Knowledge and experience in system safety, software safety, system engineering, project management, and reliability are necessary for one to work effectively in avionics safety.

SAE ARP 4761

SAE ARP4761 is specifically oriented towards "airborne systems and equipment". This standard nicely marries to:

• SAE ARP 4754 (certification considerations),
• RTCA DO-178B (software considerations), and
• RTCA DO-254 (hardware considerations).

SAE ARP4761 is based on qualitative safety targets, in the form of Development Assurance Levels, and quantitative safety targets which are flowed down and verified.

Similar to other approaches to system safety, its intent is to influence architectural design.

SAE ARP4761 utilizes the concept of failure conditions which are classified according to severity.

Since this standard focuses on aircraft hazards, it does not address the other types and their associated analyses.

SAE ARP4761 Critique While writing system safety SOW text and DIDs for a client, we noted that this standard was deficient in a few areas. We critiqued SAE ARP4761 and forwarded our comments to the originators. Some of our comments were concerned with omissions. Others were concerned with definition and nomenclature inconsistencies.

Development Assurance Levels (DALs)

DALs are primarily an SAE ARP4761 concept and are similar to Safety Integrity Levels (SILs).

The System Safety Program defines DALs for aircraft functions, for systems, for items, for hardware and for software.

DALs must be determined by experienced system safety engineers as their assignment is crucial.

DALs for aircraft functions are determined from the hazard or failure condition severities.

DALs are utilized to establish confidence that system development has been accomplished in a sufficiently disciplined manner to limit the likelihood of development errors that could impact safety.

The hardware and software design levels establish the degrees of rigor to be used in the associated development processes.

Safety Assessments

SAE ARP4761 calls up:

• Functional Hazard Assessment (FHA) ,
• Preliminary System Safety Assessment (PSSA) ,
• System Safety Assessment (SSA) , and
• Common Cause Analysis (CCA) .

CCA is addressed very well and is embodied in FHA, PSSA and SSA.

By the way, did you that you can purchase DIDs from us for FHA, PSSA, SSA and more? For more information contact Haley MacGregor.

SAE ARP4761 advocates the following analytical approaches:

• Fault Tree Analysis (FTA) ,