c e d ; Certification C e r t i f i c a t i o n basis b a s i s for f o r the t h e aircraft. a i r c r a f t . It I t may m a y be b e necessary n e c e s s a r y as a s part p a r t of o f the t h e modification m o d i f i c a t i o n implementation i m p l e m e n t a t i o n strategy s t r a t e g y to t o develop d e v e l o p safety s a f e t y assessment a s s e s s m e n t data d a t a to t o ensure e n s u r e that t h a t the t h e safety s a f e t y objectives o b j e c t i v e s for f o r the t h e replacement r e p l a c e m e n t item i t e m or o r system s y s t e m are a r e correct c o r r e c t and a n d complete c o m p l e t e and a n d to t o ensure e n s u r e that t h a t the t h e aircraft-level a i r c r a f t - l e v e l safety s a f e t y objectives o b j e c t i v e s have h a v e been b e e n satisfied. s a t i s f i e d . • • If I f credit c r e d i t is i s sought s o u g h t for f o r development d e v e l o p m e n t assurance a s s u r a n c e activities a c t i v i t i e s performed p e r f o r m e d on o n a a previously p r e v i o u s l y certificated c e r t i f i c a t e d "baseline" " b a s e l i n e " aircraft, a i r c r a f t , the t h e proposed p r o p o s e d item i t e m or o r system s y s t e m and a n d its i t s certification c e r t i f i c a t i o n data d a t a should s h o u l d be b e traceable t r a c e a b l e to t o that t h a t baseline. b a s e l i n e . granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true} Downloaded D o w n l o a d e d from f r o m SAE S A E International I n t e r n a t i o n a l by b y David D a v i d Merrill, M e r r i l l , Saturday, S a t u r d a y , November N o v e m b e r 12, 1 2 , 2016 2 0 1 6 SAE S A E ARP4754A A R P 4 7 5 4 A Page P a g e 85 8 5 of o f 115 1 1 5 • • If I f the t h e item i t e m or o r system s y s t e m being b e i n g modified m o d i f i e d was w a s included i n c l u d e d within w i t h i n the t h e baseline b a s e l i n e certificated c e r t i f i c a t e d aircraft's a i r c r a f t ' s Common C o m m o n Cause C a u s e Analysis A n a l y s i s (CCA) ( C C A ) to t o demonstrate d e m o n s t r a t e functional f u n c t i o n a l and a n d item i t e m independence i n d e p e n d e n c e from f r o m other o t h e r items i t e m s or o r systems, s y s t e m s , in i n order o r d e r to t o substantiate s u b s t a n t i a t e a a development d e v e l o p m e n t assurance a s s u r a n c e level l e v e l reduction, r e d u c t i o n , that t h a t CCA C C A will w i l l require r e q u i r e re-investigation r e - i n v e s t i g a t i o n to t o ensure e n s u r e that t h a t its i t s conclusion c o n c l u s i o n remain r e m a i n valid. v a l i d . • • If I f certification c e r t i f i c a t i o n data d a t a is i s not n o t available a v a i l a b l e for f o r unmodified u n m o d i f i e d areas a r e a s of o f the t h e aircraft a i r c r a f t on o n which w h i c h the t h e item i t e m or o r system s y s t e m is i s reliant, r e l i a n t , the t h e modification m o d i f i c a t i o n impact i m p a c t analysis a n a l y s i s should s h o u l d identify i d e n t i f y the t h e assumptions a s s u m p t i o n s that t h a t were w e r e made m a d e about a b o u t those t h o s e areas a r e a s to t o support s u p p o r t the t h e results r e s u l t s of o f the t h e safety s a f e t y assessment a s s e s s m e n t process. p r o c e s s . The T h e modification m o d i f i c a t i o n implementation i m p l e m e n t a t i o n strategy s t r a t e g y should s h o u l d incorporate i n c o r p o r a t e actions a c t i o n s to t o substantiate s u b s t a n t i a t e the t h e assumptions. a s s u m p t i o n s . However, H o w e v e r , if i f this t h i s includes i n c l u d e s areas a r e a s that t h a t were w e r e subjected s u b j e c t e d to t o the t h e CCA, C C A , this t h i s approach a p p r o a c h will w i l l require r e q u i r e specific s p e c i f i c analysis a n a l y s i s and a n d review r e v i e w with w i t h the t h e certificating c e r t i f i c a t i n g authority a u t h o r i t y to t o ensure e n s u r e that t h a t the t h e baseline b a s e l i n e CCA C C A conclusions c o n c l u s i o n s remain r e m a i n valid. v a l i d . 6.6.3 6 . 6 . 3 Adapting A d a p t i n g Existing E x i s t i n g Item I t e m or o r System S y s t e m to t o a a Different D i f f e r e n t Aircraft A i r c r a f t Type T y p e Items I t e m s or o r systems s y s t e m s previously p r e v i o u s l y approved a p p r o v e d for f o r operation o p e r a t i o n in i n one o n e aircraft a i r c r a f t type t y p e should s h o u l d be b e re-examined r e - e x a m i n e d for f o r use u s e in i n a a different d i f f e r e n t aircraft. a i r c r a f t . Should S h o u l d the t h e applicant a p p l i c a n t choose c h o o s e to t o seek s e e k credit c r e d i t from f r o m the t h e previous p r e v i o u s certification, c e r t i f i c a t i o n , the t h e certification c e r t i f i c a t i o n authority a u t h o r i t y will w i l l require r e q u i r e evidence e v i d e n c e that t h a t the t h e design, d e s i g n , installation, i n s t a l l a t i o n , and a n d application a p p l i c a t i o n are a r e similar. s i m i l a r . If I f the t h e evidence e v i d e n c e were w e r e not n o t available, a v a i l a b l e , the t h e relevant r e l e v a n t parts p a r t s of o f Sections S e c t i o n s 4 4 and a n d 5 5 would w o u l d be b e applied a p p l i e d as a s necessary n e c e s s a r y to t o provide p r o v i d e evidence e v i d e n c e that t h a t the t h e item i t e m or o r system s y s t e m to t o be b e installed i n s t a l l e d satisfies s a t i s f i e s the t h e certification c e r t i f i c a t i o n requirements/regulations r e q u i r e m e n t s / r e g u l a t i o n s . . Considerations C o n s i d e r a t i o n s for f o r addressing a d d r e s s i n g installation i n s t a l l a t i o n in i n a a different d i f f e r e n t aircraft a i r c r a f t include i n c l u d e the t h e following: f o l l o w i n g : • • The T h e applicant a p p l i c a n t should s h o u l d undertake u n d e r t a k e a a modification m o d i f i c a t i o n impact i m p a c t analysis a n a l y s i s considering: c o n s i d e r i n g : Similarity S i m i l a r i t y of o f installation i n s t a l l a t i o n and a n d operation o p e r a t i o n on o n both b o t h the t h e existing e x i s t i n g and a n d proposed p r o p o s e d aircraft, a i r c r a f t , Similarity S i m i l a r i t y of o f functions f u n c t i o n s on o n which w h i c h the t h e transferred t r a n s f e r r e d item i t e m or o r system s y s t e m is i s reliant, r e l i a n t , Impact I m p a c t of o f the t h e transferred t r a n s f e r r e d item i t e m or o r system s y s t e m on o n other o t h e r items i t e m s or o r systems s y s t e m s in i n the t h e proposed p r o p o s e d aircraft, a i r c r a f t , Similarity S i m i l a r i t y of o f existing e x i s t i n g aircraft a i r c r a f t installation i n s t a l l a t i o n Certification C e r t i f i c a t i o n basis b a s i s and a n d proposed p r o p o s e d aircraft a i r c r a f t installation i n s t a l l a t i o n Certification C e r t i f i c a t i o n basis, b a s i s , - - Adequacy A d e q u a c y of o f the t h e certification c e r t i f i c a t i o n data d a t a available a v a i l a b l e from f r o m the t h e previous p r e v i o u s installation. i n s t a l l a t i o n . This T h i s analysis a n a l y s i s then t h e n forms f o r m s the t h e basis b a s i s of o f the t h e classification c l a s s i f i c a t i o n of o f the t h e proposed p r o p o s e d modification. m o d i f i c a t i o n . If I f the t h e safety s a f e t y objectives o b j e c t i v e s are a r e the t h e same s a m e for f o r the t h e proposed p r o p o s e d installation i n s t a l l a t i o n as a s they t h e y were w e r e in i n the t h e previous p r e v i o u s installation i n s t a l l a t i o n and a n d provided p r o v i d e d that t h a t an a n appropriate a p p r o p r i a t e level l e v e l of o f aircraft a i r c r a f t similarity s i m i l a r i t y is i s established, e s t a b l i s h e d , no n o additional a d d i t i o n a l effort e f f o r t will w i l l be b e required. r e q u i r e d . The T h e modification m o d i f i c a t i o n impact i m p a c t analysis a n a l y s i s should s h o u l d identify i d e n t i f y the t h e functions f u n c t i o n s associated a s s o c i a t e d with w i t h the t h e original o r i g i n a l application a p p l i c a t i o n affected a f f e c t e d by b y the t h e functions f u n c t i o n s associated a s s o c i a t e d with w i t h the t h e new n e w installation. i n s t a l l a t i o n . The T h e assessment a s s e s s m e n t should s h o u l d address a d d r e s s unmodified u n m o d i f i e d functionality f u n c t i o n a l i t y on o n which w h i c h the t h e new n e w installation i n s t a l l a t i o n relies. r e l i e s . This T h i s may m a y be b e achieved a c h i e v e d by b y conducting c o n d u c t i n g analyses a n a l y s e s of o f the t h e interaction i n t e r a c t i o n and a n d interdependencies i n t e r d e p e n d e n c i e s between b e t w e e n the t h e new n e w item i t e m or o r system s y s t e m and a n d other o t h e r aircraft a i r c r a f t items i t e m s or o r systems. s y s t e m s . The T h e modification m o d i f i c a t i o n implementation i m p l e m e n t a t i o n strategy s t r a t e g y should s h o u l d incorporate i n c o r p o r a t e actions a c t i o n s to t o substantiate s u b s t a n t i a t e the t h e interactions i n t e r a c t i o n s with w i t h other o t h e r items, i t e m s , systems s y s t e m s and a n d functions. f u n c t i o n s . • • If I f credit c r e d i t is i s sought s o u g h t for f o r development d e v e l o p m e n t assurance a s s u r a n c e activities a c t i v i t i e s performed p e r f o r m e d on o n a a previously p r e v i o u s l y certificated c e r t i f i c a t e d "baseline" " b a s e l i n e " aircraft, a i r c r a f t , the t h e proposed p r o p o s e d item i t e m or o r system s y s t e m and a n d its i t s certification c e r t i f i c a t i o n data d a t a should s h o u l d be b e traceable t r a c e a b l e to t o that t h a t baseline. b a s e l i n e . • • If I f the t h e item i t e m or o r system s y s t e m being b e i n g modified m o d i f i e d by b y the t h e introduction i n t r o d u c t i o n of o f an a n adapted a d a p t e d item i t e m or o r system s y s t e m was w a s included i n c l u d e d within w i t h i n the t h e baseline b a s e l i n e certificated c e r t i f i c a t e d aircraft's a i r c r a f t ' s Common C o m m o n Cause C a u s e Analysis A n a l y s i s (CCA), ( C C A ) , to t o demonstrate d e m o n s t r a t e functional f u n c t i o n a l and a n d item i t e m development d e v e l o p m e n t independence i n d e p e n d e n c e from f r o m other o t h e r items i t e m s or o r systems s y s t e m s in i n order o r d e r to t o substantiate s u b s t a n t i a t e the t h e assignment a s s i g n m e n t of o f a a development d e v e l o p m e n t assurance a s s u r a n c e level l e v e l lower l o w e r than t h a n the t h e top- t o p - level l e v e l Failure F a i l u r e Condition C o n d i t i o n classification, c l a s s i f i c a t i o n , that t h a t CCA C C A will w i l l require r e q u i r e re-investigation r e - i n v e s t i g a t i o n to t o ensure e n s u r e that t h a t its i t s conclusion c o n c l u s i o n remains r e m a i n s valid. v a l i d . • • If I f certification c e r t i f i c a t i o n data d a t a is i s not n o t available a v a i l a b l e for f o r unmodified u n m o d i f i e d functions f u n c t i o n s of o f the t h e aircraft a i r c r a f t on o n which w h i c h the t h e adapted a d a p t e d item i t e m or o r system s y s t e m is i s reliant, r e l i a n t , the t h e modification m o d i f i c a t i o n impact i m p a c t analysis a n a l y s i s should s h o u l d identify i d e n t i f y the t h e assumptions a s s u m p t i o n s that t h a t were w e r e made m a d e about a b o u t those t h o s e functions f u n c t i o n s to t o support s u p p o r t the t h e results r e s u l t s of o f the t h e safety s a f e t y assessment a s s e s s m e n t process. p r o c e s s . The T h e modification m o d i f i c a t i o n implementation i m p l e m e n t a t i o n strategy s t r a t e g y should s h o u l d incorporate i n c o r p o r a t e actions a c t i o n s to t o substantiate s u b s t a n t i a t e these t h e s e assumptions. a s s u m p t i o n s . However, H o w e v e r , if i f this t h i s includes i n c l u d e s areas a r e a s that t h a t were w e r e subjected s u b j e c t e d to t o the t h e CCA, C C A , this t h i s approach a p p r o a c h will w i l l require r e q u i r e specific s p e c i f i c analysis a n a l y s i s and a n d review r e v i e w with w i t h the t h e certificating c e r t i f i c a t i n g authority a u t h o r i t y to t o ensure e n s u r e that t h a t the t h e baseline b a s e l i n e CCA C C A conclusions c o n c l u s i o n s remain r e m a i n valid. v a l i d . granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true} Downloaded D o w n l o a d e d from f r o m SAE S A E International I n t e r n a t i o n a l by b y David D a v i d Merrill, M e r r i l l , Saturday, S a t u r d a y , November N o v e m b e r 12, 1 2 , 2016 2 0 1 6 SAE S A E ARP4754A A R P 4 7 5 4 A Page P a g e 86 8 6 of o f 115 1 1 5 • • The T h e modification m o d i f i c a t i o n implementation i m p l e m e n t a t i o n strategy s t r a t e g y will w i l l need n e e d to t o allow a l l o w the t h e applicant a p p l i c a n t to t o supplement s u p p l e m e n t the t h e existing e x i s t i n g certification c e r t i f i c a t i o n data d a t a under u n d e r the t h e following f o l l o w i n g conditions c o n d i t i o n s in i n order o r d e r to t o satisfy s a t i s f y the t h e certification c e r t i f i c a t i o n requirements/regulations: r e q u i r e m e n t s / r e g u l a t i o n s : a. a . The T h e certification c e r t i f i c a t i o n data d a t a from f r o m the t h e previous p r e v i o u s installation i n s t a l l a t i o n is i s not n o t available a v a i l a b l e to t o substantiate s u b s t a n t i a t e that t h a t the t h e new n e w installation i n s t a l l a t i o n satisfies s a t i s f i e s the t h e safety s a f e t y objectives o b j e c t i v e s of o f the t h e proposed p r o p o s e d installation. i n s t a l l a t i o n . b. b . The T h e certification c e r t i f i c a t i o n data d a t a from f r o m the t h e previous p r e v i o u s installation i n s t a l l a t i o n is i s inadequate i n a d e q u a t e to t o define d e f i n e and a n d substantiate s u b s t a n t i a t e the t h e affected a f f e c t e d area. a r e a . Any A n y requirements r e q u i r e m e n t s impacted i m p a c t e d by b y the t h e new n e w installation i n s t a l l a t i o n should s h o u l d be b e validated v a l i d a t e d and a n d the t h e new n e w installation i n s t a l l a t i o n verified v e r i f i e d in i n accordance a c c o r d a n c e with w i t h the t h e guidelines g u i d e l i n e s provided p r o v i d e d in i n sections s e c t i o n s 5.4 5 . 4 and a n d 5.5. 5 . 5 . 6.6.4 6 . 6 . 4 Modification M o d i f i c a t i o n to t o Item I t e m or o r System S y s t e m Without W i t h o u t Adding A d d i n g a a Function: F u n c t i o n : A A modification m o d i f i c a t i o n to t o a a previously p r e v i o u s l y approved a p p r o v e d item i t e m or o r system s y s t e m may m a y change c h a n g e the t h e implementation i m p l e m e n t a t i o n of o f an a n aircraft a i r c r a f t function f u n c t i o n without w i t h o u t adding a d d i n g a a new n e w aircraft-level a i r c r a f t - l e v e l function. f u n c t i o n . A A modification m o d i f i c a t i o n may m a y result r e s u l t from f r o m a a change c h a n g e in i n requirements r e q u i r e m e n t s or o r desired d e s i r e d performance, p e r f o r m a n c e , correction c o r r e c t i o n of o f an a n implementation i m p l e m e n t a t i o n error, e r r o r , an a n enhancement e n h a n c e m e n t to t o equipment e q u i p m e n t reliability r e l i a b i l i t y or o r replacement r e p l a c e m e n t of o f obsolescent o b s o l e s c e n t equipment. e q u i p m e n t . Considerations C o n s i d e r a t i o n s for f o r addressing a d d r e s s i n g an a n item i t e m or o r system s y s t e m modification m o d i f i c a t i o n on o n a a previously p r e v i o u s l y certificated c e r t i f i c a t e d aircraft a i r c r a f t include: i n c l u d e : • • The T h e modification m o d i f i c a t i o n impact i m p a c t analysis a n a l y s i s which w h i c h should s h o u l d consider c o n s i d e r the t h e impact i m p a c t of o f the t h e modification m o d i f i c a t i o n on: o n : Areas A r e a s on o n which w h i c h the t h e item i t e m or o r system s y s t e m is i s reliant. r e l i a n t . Certification C e r t i f i c a t i o n basis b a s i s for f o r the t h e aircraft. a i r c r a f t . Existing E x i s t i n g requirements r e q u i r e m e n t s I I regulations r e g u l a t i o n s (including ( i n c l u d i n g the t h e impact i m p a c t on o n unchanged u n c h a n g e d requirements). r e q u i r e m e n t s ) . System S y s t e m architecture. a r c h i t e c t u r e . Area A r e a affected a f f e c t e d by b y the t h e modification. m o d i f i c a t i o n . This T h i s may m a y be b e achieved a c h i e v e d by b y conducting c o n d u c t i n g an a n analysis a n a l y s i s of o f the t h e interaction i n t e r a c t i o n of o f the t h e altered a l t e r e d item i t e m or o r system s y s t e m with w i t h other o t h e r aircraft a i r c r a f t items i t e m s or o r systems. s y s t e m s . The T h e modification m o d i f i c a t i o n implementation i m p l e m e n t a t i o n strategy s t r a t e g y should s h o u l d incorporate i n c o r p o r a t e actions a c t i o n s to t o substantiate s u b s t a n t i a t e the t h e identified i d e n t i f i e d interactions. i n t e r a c t i o n s . This T h i s analysis a n a l y s i s then t h e n forms f o r m s the t h e basis b a s i s of o f the t h e classification c l a s s i f i c a t i o n of o f the t h e proposed p r o p o s e d modification. m o d i f i c a t i o n . • • If I f credit c r e d i t is i s sought s o u g h t for f o r development d e v e l o p m e n t assurance a s s u r a n c e activities a c t i v i t i e s performed p e r f o r m e d on o n a a previously p r e v i o u s l y certificated c e r t i f i c a t e d "baseline" " b a s e l i n e " aircraft a i r c r a f t or o r system, s y s t e m , the t h e proposed p r o p o s e d item i t e m or o r system s y s t e m modification m o d i f i c a t i o n and a n d its i t s certification c e r t i f i c a t i o n data d a t a should s h o u l d be b e traceable t r a c e a b l e to t o that t h a t baseline. b a s e l i n e . • • If I f the t h e item i t e m or o r system s y s t e m being b e i n g modified m o d i f i e d was w a s included i n c l u d e d within w i t h i n the t h e baseline b a s e l i n e certificated c e r t i f i c a t e d aircraft's a i r c r a f t ' s Common C o m m o n Cause C a u s e Analysis, A n a l y s i s , to t o demonstrate d e m o n s t r a t e functional f u n c t i o n a l or o r item i t e m development d e v e l o p m e n t independence i n d e p e n d e n c e from f r o m other o t h e r items i t e m s or o r systems s y s t e m s in i n order o r d e r to t o substantiate s u b s t a n t i a t e the t h e assignment a s s i g n m e n t of o f a a development d e v e l o p m e n t assurance a s s u r a n c e level l e v e l lower l o w e r than t h a n the t h e top-level t o p - l e v e l Failure F a i l u r e Condition C o n d i t i o n classification, c l a s s i f i c a t i o n , that t h a t CCA C C A will w i l l require r e q u i r e re-investigation r e - i n v e s t i g a t i o n to t o ensure e n s u r e that t h a t its i t s conclusion c o n c l u s i o n remains r e m a i n s valid. v a l i d . • • If I f certification c e r t i f i c a t i o n data d a t a is i s not n o t available a v a i l a b l e for f o r unmodified u n m o d i f i e d areas a r e a s of o f the t h e aircraft a i r c r a f t on o n which w h i c h the t h e item i t e m or o r system s y s t e m modification m o d i f i c a t i o n is i s reliant, r e l i a n t , the t h e modification m o d i f i c a t i o n impact i m p a c t analysis a n a l y s i s should s h o u l d identify i d e n t i f y the t h e assumptions a s s u m p t i o n s that t h a t were w e r e made m a d e about a b o u t those t h o s e areas a r e a s to t o support s u p p o r t the t h e results r e s u l t s of o f the t h e safety s a f e t y assessment. a s s e s s m e n t . The T h e modification m o d i f i c a t i o n implementation i m p l e m e n t a t i o n strategy s t r a t e g y should s h o u l d incorporate i n c o r p o r a t e actions a c t i o n s to t o substantiate s u b s t a n t i a t e the t h e assumptions. a s s u m p t i o n s . However, H o w e v e r , if i f this t h i s includes i n c l u d e s areas a r e a s that t h a t were w e r e subjected s u b j e c t e d to t o the t h e CCA, C C A , this t h i s approach a p p r o a c h will w i l l require r e q u i r e specific s p e c i f i c analysis a n a l y s i s and a n d review r e v i e w with w i t h the t h e certificating c e r t i f i c a t i n g authority a u t h o r i t y to t o ensure e n s u r e that t h a t the t h e baseline b a s e l i n e CCA C C A conclusions c o n c l u s i o n s remain r e m a i n valid. v a l i d . • • The T h e modification m o d i f i c a t i o n implementation i m p l e m e n t a t i o n strategy s t r a t e g y should s h o u l d allow a l l o w the t h e applicant a p p l i c a n t to t o supplement s u p p l e m e n t the t h e existing e x i s t i n g certification c e r t i f i c a t i o n data d a t a under u n d e r the t h e following f o l l o w i n g conditions: c o n d i t i o n s : a. a . The T h e certification c e r t i f i c a t i o n data d a t a from f r o m the t h e previous p r e v i o u s installation i n s t a l l a t i o n is i s not n o t available a v a i l a b l e to t o substantiate s u b s t a n t i a t e that t h a t the t h e altered a l t e r e d item i t e m or o r system s y s t e m satisfies s a t i s f i e s the t h e safety s a f e t y objectives o b j e c t i v e s of o f the t h e proposed p r o p o s e d installation. i n s t a l l a t i o n . b. b . The T h e certification c e r t i f i c a t i o n data d a t a from f r o m the t h e previous p r e v i o u s development d e v e l o p m e n t is i s inadequate i n a d e q u a t e to t o define d e f i n e and a n d substantiate s u b s t a n t i a t e area(s) a r e a ( s ) affected a f f e c t e d by b y the t h e item i t e m or o r system s y s t e m alteration. a l t e r a t i o n . granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true} Downloaded D o w n l o a d e d from f r o m SAE S A E International I n t e r n a t i o n a l by b y David D a v i d Merrill, M e r r i l l , Saturday, S a t u r d a y , November N o v e m b e r 12, 1 2 , 2016 2 0 1 6 SAE S A E ARP4754A A R P 4 7 5 4 A Page P a g e 87 8 7 of o f 115 1 1 5 • • The T h e requirements r e q u i r e m e n t s impacted i m p a c t e d by b y the t h e modification m o d i f i c a t i o n should s h o u l d be b e validated v a l i d a t e d and a n d the t h e altered a l t e r e d implementation i m p l e m e n t a t i o n verified v e r i f i e d in i n accordance a c c o r d a n c e with w i t h the t h e guidelines g u i d e l i n e s provided p r o v i d e d in i n Sections S e c t i o n s 5.4 5 . 4 and a n d 5.5. 5 . 5 . 6.6.5 6 . 6 . 5 STC S T C Production P r o d u c t i o n Introduction I n t r o d u c t i o n Items I t e m s or o r systems s y s t e m s previously p r e v i o u s l y qualified, q u a l i f i e d , certificated, c e r t i f i c a t e d , and a n d approved a p p r o v e d for f o r operation o p e r a t i o n in i n one o n e aircraft, a i r c r a f t , by b y an a n STC S T C modification m o d i f i c a t i o n (see ( s e e sections s e c t i o n s above) a b o v e ) are a r e occasionally o c c a s i o n a l l y introduced i n t r o d u c e d into i n t o the t h e production p r o d u c t i o n process p r o c e s s of o f an a n aircraft a i r c r a f t to t o provide p r o v i d e the t h e item i t e m or o r system s y s t e m as a s a a part p a r t of o f a a revised r e v i s e d aircraft a i r c r a f t baseline. b a s e l i n e . Such S u c h a a process p r o c e s s may m a y be b e referred r e f e r r e d to t o as a s an a n in-line i n - l i n e Type T y p e Certificate C e r t i f i c a t e holder h o l d e r modification m o d i f i c a t i o n or o r might m i g h t be b e incorporated i n c o r p o r a t e d into i n t o the t h e production p r o d u c t i o n process p r o c e s s as a s a a STC. S T C . While W h i l e the t h e introduction i n t r o d u c t i o n of o f the t h e modification m o d i f i c a t i o n using u s i n g the t h e TC T C process p r o c e s s will w i l l need n e e d to t o follow f o l l o w the t h e criteria c r i t e r i a defined d e f i n e d above; a b o v e ; where w h e r e the t h e STC S T C approach a p p r o a c h is i s used, u s e d , additional a d d i t i o n a l considerations c o n s i d e r a t i o n s to t o those t h o s e already a l r e a d y given g i v e n are a r e necessary. n e c e s s a r y . Topics T o p i c s to t o be b e considered c o n s i d e r e d for f o r a a STC S T C production p r o d u c t i o n introduction i n t r o d u c t i o n are: a r e : • • Alignment A l i g n m e n t of o f Projects. P r o j e c t s . The T h e STC S T C holder, h o l d e r , the t h e TC T C holder/aircraft h o l d e r / a i r c r a f t manufacturer m a n u f a c t u r e r and a n d the t h e certification c e r t i f i c a t i o n authority a u t h o r i t y should s h o u l d work w o r k closely c l o s e l y on o n a a coordinated c o o r d i n a t e d basis b a s i s to t o ensure e n s u r e that t h a t expectations e x p e c t a t i o n s between b e t w e e n the t h e various v a r i o u s stakeholders s t a k e h o l d e r s are a r e met. m e t . • • Alignment A l i g n m e n t of o f Data D a t a expectations. e x p e c t a t i o n s . There T h e r e will w i l l need n e e d to t o be b e a a coordinated c o o r d i n a t e d effort e f f o r t to t o ensure e n s u r e that t h a t the t h e data d a t a provided p r o v i d e d by b y the t h e STC S T C satisfies s a t i s f i e s the t h e certification c e r t i f i c a t i o n requirements/regulations r e q u i r e m e n t s / r e g u l a t i o n s applicable a p p l i c a b l e to t o the t h e aircraft a i r c r a f t and a n d modification m o d i f i c a t i o n certification c e r t i f i c a t i o n basis b a s i s and a n d that t h a t of o f the t h e TC T C holder/aircraft h o l d e r / a i r c r a f t manufacturer. m a n u f a c t u r e r . • • Coordination C o o r d i n a t i o n of o f data d a t a transfer. t r a n s f e r . Once O n c e the t h e activity a c t i v i t y for f o r a a production p r o d u c t i o n introduction i n t r o d u c t i o n begins b e g i n s there t h e r e needs n e e d s to t o be b e a a process p r o c e s s that t h a t manages m a n a g e s the t h e data d a t a transfer t r a n s f e r between b e t w e e n the t h e TC T C holder, h o l d e r , the t h e STC S T C holder, h o l d e r , and a n d with w i t h the t h e certification c e r t i f i c a t i o n authority a u t h o r i t y . . In I n cases c a s e s where w h e r e there t h e r e are a r e issues i s s u e s with w i t h certification c e r t i f i c a t i o n data, d a t a , reporting r e p o r t i n g systems s y s t e m s need n e e d to t o be b e implemented i m p l e m e n t e d that t h a t track t r a c k and a n d resolve r e s o l v e the t h e data d a t a issue. i s s u e . Typically, T y p i c a l l y , this t h i s is i s done d o n e through t h r o u g h coordination c o o r d i n a t i o n memos. m e m o s . • • Clarification C l a r i f i c a t i o n of o f assumptions a s s u m p t i o n s for f o r engineering e n g i n e e r i n g data d a t a I I design d e s i g n reuse r e u s e for f o r unchanged u n c h a n g e d remnants: r e m n a n t s : Evaluate E v a l u a t e the t h e data d a t a available a v a i l a b l e from f r o m the t h e previous p r e v i o u s certification c e r t i f i c a t i o n effort e f f o r t to t o determine d e t e r m i n e which w h i c h objectives o b j e c t i v e s are a r e satisfied s a t i s f i e d for f o r the t h e new n e w application a p p l i c a t i o n and a n d which w h i c h objectives o b j e c t i v e s require r e q u i r e additional a d d i t i o n a l consideration. c o n s i d e r a t i o n . Use U s e reverse r e v e r s e engineering e n g i n e e r i n g to t o develop d e v e l o p certification c e r t i f i c a t i o n data d a t a necessary n e c e s s a r y to t o satisfy s a t i s f y the t h e objectives o b j e c t i v e s of o f this t h i s document. d o c u m e n t . Use U s e service s e r v i c e history h i s t o r y where w h e r e applicable a p p l i c a b l e to t o satisfy s a t i s f y the t h e objectives o b j e c t i v e s of o f this t h i s document. d o c u m e n t . Specify S p e c i f y the t h e strategy s t r a t e g y for f o r accomplishing a c c o m p l i s h i n g compliance c o m p l i a n c e with w i t h this t h i s document d o c u m e n t in i n the t h e Certification C e r t i f i c a t i o n Plan. P l a n . • • Comprehensive C o m p r e h e n s i v e coordination c o o r d i n a t i o n of o f STC S T C implementation i m p l e m e n t a t i o n to t o ensure e n s u r e confidence c o n f i d e n c e that t h a t the t h e certification c e r t i f i c a t i o n requirements' r e q u i r e m e n t s ' remain r e m a i n valid, v a l i d , including i n c l u d i n g compatibility c o m p a t i b i l i t y of o f multiple m u l t i p l e STCs. S T C s . Refer R e f e r to t o FAA/EASA F A A / E A S A 14CFR/IR 1 4 C F R / I R Part P a r t 21 2 1 for f o r administrative a d m i n i s t r a t i v e and a n d technical t e c h n i c a l STC S T C process p r o c e s s requirements. r e q u i r e m e n t s . 7. 7 . NOTES N O T E S 7.1 7 . 1 The T h e leadership l e a d e r s h i p of o f the t h e S-18 S - 1 8 and a n d WG-63 W G - 6 3 Committees C o m m i t t e e s would w o u l d like l i k e to t o thank t h a n k the t h e actively a c t i v e l y contributing c o n t r i b u t i n g committee c o m m i t t e e members, m e m b e r s , and a n d their t h e i r sponsoring s p o n s o r i n g companies, c o m p a n i e s , for f o r the t h e time, t i m e , effort, e f f o r t , and a n d expense e x p e n s e expended e x p e n d e d during d u r i n g the t h e years y e a r s of o f development d e v e l o p m e n t of o f this t h i s document. d o c u m e n t . Without W i t h o u t the t h e experience, e x p e r i e n c e , cooperation c o o p e r a t i o n and a n d dedication d e d i c a t i o n of o f these t h e s e people, p e o p l e , development d e v e l o p m e n t of o f this t h i s document d o c u m e n t would w o u l d not n o t have h a v e been b e e n possible. p o s s i b l e . 7.2 7 . 2 A A change c h a n g e bar b a r (I) ( I ) located l o c a t e d in i n the t h e left l e f t margin m a r g i n is i s for f o r the t h e convenience c o n v e n i e n c e of o f the t h e user u s e r in i n locating l o c a t i n g areas a r e a s where w h e r e technical t e c h n i c a l revisions, r e v i s i o n s , not n o t editorial e d i t o r i a l changes, c h a n g e s , have h a v e been b e e n made m a d e to t o the t h e previous p r e v i o u s issue i s s u e of o f this t h i s document. d o c u m e n t . An A n (R) ( R ) symbol s y m b o l to t o the t h e left l e f t of o f the t h e document d o c u m e n t title t i t l e indicates i n d i c a t e s a a complete c o m p l e t e revision r e v i s i o n of o f the t h e document, d o c u m e n t , including i n c l u d i n g technical t e c h n i c a l revisions. r e v i s i o n s . Change C h a n g e bars b a r s and a n d (R) ( R ) are a r e not n o t used u s e d in i n original o r i g i n a l publications, p u b l i c a t i o n s , nor n o r in i n documents d o c u m e n t s that t h a t contain c o n t a i n editorial e d i t o r i a l changes c h a n g e s only. o n l y . PREPARED P R E P A R E D BY B Y SYSTEMS S Y S T E M S INTEGRATION I N T E G R A T I O N SUBCOMMITTEE S U B C O M M I T T E E (FAA ( F A A SYSTEMS S Y S T E M S INTEGRATION I N T E G R A T I O N REQUIREMENTS R E Q U I R E M E N T S TG T G (SIRT) ( S I R T ) OF O F COMMITTEE C O M M I T T E E AS-1, A S - 1 , AVIONICS/ARMAMENT A V I O N I C S / A R M A M E N T INTEGRATION I N T E G R A T I O N granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true} Downloaded D o w n l o a d e d from f r o m SAE S A E International I n t e r n a t i o n a l by b y David D a v i d Merrill, M e r r i l l , Saturday, S a t u r d a y , November N o v e m b e r 12, 1 2 , 2016 2 0 1 6 SAE S A E ARP4754A A R P 4 7 5 4 A Page P a g e 88 8 8 of o f 115 1 1 5 APPENDIX A P P E N D I X A A - - PROCESS P R O C E S S OBJECTIVES O B J E C T I V E S DATA D A T A This T h i s appendix a p p e n d i x outlines o u t l i n e s the t h e aircraft/system a i r c r a f t / s y s t e m life l i f e cycle c y c l e process p r o c e s s objectives o b j e c t i v e s and a n d data d a t a outputs o u t p u t s described d e s c r i b e d in i n this t h i s document. d o c u m e n t . Table T a b l e A-1 A - 1 provides p r o v i d e s the t h e details d e t a i l s by b y function f u n c t i o n development d e v e l o p m e n t assurance a s s u r a n c e level, l e v e l , which w h i c h should s h o u l d be b e assigned a s s i g n e d according a c c o r d i n g to t o the t h e guidelines g u i d e l i n e s in i n section s e c t i o n 5.2. 5 . 2 . Activities A c t i v i t i e s of o f section s e c t i o n 5.2 5 . 2 are a r e not n o t included i n c l u d e d in i n Table T a b l e A-1, A - 1 , since s i n c e the t h e section s e c t i o n 5.2 5 . 2 activities a c t i v i t i e s are a r e used u s e d to t o identify i d e n t i f y applicability a p p l i c a b i l i t y and a n d rigor r i g o r for f o r the t h e other o t h e r activities. a c t i v i t i e s . The T h e scope s c o p e and a n d detail d e t a i l of o f the t h e life l i f e cycle c y c l e data d a t a varies v a r i e s depending d e p e n d i n g on o n the t h e assigned a s s i g n e d development d e v e l o p m e n t assurance a s s u r a n c e levels. l e v e l s . Table T a b l e A-1 A - 1 includes i n c l u d e s guidelines g u i d e l i n e s for: f o r : a. a . The T h e process p r o c e s s objectives o b j e c t i v e s applicable a p p l i c a b l e for f o r each e a c h development d e v e l o p m e n t assurance a s s u r a n c e level l e v e l (section ( s e c t i o n 5.2); 5 . 2 ) ; R*- R * - Recommended R e c o m m e n d e d for f o r certification c e r t i f i c a t i o n with w i t h process p r o c e s s independence, i n d e p e n d e n c e , R R - - Recommended R e c o m m e n d e d for f o r certification, c e r t i f i c a t i o n , A A - - As A s negotiated n e g o t i a t e d for f o r certification, c e r t i f i c a t i o n , N N - - Not N o t required r e q u i r e d for f o r certification. c e r t i f i c a t i o n . b. b . The T h e reference r e f e r e n c e to t o the t h e system s y s t e m life l i f e cycle c y c l e data d a t a objectives o b j e c t i v e s and a n d content. c o n t e n t . c. c . The T h e system s y s t e m control c o n t r o l category c a t e g o r y (SC) ( S C ) objectives o b j e c t i v e s assigned a s s i g n e d to t o the t h e data d a t a by b y development d e v e l o p m e n t assurance a s s u r a n c e level l e v e l (see ( s e e section s e c t i o n 5.6.2.6) 5 . 6 . 2 . 6 ) Table T a b l e A-1 A - 1 identifies i d e n t i f i e s data d a t a content c o n t e n t rather r a t h e r than t h a n data d a t a format. f o r m a t . Life L i f e cycle c y c l e data d a t a may m a y be b e combined c o m b i n e d in i n a a manner m a n n e r consistent c o n s i s t e n t with w i t h the t h e users u s e r s development d e v e l o p m e n t processes. p r o c e s s e s . granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true} D D = = . . = = ! ! c c m m ...... . . . . . . CJ1 C J 1 TABLE T A B L E A-1 A - 1 - - PROCESS P R O C E S S OBJECTIVES, O B J E C T I V E S , OUTPUTS O U T P U T S & & SYSTEM S Y S T E M CONTROL C O N T R O L CATEGORY C A T E G O R Y t::I t : : I c:> c : > [ [ c:> c : > = = ..i . . i . . . . =i. = i . ::;, : : ; , c:> c : > 9 9 r:,, r : , , ... . . . d d c:> c : > )> ) > ;;::o ; ; : : o CT C T "'U " ' U t::I t : : I -...J - . . . J DO D O ;:$. ; : $ . CJ1 C J 1 =i. = i . )> ) > : : . . .. . . : : ,. , . : : ir:,, i r : , , DO D O S.," S . , " =i. = i . DO D O '.:' ' . : ' z z c:> c : > a a C C ..., . . . , T T . . .... . . . . ,!'-' , ! ' - ' N N .... . . . . 0\ 0 \ "'U " ' U C C CD C D CX) C X ) ạ ạ ..... . . . . . Objective O b j e c t i v e Section S e c t i o n Applicability A p p l i c a b i l i t y and a n d Independence I n d e p e n d e n c e by b y Development D e v e l o p m e n t Assurance A s s u r a n c e Level L e v e l (see ( s e e 5.2.3) 5 . 2 . 3 ) Output O u t p u t System S y s t e m Control C o n t r o l Category C a t e g o r y by b y Level L e v e l (see ( s e e 5.6.2.6) 5 . 6 . 2 . 6 ) Comments C o m m e n t s Objective O b j e c t i v e No. N o . Objective O b j e c t i v e Description D e s c r i p t i o n A A B B C C D D E E A A B B C C D D E E 1.0 1 . 0 Planning P l a n n i n g Process P r o c e s s 1.1 1 . 1 System S y s t e m development d e v e l o p m e n t and a n d integral i n t e g r a l processes p r o c e s s e s activities a c t i v i t i e s are a r e defined d e f i n e d 5.8.1 5 . 8 . 1 5.8.4.1 5 . 8 . 4 . 1 R R R R R R R R R R Certification C e r t i f i c a t i o n Plan P l a n <D < D <D < D <D < D <D < D <D < D 3.1 3 . 1 5.1.5 5 . 1 . 5 Aoox A o o x B B R R R R R R R R N N Safety S a f e t y Program P r o g r a m Plan P l a n @ @ @ @ @ @ @ @ 3.1 3 . 1 5.8.4.3 5 . 8 . 4 . 3 R R R R R R R R N N Development D e v e l o p m e n t Plan P l a n @ @ @ @ @ @ @ @ 5.4.2a 5 . 4 . 2 a 5.4.7.1 5 . 4 . 7 . 1 R R R R R R A A N N Validation V a l i d a t i o n Plan P l a n @ @ @ @ @ @ @ @ 5.5.3 5 . 5 . 3 5.5.5.1 5 . 5 . 5 . 1 R R R R R R A A N N Verification V e r i f i c a t i o n Plan P l a n @ @ @ @ @ @ @ @ 5.6.2.1 5 . 6 . 2 . 1 R R R R R R R R A A Configuration C o n f i g u r a t i o n Management M a n a g e m e n t Plan P l a n @ @ @ @ @ @ @ @ 5.7.2 5 . 7 . 2 R R R R R R R R N N Process P r o c e s s Assurance A s s u r a n c e Plan P l a n @ @ @ @ @ @ @ @ 1.2 1 . 2 Transition T r a n s i t i o n criteria c r i t e r i a and a n d inter- i n t e r - relationship r e l a t i o n s h i p among a m o n g processes p r o c e s s e s are a r e defined. d e f i n e d . 3.2 3 . 2 R R R R R R A A N N Plans P l a n s in i n objective o b j e c t i v e no. n o . 1 1 @ @ @ @ @ @ @ @ R*- R * - Recommended R e c o m m e n d e d for f o r certification c e r t i f i c a t i o n with w i t h process p r o c e s s independence, i n d e p e n d e n c e , R R - - Recommended R e c o m m e n d e d for f o r certification, c e r t i f i c a t i o n , A A - - As A s negotiated n e g o t i a t e d for f o r certification, c e r t i f i c a t i o n , N N - - Not N o t required r e q u i r e d for f o r certification. c e r t i f i c a t i o n . * * Independence I n d e p e n d e n c e is i s achieved a c h i e v e d when w h e n the t h e activity a c t i v i t y is i s performed p e r f o r m e d by b y a a person(s) p e r s o n ( s ) other o t h e r than t h a n the t h e developer d e v e l o p e r of o f the t h e system/item. s y s t e m / i t e m . granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true} D D = = s s . . = = m m ...... . . . . . . CJ1 C J 1 t::I t : : I c:> c : > [ [ c:> c : > = = ..i . . i . . . . =i. = i . ::;, : : ; , c:> c : > 9 9 r:,, r : , , ... . . . d d c:> c : > )> ) > ;;::o ; ; : : o CT C T "'U " ' U t::I t : : I -...J - . . . J CJ1 C J 1 )> ) > DO D O ;:$. ; : $ . =i. = i . : : . . .. . . : : , , . . : : ir:,, i r : , , DO D O ., . , =i. = i . DO D O '.:' ' . : ' z z c:>a c : > a C C ..., . . . , T T . . .... . . . . ,!'-' , ! ' - ' N N .... . . . . 0\ 0 \ "'U " ' U !l) ! l ) C C CD C D CD C D Objective O b j e c t i v e Section S e c t i o n Applicability A p p l i c a b i l i t y and a n d Independence I n d e p e n d e n c e by b y Development D e v e l o p m e n t Assurance A s s u r a n c e Level L e v e l (see ( s e e 5.2.3) 5 . 2 . 3 ) Output O u t p u t System S y s t e m Control C o n t r o l Category C a t e g o r y by b y Level L e v e l (see ( s e e 5.6.2.6) 5 . 6 . 2 . 6 ) Comments C o m m e n t s Objective O b j e c t i v e No. N o . Objective O b j e c t i v e Description D e s c r i p t i o n A A B B C C D D E E A A B B C C D D E E 2.0 2 . 0 Aircraft A i r c r a f t and a n d System S y s t e m Development D e v e l o p m e n t Process P r o c e s s and a n d Rec R e c uirements u i r e m e n t s Capture C a p t u r e 2.1 2 . 1 Aircraft-level A i r c r a f t - l e v e l functions, f u n c t i o n s , functional f u n c t i o n a l requirement, r e q u i r e m e n t , functional f u n c t i o n a l interfaces i n t e r f a c e s and a n d assumptions a s s u m p t i o n s are a r e defined d e f i n e d 4.1.4 4 . 1 . 4 4.2 4 . 2 5.3 5 . 3 R R R R R R R R N N List L i s t of o f Aircraft- A i r c r a f t - level l e v e l functions f u n c t i o n s Aircraft-level A i r c r a f t - l e v e l Requirements R e q u i r e m e n t s G) G ) G) G ) G) G ) @ @ Note: N o t e : Requirements R e q u i r e m e n t s capture c a p t u r e process p r o c e s s objectives o b j e c t i v e s presented p r e s e n t e d in i n section s e c t i o n 5.3 5 . 3 are a r e included i n c l u d e d in i n this t h i s development d e v e l o p m e n t process p r o c e s s 2.2 2 . 2 Aircraft A i r c r a f t functions f u n c t i o n s are a r e allocated a l l o c a t e d to t o systems s y s t e m s 4.1.5 4 . 1 . 5 4.3 4 . 3 R R R R R R R R N N System S y s t e m Requirements R e q u i r e m e n t s G) G ) G) G ) G) G ) @ @ 2.3 2 . 3 System S y s t e m requirements, r e q u i r e m e n t s , including i n c l u d i n g assumptions a s s u m p t i o n s and a n d system s y s t e m interfaces i n t e r f a c e s are a r e defined. d e f i n e d . 5.3 5 . 3 R R R R R R R R N N System S y s t e m Requirements R e q u i r e m e n t s G) G ) G) G ) G) G ) @ @ 2.4 2 . 4 System S y s t e m derived d e r i v e d requirements r e q u i r e m e n t s (including ( i n c l u d i n g derived d e r i v e d safety-related s a f e t y - r e l a t e d requirements) r e q u i r e m e n t s ) are a r e defined d e f i n e d and a n d rationale r a t i o n a l e explained. e x p l a i n e d . 4.4 4 . 4 5.3.1.4 5 . 3 . 1 . 4 5.3.2 5 . 3 . 2 R R R R R R A A N N System S y s t e m Requirements R e q u i r e m e n t s G) G ) G) G ) G) G ) @ @ 2.5 2 . 5 System S y s t e m architecture a r c h i t e c t u r e is i s defined. d e f i n e d . 4.1.6 4 . 1 . 6 4.4 4 . 4 5.8.4.4 5 . 8 . 4 . 4 R R R R R R A A N N System S y s t e m Design D e s i g n Description D e s c r i p t i o n G) G ) G) G ) @ @ @ @ 2.6 2 . 6 System S y s t e m requirements r e q u i r e m e n t s are a r e allocated a l l o c a t e d to t o the t h e items. i t e m s . 4.1.7 4 . 1 . 7 4.5 4 . 5 4.6 4 . 6 5.3 5 . 3 R R R R R R R R N N Item I t e m Requirements R e q u i r e m e n t s G) G ) G) G ) G) G ) @ @ 2.7 2 . 7 Appropriate A p p r o p r i a t e item, i t e m , system s y s t e m and a n d aircraft a i r c r a f t integrations i n t e g r a t i o n s are a r e performed. p e r f o r m e d . 4.6.3 4 . 6 . 3 4.6.4 4 . 6 . 4 R R R R R R A A N N Verification V e r i f i c a t i o n Summary S u m m a r y @ @ @ @ @ @ @ @ R*- R * - Recommended R e c o m m e n d e d for f o r certification c e r t i f i c a t i o n with w i t h process p r o c e s s independence, i n d e p e n d e n c e , R R - - Recommended R e c o m m e n d e d for f o r certification c e r t i f i c a t i o n , , A A - - As A s negotiated n e g o t i a t e d for f o r certification c e r t i f i c a t i o n , , N N - - Not N o t required r e q u i r e d for f o r certification c e r t i f i c a t i o n * * Independence I n d e p e n d e n c e is i s achieved a c h i e v e d when w h e n the t h e activity a c t i v i t y is i s performed p e r f o r m e d by b y a a person(s) p e r s o n ( s ) other o t h e r than t h a n the t h e developer d e v e l o p e r of o f the t h e system/item. s y s t e m / i t e m . granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true} m m 0 0 ạ ạ ..... . . . . . ...... . . . . . . CJ1 C J 1 granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true} D D = = s s . . = = Q Q u, u , m m t::I t : : I c:> c : > [ [ c:> c : > = = ..i . . i . . . . =i. = i . ::;, : : ; , c:> c : > 9 9 r:,, r : , , ... . . . d d c:> c : > )> ) > ::a : : a C' C ' "U " U t::I t : : I -.J - . J s s DO; D O ; u, u , )> ) > : : . . .. . . : : ,. , . : : ir:,, i r : , , DO D O ., . , =i. = i . DO D O '.:' ' . : ' z z c:>a c : > a C C ...,. . . . , . ' ' .... . . . . ,!" , ! " N N .... . . . . 0\ 0 \ "U " U C C (D ( D a a Objective O b j e c t i v e Section S e c t i o n Applicability A p p l i c a b i l i t y and a n d Independence I n d e p e n d e n c e by b y Development D e v e l o p m e n t Assurance A s s u r a n c e Level L e v e l (see ( s e e 5.2.3) 5 . 2 . 3 ) Output O u t p u t System S y s t e m Control C o n t r o l Category C a t e g o r y by b y Level L e v e l (see ( s e e 5.6.2.6) 5 . 6 . 2 . 6 ) Comments C o m m e n t s Objective O b j e c t i v e No. N o . Objective O b j e c t i v e Description D e s c r i p t i o n A A B B C C D D E E A A B B C C D D E E 3.0 3 . 0 Safety S a f e t y Assessment A s s e s s m e n t Process P r o c e s s 3.1 3 . 1 The T h e aircraft/system a i r c r a f t / s y s t e m functional f u n c t i o n a l hazard h a z a r d assessment a s s e s s m e n t is i s performed. p e r f o r m e d . 5.1.1 5 . 1 . 1 5.2.3 5 . 2 . 3 5.2.4 5 . 2 . 4 R* R * R* R * R R R R R R Aircraft A i r c r a f t FHA F H A System S y s t e m FHA F H A CD C D CD C D CD C D CD C D CD C D 3.2 3 . 2 The T h e preliminary p r e l i m i n a r y aircraft a i r c r a f t safety s a f e t y assessment a s s e s s m e n t is i s performed. p e r f o r m e d . 5.1.2 5 . 1 . 2 5.2.3 5 . 2 . 3 5.2.4 5 . 2 . 4 R* R * R* R * R R A A N N PASA P A S A CD C D CD C D CD C D CD C D 3.3 3 . 3 The T h e preliminary p r e l i m i n a r y system s y s t e m safety s a f e t y assessment a s s e s s m e n t is i s performed. p e r f o r m e d . 5.1.2 5 . 1 . 2 5.1.6 5 . 1 . 6 5.2.3 5 . 2 . 3 5.2.4 5 . 2 . 4 R* R * R* R * R R A A N N PSSA P S S A CD C D CD C D CD C D 3.4 3 . 4 The T h e common c o m m o n cause c a u s e analyses a n a l y s e s are a r e performed. p e r f o r m e d . 5.1.4 5 . 1 . 4 R R R R A A N N N N Particular P a r t i c u l a r Risk R i s k Assessment A s s e s s m e n t CD C D CD C D CD C D R* R * R* R * A A N N N N Common C o m m o n Mode M o d e Analysis A n a l y s i s CD C D CD C D CD C D R R R R A A N N N N Zonal Z o n a l Safety S a f e t y Analysis A n a l y s i s CD C D CD C D CD C D 3.5 3 . 5 The T h e aircraft a i r c r a f t safety s a f e t y assessment a s s e s s m e n t is i s performed. p e r f o r m e d . 5.1.3 5 . 1 . 3 5.1.6 5 . 1 . 6 R* R * R* R * R R A A N N ASA A S A CD C D CD C D CD C D CD C D 3.6 3 . 6 The T h e system s y s t e m safety s a f e t y assessment a s s e s s m e n t is i s performed. p e r f o r m e d . 5.1.3 5 . 1 . 3 5.1.6 5 . 1 . 6 R* R * R* R * R R A A N N SSA S S A CD C D CD C D CD C D 3.7 3 . 7 Independence I n d e p e n d e n c e requirements r e q u i r e m e n t s in i n functions, f u n c t i o n s , systems s y s t e m s and a n d items i t e m s are a r e captured c a p t u r e d 5.3.2 5 . 3 . 2 5.2.3 5 . 2 . 3 5.1.2 5 . 1 . 2 R* R * R* R * R R R R N N System, S y s t e m , HW, H W , SW S W Requirements R e q u i r e m e n t s PASA P A S A PSSA P S S A CD C D CD C D CD C D R*- R * - Recommended R e c o m m e n d e d for f o r certification c e r t i f i c a t i o n with w i t h process p r o c e s s independence, i n d e p e n d e n c e , R R - - Recommended R e c o m m e n d e d for f o r certification c e r t i f i c a t i o n , , A A - - As A s negotiated n e g o t i a t e d for f o r certification, c e r t i f i c a t i o n , N N - - Not N o t required r e q u i r e d for f o r certification c e r t i f i c a t i o n . . * * Independence I n d e p e n d e n c e for f o r the t h e safety s a f e t y artifacts a r t i f a c t s is i s achieved a c h i e v e d when w h e n the t h e safety s a f e t y activity a c t i v i t y is i s performed p e r f o r m e d by b y a a person(s) p e r s o n ( s ) other o t h e r than t h a n the t h e developer d e v e l o p e r of o f the t h e system/item s y s t e m / i t e m . . C C granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true} D D = = s s s s . . = = Q Q ...... . . . . . . ...... . . . . . . u, u , m m t::I t : : I c:> c : > [ [ c:> c : > = = ..i . . i . . . . =i. = i . ::;, : : ; , c:> c : > 9 9 r:,, r : , , ... . . . d d c:> c : > )> ) > ::a : : a C' C ' "U " U t::I t : : I -.J - . J DO D O u, u , )> ) > : : . . .. . . : : ,. , . : : ir i r : : , , , , DO D O ., . , =i. = i . DO D O '.:' ' . : ' z z c:>a c : > a C C ...,. . . . , . ' ' .... . . . . ,!" , ! " N N .... . . . . 0\ 0 \ "U " U C C (D ( D CD C D Objective O b j e c t i v e Section S e c t i o n Applicability A p p l i c a b i l i t y and a n d Independence I n d e p e n d e n c e by b y Development D e v e l o p m e n t Assurance A s s u r a n c e Level L e v e l (see ( s e e 5.2.3) 5 . 2 . 3 ) Output O u t p u t System S y s t e m Control C o n t r o l Category C a t e g o r y by b y Level L e v e l (see ( s e e 5.6.2.6) 5 . 6 . 2 . 6 ) Comments C o m m e n t s Objective O b j e c t i v e No. N o . Objective O b j e c t i v e Description D e s c r i p t i o n A A B B C C D D E E A A B B C C D D E E 4.0 4 . 0 Requirements R e q u i r e m e n t s Validation V a l i d a t i o n Process P r o c e s s 4.1 4 . 1 Aircraft, A i r c r a f t , system, s y s t e m , item i t e m requirements r e q u i r e m e n t s are a r e complete c o m p l e t e and a n d correct. c o r r e c t . 5.4 5 . 4 5.4.2 5 . 4 . 2 C C 5.4.3 5 . 4 . 3 5.4.4 5 . 4 . 4 R* R * R* R * R R A A N N Validat V a l i d a t ion i o n Results R e s u l t s @ @ @ @ @ @ @ @ Includes I n c l u d e s coordination c o o r d i n a t i o n of o f interfaces i n t e r f a c e s between b e t w e e n systems s y s t e m s and a n d between b e t w e e n items i t e m s . . 4.2 4 . 2 Assumptions A s s u m p t i o n s are a r e justified j u s t i f i e d and a n d validated v a l i d a t e d 5.4.2.d 5 . 4 . 2 . d R* R * R R R R A A N N Validation V a l i d a t i o n Results R e s u l t s @ @ @ @ @ @ @ @ 4.3 4 . 3 Derived D e r i v e d requirements r e q u i r e m e n t s are a r e justified j u s t i f i e d and a n d validated. v a l i d a t e d . 5.3.1.4 5 . 3 . 1 . 4 5.3.2 5 . 3 . 2 5.4.2 5 . 4 . 2 R* R * R* R * R R A A N N Validation V a l i d a t i o n Results R e s u l t s @ @ @ @ @ @ @ @ 4.4 4 . 4 Requirements R e q u i r e m e n t s are a r e traceable. t r a c e a b l e . 5.4.3 5 . 4 . 3 5.4.4 5 . 4 . 4 R R R R R R A A N N Validation V a l i d a t i o n Results R e s u l t s @ @ @ @ @ @ @ @ 4.6 4 . 6 Validation V a l i d a t i o n compliance c o m p l i a n c e substantiation s u b s t a n t i a t i o n is i s provided. p r o v i d e d . 5.4.2.e 5 . 4 . 2 . e 5.4.2.f 5 . 4 . 2 . f 5.4.8 5 . 4 . 8 5.4.7.4 5 . 4 . 7 . 4 R R R R R R A A N N Validation V a l i d a t i o n Summary S u m m a r y (including ( i n c l u d i n g Validation V a l i d a t i o n Matrix) M a t r i x ) @ @ @ @ @ @ @ @ R*- R * - Recommended R e c o m m e n d e d for f o r certificat c e r t i f i c a t ion i o n with w i t h process p r o c e s s independence, i n d e p e n d e n c e , R R - - Recommended R e c o m m e n d e d for f o r certification, c e r t i f i c a t i o n , A A - - As A s negotiated n e g o t i a t e d for f o r certification, c e r t i f i c a t i o n , N N - - Not N o t required r e q u i r e d for f o r certification. c e r t i f i c a t i o n . * * Independence I n d e p e n d e n c e for f o r the t h e requirement r e q u i r e m e n t artifacts a r t i f a c t s is i s achieved a c h i e v e d when w h e n the t h e validation v a l i d a t i o n activity a c t i v i t y is i s performed p e r f o r m e d by b y a a person(s) p e r s o n ( s ) other o t h e r than t h a n the t h e developer d e v e l o p e r of o f the t h e requirement. r e q u i r e m e n t . granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true} m m " " a a ' ' ...... . . . . . . ...... . . . . . . u, u , granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true} D D = = -.J - . J s; s ; s s . . = = a a ...... . . . . . . ...... . . . . . . u, u , m m t::I t : : I c:> c : > [ [ c:> c : > = = ..i . . i . . . . =i. = i . ::;, : : ; , c:> c : > 9 9 r:,, r : , , ... . . . d d c:> c : > )> ) > ::a : : a CT C T "U " U t::I t : : I DO D O u, u , )> ) > : : . . .. . . : : ,. , . : : ir:,, i r : , , DO D O ., . , =i. = i . DO D O '.:' ' . : ' z z c:>a c : > a C C ..., . . . , T T . . .... . . . . ,!'-' , ! ' - ' N N .... . . . . 0\ 0 \ "U " U Q) Q ) C C CD C D Objective O b j e c t i v e Section S e c t i o n Applicability A p p l i c a b i l i t y and a n d Independence I n d e p e n d e n c e by b y Development D e v e l o p m e n t Assurance A s s u r a n c e Level L e v e l (see ( s e e 5.2.3) 5 . 2 . 3 ) Output O u t p u t System S y s t e m Control C o n t r o l Category C a t e g o r y by b y Level L e v e l (see ( s e e 5.6.2.6) 5 . 6 . 2 . 6 ) Comments C o m m e n t s Objective O b j e c t i v e No. N o . Objective O b j e c t i v e Description D e s c r i p t i o n A A B B C C D D E E A A B B C C D D E E 5.0 5 . 0 Implementation I m p l e m e n t a t i o n Verification V e r i f i c a t i o n Process P r o c e s s 5.1 5 . 1 Test T e s t or o r demonstration d e m o n s t r a t i o n procedures p r o c e d u r e s are a r e correct. c o r r e c t . 5.5.4.3 5 . 5 . 4 . 3 R* R * R R R R A A N N Verification V e r i f i c a t i o n Procedures P r o c e d u r e s CD C D CD C D @ @ @ @ 5.2 5 . 2 Verification V e r i f i c a t i o n demonstrates d e m o n s t r a t e s intended i n t e n d e d function f u n c t i o n and a n d confidence c o n f i d e n c e of o f no n o unintended u n i n t e n d e d function f u n c t i o n impacts i m p a c t s to t o safety. s a f e t y . 5.5.1 5 . 5 . 1 5.5.5.3 5 . 5 . 5 . 3 5.5.5.2 5 . 5 . 5 . 2 R* R * R R R R A A N N Verification V e r i f i c a t i o n Procedures P r o c e d u r e s CD C D CD C D @ @ @ @ R* R * R R R R A A N N Verification V e r i f i c a t i o n Results R e s u l t s @ @ @ @ @ @ @ @ 5.3 5 . 3 Product P r o d u c t implementation i m p l e m e n t a t i o n complies c o m p l i e s with w i t h aircraft, a i r c r a f t , and a n d system s y s t e m requirements. r e q u i r e m e n t s . 5.5.1 5 . 5 . 1 5.5.2 5 . 5 . 2 R* R * R R R R A A N N Verification V e r i f i c a t i o n Procedures P r o c e d u r e s CD C D CD C D @ @ @ @ R* R * R R R R A A N N Verification V e r i f i c a t i o n Results R e s u l t s @ @ @ @ @ @ @ @ Specific S p e c i f i c item i t e m verification v e r i f i c a t i o n activities a c t i v i t i e s are a r e performed p e r f o r m e d under u n d e r DO- D O - 1788/ED-128 1 7 8 8 / E D - 1 2 8 and a n d DO- D O - 254/ED-80. 2 5 4 / E D - 8 0 . 5.4 5 . 4 Safety S a f e t y requirements r e q u i r e m e n t s are a r e verified. v e r i f i e d . 5.5.1 5 . 5 . 1 5.5.5.3 5 . 5 . 5 . 3 R* R * R* R * R R A A N N Verification V e r i f i c a t i o n Procedures P r o c e d u r e s and a n d Results R e s u l t s (ASA, ( A S A , SSA) S S A ) @ @ @ @ @ @ @ @ See S e e Appendix A p p e n d i x A, A , Section S e c t i o n 3.0, 3 . 0 , Safety S a f e t y Assessment A s s e s s m e n t Objectives O b j e c t i v e s for f o r specific s p e c i f i c safety s a f e t y objectives o b j e c t i v e s and a n d control c o n t r o l cateQories c a t e Q o r i e s . . 5.5 5 . 5 Verification V e r i f i c a t i o n compliance c o m p l i a n c e substantiation s u b s t a n t i a t i o n is i s included. i n c l u d e d . 5.5.6.3 5 . 5 . 6 . 3 5.5.6.4 5 . 5 . 6 . 4 R R R R R R A A N N Verification V e r i f i c a t i o n Matrix M a t r i x @ @ @ @ @ @ @ @ R R R R R R A A N N Verification V e r i f i c a t i o n Summarv S u m m a r v @ @ @ @ @ @ @ @ 5.6 5 . 6 Assessment A s s e s s m e n t of o f deficiencies d e f i c i e n c i e s and a n d their t h e i r related r e l a t e d impact i m p a c t on o n safety s a f e t y is i s identified. i d e n t i f i e d . 5.5.6.4 5 . 5 . 6 . 4 R R R R R R A A N N Verification V e r i f i c a t i o n Summary S u m m a r y @ @ @ @ @ @ @ @ R R R R R R A A N N Problem P r o b l e m Reports R e p o r t s @ @ @ @ @ @ @ @ R*- R * - Recommended R e c o m m e n d e d for f o r certification c e r t i f i c a t i o n with w i t h process p r o c e s s independence, i n d e p e n d e n c e , R R - - Recommended R e c o m m e n d e d for f o r certification, c e r t i f i c a t i o n , A A - - As A s negotiated n e g o t i a t e d for f o r certification, c e r t i f i c a t i o n , N N - - Not N o t required r e q u i r e d for f o r certification. c e r t i f i c a t i o n . * * Independence I n d e p e n d e n c e is i s achieved a c h i e v e d when w h e n the t h e verification v e r i f i c a t i o n activity a c t i v i t y is i s performed p e r f o r m e d by b y a a person(s) p e r s o n ( s ) other o t h e r than t h a n the t h e developer. d e v e l o p e r . ( ( v v granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true} D D = = s s . . = = a a ...... . . . . . . ...... . . . . . . u, u , m m t::I t : : I c:> c : > [ [ c:> c : > = = ..i . . i . . . . =i. = i . ::;, : : ; , c:> c : > 9 9 r:,, r : , , ... . . . d d c:> c : > )> ) > ::a : : a C' C ' "U " U t::I t : : I -.J - . J s s DO; D O ; u, u , )> ) > : : . . .. . . : : ,. , . : : ir:,, i r : , , DO D O ., . , =i. = i . DO D O '.:' ' . : ' z z c:>a c : > a C C ...,. . . . , . ' ' .... . . . . ,!'-' , ! ' - ' N N .... . . . . 0\ 0 \ "U " U Q) Q ) C C (D ( D CD C D Objective O b j e c t i v e Section S e c t i o n Applicability A p p l i c a b i l i t y and a n d Independence I n d e p e n d e n c e by b y Development D e v e l o p m e n t Assurance A s s u r a n c e Level L e v e l (see ( s e e 5.2.3) 5 . 2 . 3 ) Output O u t p u t System S y s t e m Control C o n t r o l Category C a t e g o r y by b y Level L e v e l (see ( s e e 5.6.2.6) 5 . 6 . 2 . 6 ) Comments C o m m e n t s Objective O b j e c t i v e No. N o . Objective O b j e c t i v e Description D e s c r i p t i o n A A B B C C D D E E A A B B C C D D E E 6.0 6 . 0 Configuration C o n f i g u r a t i o n Management M a n a g e m e n t Process P r o c e s s 6.1 6 . 1 Configuration C o n f i g u r a t i o n items i t e m s are a r e identified. i d e n t i f i e d . 5.6.2.2 5 . 6 . 2 . 2 R R R R R R A A N N CM C M Records R e c o r d s @ @ @ @ @ @ @ @ 6.2 6 . 2 Configuration C o n f i g u r a t i o n baseline b a s e l i n e and a n d derivatives d e r i v a t i v e s are a r e established e s t a b l i s h e d . . 5.6.2.3 5 . 6 . 2 . 3 R R R R R R A A N N Configuration C o n f i g u r a t i o n Baseline B a s e l i n e Records R e c o r d s CD C D CD C D @ @ @ @ 6.3 6 . 3 Problem P r o b l e m reporting, r e p o r t i n g , change c h a n g e control, c o n t r o l , change c h a n g e review, r e v i e w , and a n d configuration c o n f i g u r a t i o n status s t a t u s accountinQ a c c o u n t i n Q are a r e established e s t a b l i s h e d . . 5.6.2.4 5 . 6 . 2 . 4 R R R R R R R R N N Problem P r o b l e m reports r e p o r t s CM C M Records R e c o r d s @ @ @ @ @ @ @ @ 6.4 6 . 4 Archive A r c h i v e and a n d retrieval r e t r i e v a l are a r e established. e s t a b l i s h e d . 5.6.2.5 5 . 6 . 2 . 5 R R R R R R R R N N CM C M Records R e c o r d s @ @ @ @ @ @ @ @ R*- R * - Recommended R e c o m m e n d e d for f o r certification c e r t i f i c a t i o n with w i t h process p r o c e s s independence, i n d e p e n d e n c e , R R - - Recommended R e c o m m e n d e d for f o r certification, c e r t i f i c a t i o n , A A - - As A s negotiated n e g o t i a t e d for f o r certification, c e r t i f i c a t i o n , N N - - Not N o t required r e q u i r e d for f o r certification c e r t i f i c a t i o n . . granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true} D D = = s s . . = = m m a a ...... . . . . . . ...... . . . . . . u, u , t::I t : : I c:> c : > [ [ c:> c : > = = ..i . . i . . . . =i. = i . ::;, : : ; , c:> c : > 9 9 r:,, r : , , ... . . . d d c:> c : > )> ) > ::a : : a C' C ' "U " U t::I t : : I u u -.J - . J , , )> ) > D D s s O O ; ; : : . . .. . . : : , , . . : : ir:,, i r : , , DO D O ., . , =i. = i . DO D O '.:' ' . : ' z z c:>a c : > a C C ..., . . . , . . ' ' .... . . . . ,!" , ! " N N .... . . . . 0\ 0 \ "U " U Q) Q ) Objective O b j e c t i v e Section S e c t i o n Applicability A p p l i c a b i l i t y and a n d Independence I n d e p e n d e n c e by b y Development D e v e l o p m e n t Assurance A s s u r a n c e Level L e v e l (see ( s e e 5.2.3) 5 . 2 . 3 ) Output O u t p u t System S y s t e m Control C o n t r o l Category C a t e g o r y by b y Level L e v e l (see ( s e e 5.6.2.6) 5 . 6 . 2 . 6 ) Comments C o m m e n t s Objective O b j e c t i v e No. N o . Objective O b j e c t i v e Description D e s c r i p t i o n A A B B C C D D E E A A B B C C D D E E 7.0 7 . 0 Process P r o c e s s Assurance A s s u r a n c e Process P r o c e s s 7.1 7 . 1 Assurance A s s u r a n c e is i s obtained o b t a i n e d that t h a t necessary n e c e s s a r y plans p l a n s are a r e developed d e v e l o p e d and a n d maintained m a i n t a i n e d for f o r all a l l aspects a s p e c t s of o f system s y s t e m certification. c e r t i f i c a t i o n . 5.7.3 5 . 7 . 3 R* R * R* R * R* R * R R N N Evidence E v i d e n c e of o f Process P r o c e s s Assurance A s s u r a n c e (D ( D (D ( D (D ( D (D ( D 7.2 7 . 2 Development D e v e l o p m e n t activities a c t i v i t i e s and a n d processes p r o c e s s e s are a r e conducted c o n d u c t e d in i n accordance a c c o r d a n c e with w i t h those t h o s e plans. p l a n s . 5.7.4 5 . 7 . 4 R* R * R* R * R* R * R R N N Evidence E v i d e n c e of o f Process P r o c e s s Assurance A s s u r a n c e (D ( D (D ( D (D ( D (D ( D R*- R * - Recommended R e c o m m e n d e d for f o r certification c e r t i f i c a t i o n with w i t h process p r o c e s s independence, i n d e p e n d e n c e , R R - - Recommended R e c o m m e n d e d for f o r certification, c e r t i f i c a t i o n , A A - - As A s negotiated n e g o t i a t e d for f o r certification, c e r t i f i c a t i o n , N N - - Not N o t required r e q u i r e d for f o r certification. c e r t i f i c a t i o n . * * Independence I n d e p e n d e n c e is i s achieved a c h i e v e d when w h e n the t h e process p r o c e s s assurance a s s u r a n c e activity a c t i v i t y is i s performed p e r f o r m e d by b y a a person(s) p e r s o n ( s ) other o t h e r than t h a n the t h e developer. d e v e l o p e r . granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true} m m C C (D ( D Cu C u D D , , a a ...... . . . . . . ...... . . . . . . u, u , granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true} t t iD i D a a z z a a m m )> ) > :::a : : : a -u - u .,l:l,,. . , l : l , , . -...J - . . . J 01 0 1 t::I t : : I 0 0 = = ..i . . i . . . . =i. = i . ::;, : : ; , E E ... . . . dD d D : : O O :; : ; § § !!?. ! ! ? . C' C ' t::I t : : I DO D O ;:$. ; : $ . =i. = i . : : . . .. . . : : , , . . : : ::i. : : i . .F . F er, e r , s- s - DO D O '.:' ' . : ' 0.. 0 . . C' C ' .... . . . . ,!" , ! " .... . . . . 0\ 0 \ -u - u !l) ! l ) :a : a CD C D co c o 0) 0 ) ạ ạ ....... . . . . . . . ........ . . . . . . . . 01 0 1 Objective O b j e c t i v e Section S e c t i o n Applicability A p p l i c a b i l i t y and a n d Independence I n d e p e n d e n c e by b y Development D e v e l o p m e n t Assurance A s s u r a n c e Level L e v e l (see ( s e e 5.2.3) 5 . 2 . 3 ) Output O u t p u t System S y s t e m Control C o n t r o l Category C a t e g o r y by b y Level L e v e l (see ( s e e 5.6.2.6) 5 . 6 . 2 . 6 ) Comments C o m m e n t s Objective O b j e c t i v e No. N o . Objective O b j e c t i v e Description D e s c r i p t i o n A A B B C C D D E E A A B B C C D D E E 8.0 8 . 0 Certification C e r t i f i c a t i o n and a n d ReQulatorv R e Q u l a t o r v Authority A u t h o r i t y Coordination C o o r d i n a t i o n Process P r o c e s s 8.1 8 . 1 Compliance C o m p l i a n c e substantiation s u b s t a n t i a t i o n is i s provided. p r o v i d e d . 5.8.3 5 . 8 . 3 R R R R R R A A N N Certification C e r t i f i c a t i o n Summary S u m m a r y CD C D CD C D CD C D G) G ) 5.8.4.2 5 . 8 . 4 . 2 R R R R R R A A N N Configuration C o n f i g u r a t i o n Index I n d e x CD C D CD C D G) G ) G) G ) R*- R * - Recommended R e c o m m e n d e d for f o r certification c e r t i f i c a t i o n with w i t h process p r o c e s s independence, i n d e p e n d e n c e , R R - - Recommended R e c o m m e n d e d for f o r certification, c e r t i f i c a t i o n , A A - - As A s negotiated n e g o t i a t e d for f o r certification, c e r t i f i c a t i o n , N N - - Not N o t required r e q u i r e d for f o r certification. c e r t i f i c a t i o n . granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true} Downloaded D o w n l o a d e d from f r o m SAE S A E International I n t e r n a t i o n a l by b y David D a v i d Merrill, M e r r i l l , Saturday, S a t u r d a y , November N o v e m b e r 12, 1 2 , 2016 2 0 1 6 SAE S A E ARP4754A A R P 4 7 5 4 A Page P a g e 97 9 7 of o f 115 1 1 5 APPENDIX A P P E N D I X B B - - SAFETY S A F E T Y PROGRAM P R O G R A M PLAN P L A N The T h e first f i r s t task t a s k that t h a t should s h o u l d be b e accomplished a c c o m p l i s h e d on o n any a n y new n e w program p r o g r a m is i s the t h e creation c r e a t i o n of o f a a safety s a f e t y program p r o g r a m plan. p l a n . This T h i s plan p l a n outlines o u t l i n e s what w h a t should s h o u l d be b e accomplished a c c o m p l i s h e d to t o assess a s s e s s the t h e design d e s i g n safety s a f e t y of o f the t h e product. p r o d u c t . It I t also a l s o outlines o u t l i n e s what w h a t individuals/ i n d i v i d u a l s / organizations o r g a n i z a t i o n s should s h o u l d be b e responsible r e s p o n s i b l e for f o r accomplishing a c c o m p l i s h i n g these t h e s e tasks t a s k s and a n d how h o w the t h e assessment a s s e s s m e n t will w i l l be b e reviewed r e v i e w e d and a n d recorded. r e c o r d e d . It I t is i s organized o r g a n i z e d on o n a a chronological c h r o n o l o g i c a l timeline t i m e l i n e and a n d arranged a r r a n g e d according a c c o r d i n g to t o how h o w a a given g i v e n company c o m p a n y assigns a s s i g n s responsibilities r e s p o n s i b i l i t i e s for f o r the t h e tasks t a s k s involved. i n v o l v e d . This T h i s appendix a p p e n d i x contains c o n t a i n s an a n example e x a m p l e which w h i c h could c o u l d be b e used u s e d as a s a a template t e m p l a t e to t o create c r e a t e a a safety s a f e t y plan p l a n for f o r a a given g i v e n program. p r o g r a m . Each E a c h program p r o g r a m is i s unique u n i q u e and a n d the t h e plan p l a n should s h o u l d be b e tailored t a i l o r e d to t o fit f i t the t h e parameters p a r a m e t e r s of o f the t h e program. p r o g r a m . Also, A l s o , each e a c h company c o m p a n y has h a s its i t s own o w n organizational o r g a n i z a t i o n a l structure s t r u c t u r e and a n d may m a y assign a s s i g n functions f u n c t i o n s to t o groups g r o u p s or o r individuals i n d i v i d u a l s that t h a t are a r e different d i f f e r e n t than t h a n those t h o s e shown s h o w n in i n the t h e example. e x a m p l e . This T h i s is i s appropriate; a p p r o p r i a t e ; however h o w e v e r the t h e elements e l e m e n t s of o f the t h e plan p l a n should s h o u l d be b e represented r e p r e s e n t e d in i n all a l l plans. p l a n s . The T h e plan p l a n will w i l l have h a v e to t o be b e tailored t a i l o r e d to t o the t h e size s i z e and a n d scope s c o p e of o f the t h e specific s p e c i f i c program. p r o g r a m . The T h e example e x a m p l e is i s provided p r o v i d e d as a s a a template t e m p l a t e to t o aid a i d in i n the t h e creation c r e a t i o n of o f the t h e plan p l a n and a n d to t o help h e l p assure a s s u r e that t h a t all a l l aspects a s p e c t s are a r e incorporated. i n c o r p o r a t e d . It I t is i s not n o t intended i n t e n d e d to t o be b e a a prescriptive p r e s c r i p t i v e template, t e m p l a t e , but b u t is i s a a guide g u i d e to t o organizing o r g a n i z i n g a a plan. p l a n . What W h a t follows f o l l o w s should s h o u l d cover c o v e r all a l l aspects a s p e c t s of o f a a large l a r g e scale s c a l e development. d e v e l o p m e n t . Smaller S m a l l e r programs p r o g r a m s may m a y show s h o w a a different d i f f e r e n t structure, s t r u c t u r e , but b u t should s h o u l d cover c o v e r the t h e same s a m e assessment a s s e s s m e n t elements e l e m e n t s appropriate a p p r o p r i a t e to t o the t h e scope s c o p e of o f the t h e given g i v e n design d e s i g n development. d e v e l o p m e n t . For F o r example, e x a m p l e , a a developer d e v e l o p e r of o f a a lower l o w e r level l e v e l system s y s t e m would w o u l d not n o t include i n c l u d e airframe a i r f r a m e level l e v e l reviews. r e v i e w s . The T h e objective o b j e c t i v e of o f the t h e plan p l a n is i s to t o provide p r o v i d e a a clear c l e a r picture p i c t u r e at a t the t h e beginning b e g i n n i n g of o f a a program p r o g r a m of o f the t h e tasks t a s k s to t o be b e accomplished a c c o m p l i s h e d and a n d the t h e individuals/organizations i n d i v i d u a l s / o r g a n i z a t i o n s responsible r e s p o n s i b l e for f o r accomplishing a c c o m p l i s h i n g them. t h e m . This T h i s appendix a p p e n d i x provides p r o v i d e s a a safety s a f e t y program p r o g r a m plan p l a n example. e x a m p l e . Details D e t a i l s for f o r accomplishing a c c o m p l i s h i n g the t h e tasks t a s k s described d e s c r i b e d herein h e r e i n may m a y be b e found f o u n d in i n ARP4761 A R P 4 7 6 1 . . granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true} Downloaded D o w n l o a d e d from f r o m SAE S A E International I n t e r n a t i o n a l by b y David D a v i d Merrill, M e r r i l l , Saturday, S a t u r d a y , November N o v e m b e r 12, 1 2 , 2016 2 0 1 6 SAE S A E ARP4754A A R P 4 7 5 4 A Page P a g e 98 9 8 of o f 115 1 1 5 Table T a b l e of o f Contents C o n t e n t s Example E x a m p l e Safety S a f e t y Program P r o g r a m Plan P l a n 1.0 1 . 0 SCOPE S C O P E AND A N D PURPOSE.......................................................................................................................................... P U R P O S E . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 98 9 8 2.1 2 . 1 ORGANIZATIONAL O R G A N I Z A T I O N A L STRUCTURE S T R U C T U R E OF O F THE T H E AIRCRAFT A I R C R A F T PROGRAM......................................................................98 P R O G R A M . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9 8 2.2 2 . 2 Aircraft A i r c r a f t Safety S a f e t y Group G r o u p Sub S u b teams.............................................................................................................................. t e a m s . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 98 9 8 3.1 3 . 1 SAFETY S A F E T Y RESPONSIBILITIES...................................................................................................................................... R E S P O N S I B I L I T I E S . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 98 9 8 3.2 3 . 2 Design D e s i g n Groups......................................................................................................................................................... G r o u p s . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 98 9 8 3.3 3 . 3 Safety S a f e t y Program P r o g r a m Plan.............................................................................................................................................. P l a n . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 100 1 0 0 3.4 3 . 4 Safety-Related S a f e t y - R e l a t e d Requirements................................................................................................................................. R e q u i r e m e n t s . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 100 1 0 0 3.4.1 3 . 4 . 1 Safety-Related S a f e t y - R e l a t e d Requirements R e q u i r e m e n t s from f r o m Regulatory R e g u l a t o r y Agencies.......................................................................100 A g e n c i e s . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 0 0 3.4.2 3 . 4 . 2 Safety-Related S a f e t y - R e l a t e d Requirements R e q u i r e m e n t s in i n the t h e Requirements R e q u i r e m e n t s Database................................................................101 D a t a b a s e . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 0 1 3.4.3 3 . 4 . 3 Requirements R e q u i r e m e n t s from f r o m Functional F u n c t i o n a l Hazard H a z a r d Analysis A n a l y s i s Results........................................................................101 R e s u l t s . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 0 1 3.4.4 3 . 4 . 4 Maintenance M a i n t e n a n c e Steering S t e e r i n g Group G r o u p (MSG-3) ( M S G - 3 ) Analysis.....................................................................................101 A n a l y s i s . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 0 1 3.4.5 3 . 4 . 5 The T h e Master M a s t e r Minimum M i n i m u m Equipment E q u i p m e n t List L i s t (MMEL) ( M M E L ) Process..........................................................................101 P r o c e s s . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 0 1 3.4.6 3 . 4 . 6 Flight F l i g h t Testing.......................................................................................................................................... T e s t i n g . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 101 1 0 1 3.4 3 . 4 Special S p e c i a l Aircraft-Level A i r c r a f t - L e v e l Safety S a f e t y Assessments............................................................................................................101 A s s e s s m e n t s . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 0 1 3.4.1 3 . 4 . 1 Return R e t u r n to t o Land L a n d Assessment..................................................................................................................... A s s e s s m e n t . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 101 1 0 1 3.4.2 3 . 4 . 2 Blade B l a d e Out/Engine O u t / E n g i n e Vibration V i b r a t i o n Assessment.................................................................................................102 A s s e s s m e n t . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 0 2 3.5 3 . 5 Certification C e r t i f i c a t i o n Plan P l a n for f o r Aircraft-Level A i r c r a f t - L e v e l Safety.............................................................................................................. S a f e t y . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 102 1 0 2 3.5.1 3 . 5 . 1 Aircraft-Level A i r c r a f t - L e v e l Safety S a f e t y Assessment A s s e s s m e n t Document..........................................................................................102 D o c u m e n t . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 0 2 3.6 3 . 6 The T h e Aircraft A i r c r a f t Safety S a f e t y Program P r o g r a m Schedule................................................................................................................... S c h e d u l e . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 103 1 0 3 3.7 3 . 7 Preliminary P r e l i m i n a r y Design D e s i g n Reviews................................................................................................................................... R e v i e w s . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 103 1 0 3 3.8 3 . 8 Critical C r i t i c a l Design D e s i g n Reviews.......................................................................................................................................... R e v i e w s . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 103 1 0 3 3.9 3 . 9 Engineering E n g i n e e r i n g Safety S a f e t y Review.................................................................................................................................... R e v i e w . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 103 1 0 3 4.1 4 . 1 COMMON C O M M O N CAUSE C A U S E ASSESSMENTS...................................................................................................................... A S S E S S M E N T S . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 104 1 0 4 4.2 4 . 2 System S y s t e m Separation................................................................................................................................................. S e p a r a t i o n . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 104 1 0 4 4.2.1 4 . 2 . 1 System S y s t e m Separation S e p a r a t i o n Requirements R e q u i r e m e n t s Incorporation I n c o r p o r a t i o n into i n t o the t h e Requirements R e q u i r e m e n t s Database................................104 D a t a b a s e . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 0 4 4.2.2 4 . 2 . 2 System S y s t e m Separation S e p a r a t i o n Requirements R e q u i r e m e n t s Compliance C o m p l i a n c e Verification....................................................................104 V e r i f i c a t i o n . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 0 4 4.2 4 . 2 Aircraft A i r c r a f t Survivability................................................................................................................................................ S u r v i v a b i l i t y . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 104 1 0 4 4.2.1 4 . 2 . 1 Particular P a r t i c u l a r Risks R i s k s Assessment A s s e s s m e n t (PRA)........................................................................................................105 ( P R A ) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 0 5 4.3 4 . 3 Zonal Z o n a l Safety S a f e t y Analysis A n a l y s i s (ZSA)................................................................................................................................... ( Z S A ) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 105 1 0 5 4.4 4 . 4 Common C o m m o n Mode M o d e Analysis A n a l y s i s (CMA)............................................................................................................................. ( C M A ) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 106 1 0 6 5.1 5 . 1 SAFETY S A F E T Y ASSESSMENTS A S S E S S M E N T S AND A N D ANALYSES........................................................................................................106 A N A L Y S E S . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 0 6 5.2 5 . 2 Common C o m m o n Naming N a m i n g Convention................................................................................................................................. C o n v e n t i o n . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 106 1 0 6 5.3 5 . 3 Aircraft A i r c r a f t Level L e v e l FHA F H A and a n d PASA................................................................................................................................. P A S A . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 106 1 0 6 5.2.1 5 . 2 . 1 Continued C o n t i n u e d Safe S a f e Flight F l i g h t and a n d Landing L a n d i n g Functions F u n c t i o n s List.................................................................................107 L i s t . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 0 7 5.3 5 . 3 System S y s t e m Level L e v e l FHA................................................................................................................................................. F H A . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 107 1 0 7 5.3.1 5 . 3 . 1 FHA F H A Manual............................................................................................................................................. M a n u a l . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 107 1 0 7 5.3.2 5 . 3 . 2 FHA F H A Compliance C o m p l i a n c e Verifications V e r i f i c a t i o n s and a n d Closure.............................................................................................107 C l o s u r e . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 0 7 5.4 5 . 4 Preliminary P r e l i m i n a r y System S y s t e m Safety S a f e t y Assessment................................................................................................................ A s s e s s m e n t . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 109 1 0 9 5.5 5 . 5 System S y s t e m Safety S a f e t y Assessment................................................................................................................................... A s s e s s m e n t . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 109 1 0 9 5.6 5 . 6 System S y s t e m FTAs F T A s and a n d FMEAs....................................................................................................................................... F M E A s . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 109 1 0 9 granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true} Downloaded D o w n l o a d e d from f r o m SAE S A E International I n t e r n a t i o n a l by b y David D a v i d Merrill, M e r r i l l , Saturday, S a t u r d a y , November N o v e m b e r 12, 1 2 , 2016 2 0 1 6 SAE S A E ARP4754A A R P 4 7 5 4 A Page P a g e 99 9 9 of o f 115 1 1 5 1.0 1 . 0 Scope S c o p e and a n d Purpose P u r p o s e The T h e purpose p u r p o s e of o f this t h i s safety s a f e t y program p r o g r a m plan p l a n is i s to t o define d e f i n e the t h e scope s c o p e of o f the t h e safety s a f e t y work w o r k and a n d the t h e deliverables d e l i v e r a b l e s planned p l a n n e d for f o r the t h e program p r o g r a m and a n d to t o assign a s s i g n responsibilities. r e s p o n s i b i l i t i e s . It I t also a l s o indicates i n d i c a t e s the t h e principles p r i n c i p l e s of o f the t h e safety s a f e t y assessment a s s e s s m e n t tasks, t a s k s , management m a n a g e m e n t and a n d the t h e schedule s c h e d u l e for f o r deliverable d e l i v e r a b l e items i t e m s according a c c o r d i n g to t o the t h e milestones m i l e s t o n e s (reviews) ( r e v i e w s ) of o f the t h e development d e v e l o p m e n t plan. p l a n . The T h e program p r o g r a m has h a s the t h e overall o v e r a l l responsibility r e s p o n s i b i l i t y for f o r the t h e design d e s i g n safety s a f e t y of o f the t h e product. p r o d u c t . The T h e tasks t a s k s are a r e organized o r g a n i z e d to t o accomplish a c c o m p l i s h the t h e goal g o a l to t o ensure e n s u r e that t h a t the t h e aircraft/system a i r c r a f t / s y s t e m design d e s i g n will w i l l not n o t cause c a u s e or o r contribute c o n t r i b u t e to t o an a n aircraft a i r c r a f t accident. a c c i d e n t . The T h e plan p l a n describes d e s c r i b e s the t h e safety s a f e t y processes p r o c e s s e s in i n general. g e n e r a l . For F o r each e a c h specific s p e c i f i c process p r o c e s s task, t a s k , the t h e roles r o l e s and a n d responsibilities r e s p o n s i b i l i t i e s have h a v e been b e e n identified i d e n t i f i e d for f o r the t h e responsible r e s p o n s i b l e parties. p a r t i e s . The T h e responsibility r e s p o n s i b i l i t y for f o r the t h e safety s a f e t y assessment a s s e s s m e n t tasks t a s k s is i s split s p l i t among a m o n g the t h e organizations o r g a n i z a t i o n s . . The T h e aircraft a i r c r a f t level l e v e l safety s a f e t y analysis a n a l y s i s tasks t a s k s are a r e accomplished a c c o m p l i s h e d by b y an a n airplane a i r p l a n e level l e v e l team t e a m led l e d by b y a a group g r o u p with w i t h airplane a i r p l a n e level l e v e l analysis a n a l y s i s responsibility r e s p o n s i b i l i t y (e.g. ( e . g . the t h e Aircraft A i r c r a f t Safety S a f e t y Group). G r o u p ) . The T h e safety s a f e t y assessment a s s e s s m e n t process p r o c e s s should s h o u l d be b e consistent c o n s i s t e n t with w i t h industry i n d u s t r y safety s a f e t y assessment a s s e s s m e n t standards. s t a n d a r d s . During D u r i n g the t h e conceptual c o n c e p t u a l development d e v e l o p m e n t phase p h a s e of o f the t h e program, p r o g r a m , the t h e process p r o c e s s develops d e v e l o p s and a n d validates v a l i d a t e s requirements r e q u i r e m e n t s using u s i n g a a top-down t o p - d o w n approach. a p p r o a c h . During D u r i n g the t h e detailed d e t a i l e d design d e s i g n and a n d test t e s t phase p h a s e of o f the t h e program, p r o g r a m , design d e s i g n implementation i m p l e m e n t a t i o n is i s measured m e a s u r e d against a g a i n s t the t h e requirements r e q u i r e m e n t s and a n d compliance c o m p l i a n c e is i s verified v e r i f i e d using u s i n g a a bottom-up b o t t o m - u p approach. a p p r o a c h . Component C o m p o n e n t requirements r e q u i r e m e n t s verification v e r i f i c a t i o n is i s gathered g a t h e r e d into i n t o system s y s t e m and a n d eventually e v e n t u a l l y aircraft a i r c r a f t verification v e r i f i c a t i o n as a s the t h e program p r o g r a m proceeds p r o c e e d s through t h r o u g h the t h e build b u i l d and a n d deliver d e l i v e r phase p h a s e of o f the t h e program. p r o g r a m . This T h i s document d o c u m e n t covers c o v e r s all a l l phases p h a s e s of o f the t h e development d e v e l o p m e n t of o f (insert ( i n s e r t program p r o g r a m name n a m e here). h e r e ) . The T h e plan p l a n covers c o v e r s the t h e development d e v e l o p m e n t of o f the t h e maintenance m a i n t e n a n c e planning p l a n n i n g documents d o c u m e n t s under u n d e r the t h e Maintenance M a i n t e n a n c e Steering S t e e r i n g Group G r o u p process p r o c e s s (MSG-3) ( M S G - 3 ) and a n d the t h e development d e v e l o p m e n t of o f the t h e Master M a s t e r Minimum M i n i m u m Equipment E q u i p m e n t List L i s t (MMEL). ( M M E L ) . The T h e in-service i n - s e r v i c e "Operate " O p e r a t e and a n d Monitor" M o n i t o r " phase p h a s e of o f the t h e program p r o g r a m will w i l l be b e governed g o v e r n e d by b y standards s t a n d a r d s such s u c h as a s ARP A R P 5150 5 1 5 0 after a f t e r initial i n i t i a l delivery d e l i v e r y and a n d are a r e not n o t covered c o v e r e d here. h e r e . 2.1 2 . 1 Organizational O r g a n i z a t i o n a l Structure S t r u c t u r e of o f the t h e Program P r o g r a m The T h e organizational o r g a n i z a t i o n a l structure s t r u c t u r e of o f the t h e program p r o g r a m should s h o u l d be b e outlined o u t l i n e d here. h e r e . 2.2 2 . 2 Safety S a f e t y Group G r o u p Sub-Teams: S u b - T e a m s : Sub-teams, S u b - t e a m s , each e a c h with w i t h a a well-defined w e l l - d e f i n e d focus, f o c u s , will w i l l be b e formed. f o r m e d . The T h e sub-teams s u b - t e a m s allow a l l o w for f o r better b e t t e r division d i v i s i o n of o f safety s a f e t y tasks. t a s k s . Example E x a m p l e sub-teams s u b - t e a m s are: a r e : Particular P a r t i c u l a r Risks R i s k s Assessment A s s e s s m e n t (PRA) ( P R A ) Team T e a m and a n d Aircraft-Level A i r c r a f t - L e v e l Safety S a f e t y Assessment A s s e s s m e n t Team T e a m (ASAT). ( A S A T ) . 3.1 3 . 1 Safety S a f e t y Responsibilities: R e s p o n s i b i l i t i e s : The T h e overall o v e r a l l ownership o w n e r s h i p (usually ( u s u a l l y consisting c o n s i s t i n g of o f the t h e Chief C h i e f Program P r o g r a m Engineer E n g i n e e r and a n d his h i s staff) s t a f f ) of o f the t h e safety s a f e t y program p r o g r a m is i s chartered c h a r t e r e d with w i t h the t h e authority a u t h o r i t y necessary n e c e s s a r y to t o ensure e n s u r e the t h e program p r o g r a m meets m e e t s all a l l of o f its i t s requirements. r e q u i r e m e n t s . A A primary p r i m a r y responsibility r e s p o n s i b i l i t y of o f this t h i s group g r o u p is i s to t o plan, p l a n , coordinate c o o r d i n a t e and a n d manage m a n a g e safety-related s a f e t y - r e l a t e d activities a c t i v i t i e s and a n d provide p r o v i d e a a management m a n a g e m e n t overview, o v e r v i e w , with w i t h the t h e objective o b j e c t i v e that t h a t the t h e design d e s i g n will w i l l neither n e i t h e r cause c a u s e nor n o r contribute c o n t r i b u t e to t o an a n aircraft a i r c r a f t accident. a c c i d e n t . These T h e s e activities a c t i v i t i e s will w i l l bring b r i n g to t o the t h e program p r o g r a m a a consistent c o n s i s t e n t approach a p p r o a c h to t o aircraft/system a i r c r a f t / s y s t e m design d e s i g n safety. s a f e t y . 3.2 3 . 2 Aircraft A i r c r a f t Safety S a f e t y Group: G r o u p : An A n Aircraft A i r c r a f t Safety S a f e t y Group G r o u p is i s chartered c h a r t e r e d with w i t h the t h e responsibility r e s p o n s i b i l i t y to t o perform p e r f o r m and/or a n d / o r monitor m o n i t o r the t h e program p r o g r a m safety s a f e t y tasks. t a s k s . The T h e Aircraft A i r c r a f t Safety S a f e t y Group G r o u p responsibilities r e s p o n s i b i l i t i e s are: a r e : • • Establish E s t a b l i s h and a n d communicate c o m m u n i c a t e the t h e safety s a f e t y requirements r e q u i r e m e n t s at a t all a l l tiers t i e r s of o f definition d e f i n i t i o n • • Identify I d e n t i f y aircraft/system a i r c r a f t / s y s t e m functions f u n c t i o n s required r e q u i r e d for f o r continued c o n t i n u e d safe s a f e flight f l i g h t and a n d landing l a n d i n g • • Develop D e v e l o p an a n Aircraft-Level A i r c r a f t - L e v e l Functional F u n c t i o n a l Hazard H a z a r d Assessment A s s e s s m e n t (FHA) ( F H A ) [if [ i f at a t the t h e OEM O E M level] l e v e l ] • • Develop D e v e l o p System S y s t e m FHA F H A manual m a n u a l and a n d ensure e n s u r e System S y s t e m FHAs F H A s are a r e performed p e r f o r m e d consistently c o n s i s t e n t l y in i n accordance a c c o r d a n c e with w i t h this t h i s guidelines g u i d e l i n e s [if [ i f at a t the t h e OEM O E M level] l e v e l ] granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true} Downloaded D o w n l o a d e d from f r o m SAE S A E International I n t e r n a t i o n a l by b y David D a v i d Merrill, M e r r i l l , Saturday, S a t u r d a y , November N o v e m b e r 12, 1 2 , 2016 2 0 1 6 SAE S A E ARP4754A A R P 4 7 5 4 A Page P a g e 100 1 0 0 of o f 115 1 1 5 • • Conduct C o n d u c t thorough, t h o r o u g h , integrated i n t e g r a t e d survivability s u r v i v a b i l i t y assessments a s s e s s m e n t s [if [ i f at a t the t h e OEM O E M level] l e v e l ] • • Identify I d e n t i f y safety s a f e t y lessons l e s s o n s learned l e a r n e d from f r o m previous p r e v i o u s programs p r o g r a m s and a n d provide p r o v i d e visibility v i s i b i l i t y to t o program p r o g r a m management m a n a g e m e n t • • Identify I d e n t i f y aircraft a i r c r a f t level l e v e l safety s a f e t y issues i s s u e s and a n d provide p r o v i d e visibility v i s i b i l i t y to t o program p r o g r a m management m a n a g e m e n t responsible r e s p o n s i b l e for f o r assuring a s s u r i n g implementation i m p l e m e n t a t i o n of o f committed c o m m i t t e d safety s a f e t y changes c h a n g e s [if [ i f at a t the t h e OEM O E M level] l e v e l ] • • Monitor M o n i t o r the t h e completion c o m p l e t i o n of o f the t h e preliminary p r e l i m i n a r y system s y s t e m safety s a f e t y assessments, a s s e s s m e n t s , to t o ensure e n s u r e that t h a t safety s a f e t y requirements r e q u i r e m e n t s are a r e established, e s t a b l i s h e d , validated v a l i d a t e d and a n d documented. d o c u m e n t e d . • • Coordinate C o o r d i n a t e to t o promote p r o m o t e consistency c o n s i s t e n c y of o f analysis a n a l y s i s methods m e t h o d s and a n d approaches a p p r o a c h e s used u s e d in i n verification v e r i f i c a t i o n of o f safety s a f e t y requirements r e q u i r e m e n t s (e.g. ( e . g . mission m i s s i o n lengths l e n g t h s and a n d other o t h e r exposure e x p o s u r e times) t i m e s ) • • Monitor M o n i t o r the t h e completion c o m p l e t i o n of o f aircraft a i r c r a f t and a n d system s y s t e m safety s a f e t y assessments, a s s e s s m e n t s , including i n c l u d i n g the t h e documentation d o c u m e n t a t i o n that t h a t their t h e i r compliance c o m p l i a n c e meets m e e t s the t h e safety s a f e t y requirements. r e q u i r e m e n t s . • • Coordinate C o o r d i n a t e with w i t h the t h e Test T e s t Organization O r g a n i z a t i o n to t o ensure e n s u r e proper p r o p e r testing t e s t i n g of o f failure f a i l u r e modes m o d e s developed d e v e l o p e d in i n the t h e Fault F a u l t Trees T r e e s and a n d FMEAs. F M E A s . • • Work W o r k with w i t h the t h e Chief C h i e f Pilot P i l o t to t o ensure e n s u r e that t h a t there t h e r e are a r e no n o design d e s i g n issues i s s u e s that t h a t could c o u l d lead l e a d to t o a a flight f l i g h t crew c r e w caused c a u s e d incident i n c i d e n t or o r accident. a c c i d e n t . • • Work W o r k with w i t h the t h e maintenance m a i n t e n a n c e organization o r g a n i z a t i o n to t o ensure e n s u r e that t h a t there t h e r e are a r e no n o design d e s i g n issues i s s u e s that t h a t could c o u l d lead l e a d to t o a a maintenance m a i n t e n a n c e caused c a u s e d incident i n c i d e n t or o r accident. a c c i d e n t . • • Play P l a y an a n active a c t i v e role r o l e in i n the t h e Candidate C a n d i d a t e Certification C e r t i f i c a t i o n Maintenance M a i n t e n a n c e Requirement R e q u i r e m e n t (CMR) ( C M R ) meetings. m e e t i n g s . • • Play P l a y an a n active a c t i v e role r o l e in i n the t h e maintenance m a i n t e n a n c e planning p l a n n i n g meetings m e e t i n g s to t o accomplish a c c o m p l i s h the t h e Maintenance M a i n t e n a n c e Steering S t e e r i n g Group G r o u p 3 3 (MSG-3) ( M S G - 3 ) planning p l a n n i n g for f o r scheduled s c h e d u l e d maintenance m a i n t e n a n c e to t o ensure e n s u r e that t h a t safety s a f e t y issues i s s u e s are a r e resolved r e s o l v e d and a n d properly p r o p e r l y dispositioned d i s p o s i t i o n e d . . • • Play P l a y an a n active a c t i v e role r o l e in i n the t h e Flight F l i g h t Operations O p e r a t i o n s development d e v e l o p m e n t of o f the t h e Master M a s t e r Minimum M i n i m u m Equipment E q u i p m e n t List L i s t (MMEL). ( M M E L ) . • • Coordinate C o o r d i n a t e Aircraft A i r c r a f t level l e v e l Safety S a f e t y certification c e r t i f i c a t i o n activities a c t i v i t i e s [if [ i f at a t the t h e OEM O E M level] l e v e l ] Aircraft A i r c r a f t Safety S a f e t y Group G r o u p deliverables d e l i v e r a b l e s may m a y include: i n c l u d e : • • Safety S a f e t y Program P r o g r a m Plan P l a n • • Aircraft A i r c r a f t Level L e v e l FHA F H A • • Aircraft A i r c r a f t level l e v e l PASA/ASA P A S A / A S A • • Aircraft-level A i r c r a f t - l e v e l safety s a f e t y requirements r e q u i r e m e n t s and a n d objectives o b j e c t i v e s • • System-level S y s t e m - l e v e l safety s a f e t y requirements r e q u i r e m e n t s • • Validation/verification V a l i d a t i o n / v e r i f i c a t i o n progress p r o g r e s s reports, r e p o r t s , as a s required r e q u i r e d for f o r the t h e safety s a f e t y program p r o g r a m • • Special S p e c i a l Aircraft-Level A i r c r a f t - L e v e l Safety S a f e t y Assessments, A s s e s s m e n t s , as a s required r e q u i r e d by b y the t h e program p r o g r a m • • Safety S a f e t y Program P r o g r a m Schedules S c h e d u l e s • • Safety S a f e t y case c a s e deliverable. d e l i v e r a b l e . granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true} Downloaded D o w n l o a d e d from f r o m SAE S A E International I n t e r n a t i o n a l by b y David D a v i d Merrill, M e r r i l l , Saturday, S a t u r d a y , November N o v e m b e r 12, 1 2 , 2016 2 0 1 6 SAE S A E ARP4754A A R P 4 7 5 4 A Page P a g e 101 1 0 1 of o f 115 1 1 5 3.3 3 . 3 Safety S a f e t y Program P r o g r a m Plan P l a n The T h e Aircraft A i r c r a f t Safety S a f e t y Group G r o u p will w i l l prepare p r e p a r e the t h e Safety S a f e t y Program P r o g r a m Plan P l a n and a n d maintain m a i n t a i n it, i t , updating u p d a t i n g it i t as a s necessary. n e c e s s a r y . The T h e Plan P l a n will w i l l be b e reviewed r e v i e w e d and a n d approved a p p r o v e d by b y the t h e Chief C h i e f Engineer E n g i n e e r and a n d other o t h e r appropriate a p p r o p r i a t e leaders l e a d e r s of o f the t h e parties p a r t i e s involved i n v o l v e d in i n the t h e development d e v e l o p m e n t program. p r o g r a m . The T h e safety s a f e t y program p r o g r a m is i s integrated i n t e g r a t e d throughout t h r o u g h o u t the t h e development d e v e l o p m e n t program p r o g r a m and a n d addresses a d d r e s s e s those t h o s e activities a c t i v i t i e s that t h a t are a r e related r e l a t e d to t o aircraft a i r c r a f t safety. s a f e t y . Satisfactory S a t i s f a c t o r y execution e x e c u t i o n of o f the t h e safety s a f e t y program p r o g r a m will w i l l depend d e p e n d on o n effective e f f e c t i v e participation p a r t i c i p a t i o n by b y all a l l Design D e s i g n and a n d Design-support D e s i g n - s u p p o r t organizations o r g a n i z a t i o n s . . Organization O r g a n i z a t i o n Roles R o l e s and a n d Responsibilities R e s p o n s i b i l i t i e s Aircraft A i r c r a f t Safety S a f e t y Group G r o u p Prepares P r e p a r e s draft d r a f t Safety S a f e t y Program P r o g r a m Plan P l a n document. d o c u m e n t . Circulates C i r c u l a t e s plan p l a n for f o r review, r e v i e w , obtains o b t a i n s comments, c o m m e n t s , updates u p d a t e s the t h e document, d o c u m e n t , and a n d obtains o b t a i n s approval a p p r o v a l signatures. s i g n a t u r e s . Communicates C o m m u n i c a t e s the t h e plan p l a n to t o others. o t h e r s . Insures I n s u r e s implementation i m p l e m e n t a t i o n of o f the t h e plan. p l a n . Other O t h e r Design D e s i g n Organizations O r g a n i z a t i o n s Reviews R e v i e w s and a n d concurs c o n c u r s with w i t h the t h e plan. p l a n . Chief C h i e f Project P r o j e c t Engineer E n g i n e e r Reviews R e v i e w s and a n d approves a p p r o v e s plan. p l a n . 3.4 3 . 4 Safety-Related S a f e t y - R e l a t e d Requirements R e q u i r e m e n t s A A safety s a f e t y assessment a s s e s s m e n t team, t e a m , led l e d by b y safety, s a f e t y , consists c o n s i s t s of o f safety s a f e t y focals f o c a l s from f r o m all a l l the t h e aircraft/systems a i r c r a f t / s y s t e m s and a n d facilitates f a c i l i t a t e s the t h e development d e v e l o p m e n t of o f aircraft/system a i r c r a f t / s y s t e m level l e v e l safety s a f e t y requirements. r e q u i r e m e n t s . Each E a c h safety-related s a f e t y - r e l a t e d system-level s y s t e m - l e v e l or o r aircraft-level a i r c r a f t - l e v e l design d e s i g n requirement r e q u i r e m e n t will w i l l have h a v e a a compliance c o m p l i a n c e owner o w n e r having h a v i n g the t h e primary p r i m a r y responsibility r e s p o n s i b i l i t y for f o r its i t s accomplishment. a c c o m p l i s h m e n t . A A major m a j o r role r o l e for f o r the t h e design d e s i g n organization o r g a n i z a t i o n will w i l l be b e to t o ensure e n s u r e that t h a t relevant r e l e v a n t safety-related s a f e t y - r e l a t e d requirements r e q u i r e m e n t s are a r e identified i d e n t i f i e d and a n d properly p r o p e r l y acted a c t e d upon. u p o n . These T h e s e requirements r e q u i r e m e n t s will w i l l include i n c l u d e applicable a p p l i c a b l e Federal F e d e r a l Aviation A v i a t i o n Regulations R e g u l a t i o n s (FARs) ( F A R s ) and a n d Certification C e r t i f i c a t i o n Specifications S p e c i f i c a t i o n s (CSs) ( C S s ) and a n d any a n y applicable a p p l i c a b l e supplementary s u p p l e m e n t a r y regulatory-agency r e g u l a t o r y - a g e n c y requirements. r e q u i r e m e n t s . The T h e requirements r e q u i r e m e n t s will w i l l also a l s o include i n c l u d e the t h e applicable a p p l i c a b l e company c o m p a n y requirements. r e q u i r e m e n t s . The T h e primary p r i m a r y sources s o u r c e s of o f design d e s i g n safety s a f e t y requirements r e q u i r e m e n t s for f o r the t h e program p r o g r a m are a r e defined d e f i n e d in i n the t h e following f o l l o w i n g paragraphs. p a r a g r a p h s . Organization O r g a n i z a t i o n Roles R o l e s and a n d Responsibilities R e s p o n s i b i l i t i e s Aircraft A i r c r a f t Safety S a f e t y Group G r o u p Documentation D o c u m e n t a t i o n and a n d upkeep u p k e e p of o f safety s a f e t y requirements r e q u i r e m e n t s Design D e s i g n Organizations O r g a n i z a t i o n s Reviews, R e v i e w s , concurs c o n c u r s with w i t h and a n d implements i m p l e m e n t s safety s a f e t y requirements r e q u i r e m e n t s where w h e r e they t h e y are a r e an a n affected a f f e c t e d owner o w n e r 3.3.1 3 . 3 . 1 Safety-Related S a f e t y - R e l a t e d Requirements R e q u i r e m e n t s from f r o m Regulatory R e g u l a t o r y Agencies A g e n c i e s : : The T h e Designers D e s i g n e r s and a n d the t h e appropriate a p p r o p r i a t e Design-Support D e s i g n - S u p p o r t organizations o r g a n i z a t i o n s will w i l l identify i d e n t i f y all a l l the t h e airworthiness a i r w o r t h i n e s s requirements r e q u i r e m e n t s from f r o m regulatory r e g u l a t o r y agencies a g e n c i e s and a n d the t h e amendment a m e n d m e n t levels l e v e l s that t h a t will w i l l apply a p p l y to t o the t h e program. p r o g r a m . All A l l differences d i f f e r e n c e s with w i t h respect r e s p e c t to t o the t h e regulatory r e g u l a t o r y requirements r e q u i r e m e n t s applicable a p p l i c a b l e to t o the t h e baseline b a s e l i n e will w i l l be b e specifically s p e c i f i c a l l y identified. i d e n t i f i e d . Regulatory R e g u l a t o r y requirements r e q u i r e m e n t s include i n c l u d e the t h e regulatory r e g u l a t o r y airworthiness a i r w o r t h i n e s s standards s t a n d a r d s and a n d all a l l other o t h e r relevant r e l e v a n t safety-related s a f e t y - r e l a t e d requirements r e q u i r e m e n t s documented d o c u m e n t e d in i n issue i s s u e papers, p a p e r s , special s p e c i a l conditions, c o n d i t i o n s , and a n d certification c e r t i f i c a t i o n requirement r e q u i r e m e n t items. i t e m s . The T h e Certification C e r t i f i c a t i o n organization o r g a n i z a t i o n will w i l l maintain m a i n t a i n a a current c u r r e n t record r e c o r d of o f the t h e regulatory r e g u l a t o r y requirements r e q u i r e m e n t s applicable a p p l i c a b l e to t o the t h e aircraft a i r c r a f t as a s the t h e program p r o g r a m evolves. e v o l v e s . The T h e information i n f o r m a t i o n will w i l l be b e made m a d e available a v a i l a b l e to t o the t h e program p r o g r a m organizations o r g a n i z a t i o n s . . granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true} Downloaded D o w n l o a d e d from f r o m SAE S A E International I n t e r n a t i o n a l by b y David D a v i d Merrill, M e r r i l l , Saturday, S a t u r d a y , November N o v e m b e r 12, 1 2 , 2016 2 0 1 6 SAE S A E ARP4754A A R P 4 7 5 4 A Page P a g e 102 1 0 2 of o f 115 1 1 5 3.3.2 3 . 3 . 2 Safety-Related S a f e t y - R e l a t e d Requirements R e q u i r e m e n t s in i n the t h e Requirements R e q u i r e m e n t s Database D a t a b a s e The T h e Safety S a f e t y organization o r g a n i z a t i o n and a n d the t h e applicable a p p l i c a b l e Design D e s i g n and a n d Design-Support D e s i g n - S u p p o r t organizations o r g a n i z a t i o n s will w i l l have h a v e the t h e responsibility r e s p o n s i b i l i t y for f o r supplying s u p p l y i n g the t h e information i n f o r m a t i o n that t h a t will w i l l be b e added a d d e d to t o the t h e Requirements R e q u i r e m e n t s Database. D a t a b a s e . The T h e Systems S y s t e m s Engineering E n g i n e e r i n g organization o r g a n i z a t i o n will w i l l have h a v e the t h e responsibility r e s p o n s i b i l i t y for f o r managing m a n a g i n g the t h e database d a t a b a s e and a n d publishing p u b l i s h i n g this t h i s material. m a t e r i a l . The T h e Design D e s i g n organizations o r g a n i z a t i o n s are a r e responsible r e s p o n s i b l e for f o r reviewing r e v i e w i n g the t h e safety-related s a f e t y - r e l a t e d requirements, r e q u i r e m e n t s , resolving r e s o l v i n g any a n y issues i s s u e s that t h a t arise, a r i s e , and a n d approving a p p r o v i n g the t h e safety s a f e t y portion p o r t i o n of o f the t h e database. d a t a b a s e . 3.3.3 3 . 3 . 3 Requirements R e q u i r e m e n t s from f r o m Functional F u n c t i o n a l Hazard H a z a r d Assessment A s s e s s m e n t Results: R e s u l t s : The T h e Chief C h i e f Project P r o j e c t Engineer E n g i n e e r will w i l l ensure e n s u r e that t h a t the t h e safety s a f e t y objectives o b j e c t i v e s including i n c l u d i n g the t h e derived d e r i v e d probabilistic p r o b a b i l i s t i c requirements r e q u i r e m e n t s that t h a t result r e s u l t from f r o m the t h e Functional F u n c t i o n a l Hazard H a z a r d Assessment A s s e s s m e n t are a r e properly p r o p e r l y allocated a l l o c a t e d to t o systems. s y s t e m s . 3.3.4 3 . 3 . 4 Maintenance M a i n t e n a n c e Steering S t e e r i n g Group G r o u p (MSG-3) ( M S G - 3 ) Analysis A n a l y s i s : : The T h e Aircraft A i r c r a f t Safety S a f e t y Group G r o u p will w i l l participate p a r t i c i p a t e in i n the t h e MSG-3 M S G - 3 analysis a n a l y s i s process p r o c e s s in i n order o r d e r to t o ensure e n s u r e that t h a t the t h e design d e s i g n safety s a f e t y requirements r e q u i r e m e n t s are a r e not n o t compromised c o m p r o m i s e d during d u r i n g the t h e development d e v e l o p m e n t of o f the t h e maintenance m a i n t e n a n c e plan. p l a n . 3.3.5 3 . 3 . 5 The T h e Master M a s t e r Minimum M i n i m u m Equipment E q u i p m e n t List L i s t (MMEL) ( M M E L ) Process: P r o c e s s : The T h e Aircraft A i r c r a f t Safety S a f e t y Group G r o u p will w i l l participate p a r t i c i p a t e in i n the t h e MMEL M M E L development d e v e l o p m e n t in i n order o r d e r to t o ensure e n s u r e that t h a t the t h e design d e s i g n requirements r e q u i r e m e n t s are a r e properly p r o p e r l y applied a p p l i e d to t o the t h e list l i s t of o f minimum m i n i m u m equipment e q u i p m e n t available a v a i l a b l e for f o r dispatch d i s p a t c h and a n d that t h a t the t h e restrictions r e s t r i c t i o n s applied a p p l i e d are a r e appropriate a p p r o p r i a t e and a n d complete. c o m p l e t e . 3.3.6 3 . 3 . 6 Flight F l i g h t Testing T e s t i n g The T h e Safety S a f e t y organization o r g a n i z a t i o n will w i l l participate p a r t i c i p a t e in i n the t h e planning p l a n n i n g and a n d execution e x e c u t i o n of o f flight f l i g h t testing t e s t i n g to t o ensure e n s u r e that t h a t the t h e design d e s i g n safety s a f e t y issues i s s u e s are a r e addressed. a d d r e s s e d . This T h i s will w i l l include i n c l u d e determining d e t e r m i n i n g what w h a t tests t e s t s are a r e required r e q u i r e d and a n d the t h e method m e t h o d of o f testing t e s t i n g that t h a t will w i l l most m o s t adequately a d e q u a t e l y satisfy s a t i s f y the t h e aircraft-level a i r c r a f t - l e v e l safety s a f e t y requirements. r e q u i r e m e n t s . These T h e s e activities a c t i v i t i e s will w i l l be b e in i n accordance a c c o r d a n c e with w i t h the t h e Flight F l i g h t Test T e s t Program P r o g r a m Plan. P l a n . The T h e Safety S a f e t y organization o r g a n i z a t i o n will w i l l maintain m a i n t a i n oversight o v e r s i g h t on o n test t e s t readiness r e a d i n e s s reviews, r e v i e w s , including i n c l u d i n g the t h e First F i r s t Flight F l i g h t Readiness R e a d i n e s s Review. R e v i e w . Safety S a f e t y issues i s s u e s arising a r i s i n g from f r o m flight f l i g h t testing t e s t i n g will w i l l be b e dispositioned d i s p o s i t i o n e d using u s i n g the t h e processes p r o c e s s e s in i n this t h i s plan. p l a n . 3.4 3 . 4 Special S p e c i a l Aircraft-Level A i r c r a f t - L e v e l Safety S a f e t y Assessments A s s e s s m e n t s [for [ f o r airframe a i r f r a m e manufacturers]: m a n u f a c t u r e r s ] : A A Special S p e c i a l Aircraft-Level A i r c r a f t - L e v e l Safety S a f e t y Assessment A s s e s s m e n t is i s any a n y aircraft-level a i r c r a f t - l e v e l safety s a f e t y assessment a s s e s s m e n t required r e q u i r e d for f o r certification c e r t i f i c a t i o n other o t h e r than t h a n an a n aircraft-level a i r c r a f t - l e v e l threat-survivability t h r e a t - s u r v i v a b i l i t y assessment, a s s e s s m e n t , the t h e aircraft a i r c r a f t level l e v e l FHA, F H A , FTA F T A or o r an a n aircraft-level a i r c r a f t - l e v e l separation s e p a r a t i o n assessment. a s s e s s m e n t . Two T w o special s p e c i a l aircraft a i r c r a f t level l e v e l safety s a f e t y assessments a s s e s s m e n t s that t h a t have h a v e been b e e n identified i d e n t i f i e d as a s candidates c a n d i d a t e s on o n some s o m e programs p r o g r a m s in i n the t h e past p a s t are a r e Return R e t u r n to t o Land L a n d Assessment, A s s e s s m e n t , and a n d Blade B l a d e Out O u t Analysis A n a l y s i s . . Others O t h e r s maybe m a y b e identified i d e n t i f i e d as a s the t h e program p r o g r a m proceeds p r o c e e d s toward t o w a r d completion. c o m p l e t i o n . 3.4.1 3 . 4 . 1 Return R e t u r n to t o Land L a n d Assessment: A s s e s s m e n t : An A n FAA F A A issue i s s u e paper p a p e r identifies i d e n t i f i e s the t h e requirement r e q u i r e m e n t for f o r a a Return R e t u r n to t o Land L a n d Assessment. A s s e s s m e n t . The T h e aircraft a i r c r a f t must m u s t be b e able a b l e to t o return r e t u r n to t o any a n y field f i e l d from f r o m which w h i c h it i t departed d e p a r t e d in i n any a n y dispatchable d i s p a t c h a b l e configuration, c o n f i g u r a t i o n , and a n d it i t must m u s t be b e able a b l e to t o return r e t u r n to t o any a n y field f i e l d from f r o m which w h i c h it i t departed d e p a r t e d following f o l l o w i n g any a n y failure f a i l u r e or o r failure f a i l u r e combination c o m b i n a t i o n not n o t shown s h o w n to t o be b e extremely e x t r e m e l y improbable. i m p r o b a b l e . Organization O r g a n i z a t i o n Roles R o l e s and a n d Responsibilities R e s p o n s i b i l i t i e s Aircraft A i r c r a f t Safety S a f e t y Group G r o u p Facilitates F a c i l i t a t e s the t h e Return R e t u r n to t o Land L a n d assessment a s s e s s m e n t Aerodynamics A e r o d y n a m i c s Perform P e r f o r m assessment a s s e s s m e n t granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true} Downloaded D o w n l o a d e d from f r o m SAE S A E International I n t e r n a t i o n a l by b y David D a v i d Merrill, M e r r i l l , Saturday, S a t u r d a y , November N o v e m b e r 12, 1 2 , 2016 2 0 1 6 SAE S A E ARP4754A A R P 4 7 5 4 A Page P a g e 103 1 0 3 of o f 115 1 1 5 3.4.2 3 . 4 . 2 Blade B l a d e Out/Engine O u t / E n g i n e Vibration V i b r a t i o n Assessment: A s s e s s m e n t : An A n assessment a s s e s s m e n t of o f engine e n g i n e vibration v i b r a t i o n following f o l l o w i n g a a single s i n g l e blade b l a d e loss l o s s and a n d its i t s possible p o s s i b l e effects e f f e c t s on o n the t h e aircraft a i r c r a f t will w i l l be b e developed d e v e l o p e d to t o ensure e n s u r e the t h e aircraft a i r c r a f t remains r e m a i n s capable c a p a b l e of o f continued c o n t i n u e d safe s a f e flight f l i g h t and a n d landing. l a n d i n g . Particular P a r t i c u l a r focus f o c u s will w i l l be b e on o n whether w h e t h e r the t h e flight f l i g h t crew c r e w can c a n perform p e r f o r m their t h e i r functions f u n c t i o n s and a n d maintain m a i n t a i n adequate a d e q u a t e control c o n t r o l of o f the t h e aircraft a i r c r a f t during d u r i n g high h i g h vibration v i b r a t i o n scenarios. s c e n a r i o s . Note: N o t e : This T h i s assessment a s s e s s m e n t may m a y be b e included i n c l u d e d in i n the t h e PRA P R A in i n some s o m e companies. c o m p a n i e s . Organization O r g a n i z a t i o n Roles R o l e s and a n d Responsibilities R e s p o n s i b i l i t i e s Aircraft A i r c r a f t Safety S a f e t y Group G r o u p Facilitates F a c i l i t a t e s the t h e Blade B l a d e Out O u t assessment a s s e s s m e n t Affected A f f e c t e d Design D e s i g n Organizations O r g a n i z a t i o n s Perform P e r f o r m assessment a s s e s s m e n t Program P r o g r a m Engineering E n g i n e e r i n g Review R e v i e w and a n d approve a p p r o v e assessment a s s e s s m e n t 3.5 3 . 5 Certification C e r t i f i c a t i o n Plan P l a n for f o r Aircraft-Level A i r c r a f t - L e v e l Safety S a f e t y [for [ f o r airframe a i r f r a m e manufacturers]: m a n u f a c t u r e r s ] : The T h e Certification C e r t i f i c a t i o n Plan P l a n for f o r Aircraft-Level A i r c r a f t - L e v e l Safety S a f e t y contains c o n t a i n s information i n f o r m a t i o n showing s h o w i n g compliance c o m p l i a n c e with w i t h 14 1 4 CFR/CS C F R / C S Part P a r t 25.1309 2 5 . 1 3 0 9 regarding r e g a r d i n g the t h e interactions i n t e r a c t i o n s of o f aircraft a i r c r a f t systems. s y s t e m s . This T h i s aspect a s p e c t is i s not n o t usually u s u a l l y addressed a d d r e s s e d in i n the t h e individual i n d i v i d u a l system s y s t e m certification c e r t i f i c a t i o n plans. p l a n s . In I n this t h i s plan, p l a n , the t h e Aircraft A i r c r a f t Safety S a f e t y Group G r o u p describes d e s c r i b e s the t h e analytical a n a l y t i c a l approaches a p p r o a c h e s used u s e d to t o show s h o w that t h a t the t h e program p r o g r a m meets m e e t s the t h e 14 1 4 CFR/CS C F R / C S Part P a r t 25.1309 2 5 . 1 3 0 9 requirements r e q u i r e m e n t s for f o r the t h e hazards h a z a r d s identified i d e n t i f i e d in i n the t h e aircraft a i r c r a f t FHA. F H A . Organization O r g a n i z a t i o n Roles R o l e s and a n d Responsibilities R e s p o n s i b i l i t i e s Aircraft A i r c r a f t Safety S a f e t y Group G r o u p Prepare P r e p a r e Certification C e r t i f i c a t i o n Plan P l a n for f o r Aircraft-Level A i r c r a f t - L e v e l Safety S a f e t y Program P r o g r a m Engineering E n g i n e e r i n g Review R e v i e w and a n d approve a p p r o v e Certification C e r t i f i c a t i o n Plan P l a n 3.5.1 3 . 5 . 1 Aircraft-Level A i r c r a f t - L e v e l Safety S a f e t y Assessment A s s e s s m e n t Document: D o c u m e n t : The T h e Aircraft-Level A i r c r a f t - L e v e l Safety S a f e t y Assessment A s s e s s m e n t document d o c u m e n t summarizes s u m m a r i z e s the t h e program's p r o g r a m ' s safety-related s a f e t y - r e l a t e d activities a c t i v i t i e s and a n d provides p r o v i d e s single s i n g l e point p o i n t documentation d o c u m e n t a t i o n for f o r the t h e tasks t a s k s identified i d e n t i f i e d in i n the t h e Safety S a f e t y Plan. P l a n . Part P a r t of o f this t h i s activity a c t i v i t y is i s sometimes s o m e t i m e s called c a l l e d safety s a f e t y synthesis s y n t h e s i s All A l l or o r part p a r t of o f this t h i s document d o c u m e n t may m a y be b e provided p r o v i d e d to t o the t h e regulatory r e g u l a t o r y agencies a g e n c i e s in i n the t h e form f o r m of o f an a n Aircraft A i r c r a f t Safety S a f e t y Certification C e r t i f i c a t i o n Summary S u m m a r y to t o demonstrate d e m o n s t r a t e compliance c o m p l i a n c e with w i t h the t h e Certification C e r t i f i c a t i o n Plan P l a n for f o r Aircraft-Level A i r c r a f t - L e v e l Safety S a f e t y identified i d e n t i f i e d above. a b o v e . The T h e Aircraft A i r c r a f t Safety S a f e t y Group G r o u p will w i l l prepare p r e p a r e the t h e Aircraft-Level A i r c r a f t - L e v e l Safety S a f e t y Assessment A s s e s s m e n t document. d o c u m e n t . Organization O r g a n i z a t i o n Roles R o l e s and a n d Responsibilities R e s p o n s i b i l i t i e s Aircraft A i r c r a f t Safety S a f e t y Group G r o u p Prepare P r e p a r e Aircraft A i r c r a f t Level L e v e l Safety S a f e t y Assessment A s s e s s m e n t Document D o c u m e n t Design D e s i g n Provide P r o v i d e data, d a t a , review r e v i e w and a n d approve a p p r o v e Aircraft A i r c r a f t Level L e v e l Safety S a f e t y Assessment A s s e s s m e n t 3.6 3 . 6 Aircraft A i r c r a f t Safety S a f e t y Program P r o g r a m Schedule: S c h e d u l e : The T h e overall o v e r a l l schedule s c h e d u l e for f o r execution e x e c u t i o n of o f the t h e Safety S a f e t y Program P r o g r a m Plan P l a n has h a s been b e e n incorporated i n c o r p o r a t e d into i n t o the t h e program p r o g r a m master m a s t e r schedule. s c h e d u l e . The T h e Safety S a f e t y Program P r o g r a m Plan P l a n will w i l l be b e effective e f f e c t i v e during d u r i n g the t h e remainder r e m a i n d e r of o f the t h e Preliminary P r e l i m i n a r y Design D e s i g n phase p h a s e and a n d will w i l l continue c o n t i n u e through t h r o u g h aircraft a i r c r a f t development d e v e l o p m e n t to t o first f i r s t delivery. d e l i v e r y . granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true} Downloaded D o w n l o a d e d from f r o m SAE S A E International I n t e r n a t i o n a l by b y David D a v i d Merrill, M e r r i l l , Saturday, S a t u r d a y , November N o v e m b e r 12, 1 2 , 2016 2 0 1 6 SAE S A E ARP4754A A R P 4 7 5 4 A Page P a g e 104 1 0 4 of o f 115 1 1 5 3.7 3 . 7 Preliminary P r e l i m i n a r y Design D e s i g n Reviews R e v i e w s Preliminary P r e l i m i n a r y Design D e s i g n Reviews R e v i e w s will w i l l be b e performed p e r f o r m e d to t o ensure e n s u r e that t h a t design d e s i g n requirements r e q u i r e m e n t s are a r e complete c o m p l e t e and a n d correct, c o r r e c t , and a n d that t h a t the t h e design d e s i g n approach a p p r o a c h is i s consistent c o n s i s t e n t with w i t h the t h e requirements. r e q u i r e m e n t s . The T h e Aircraft A i r c r a f t Safety S a f e t y Group G r o u p will w i l l participate p a r t i c i p a t e in i n these t h e s e reviews, r e v i e w s , to t o ensure e n s u r e that t h a t all a l l safety s a f e t y requirements r e q u i r e m e n t s are a r e considered c o n s i d e r e d and a n d can c a n be b e met. m e t . Organization O r g a n i z a t i o n Roles R o l e s and a n d Responsibilities R e s p o n s i b i l i t i e s Aircraft A i r c r a f t Safety S a f e t y Group G r o u p Participate P a r t i c i p a t e in i n the t h e Preliminary P r e l i m i n a r y Design D e s i g n Review R e v i e w to t o ensure e n s u r e all a l l safety s a f e t y requirements, r e q u i r e m e n t s , hazards h a z a r d s and a n d safety s a f e t y lessons l e s s o n s learned l e a r n e d are a r e presented p r e s e n t e d and a n d resolved. r e s o l v e d . Design D e s i g n Conduct C o n d u c t the t h e Preliminary P r e l i m i n a r y Design D e s i g n Review R e v i e w 3.8 3 . 8 Critical C r i t i c a l Design D e s i g n Reviews: R e v i e w s : Critical C r i t i c a l Design D e s i g n Reviews R e v i e w s will w i l l be b e performed p e r f o r m e d to t o ensure e n s u r e that t h a t design d e s i g n requirements r e q u i r e m e n t s are a r e complete c o m p l e t e and a n d correct, c o r r e c t , and a n d the t h e design d e s i g n implementations i m p l e m e n t a t i o n s are a r e consistent c o n s i s t e n t with w i t h the t h e requirements. r e q u i r e m e n t s . The T h e Aircraft A i r c r a f t Safety S a f e t y Group G r o u p will w i l l take t a k e an a n active a c t i v e part p a r t in i n these t h e s e reviews, r e v i e w s , to t o ensure e n s u r e that t h a t all a l l safety s a f e t y requirements r e q u i r e m e n t s are a r e being b e i n g considered c o n s i d e r e d and a n d met. m e t . Organization O r g a n i z a t i o n Roles R o l e s and a n d Responsibilities R e s p o n s i b i l i t i e s Aircraft A i r c r a f t Safety S a f e t y Group G r o u p Participate P a r t i c i p a t e in i n the t h e Critical C r i t i c a l Design D e s i g n Review R e v i e w to t o ensure e n s u r e all a l l safety s a f e t y requirements, r e q u i r e m e n t s , hazards h a z a r d s and a n d safety s a f e t y lessons l e s s o n s learned l e a r n e d are a r e presented p r e s e n t e d and a n d resolved r e s o l v e d Design D e s i g n Conduct C o n d u c t the t h e Critical C r i t i c a l Design D e s i g n Review R e v i e w 3.9 3 . 9 Engineering E n g i n e e r i n g Safety S a f e t y Review: R e v i e w : An A n Engineering E n g i n e e r i n g Safety S a f e t y Review R e v i e w will w i l l be b e held h e l d prior p r i o r to t o first f i r s t flight f l i g h t to t o verify v e r i f y that t h a t the t h e aircraft a i r c r a f t and a n d its i t s systems s y s t e m s were w e r e built b u i l t in i n the t h e correct c o r r e c t configuration c o n f i g u r a t i o n and a n d without w i t h o u t flaws f l a w s or o r errors e r r o r s that t h a t might m i g h t affect a f f e c t safety s a f e t y of o f flight. f l i g h t . Usually, U s u a l l y , a a number n u m b e r of o f discrepancies d i s c r e p a n c i e s are a r e found f o u n d which w h i c h are a r e corrected c o r r e c t e d prior p r i o r to t o first f i r s t flight. f l i g h t . This T h i s review r e v i e w is i s a a complete c o m p l e t e inspection i n s p e c t i o n of o f the t h e aircraft. a i r c r a f t . Manufacturing M a n u f a c t u r i n g opens o p e n s access a c c e s s panels p a n e l s and a n d otherwise o t h e r w i s e prepares p r e p a r e s the t h e aircraft a i r c r a f t to t o be b e inspected i n s p e c t e d as a s thoroughly t h o r o u g h l y as a s possible. p o s s i b l e . Following F o l l o w i n g this t h i s inspection, i n s p e c t i o n , a a determination d e t e r m i n a t i o n is i s made m a d e whether w h e t h e r the t h e aircraft a i r c r a f t is i s ready r e a d y for f o r first f i r s t flight. f l i g h t . The T h e program p r o g r a m will w i l l prepare p r e p a r e plans p l a n s for f o r the t h e Engineering E n g i n e e r i n g Safety S a f e t y Review R e v i e w well w e l l in i n advance a d v a n c e of o f the t h e scheduled s c h e d u l e d first f i r s t flight f l i g h t date d a t e on o n the t h e master-phasing m a s t e r - p h a s i n g schedule. s c h e d u l e . The T h e Aircraft A i r c r a f t Safety S a f e t y Group G r o u p will w i l l review r e v i e w these t h e s e plans p l a n s and a n d provided p r o v i d e d comments. c o m m e n t s . The T h e Final F i n a l plans p l a n s will w i l l be b e coordinated c o o r d i n a t e d with w i t h all a l l affected a f f e c t e d groups g r o u p s on o n the t h e program p r o g r a m by b y the t h e Program. P r o g r a m . Engineering E n g i n e e r i n g Operations O p e r a t i o n s will w i l l lead l e a d the t h e meeting m e e t i n g and a n d walk-through w a l k - t h r o u g h process p r o c e s s for f o r the t h e Engineering E n g i n e e r i n g Safety S a f e t y Review. R e v i e w . Items I t e m s identified i d e n t i f i e d will w i l l be b e tracked t r a c k e d to t o closure c l o s u r e to t o ensure e n s u r e that t h a t all a l l issues i s s u e s are a r e corrected c o r r e c t e d prior p r i o r to t o first f i r s t flight. f l i g h t . The T h e Aircraft A i r c r a f t Safety S a f e t y Group G r o u p will w i l l support s u p p o r t the t h e process p r o c e s s as a s required. r e q u i r e d . Organization O r g a n i z a t i o n Roles R o l e s and a n d Responsibilities R e s p o n s i b i l i t i e s Engineering E n g i n e e r i n g Operations O p e r a t i o n s Plan P l a n and a n d coordinate c o o r d i n a t e Engineering E n g i n e e r i n g Safety S a f e t y Review R e v i e w Manufacturing M a n u f a c t u r i n g Make M a k e aircraft a i r c r a f t available a v a i l a b l e and a n d prepare p r e p a r e it i t for f o r Engineering E n g i n e e r i n g Safety S a f e t y Review R e v i e w Aircraft A i r c r a f t Safety S a f e t y Group G r o u p Participates P a r t i c i p a t e s in i n the t h e Engineering E n g i n e e r i n g Safety S a f e t y Review R e v i e w to t o determine d e t e r m i n e that t h a t the t h e aircraft a i r c r a f t was w a s built b u i l t as a s designed. d e s i g n e d . granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true} Downloaded D o w n l o a d e d from f r o m SAE S A E International I n t e r n a t i o n a l by b y David D a v i d Merrill, M e r r i l l , Saturday, S a t u r d a y , November N o v e m b e r 12, 1 2 , 2016 2 0 1 6 SAE S A E ARP4754A A R P 4 7 5 4 A Page P a g e 105 1 0 5 of o f 4.0 4 . 0 Common C o m m o n Cause C a u s e Assessments A s s e s s m e n t s : : 4.1 4 . 1 System S y s t e m Separation S e p a r a t i o n : : Note: N o t e : (This ( T h i s example e x a m p l e cites c i t e s a a case c a s e where w h e r e a a unique u n i q u e separation s e p a r a t i o n document d o c u m e n t is i s developed. d e v e l o p e d . Some S o m e companies c o m p a n i e s include i n c l u d e this t h i s work w o r k in i n their t h e i r basic b a s i c safety s a f e t y analyses.) a n a l y s e s . ) A A Separation S e p a r a t i o n Work W o r k Group, G r o u p , led l e d by b y the t h e Aircraft A i r c r a f t Safety S a f e t y Group, G r o u p , will w i l l develop d e v e l o p the t h e system s y s t e m physical p h y s i c a l and a n d functional f u n c t i o n a l separation s e p a r a t i o n requirements. r e q u i r e m e n t s . The T h e purpose p u r p o s e of o f this t h i s activity a c t i v i t y is i s to t o ensure e n s u r e aircraft a i r c r a f t flight f l i g h t capability c a p a b i l i t y is i s maintained m a i n t a i n e d by b y assuring a s s u r i n g adequate a d e q u a t e separation s e p a r a t i o n of o f functions, f u n c t i o n s , including i n c l u d i n g the t h e threats t h r e a t s defined d e f i n e d in i n the t h e PRA P R A document d o c u m e n t (see ( s e e 4.2.1). 4 . 2 . 1 ) . Design D e s i g n will w i l l review r e v i e w and a n d approve a p p r o v e the t h e separation s e p a r a t i o n requirements. r e q u i r e m e n t s . Cross C r o s s functional f u n c t i o n a l teams t e a m s responsible r e s p o n s i b l e for f o r specific s p e c i f i c areas a r e a s of o f the t h e aircraft a i r c r a f t (herein ( h e r e i n referred r e f e r r e d to t o as a s Volume V o l u m e Teams) T e a m s ) will w i l l assure a s s u r e the t h e implementation i m p l e m e n t a t i o n of o f the t h e system s y s t e m separation s e p a r a t i o n requirements. r e q u i r e m e n t s . The T h e Separation S e p a r a t i o n Work W o r k Group G r o u p deliverables d e l i v e r a b l e s may m a y include i n c l u d e (varies ( v a r i e s by b y company) c o m p a n y ) : : • • Establish E s t a b l i s h and a n d validate v a l i d a t e separation s e p a r a t i o n requirements r e q u i r e m e n t s to t o incorporate i n c o r p o r a t e into i n t o the t h e requirements r e q u i r e m e n t s database. d a t a b a s e . • • Participate P a r t i c i p a t e in i n analyzing a n a l y z i n g the t h e system s y s t e m designs d e s i g n s and a n d installations i n s t a l l a t i o n s to t o verify v e r i f y compliance c o m p l i a n c e with w i t h the t h e requirements. r e q u i r e m e n t s . • • Interface I n t e r f a c e with w i t h Design D e s i g n to t o accomplish a c c o m p l i s h these t h e s e tasks. t a s k s . 4.1.1 4 . 1 . 1 System S y s t e m Separation S e p a r a t i o n Requirements R e q u i r e m e n t s Incorporation I n c o r p o r a t i o n into i n t o the t h e Requirements R e q u i r e m e n t s Database: D a t a b a s e : The T h e Aircraft A i r c r a f t Safety S a f e t y Group G r o u p and a n d the t h e appropriate a p p r o p r i a t e Design D e s i g n organizations o r g a n i z a t i o n s will w i l l be b e responsible r e s p o n s i b l e for f o r defining d e f i n i n g the t h e functional f u n c t i o n a l and a n d physical p h y s i c a l separation s e p a r a t i o n requirements r e q u i r e m e n t s so s o they t h e y can c a n be b e included i n c l u d e d into i n t o the t h e aircraft a i r c r a f t requirements r e q u i r e m e n t s database. d a t a b a s e . Organization O r g a n i z a t i o n Roles R o l e s and a n d Responsibilities R e s p o n s i b i l i t i e s Aircraft A i r c r a f t Safety S a f e t y Group G r o u p Lead L e a d the t h e Separation S e p a r a t i o n Requirements R e q u i r e m e n t s development d e v e l o p m e n t Activity A c t i v i t y Design D e s i g n Review, R e v i e w , approve a p p r o v e and a n d implement i m p l e m e n t the t h e Separation S e p a r a t i o n Requirements. R e q u i r e m e n t s . 4.1.2 4 . 1 . 2 System S y s t e m Separation S e p a r a t i o n Requirements R e q u i r e m e n t s Compliance C o m p l i a n c e Verification: V e r i f i c a t i o n : Once O n c e the t h e separation s e p a r a t i o n requirements r e q u i r e m e n t s are a r e established e s t a b l i s h e d and a n d documented, d o c u m e n t e d , a a verification v e r i f i c a t i o n process p r o c e s s needs n e e d s to t o be b e identified i d e n t i f i e d to t o ensure e n s u r e that t h a t the t h e separation s e p a r a t i o n requirements r e q u i r e m e n t s are a r e implemented i m p l e m e n t e d into i n t o the t h e design d e s i g n and a n d manufacturing m a n u f a c t u r i n g of o f the t h e aircraft. a i r c r a f t . The T h e Volume V o l u m e Teams T e a m s (made ( m a d e up u p of o f members m e m b e r s from f r o m systems, s y s t e m s , design, d e s i g n , safety s a f e t y organizations) o r g a n i z a t i o n s ) lead l e a d this t h i s effort. e f f o r t . The T h e Design D e s i g n Organization O r g a n i z a t i o n will w i l l determine d e t e r m i n e the t h e most m o s t effective e f f e c t i v e method m e t h o d of o f completing c o m p l e t i n g this t h i s task. t a s k . Methods M e t h o d s may m a y include i n c l u d e Zonal Z o n a l reviews, r e v i e w s , Fly-throughs F l y - t h r o u g h s and a n d As A s Built B u i l t reviews. r e v i e w s . Organization O r g a n i z a t i o n Roles R o l e s and a n d Responsibilities R e s p o n s i b i l i t i e s Volume V o l u m e Teams T e a m s Lead L e a d the t h e Separation S e p a r a t i o n Requirements R e q u i r e m e n t s Verification V e r i f i c a t i o n Activity A c t i v i t y to t o assure a s s u r e Separation S e p a r a t i o n Requirements R e q u i r e m e n t s are a r e met. m e t . Design D e s i g n Organizations O r g a n i z a t i o n s Review R e v i e w and a n d approve a p p r o v e the t h e Separation S e p a r a t i o n Verificat V e r i f i c a t ion i o n 4.2 4 . 2 Aircraft A i r c r a f t Survivability S u r v i v a b i l i t y : : Use U s e the t h e hazard h a z a r d classification c l a s s i f i c a t i o n chart c h a r t listed l i s t e d in i n AC/AMC A C / A M C 25.1309 2 5 . 1 3 0 9 to t o define d e f i n e the t h e severity s e v e r i t y levels l e v e l s of o f the t h e hazards. h a z a r d s . granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true} Downloaded D o w n l o a d e d from f r o m SAE S A E International I n t e r n a t i o n a l by b y David D a v i d Merrill, M e r r i l l , Saturday, S a t u r d a y , November N o v e m b e r 12, 1 2 , 2016 2 0 1 6 SAE S A E ARP4754A A R P 4 7 5 4 A Page P a g e 106 1 0 6 of o f 115 1 1 5 4.2.1 4 . 2 . 1 Particular P a r t i c u l a r Risk R i s k Review R e v i e w Team T e a m (PRRT): ( P R R T ) : The T h e PRRT P R R T task t a s k is i s to t o assess a s s e s s the t h e aircraft a i r c r a f t design d e s i g n for f o r external e x t e r n a l threats t h r e a t s that t h a t may m a y compromise c o m p r o m i s e continued c o n t i n u e d safe s a f e flight f l i g h t and a n d landing l a n d i n g (ARP4761 ( A R P 4 7 6 1 Particular P a r t i c u l a r Risk R i s k Assessment) A s s e s s m e n t ) . . These T h e s e threats t h r e a t s are a r e limited l i m i t e d to t o those t h o s e external e x t e r n a l to t o the t h e system s y s t e m in i n question q u e s t i o n (e.g. ( e . g . hydraulic h y d r a u l i c system s y s t e m vulnerability v u l n e r a b i l i t y to t o engine e n g i n e burst) b u r s t ) or o r to t o the t h e aircraft a i r c r a f t (e.g. ( e . g . birdstrike). b i r d s t r i k e ) . The T h e PRRT P R R T deliverables d e l i v e r a b l e s are: a r e : • • Identify I d e n t i f y credible c r e d i b l e flight f l i g h t safety s a f e t y threats t h r e a t s that t h a t are a r e appropriate a p p r o p r i a t e for f o r survivability s u r v i v a b i l i t y analysis. a n a l y s i s . • • Provide P r o v i d e the t h e requirements r e q u i r e m e n t s so s o they t h e y can c a n be b e listed l i s t e d in i n the t h e requirements r e q u i r e m e n t s database. d a t a b a s e . • • Assess A s s e s s the t h e aircraft a i r c r a f t survivability s u r v i v a b i l i t y with w i t h respect r e s p e c t to t o each e a c h identified i d e n t i f i e d threat, t h r e a t , taking t a k i n g into i n t o account a c c o u n t physical p h y s i c a l and a n d functional f u n c t i o n a l system s y s t e m separation s e p a r a t i o n requirements r e q u i r e m e n t s and a n d system s y s t e m hardening. h a r d e n i n g . • • Validate V a l i d a t e and a n d document d o c u m e n t the t h e aircraft/system a i r c r a f t / s y s t e m safety s a f e t y requirements r e q u i r e m e n t s for f o r survivability s u r v i v a b i l i t y . . • • Verify V e r i f y that t h a t the t h e aircraft a i r c r a f t design d e s i g n incorporates i n c o r p o r a t e s design d e s i g n solutions s o l u t i o n s for f o r each e a c h identified i d e n t i f i e d threat t h r e a t The T h e team t e a m will w i l l review r e v i e w all a l l survivability s u r v i v a b i l i t y requirements r e q u i r e m e n t s from f r o m other o t h e r aircraft a i r c r a f t models. m o d e l s . They T h e y will w i l l also a l s o research r e s e a r c h any a n y new n e w threats t h r e a t s generated g e n e r a t e d by b y the t h e new n e w technology t e c h n o l o g y used u s e d on o n the t h e aircraft. a i r c r a f t . Any A n y threat-survivability t h r e a t - s u r v i v a b i l i t y requirements r e q u i r e m e n t s identified i d e n t i f i e d will w i l l be b e included i n c l u d e d in i n the t h e requirements r e q u i r e m e n t s database. d a t a b a s e . The T h e consequences c o n s e q u e n c e s of o f the t h e threats t h r e a t s resulting r e s u l t i n g in i n a a hazard h a z a r d class c l a s s Ior I o r II I I will w i l l be b e documented. d o c u m e n t e d . Organization O r g a n i z a t i o n Roles R o l e s and a n d Responsibilities R e s p o n s i b i l i t i e s Aircraft A i r c r a f t Safety S a f e t y Group G r o u p Leads L e a d s the t h e PRRT P R R T process p r o c e s s Design D e s i g n Focals F o c a l s Participate P a r t i c i p a t e in i n the t h e PRRT P R R T Program P r o g r a m Engineering E n g i n e e r i n g Review R e v i e w and a n d approve a p p r o v e the t h e PRRT P R R T document d o c u m e n t and a n d implement i m p l e m e n t changes c h a n g e s required. r e q u i r e d . 4.3 4 . 3 Zonal Z o n a l Safety S a f e t y Analysis A n a l y s i s (ZSA) ( Z S A ) A A ZSA Z S A will w i l l be b e performed p e r f o r m e d in i n each e a c h zone z o n e of o f the t h e aircraft a i r c r a f t after a f t e r the t h e components c o m p o n e n t s are a r e situated s i t u a t e d in i n the t h e as-built a s - b u i l t configuration c o n f i g u r a t i o n . . The T h e analysis a n a l y s i s consists c o n s i s t s of o f consideration c o n s i d e r a t i o n of o f installation i n s t a l l a t i o n aspects a s p e c t s of o f individual i n d i v i d u a l systems s y s t e m s and a n d components c o m p o n e n t s and a n d the t h e mutual m u t u a l influence i n f l u e n c e between b e t w e e n several s e v e r a l systems/components s y s t e m s / c o m p o n e n t s installed i n s t a l l e d in i n close c l o s e proximity p r o x i m i t y on o n the t h e aircraft. a i r c r a f t . Zone Z o n e Chiefs C h i e f s will w i l l be b e assigned a s s i g n e d for f o r each e a c h zone z o n e of o f the t h e aircraft. a i r c r a f t . They T h e y will w i l l lead l e a d the t h e ZSA Z S A for f o r their t h e i r zone, z o n e , utilizing u t i l i z i n g participants p a r t i c i p a n t s from f r o m the t h e effected e f f e c t e d design d e s i g n groups g r o u p s and a n d from f r o m functional f u n c t i o n a l support s u p p o r t groups. g r o u p s . The T h e conclusions c o n c l u s i o n s of o f the t h e ZSAs Z S A s will w i l l provide p r o v i d e inputs i n p u t s to t o the t h e relevant r e l e v a n t SSAs. S S A s . Findings F i n d i n g s of o f exceptions e x c e p t i o n s in i n the t h e ZSA Z S A should s h o u l d result r e s u l t in i n a a design d e s i g n change c h a n g e or o r a a documented d o c u m e n t e d justification j u s t i f i c a t i o n for f o r a a deviation. d e v i a t i o n . Organization O r g a n i z a t i o n Roles R o l e s and a n d Responsibilities R e s p o n s i b i l i t i e s Zone Z o n e Chiefs C h i e f s Lead L e a d the t h e ZSA Z S A for f o r their t h e i r areas. a r e a s . Aircraft A i r c r a f t Safety S a f e t y Group G r o u p Participates P a r t i c i p a t e s in i n the t h e Zonal Z o n a l Safety S a f e t y Analysis A n a l y s i s Program P r o g r a m Engineering E n g i n e e r i n g Review R e v i e w and a n d approve a p p r o v e the t h e Zonal Z o n a l Safety S a f e t y Analysis A n a l y s i s and a n d implement i m p l e m e n t changes c h a n g e s required. r e q u i r e d . granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true} Downloaded D o w n l o a d e d from f r o m SAE S A E International I n t e r n a t i o n a l by b y David D a v i d Merrill, M e r r i l l , Saturday, S a t u r d a y , November N o v e m b e r 12, 1 2 , 2016 2 0 1 6 SAE S A E ARP4754A A R P 4 7 5 4 A Page P a g e 107 1 0 7 of o f 115 1 1 5 4.4 4 . 4 Common C o m m o n Mode M o d e Analysis A n a l y s i s (CMA): ( C M A ) : A A Common C o m m o n Mode M o d e Analysis A n a l y s i s (CMA) ( C M A ) is i s performed p e r f o r m e d to t o verify v e r i f y that t h a t ANDed A N D e d events e v e n t s in i n the t h e FTA F T A are a r e truly t r u l y independent. i n d e p e n d e n t . The T h e effects e f f e c t s of o f design d e s i g n implementation, i m p l e m e n t a t i o n , manufacturing, m a n u f a c t u r i n g , maintenance m a i n t e n a n c e errors e r r o r s and a n d failures f a i l u r e s of o f system s y s t e m components c o m p o n e n t s that t h a t defeat d e f e a t redundant r e d u n d a n t design d e s i g n principles p r i n c i p l e s should s h o u l d be b e analyzed. a n a l y z e d . Generally G e n e r a l l y speaking, s p e a k i n g , the t h e CMA C M A contributes c o n t r i b u t e s to t o the t h e verification v e r i f i c a t i o n that t h a t independent i n d e p e n d e n t principles p r i n c i p l e s have h a v e been b e e n applied a p p l i e d when w h e n necessary. n e c e s s a r y . Considerations C o n s i d e r a t i o n s should s h o u l d be b e given g i v e n to t o the t h e independence i n d e p e n d e n c e of o f functions f u n c t i o n s and a n d their t h e i r respective r e s p e c t i v e monitors. m o n i t o r s . Components C o m p o n e n t s with w i t h identical i d e n t i c a l hardware h a r d w a r e and/or a n d / o r software s o f t w a r e could c o u l d be b e susceptible s u s c e p t i b l e to t o generic g e n e r i c (common ( c o m m o n cause) c a u s e ) faults f a u l t s which w h i c h could c o u l d cause c a u s e failures f a i l u r e s in i n multiple m u l t i p l e systems. s y s t e m s . The T h e CMA C M A process p r o c e s s is i s based b a s e d on o n analyzing a n a l y z i n g designs d e s i g n s and a n d implementation i m p l e m e n t a t i o n for f o r elements e l e m e n t s that t h a t may m a y defeat d e f e a t the t h e redundancy r e d u n d a n c y or o r independence i n d e p e n d e n c e of o f functions f u n c t i o n s within w i t h i n the t h e design. d e s i g n . Wherever W h e r e v e r required r e q u i r e d redundancy r e d u n d a n c y or o r independence i n d e p e n d e n c e is i s compromised, c o m p r o m i s e d , justification j u s t i f i c a t i o n for f o r the t h e acceptability a c c e p t a b i l i t y of o f the t h e compromise c o m p r o m i s e is i s required. r e q u i r e d . Organization O r g a n i z a t i o n Roles R o l e s and a n d Responsibilities R e s p o n s i b i l i t i e s Aircraft A i r c r a f t Safety S a f e t y Group G r o u p Leads L e a d s the t h e CMA. C M A . Design D e s i g n Focals F o c a l s Participate P a r t i c i p a t e in i n the t h e CMA. C M A . Program P r o g r a m Engineering E n g i n e e r i n g Review R e v i e w and a n d approve a p p r o v e the t h e Common C o m m o n Mode M o d e Analysis A n a l y s i s and a n d implement i m p l e m e n t changes c h a n g e s required. r e q u i r e d . 5.1 5 . 1 Safety S a f e t y Assessments A s s e s s m e n t s and a n d Analyses A n a l y s e s : : The T h e safety s a f e t y assessment a s s e s s m e n t and a n d analysis a n a l y s i s process p r o c e s s includes i n c l u d e s requirements r e q u i r e m e n t s generation, g e n e r a t i o n , validation v a l i d a t i o n and a n d verification v e r i f i c a t i o n which w h i c h supports s u p p o r t s the t h e aircraft a i r c r a f t development d e v e l o p m e n t activities. a c t i v i t i e s . These T h e s e processes p r o c e s s e s provide p r o v i d e a a methodology m e t h o d o l o g y to t o evaluate e v a l u a t e aircraft a i r c r a f t functions f u n c t i o n s and a n d the t h e design d e s i g n of o f systems s y s t e m s performing p e r f o r m i n g these t h e s e functions f u n c t i o n s to t o determine d e t e r m i n e that t h a t the t h e associated a s s o c i a t e d hazards h a z a r d s have h a v e been b e e n properly p r o p e r l y addressed. a d d r e s s e d . The T h e safety s a f e t y assessment a s s e s s m e n t processes p r o c e s s e s have h a v e both b o t h qualitative q u a l i t a t i v e and a n d quantitative q u a n t i t a t i v e components. c o m p o n e n t s . 5.2 5 . 2 Common C o m m o n Naming N a m i n g Convention: C o n v e n t i o n : One O n e of o f the t h e tools t o o l s required r e q u i r e d to t o perform p e r f o r m multi-function m u l t i - f u n c t i o n analyses a n a l y s e s is i s a a common c o m m o n naming n a m i n g convention c o n v e n t i o n for f o r labeling l a b e l i n g all a l l basic b a s i c events e v e n t s used u s e d in i n a a fault f a u l t tree. t r e e . This T h i s is i s required r e q u i r e d so s o that t h a t multiple m u l t i p l e occurring o c c u r r i n g events e v e n t s are a r e properly p r o p e r l y identified. i d e n t i f i e d . A A common c o m m o n naming n a m i n g convention c o n v e n t i o n will w i l l be b e used u s e d to t o assign a s s i g n a a name n a m e to t o a a basic b a s i c event e v e n t that t h a t will w i l l be b e used u s e d across a c r o s s the t h e design d e s i g n team. t e a m . This T h i s method m e t h o d ensures e n s u r e s that t h a t multiple m u l t i p l e occurring o c c u r r i n g events e v e n t s in i n the t h e aircraft a i r c r a f t architecture a r c h i t e c t u r e are a r e correctly c o r r e c t l y represented r e p r e s e n t e d in i n the t h e tree t r e e and a n d identified i d e n t i f i e d in i n cut c u t sets. s e t s . Organization O r g a n i z a t i o n Roles R o l e s and a n d Responsibilities R e s p o n s i b i l i t i e s Aircraft A i r c r a f t Safety S a f e t y Group/Reliability G r o u p / R e l i a b i l i t y Develop D e v e l o p and a n d implement i m p l e m e n t FMEA F M E A and a n d FTA F T A Ground G r o u n d Rules R u l e s and a n d Assumptions A s s u m p t i o n s . . Design D e s i g n Use U s e the t h e ground g r o u n d rules r u l e s and a n d assumptions a s s u m p t i o n s document d o c u m e n t in i n the t h e development d e v e l o p m e n t of o f the t h e FTAs F T A s and a n d FMEAs. F M E A s . 5.3 5 . 3 Aircraft A i r c r a f t Level L e v e l FHA F H A and a n d PASA P A S A A A team t e a m led l e d by b y the t h e Aircraft A i r c r a f t Safety S a f e t y Group G r o u p is i s responsible r e s p o n s i b l e for f o r developing d e v e l o p i n g the t h e Aircraft A i r c r a f t Level L e v e l FHA F H A and a n d for f o r ensuring e n s u r i n g that t h a t all a l l system s y s t e m level l e v e l FHAs F H A s are a r e consistent c o n s i s t e n t with w i t h other o t h e r system s y s t e m FHAs F H A s and a n d with w i t h the t h e aircraft a i r c r a f t FHA. F H A . This T h i s team t e a m will w i l l also a l s o be b e responsible r e s p o n s i b l e for f o r preparing p r e p a r i n g a a Preliminary P r e l i m i n a r y Aircraft A i r c r a f t level l e v e l Safety S a f e t y Assessment A s s e s s m e n t (PASA) ( P A S A ) based b a s e d on o n the t h e aircraft a i r c r a f t FHA, F H A , with w i t h refinement r e f i n e m e n t over o v e r the t h e course c o u r s e of o f the t h e development d e v e l o p m e n t program. p r o g r a m . This T h i s team t e a m will w i l l assess a s s e s s the t h e effects e f f e c t s of o f individual i n d i v i d u a l and a n d combined c o m b i n e d system s y s t e m failures f a i l u r e s on o n aircraft a i r c r a f t level l e v e l functions f u n c t i o n s . . From F r o m this t h i s activity, a c t i v i t y , safety s a f e t y requirements r e q u i r e m e n t s (for ( f o r example e x a m p l e functional f u n c t i o n a l separation s e p a r a t i o n requirements r e q u i r e m e n t s to t o ensure e n s u r e that t h a t combinations c o m b i n a t i o n s of o f system s y s t e m failures f a i l u r e s do d o not n o t compromise c o m p r o m i s e continued c o n t i n u e d safe s a f e flight f l i g h t and a n d landing) l a n d i n g ) can c a n be b e generated g e n e r a t e d and a n d submitted s u b m i t t e d into i n t o the t h e requirement r e q u i r e m e n t database d a t a b a s e with w i t h appropriate a p p r o p r i a t e compliance c o m p l i a n c e owner o w n e r and a n d affected a f f e c t e d owners. o w n e r s . The T h e team t e a m will w i l l have h a v e the t h e responsibility r e s p o n s i b i l i t y to t o track t r a c k the t h e functional f u n c t i o n a l hazard h a z a r d status s t a t u s to t o closure. c l o s u r e . The T h e Aircraft A i r c r a f t level l e v e l FHA F H A is i s complete c o m p l e t e when w h e n all a l l functional f u n c t i o n a l hazards h a z a r d s have h a v e been b e e n identified i d e n t i f i e d and a n d addressed. a d d r e s s e d . granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true} Downloaded D o w n l o a d e d from f r o m SAE S A E International I n t e r n a t i o n a l by b y David D a v i d Merrill, M e r r i l l , Saturday, S a t u r d a y , November N o v e m b e r 12, 1 2 , 2016 2 0 1 6 SAE S A E ARP4754A A R P 4 7 5 4 A Page P a g e 108 1 0 8 of o f 115 1 1 5 Organization O r g a n i z a t i o n Roles R o l e s and a n d Responsibilities R e s p o n s i b i l i t i e s Aircraft A i r c r a f t Safety S a f e t y Group G r o u p Develop D e v e l o p and a n d document d o c u m e n t Aircraft A i r c r a f t Level L e v e l FHA F H A Design D e s i g n Provide P r o v i d e input i n p u t and a n d review r e v i e w of o f Aircraft A i r c r a f t Level L e v e l FHA F H A 5.3.1 5 . 3 . 1 Continued C o n t i n u e d Safe S a f e Flight F l i g h t and a n d Landing L a n d i n g Functions F u n c t i o n s List: L i s t : The T h e Aircraft A i r c r a f t Safety S a f e t y Group G r o u p will w i l l provide p r o v i d e the t h e program p r o g r a m with w i t h the t h e list l i s t of o f functions f u n c t i o n s that t h a t are a r e required r e q u i r e d for f o r Continued C o n t i n u e d Safe S a f e Flight F l i g h t and a n d Landing. L a n d i n g . This T h i s list l i s t is i s used u s e d to t o help h e l p determine d e t e r m i n e the t h e architectural a r c h i t e c t u r a l layout l a y o u t of o f the t h e aircraft. a i r c r a f t . Organization O r g a n i z a t i o n Roles R o l e s and a n d Responsibilities R e s p o n s i b i l i t i e s Aircraft A i r c r a f t Safety S a f e t y Group G r o u p Develop D e v e l o p Continued C o n t i n u e d Safety S a f e t y Flight F l i g h t and a n d Landing L a n d i n g functions f u n c t i o n s list l i s t Design D e s i g n Review R e v i e w and a n d concur c o n c u r with w i t h the t h e list l i s t and a n d use u s e to t o determine d e t e r m i n e architecture a r c h i t e c t u r e and a n d capabilities c a p a b i l i t i e s 5.4 5 . 4 System S y s t e m Level L e v e l FHA: F H A : System S y s t e m Level L e v e l Functional F u n c t i o n a l Hazard H a z a r d Assessments A s s e s s m e n t s (FHA) ( F H A ) are a r e conducted c o n d u c t e d at a t the t h e beginning b e g i n n i n g of o f the t h e aircraft a i r c r a f t development d e v e l o p m e n t cycle. c y c l e . They T h e y should s h o u l d identify i d e n t i f y and a n d classify c l a s s i f y the t h e Failure F a i l u r e Conditions C o n d i t i o n s associated a s s o c i a t e d with w i t h the t h e aircraft a i r c r a f t functions, f u n c t i o n s , including i n c l u d i n g the t h e rationale r a t i o n a l e for f o r the t h e classification. c l a s s i f i c a t i o n . The T h e Aircraft A i r c r a f t Safety S a f e t y Group G r o u p will w i l l coordinate c o o r d i n a t e reviews r e v i e w s of o f system s y s t e m level l e v e l FHAs F H A s to t o ensure e n s u r e that t h a t all a l l hazards h a z a r d s have h a v e been b e e n identified i d e n t i f i e d and a n d that t h a t the t h e FHAs F H A s are a r e consistent c o n s i s t e n t between b e t w e e n design d e s i g n groups. g r o u p s . The T h e results r e s u l t s of o f these t h e s e reviews r e v i e w s will w i l l produce p r o d u c e the t h e safety s a f e t y objectives o b j e c t i v e s including i n c l u d i n g the t h e budgeted b u d g e t e d probabilistic p r o b a b i l i s t i c safety s a f e t y requirements r e q u i r e m e n t s for f o r each e a c h system/function s y s t e m / f u n c t i o n . . The T h e System S y s t e m level l e v e l FHAs F H A s provide p r o v i d e the t h e basis b a s i s for f o r analyzing a n a l y z i n g combinations c o m b i n a t i o n s of o f system s y s t e m failures f a i l u r e s and a n d assessing a s s e s s i n g Aircraft A i r c r a f t level l e v e l effects. e f f e c t s . Organization O r g a n i z a t i o n Roles R o l e s and a n d Responsibilities R e s p o n s i b i l i t i e s Aircraft A i r c r a f t Safety S a f e t y Group G r o u p Ensure E n s u r e the t h e System S y s t e m Level L e v e l FHAs F H A s are a r e performed p e r f o r m e d in i n accordance a c c o r d a n c e with w i t h FHA F H A Manual M a n u a l Design D e s i g n Prepare P r e p a r e the t h e System S y s t e m Level L e v e l FHAs F H A s 5.4.1 5 . 4 . 1 FHA F H A Manual: M a n u a l : Safety S a f e t y should s h o u l d prepare p r e p a r e a a Functional F u n c t i o n a l Hazard H a z a r d Assessment A s s e s s m e n t Manual M a n u a l to t o aid a i d the t h e designers d e s i g n e r s in i n accomplishing a c c o m p l i s h i n g the t h e task. t a s k . This T h i s will w i l l help h e l p to t o ensure e n s u r e consistency c o n s i s t e n c y in i n the t h e FHA F H A results r e s u l t s 5.4.2 5 . 4 . 2 FHA F H A Compliance C o m p l i a n c e Verifications V e r i f i c a t i o n s and a n d Closure C l o s u r e FHA F H A Requirements R e q u i r e m e n t s Compliance C o m p l i a n c e Verification V e r i f i c a t i o n is i s the t h e process p r o c e s s of o f determining d e t e r m i n i n g and a n d documenting d o c u m e n t i n g whether w h e t h e r each e a c h FHA F H A derived d e r i v e d safety s a f e t y criterion c r i t e r i o n is i s complied c o m p l i e d with. w i t h . The T h e FHA F H A closure c l o s u r e status s t a t u s will w i l l be b e presented p r e s e n t e d to t o program p r o g r a m management m a n a g e m e n t on o n a a regular r e g u l a r interval i n t e r v a l to t o give g i v e visibility v i s i b i l i t y of o f the t h e remaining r e m a i n i n g safety s a f e t y tasks. t a s k s . Results R e s u l t s will w i l l be b e summarized s u m m a r i z e d in i n the t h e Aircraft-level A i r c r a f t - l e v e l Safety S a f e t y Assessment A s s e s s m e n t document. d o c u m e n t . Organization O r g a n i z a t i o n Roles R o l e s and a n d Responsibilities R e s p o n s i b i l i t i e s Aircraft A i r c r a f t Safety S a f e t y Group G r o u p Plan P l a n and a n d coordinate c o o r d i n a t e FHA F H A requirements r e q u i r e m e n t s verification v e r i f i c a t i o n and a n d closure. c l o s u r e . Program P r o g r a m Engineering E n g i n e e r i n g Review R e v i e w and a n d approve a p p r o v e the t h e FHA F H A requirements r e q u i r e m e n t s verification v e r i f i c a t i o n and a n d closure. c l o s u r e . granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true} Downloaded D o w n l o a d e d from f r o m SAE S A E International I n t e r n a t i o n a l by b y David D a v i d Merrill, M e r r i l l , Saturday, S a t u r d a y , November N o v e m b e r 12, 1 2 , 2016 2 0 1 6 SAE S A E ARP4754A A R P 4 7 5 4 A Page P a g e 109 1 0 9 of o f 115 1 1 5 5.5 5 . 5 Preliminary P r e l i m i n a r y System S y s t e m Safety S a f e t y Assessment: A s s e s s m e n t : The T h e Preliminary P r e l i m i n a r y System S y s t e m Safety S a f e t y Assessment A s s e s s m e n t (PSSA) ( P S S A ) is i s a a systematic s y s t e m a t i c examination e x a m i n a t i o n of o f the t h e proposed p r o p o s e d system s y s t e m architecture(s) a r c h i t e c t u r e ( s ) to t o determine d e t e r m i n e how h o w failures f a i l u r e s can c a n cause c a u s e the t h e functional f u n c t i o n a l hazards h a z a r d s identified i d e n t i f i e d by b y the t h e FHA F H A The T h e objective o b j e c t i v e of o f the t h e PSSA P S S A is i s to t o establish e s t a b l i s h the t h e safety s a f e t y requirements r e q u i r e m e n t s of o f the t h e system s y s t e m and a n d to t o determine d e t e r m i n e that t h a t the t h e proposed p r o p o s e d architecture a r c h i t e c t u r e can c a n reasonably r e a s o n a b l y be b e expected e x p e c t e d to t o meet m e e t the t h e safety s a f e t y objectives o b j e c t i v e s identified i d e n t i f i e d by b y the t h e FHA F H A The T h e PSSA P S S A is i s also a l s o an a n interactive i n t e r a c t i v e process p r o c e s s associated a s s o c i a t e d with w i t h the t h e design d e s i g n definition. d e f i n i t i o n . The T h e PSSA P S S A is i s conducted c o n d u c t e d at a t multiple m u l t i p l e stages s t a g e s of o f the t h e system s y s t e m development d e v e l o p m e n t including i n c l u d i n g system, s y s t e m , component, c o m p o n e n t , and a n d hardware/software h a r d w a r e / s o f t w a r e design d e s i g n definitions. d e f i n i t i o n s . Organization O r g a n i z a t i o n Roles R o l e s and a n d Responsibilities R e s p o n s i b i l i t i e s Aircraft A i r c r a f t Safety S a f e t y Group G r o u p Ensure E n s u r e development d e v e l o p m e n t of o f system s y s t e m FHA F H A and a n d provide p r o v i d e input i n p u t to t o the t h e PSSA P S S A process. p r o c e s s . Design D e s i g n Perform P e r f o r m PSSA P S S A and a n d implement i m p l e m e n t changes c h a n g e s required. r e q u i r e d . 5.6 5 . 6 System S y s t e m Safety S a f e t y Assessment A s s e s s m e n t The T h e System S y s t e m Safety S a f e t y Assessment A s s e s s m e n t (SSA) ( S S A ) is i s a a systematic, s y s t e m a t i c , comprehensive c o m p r e h e n s i v e evaluation e v a l u a t i o n of o f the t h e implemented i m p l e m e n t e d system s y s t e m to t o show s h o w that t h a t safety s a f e t y objectives o b j e c t i v e s from f r o m the t h e development d e v e l o p m e n t documents, d o c u m e n t s , principally p r i n c i p a l l y from f r o m the t h e FHA F H A and a n d derived d e r i v e d safety s a f e t y requirements r e q u i r e m e n t s from f r o m the t h e PSSA, P S S A , are a r e met. m e t . The T h e SSA S S A is i s usually u s u a l l y based b a s e d on o n the t h e PSSA P S S A FTA F T A or o r other o t h e r approved a p p r o v e d methods m e t h o d s and a n d uses u s e s the t h e quantitative q u a n t i t a t i v e values v a l u e s obtained o b t a i n e d from f r o m the t h e Failure F a i l u r e Modes M o d e s and a n d Effects E f f e c t s Summary S u m m a r y (FMES). ( F M E S ) . The T h e SSA S S A also a l s o verifies v e r i f i e s that t h a t qualitative q u a l i t a t i v e aspects a s p e c t s e.g. e . g . development d e v e l o p m e n t assurance a s s u r a n c e levels l e v e l s have h a v e been b e e n accomplished. a c c o m p l i s h e d . The T h e SSA S S A should s h o u l d verify v e r i f y that t h a t all a l l significant s i g n i f i c a n t effects e f f e c t s identified i d e n t i f i e d in i n the t h e FMES F M E S are a r e considered c o n s i d e r e d for f o r inclusion i n c l u s i o n as a s primary p r i m a r y events e v e n t s in i n the t h e FTA F T A The T h e FMES F M E S is i s a a summary s u m m a r y of o f failures f a i l u r e s identified i d e n t i f i e d by b y the t h e FMEA(s) F M E A ( s ) which w h i c h are a r e grouped g r o u p e d together t o g e t h e r on o n the t h e basis b a s i s of o f their t h e i r failure f a i l u r e effects. e f f e c t s . The T h e SSA S S A should s h o u l d also a l s o include i n c l u d e applicable a p p l i c a b l e common c o m m o n cause c a u s e analysis a n a l y s i s results. r e s u l t s . Organization O r g a n i z a t i o n Roles R o l e s and a n d Responsibilities R e s p o n s i b i l i t i e s Design D e s i g n Create C r e a t e the t h e SSA S S A Aircraft A i r c r a f t Safety S a f e t y Group G r o u p Participates P a r t i c i p a t e s in i n the t h e SSA S S A Program P r o g r a m Engineering E n g i n e e r i n g Review R e v i e w and a n d approve a p p r o v e the t h e SSA S S A 5.7 5 . 7 System S y s t e m FTAs F T A s and a n d FMEAs F M E A s The T h e system s y s t e m FTAs F T A s and a n d FMEAs F M E A s are a r e performed p e r f o r m e d with w i t h Safety S a f e t y Engineering E n g i n e e r i n g maintaining m a i n t a i n i n g oversight o v e r s i g h t to t o ensure e n s u r e that t h a t FMEA F M E A and a n d FTA F T A processes p r o c e s s e s are a r e consistently c o n s i s t e n t l y applied a p p l i e d across a c r o s s systems. s y s t e m s . Safety S a f e t y Engineering E n g i n e e r i n g and a n d the t h e ASA A S A team t e a m will w i l l also a l s o track t r a c k FTA F T A and a n d FMEA F M E A progress p r o g r e s s to t o ensure e n s u r e that t h a t FHA F H A Failure F a i l u r e Conditions C o n d i t i o n s are a r e adequately a d e q u a t e l y addressed. a d d r e s s e d . This T h i s will w i l l include i n c l u d e all a l l Catastrophic C a t a s t r o p h i c and a n d Hazardous H a z a r d o u s Failure F a i l u r e Conditions C o n d i t i o n s as a s well w e l l as a s significant s i g n i f i c a n t Major M a j o r conditions c o n d i t i o n s for f o r which w h i c h this t h i s level l e v e l of o f analysis a n a l y s i s is i s deemed d e e m e d appropriate. a p p r o p r i a t e . Finally, F i n a l l y , Design D e s i g n will w i l l collect c o l l e c t the t h e system s y s t e m FTAs F T A s and a n d FMEAs F M E A s and a n d use u s e them t h e m as a s required r e q u i r e d to t o develop d e v e l o p multi-function m u l t i - f u n c t i o n analyses a n a l y s e s to t o be b e included i n c l u d e d in i n the t h e Aircraft-Level A i r c r a f t - L e v e l Safety S a f e t y Assessment A s s e s s m e n t Document. D o c u m e n t . Organization O r g a n i z a t i o n Roles R o l e s and a n d Responsibilities R e s p o n s i b i l i t i e s Design D e s i g n Create C r e a t e the t h e FTAs F T A s and a n d FMEAs. F M E A s . Aircraft A i r c r a f t Safety S a f e t y Group G r o u p Participates P a r t i c i p a t e s in i n the t h e FTAs F T A s and a n d FMEAs. F M E A s . Program P r o g r a m Engineering E n g i n e e r i n g Review R e v i e w and a n d approve a p p r o v e the t h e FTAs F T A s and a n d FMEAs. F M E A s . granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true} Downloaded D o w n l o a d e d from f r o m SAE S A E International I n t e r n a t i o n a l by b y David D a v i d Merrill, M e r r i l l , Saturday, S a t u r d a y , November N o v e m b e r 12, 1 2 , 2016 2 0 1 6 SAE S A E ARP4754A A R P 4 7 5 4 A Page P a g e 110 1 1 0 of o f 115 1 1 5 APPENDIX A P P E N D I X C C - - FDAL/IDAL F D A L / I D A L ASSIGNMENT A S S I G N M E N T PROCESS P R O C E S S EXAMPLE E X A M P L E The T h e process p r o c e s s for f o r assigning a s s i g n i n g Development D e v e l o p m e n t Assurance A s s u r a n c e Levels L e v e l s to t o Functions F u n c t i o n s (FOAL) ( F O A L ) and a n d to t o items i t e m s (IDAL) ( I D A L ) with w i t h architectural a r c h i t e c t u r a l considerations c o n s i d e r a t i o n s (see ( s e e section s e c t i o n 5.2.3.2) 5 . 2 . 3 . 2 ) is i s shown s h o w n in i n the t h e Figures F i g u r e s C-1 C - 1 and a n d C-2. C - 2 . This T h i s process p r o c e s s should s h o u l d be b e applied a p p l i e d each e a c h time t i m e the t h e aircraft/system a i r c r a f t / s y s t e m architecture a r c h i t e c t u r e is i s modified, m o d i f i e d , during d u r i n g the t h e PASNPSSA P A S N P S S A when w h e n all a l l causes c a u s e s of o f the t h e Failure F a i l u r e Conditions C o n d i t i o n s need n e e d to t o be b e identified i d e n t i f i e d and a n d reassessed, r e a s s e s s e d , and a n d each e a c h time t i m e the t h e Functional F u n c t i o n a l Hazard H a z a r d Assessment A s s e s s m e n t is i s revised. r e v i s e d . When W h e n considering c o n s i d e r i n g re-use r e - u s e of o f previously p r e v i o u s l y developed d e v e l o p e d aircraft/system a i r c r a f t / s y s t e m functions f u n c t i o n s and a n d items, i t e m s , their t h e i r associated a s s o c i a t e d FFS F F S should s h o u l d satisfy s a t i s f y the t h e general g e n e r a l principles p r i n c i p l e s defined d e f i n e d in i n Section S e c t i o n 5.2.1 5 . 2 . 1 and a n d may m a y not n o t require r e q u i r e full f u l l application a p p l i c a t i o n of o f each e a c h step s t e p of o f the t h e process p r o c e s s described d e s c r i b e d in i n the t h e Figure F i g u r e C-1 C - 1 and a n d C-2. C - 2 . The T h e process p r o c e s s in i n the t h e following f o l l o w i n g flowchart f l o w c h a r t is i s top t o p down, d o w n , starting s t a r t i n g from f r o m a a Failure F a i l u r e Condition C o n d i t i o n Classification C l a s s i f i c a t i o n identified i d e n t i f i e d in i n the t h e Aircraft A i r c r a f t Level L e v e l FHA F H A and a n d its i t s associated a s s o c i a t e d Top-Level T o p - L e v e l FOAL; F O A L ; then t h e n assigning a s s i g n i n g Function F u n c t i o n FDALs F D A L s to t o identified i d e n t i f i e d FFSs F F S s and a n d its i t s Members; M e m b e r s ; culminating c u l m i n a t i n g with w i t h assignment a s s i g n m e n t of o f the t h e IDAL I D A L to t o items i t e m s (software/electronic ( s o f t w a r e / e l e c t r o n i c hardware). h a r d w a r e ) . Ultimately, U l t i m a t e l y , the t h e intent i n t e n t is i s to t o go g o through t h r o u g h the t h e process p r o c e s s flow f l o w described d e s c r i b e d below b e l o w to t o satisfy s a t i s f y all a l l the t h e Failure F a i l u r e Conditions C o n d i t i o n s identified i d e n t i f i e d in i n the t h e FHA. F H A . The T h e process p r o c e s s flow f l o w is i s represented r e p r e s e n t e d as a s a a single s i n g l e pass p a s s flow; f l o w ; however, h o w e v e r , it i t should s h o u l d be b e understood u n d e r s t o o d that t h a t there t h e r e is i s interact i n t e r a c t ion i o n between b e t w e e n the t h e aircraft/system a i r c r a f t / s y s t e m functional f u n c t i o n a l levels l e v e l s and a n d the t h e item i t e m development d e v e l o p m e n t levels l e v e l s thus t h u s may m a y require r e q u i r e multiple m u l t i p l e iterations i t e r a t i o n s across a c r o s s the t h e FDAL/IDAL F D A L / I D A L boundary. b o u n d a r y . Step S t e p by b y Step S t e p Process P r o c e s s Description D e s c r i p t i o n a) a ) Select S e l e c t a a FC F C from f r o m the t h e FHA F H A The T h e list l i s t of o f Failure F a i l u r e Conditions C o n d i t i o n s (FCs) ( F C s ) identified i d e n t i f i e d in i n the t h e Aircraft A i r c r a f t or o r System S y s t e m Level L e v e l Functional F u n c t i o n a l Hazard H a z a r d Assessment A s s e s s m e n t (see ( s e e Section S e c t i o n 5.1.1) 5 . 1 . 1 ) is i s the t h e input i n p u t to t o the t h e FOAL F O A L and a n d IDAL I D A L assignment a s s i g n m e n t process. p r o c e s s . The T h e Preliminary P r e l i m i n a r y Aircraft A i r c r a f t Safety S a f e t y Assessment/Preliminary A s s e s s m e n t / P r e l i m i n a r y System S y s t e m Safety S a f e t y Assessments A s s e s s m e n t s use u s e the t h e Failure F a i l u r e Condition C o n d i t i o n data d a t a for f o r the t h e purposes p u r p o s e s of o f FOAL F O A L Assignment. A s s i g n m e n t . b) b ) Assign A s s i g n top t o p FOAL F O A L per p e r Table T a b l e 2 2 A A top t o p FOAL F O A L is i s assigned a s s i g n e d based b a s e d on o n the t h e Failure F a i l u r e Condition C o n d i t i o n Classification. C l a s s i f i c a t i o n . This T h i s is i s performed p e r f o r m e d for f o r each e a c h Failure F a i l u r e Condition C o n d i t i o n in i n the t h e aircraft a i r c r a f t and a n d system s y s t e m FHAs F H A s in i n accordance a c c o r d a n c e with w i t h Table T a b l e 2 2 of o f Section S e c t i o n 5.2.3. 5 . 2 . 3 . For F o r systems s y s t e m s that t h a t provide p r o v i d e protection p r o t e c t i o n against a g a i n s t an a n external e x t e r n a l event, e v e n t , this t h i s may m a y also a l s o consider c o n s i d e r external e x t e r n a l events e v e n t s per p e r Section S e c t i o n 5.2.4. 5 . 2 . 4 . c) c ) Identify I d e n t i f y the t h e Functional F u n c t i o n a l Level L e v e l FFSs F F S s At A t this t h i s stage s t a g e of o f the t h e development d e v e l o p m e n t process, p r o c e s s , the t h e functional f u n c t i o n a l failure f a i l u r e set s e t analysis a n a l y s i s should s h o u l d be b e performed p e r f o r m e d to t o identify i d e n t i f y FFSs F F S s and a n d their t h e i r associated a s s o c i a t e d functional f u n c t i o n a l Members. M e m b e r s . There T h e r e may m a y be b e single s i n g l e member m e m b e r FFS(s) F F S ( s ) or o r multiple m u l t i p l e member m e m b e r FFSs. F F S s . Conceptually, C o n c e p t u a l l y , an a n FFS F F S is i s equivalent e q u i v a l e n t to t o a a Fault F a u l t Tree T r e e minimal m i n i m a l cut c u t set s e t (as ( a s defined d e f i n e d in i n ARP4761 A R P 4 7 6 1 ), ) , whose w h o s e members m e m b e r s represent r e p r e s e n t the t h e result r e s u l t of o f potential p o t e n t i a l development d e v e l o p m e n t errors e r r o r s rather r a t h e r than t h a n failures. f a i l u r e s . d) d ) Select S e l e c t a a Functional F u n c t i o n a l Failure F a i l u r e Set S e t (FFS) ( F F S ) Select S e l e c t a a single s i n g l e FFS F F S from f r o m the t h e identified i d e n t i f i e d FFSs. F F S s . The T h e FOAL F O A L assignment a s s i g n m e n t process p r o c e s s is i s applied a p p l i e d to t o all a l l identified i d e n t i f i e d FFSs, F F S s , for f o r each e a c h Failure F a i l u r e Condition C o n d i t i o n in i n the t h e FA F A and a n d is i s applied a p p l i e d to t o all a l l identified i d e n t i f i e d FFs. F F s . e) e ) Does D o e s the t h e FFS F F S have h a v e Multiple M u l t i p l e Members? M e m b e r s ? At A t this t h i s stage s t a g e a a multiple m u l t i p l e Member M e m b e r FFS F F S has h a s functionally f u n c t i o n a l l y independent i n d e p e n d e n t Members. M e m b e r s . f) f ) Are A r e Functional F u n c t i o n a l Independence I n d e p e n d e n c e Claims C l a i m s Valid? V a l i d ? For F o r a a FFS F F S with w i t h multiple m u l t i p l e Members, M e m b e r s , Functional F u n c t i o n a l Independence I n d e p e n d e n c e can c a n be b e claimed c l a i m e d when w h e n the t h e common c o m m o n sources s o u r c e s of o f Error E r r o r between b e t w e e n multiple m u l t i p l e requirement r e q u i r e m e n t sets s e t s have h a v e been b e e n minimized m i n i m i z e d at a t a a level l e v e l of o f rigor r i g o r commensurate c o m m e n s u r a t e with w i t h the t h e top t o p FOAL. F O A L . If I f the t h e presence p r e s e n c e of o f common c o m m o n Error E r r o r sources s o u r c e s in i n the t h e requirements r e q u i r e m e n t s is i s indeterminate, i n d e t e r m i n a t e , then t h e n Functional F u n c t i o n a l Independence I n d e p e n d e n c e claims c l a i m s are a r e invalid i n v a l i d (see ( s e e Section S e c t i o n 5.2.3.2.1.1). 5 . 2 . 3 . 2 . 1 . 1 ) . granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true} Downloaded D o w n l o a d e d from f r o m SAE S A E International I n t e r n a t i o n a l by b y David D a v i d Merrill, M e r r i l l , Saturday, S a t u r d a y , November N o v e m b e r 12, 1 2 , 2016 2 0 1 6 SAE S A E ARP4754A A R P 4 7 5 4 A Page P a g e 111 1 1 1 of o f 115 1 1 5 --------1.i - - - - - - - - 1 . i a. a . Select S e l e c t a a FC F C from f r o m the t h e FHA F H A b. b . Assign A s s i g n top t o p FOAL F O A L per p e r Table T a b l e 5-1 5 - 1 c. c . Identify I d e n t i f y the t h e Functional F u n c t i o n a l Level L e v e l FFSs F F S s d. d . Select S e l e c t a a FFS F F S e. e . Does D o e s the t h e FFS F F S have h a v e Multiple M u l t i p l e Members? M e m b e r s ? No N o No N o h.Assign h . A s s i g n FOAL F O A L to t o FFS F F S Members M e m b e r s per p e r Option O p t i o n 1 1 or o r Option O p t i o n 2 2 of o f Table T a b l e 5-2 5 - 2 g. g . Assign A s s i g n FOAL F O A L to t o FFS F F S Member M e m b e r per p e r Column C o l u m n 2 2 of o f Table T a b l e 5-2 5 - 2 j. j . Have H a v e all a l l the t h e FCs F C s from f r o m the t h e FHA F H A No N o en e n assessed? a s s e s s e d ? been b e e n assessed? a s s e s s e d ? No N o Yes Y e s k. k . Ensure E n s u r e the t h e FOAL F O A L assignments a s s i g n m e n t s satisfy s a t i s f y all a l l FCs F C s in i n the t h e FHA F H A FOAL F O A L Assignment A s s i g n m e n t Figure F i g u r e C- C - 1 1 Example E x a m p l e FDAL/IDAL F D A L / I D A L Assignment A s s i g n m e n t with w i t h Architecture A r c h i t e c t u r e Considerations C o n s i d e r a t i o n s Process P r o c e s s Flow F l o w Chart C h a r t (1 ( 1 of o f 2) 2 ) granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true} Downloaded D o w n l o a d e d from f r o m SAE S A E International I n t e r n a t i o n a l by b y David D a v i d Merrill, M e r r i l l , Saturday, S a t u r d a y , November N o v e m b e r 12, 1 2 , 2016 2 0 1 6 SAE S A E ARP4754A A R P 4 7 5 4 A Page P a g e 112 1 1 2 of o f 115 1 1 5 IDAL I D A L Assignment A s s i g n m e n t ------------ - - - - - - - - - - - - I. I . Select S e l e c t a a FC F C from f r o m the t h e FHA F H A Identify I d e n t i f y FFSs F F S s associated a s s o c i a t e d with w i t h Items I t e m s or o r combined c o m b i n e d Items I t e m s and a n d Functions F u n c t i o n s Select S e l e c t a a FFS F F S No N o No N o p. p . Are A r e the t h e Item I t e m Development D e v e l o p m e n t Independence I n d e p e n d e n c e claims c l a i m s valid v a l i d and a n d have h a v e the t h e Functional F u n c t i o n a l Independence I n d e p e n d e n c e claims c l a i m s been b e e n maintained? m a i n t a i n e d ? Yes Y e s q. q . Assign A s s i g n IDAL I D A L to t o FFS F F S Members M e m b e r s as a s per p e r Option O p t i o n 1 1 or o r Option O p t i o n 2 2 of o f Table T a b l e 5-2 5 - 2 and a n d Additional A d d i t i o n a l Considerations C o n s i d e r a t i o n s defined d e f i n e d in i n 5.2.3.4 5 . 2 . 3 . 4 ------1 - - - - - - 1 r. r . -Assign - A s s i g n f---- f - - - - - - IDAL I D A L to t o the t h e FFS F F S Member M e m b e r per p e r Column C o l u m n 2 2 of o f Table T a b l e 5-2 5 - 2 No N o No N o u. u . Finish F i n i s h When W h e n all a l l FCs F C s have h a v e been b e e n addressed, a d d r e s s e d , and a n d FDALs F D A L s and a n d IDALs I D A L s have h a v e been b e e n assigned a s s i g n e d to t o Members M e m b e r s of o f all a l l FFSs F F S s Figure F i g u r e C-2 C - 2 Example E x a m p l e FDAL/IDAL F D A L / I D A L Assignment A s s i g n m e n t with w i t h Architecture A r c h i t e c t u r e Considerations C o n s i d e r a t i o n s Process P r o c e s s Flow F l o w Chart C h a r t (2 ( 2 of o f 2) 2 ) granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true} Downloaded D o w n l o a d e d from f r o m SAE S A E International I n t e r n a t i o n a l by b y David D a v i d Merrill, M e r r i l l , Saturday, S a t u r d a y , November N o v e m b e r 12, 1 2 , 2016 2 0 1 6 SAE S A E ARP4754A A R P 4 7 5 4 A Page P a g e 113 1 1 3 of o f 115 1 1 5 g) g ) Assign A s s i g n FOAL F O A L to t o FFS F F S Member M e m b e r per p e r Column C o l u m n 2 2 of o f Table T a b l e 3 3 If I f the t h e FFS F F S has h a s a a single s i n g l e Member, M e m b e r , (i.e. ( i . e . an a n error e r r o r in i n the t h e development d e v e l o p m e n t of o f that t h a t Member M e m b e r can c a n directly d i r e c t l y result r e s u l t in i n the t h e Failure F a i l u r e Condition C o n d i t i o n being b e i n g assessed) a s s e s s e d ) then t h e n the t h e FOAL F O A L should s h o u l d be b e assigned a s s i g n e d to t o that t h a t Member M e m b e r as a s per p e r Column C o l u m n 2 2 of o f Table T a b l e 3 3 of o f Section S e c t i o n 5.2.3.2.2. 5 . 2 . 3 . 2 . 2 . h) h ) Assign A s s i g n FOAL F O A L to t o FFS F F S Members M e m b e r s per p e r Option O p t i o n 1or 1 o r Option O p t i o n 2 2 of o f Table T a b l e 3 3 The T h e choice c h o i c e of o f whether w h e t h e r to t o apply a p p l y Option O p t i o n 1 1 or o r Option O p t i o n 2 2 is i s at a t the t h e discretion d i s c r e t i o n of o f the t h e applicant a p p l i c a n t but b u t should s h o u l d consider c o n s i d e r what w h a t functional f u n c t i o n a l implementation i m p l e m e n t a t i o n is i s most m o s t appropriate a p p r o p r i a t e to t o mitigate m i t i g a t e the t h e FCs. F C s . Considerations C o n s i d e r a t i o n s may m a y also a l s o be b e warranted w a r r a n t e d for f o r external e x t e r n a l events e v e n t s per p e r Section S e c t i o n 5.2.4. 5 . 2 . 4 . i) i ) Have H a v e all a l l FFSs F F S s for f o r the t h e Selected S e l e c t e d Failure F a i l u r e Condition C o n d i t i o n been b e e n assessed? a s s e s s e d ? Once O n c e FDALs F D A L s have h a v e been b e e n assigned a s s i g n e d to t o the t h e Members M e m b e r s in i n the t h e selected s e l e c t e d FFS, F F S , the t h e FOAL F O A L assignment a s s i g n m e n t process p r o c e s s should s h o u l d be b e applied a p p l i e d to t o each e a c h of o f the t h e identified i d e n t i f i e d FFSs F F S s for f o r the t h e selected s e l e c t e d Failure F a i l u r e Condition. C o n d i t i o n . j) j ) Have H a v e all a l l the t h e Failure F a i l u r e Conditions C o n d i t i o n s from f r o m the t h e FHA F H A been b e e n assessed? a s s e s s e d ? Once O n c e FDALs F D A L s have h a v e been b e e n assigned a s s i g n e d to t o all a l l Members M e m b e r s of o f all a l l FFSs F F S s associated a s s o c i a t e d with w i t h the t h e selected s e l e c t e d Failure F a i l u r e Condition, C o n d i t i o n , the t h e FOAL F O A L assignment a s s i g n m e n t process p r o c e s s should s h o u l d be b e applied a p p l i e d to t o each e a c h of o f the t h e Failure F a i l u r e Conditions C o n d i t i o n s identified i d e n t i f i e d in i n the t h e FHA. F H A . k) k ) Ensure E n s u r e the t h e FOAL F O A L assignments a s s i g n m e n t s satisfy s a t i s f y all a l l FCs F C s in i n the t h e FHA F H A Compile C o m p i l e a a list l i s t of o f all a l l functions f u n c t i o n s and a n d select s e l e c t the t h e FOAL F O A L assignment(s) a s s i g n m e n t ( s ) that t h a t satisfy s a t i s f y all a l l applicable a p p l i c a b l e FFSs F F S s and a n d Failure F a i l u r e Conditions. C o n d i t i o n s . It I t is i s recognized r e c o g n i z e d that t h a t FFSs F F S s may m a y share s h a r e common c o m m o n Members M e m b e r s and a n d FCs F C s may m a y relate r e l a t e to t o common c o m m o n functions; f u n c t i o n s ; therefore, t h e r e f o r e , the t h e FOAL F O A L assignment a s s i g n m e n t to t o Members M e m b e r s of o f all a l l the t h e FFSs F F S s for f o r all a l l FCs F C s identified i d e n t i f i e d from f r o m the t h e FHA F H A should s h o u l d be b e reviewed r e v i e w e d to t o ensure e n s u r e that t h a t the t h e Top T o p FDAL F D A L for f o r each e a c h FC F C in i n the t h e FHA F H A is i s satisfied. s a t i s f i e d . Futhermore, F u t h e r m o r e , it i t is i s recognized r e c o g n i z e d that t h a t one o n e may m a y need n e e d to t o reassign r e a s s i g n the t h e appropriate a p p r o p r i a t e FOAL F O A L and/or a n d / o r reallocate r e a l l o c a t e functions f u n c t i o n s to t o ensure e n s u r e the t h e FDAL F D A L assignments a s s i g n m e n t s satisfy s a t i s f y the t h e general g e n e r a l principles p r i n c i p l e s defined d e f i n e d in i n Section S e c t i o n 5.2.1. 5 . 2 . 1 . I) I ) Select S e l e c t a a FC F C from f r o m the t h e FHA F H A The T h e System S y s t e m Safety S a f e t y Assessment A s s e s s m e n t needs n e e d s to t o apply a p p l y the t h e IDAL I D A L assignment a s s i g n m e n t process p r o c e s s to t o each e a c h Failure F a i l u r e Condition C o n d i t i o n in i n the t h e FHA. F H A . Once O n c e the t h e FHA F H A has h a s been b e e n established e s t a b l i s h e d for f o r the t h e Aircraft A i r c r a f t or o r System, S y s t e m , the t h e first f i r s t Failure F a i l u r e Condition C o n d i t i o n (FC) ( F C ) from f r o m the t h e FHA F H A - - and a n d then t h e n each e a c h subsequent s u b s e q u e n t FC F C thereafter t h e r e a f t e r - - should s h o u l d be b e selected s e l e c t e d for f o r the t h e purposes p u r p o s e s of o f IDAL I D A L Assignment. A s s i g n m e n t . m) m ) Identify I d e n t i f y FFSs F F S s Associated A s s o c i a t e d with w i t h Items I t e m s or o r Combined C o m b i n e d Items I t e m s and a n d Functions F u n c t i o n s Each E a c h functional f u n c t i o n a l level l e v e l FFS F F S will w i l l have h a v e one o n e or o r more m o r e associated a s s o c i a t e d item i t e m level l e v e l FFS(s). F F S ( s ) . Furthermore, F u r t h e r m o r e , FFSs F F S s may m a y exist e x i s t that t h a t combine c o m b i n e aircraft/system a i r c r a f t / s y s t e m functions f u n c t i o n s and a n d items. i t e m s . The T h e item i t e m level l e v e l FFS(s) F F S ( s ) and a n d any a n y FFSs F F S s with w i t h combined c o m b i n e d items i t e m s and a n d Functions F u n c t i o n s should s h o u l d be b e identified i d e n t i f i e d using u s i n g the t h e techniques t e c h n i q u e s shown s h o w n in i n Figure F i g u r e 9 9 of o f Section S e c t i o n 5.2.3.2.3.2 5 . 2 . 3 . 2 . 3 . 2 and a n d Figure F i g u r e 10 1 0 of o f Section S e c t i o n 5.2.3.2.3.3. 5 . 2 . 3 . 2 . 3 . 3 . n) n ) Select S e l e c t a a FFS F F S Select S e l e c t a a single s i n g l e FFS F F S from f r o m the t h e identified i d e n t i f i e d FFSs. F F S s . o) o ) Does D o e s the t h e FFS F F S have h a v e Multiple M u l t i p l e Members? M e m b e r s ? At A t this t h i s stage s t a g e a a multiple m u l t i p l e Member M e m b e r FFS F F S may m a y have h a v e Independent I n d e p e n d e n t Members. M e m b e r s . When W h e n the t h e Members M e m b e r s include i n c l u d e both b o t h aircraft/system a i r c r a f t / s y s t e m functions f u n c t i o n s and a n d items, i t e m s , all a l l Members M e m b e r s of o f the t h e FFS F F S must m u s t demonstrate d e m o n s t r a t e both b o t h Functional F u n c t i o n a l Independence I n d e p e n d e n c e and a n d Item I t e m Development D e v e l o p m e n t Independence. I n d e p e n d e n c e . granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true} Downloaded D o w n l o a d e d from f r o m SAE S A E International I n t e r n a t i o n a l by b y David D a v i d Merrill, M e r r i l l , Saturday, S a t u r d a y , November N o v e m b e r 12, 1 2 , 2016 2 0 1 6 SAE S A E ARP4754A A R P 4 7 5 4 A Page P a g e 114 1 1 4 of o f 115 1 1 5 p) p ) Are A r e the t h e Item I t e m Development D e v e l o p m e n t Independence I n d e p e n d e n c e Claims C l a i m s Valid V a l i d and a n d Have H a v e the t h e Functional F u n c t i o n a l Independence I n d e p e n d e n c e Claims C l a i m s Been B e e n Maintained? M a i n t a i n e d ? Item I t e m Development D e v e l o p m e n t Independence I n d e p e n d e n c e is i s substantiated s u b s t a n t i a t e d when w h e n the t h e common c o m m o n sources s o u r c e s of o f Error E r r o r between b e t w e e n multiple m u l t i p l e items i t e m s have h a v e been b e e n minimized m i n i m i z e d by b y applying a p p l y i n g a a level l e v e l of o f rigor r i g o r commensurate c o m m e n s u r a t e with w i t h the t h e top t o p FOAL, F O A L , based b a s e d on o n the t h e state s t a t e of o f the t h e art a r t and a n d in-service i n - s e r v i c e experience. e x p e r i e n c e . If I f the t h e presence p r e s e n c e of o f common c o m m o n Error E r r o r sources s o u r c e s in i n the t h e items i t e m s is i s indeterminate, i n d e t e r m i n a t e , then t h e n Item I t e m Development D e v e l o p m e n t Independence I n d e p e n d e n c e cannot c a n n o t be b e claimed c l a i m e d (see ( s e e Section S e c t i o n 5.2.3.2). 5 . 2 . 3 . 2 ) . In I n addition, a d d i t i o n , functional f u n c t i o n a l Independence I n d e p e n d e n c e claims c l a i m s should s h o u l d remain r e m a i n valid v a l i d as a s in i n step s t e p f. f . q) q ) Assign A s s i g n IDAL I D A L to t o the t h e FFS F F S Member M e m b e r per p e r Column C o l u m n 2 2 as a s per p e r Option O p t i o n 1or 1 o r Option O p t i o n 2 2 of o f Table T a b l e 3 3 and a n d Additional A d d i t i o n a l Considerations C o n s i d e r a t i o n s defined d e f i n e d in i n Section S e c t i o n 5.2.2.3 5 . 2 . 2 . 3 The T h e choice c h o i c e of o f whether w h e t h e r to t o apply a p p l y Option O p t i o n 1 1 or o r Option O p t i o n 2 2 is i s at a t the t h e discretion d i s c r e t i o n of o f the t h e applicant a p p l i c a n t but b u t should s h o u l d consider c o n s i d e r what w h a t Item I t e m Development D e v e l o p m e n t implementation i m p l e m e n t a t i o n is i s most m o s t appropriate a p p r o p r i a t e to t o mitigate m i t i g a t e the t h e FCs. F C s . r) r ) Assign A s s i g n IDAL I D A L to t o the t h e FFS F F S Member M e m b e r per p e r Column C o l u m n 2 2 of o f Table T a b l e 3 3 If I f the t h e FFS F F S has h a s a a single s i n g l e Member, M e m b e r , (i.e. ( i . e . an a n error e r r o r in i n the t h e development d e v e l o p m e n t of o f that t h a t Member M e m b e r can c a n directly d i r e c t l y result r e s u l t in i n the t h e Failure F a i l u r e Condition C o n d i t i o n being b e i n g assessed) a s s e s s e d ) then t h e n the t h e IDAL I D A L should s h o u l d be b e assigned a s s i g n e d to t o that t h a t Member M e m b e r as a s per p e r Column C o l u m n 2 2 of o f Table T a b l e 3 3 of o f Section S e c t i o n 5.2.3.2.2. 5 . 2 . 3 . 2 . 2 . s) s ) Have H a v e all a l l the t h e FFSs F F S s for f o r the t h e Selected S e l e c t e d FC F C been b e e n assessed? a s s e s s e d ? Once O n c e IDALs I D A L s have h a v e been b e e n assigned a s s i g n e d to t o the t h e Members M e m b e r s in i n the t h e selected s e l e c t e d FFS F F S the t h e IDAL I D A L assignment a s s i g n m e n t process p r o c e s s should s h o u l d be b e applied a p p l i e d to t o each e a c h of o f the t h e other o t h e r identified i d e n t i f i e d FFS F F S for f o r the t h e selected s e l e c t e d FC. F C . t) t ) Have H a v e all a l l the t h e FCs F C s from f r o m the t h e FHA F H A been b e e n assessed? a s s e s s e d ? Once O n c e IDALs I D A L s have h a v e been b e e n assigned a s s i g n e d to t o all a l l Members M e m b e r s of o f all a l l FFSs F F S s associated a s s o c i a t e d with w i t h the t h e selected s e l e c t e d FC F C the t h e IDAL I D A L assignment a s s i g n m e n t process p r o c e s s should s h o u l d be b e applied a p p l i e d to t o each e a c h of o f the t h e other o t h e r FCs F C s identified i d e n t i f i e d in i n the t h e FHA. F H A . u) u ) Finish F i n i s h when w h e n all a l l FCs F C s have h a v e been b e e n addressed a d d r e s s e d and a n d FDALs F D A L s and a n d IDALs I D A L s have h a v e been b e e n assigned a s s i g n e d to t o Members M e m b e r s of o f all a l l FFSs F F S s The T h e FOAL F O A L and a n d IDAL I D A L assignment a s s i g n m e n t process p r o c e s s is i s complete c o m p l e t e when w h e n all a l l Failure F a i l u r e Conditions C o n d i t i o n s identified i d e n t i f i e d in i n the t h e FHA F H A have h a v e been b e e n addressed, a d d r e s s e d , and a n d FDALs F D A L s and a n d IDALs I D A L s for f o r all a l l Members M e m b e r s have h a v e been b e e n identified i d e n t i f i e d to t o satisfy s a t i s f y the t h e general g e n e r a l principles p r i n c i p l e s defined d e f i n e d in i n Section S e c t i o n 5.2.1. 5 . 2 . 1 . It I t is i s recognized r e c o g n i z e d that t h a t FFSs F F S s may m a y share s h a r e common c o m m o n Members M e m b e r s and a n d FCs F C s may m a y relate r e l a t e to t o common c o m m o n functions f u n c t i o n s and/or a n d / o r items; i t e m s ; therefore, t h e r e f o r e , the t h e FOAL F O A L and a n d IDAL I D A L assignment a s s i g n m e n t to t o Members M e m b e r s of o f all a l l the t h e FFSs F F S s for f o r all a l l FCs F C s identified i d e n t i f i e d from f r o m the t h e FHA F H A should s h o u l d be b e reviewed r e v i e w e d to t o ensure e n s u r e that t h a t the t h e Top T o p FOAL F O A L for f o r each e a c h FC F C in i n the t h e FHA F H A is i s satisfied, s a t i s f i e d , and a n d FDALs F D A L s and a n d IDALs I D A L s for f o r all a l l Members M e m b e r s have h a v e been b e e n identified i d e n t i f i e d to t o satisfy s a t i s f y the t h e general g e n e r a l principles p r i n c i p l e s defined d e f i n e d in i n Section S e c t i o n 5.2.1. 5 . 2 . 1 . At A t the t h e end e n d of o f the t h e assignment a s s i g n m e n t process, p r o c e s s , an a n IDAL I D A L required r e q u i r e d assignment a s s i g n m e n t higher h i g h e r than t h a n the t h e corresponding c o r r e s p o n d i n g FOAL F O A L may m a y be b e indication i n d i c a t i o n that t h a t the t h e Functional F u n c t i o n a l Independence I n d e p e n d e n c e at a t the t h e FOAL F O A L assignment a s s i g n m e n t has h a s been b e e n invalidated. i n v a l i d a t e d . Therefore, T h e r e f o r e , the t h e applicant a p p l i c a n t may m a y have h a v e to t o justify j u s t i f y the t h e architecture a r c h i t e c t u r e supporting s u p p o r t i n g the t h e top t o p level l e v e l FC. F C . granularity=word tetml={elements={line} glyphdetails={all}} contentanalysis={punctuationbreaks=false dehyphenate=false shadowdetect=false} layoutanalysis={tabledetect=0 layoutdetect=3} structureanalysis={list=true} Downloaded D o w n l o a d e d from f r o m SAE S A E International I n t e r n a t i o n a l by b y David D a v i d Merrill, M e r r i l l , Saturday, S a t u r d a y , November N o v e m b e r 12, 1 2 , 2016 2 0 1 6 SAE S A E ARP4754A A R P 4 7 5 4 A Page P a g e 115 1 1 5 of o f 115 1 1 5 APPENDIX A P P E N D I X D D - - DELETED D E L E T E D Previous P r e v i o u s guidelines g u i d e l i n e s in i n this t h i s appendix a p p e n d i x have h a v e been b e e n superseded s u p e r s e d e d by b y the t h e material m a t e r i a l found f o u n d in i n section s e c t i o n 5.2 5 . 2 herein. h e r e i n . 0.63 0.63 0.64 0.21 0.20 0.21 0.34 0.35 0.36 0.29 0.27 0.28 0.00 0.00 0.00 0.56 0.56 0.56 0.49 0.49 0.49 0.40 0.40 0.41 0.31 0.31 0.32 0.46 0.46 0.47 0.31 0.31 0.31 0.31 0.31 0.32 0.49 0.49 0.50 0.62 0.61 0.63 0.47 0.47 0.47 0.40 0.40 0.40 0.39 0.39 0.40 0.47 0.47 0.48 0.45 0.45 0.46 0.53 0.53 0.54 0.39 0.39 0.40 0.36 0.40 0.69 0.47 0.51 0.74 0.32 0.32 0.33 0.37 0.41 0.69 0.49 0.52 0.75 0.45 0.45 0.46 0.55 0.55 0.55 0.54 0.54 0.54 0.54 0.54 0.54 0.46 0.46 0.46 0.56 0.56 0.56 0.41 0.41 0.42 0.43 0.43 0.44 0.43 0.43 0.43 0.52 0.52 0.53 0.34 0.34 0.35 0.63 0.63 0.64 0.27 0.27 0.27 0.30 0.30 0.31 0.64 0.64 0.65 0.45 0.45 0.45 0.47 0.47 0.47 0.61 0.61 0.62 0.41 0.41 0.41 0.54 0.54 0.55 0.55 0.55 0.56 0.48 0.48 0.49 0.21 0.20 0.20 0.40 0.40 0.40 0.51 0.51 0.52 0.54 0.54 0.55 0.22 0.21 0.21 0.42 0.42 0.43 0.42 0.42 0.43 0.25 0.25 0.25 0.18 0.18 0.18 0.44 0.44 0.45 0.43 0.43 0.43 0.53 0.53 0.53 0.34 0.34 0.34 0.44 0.44 0.44 0.62 0.62 0.63 0.43 0.44 0.46 0.36 0.40 0.69 0.30 0.31 0.31 0.46 0.48 0.50 0.39 0.41 0.43 0.36 0.41 0.69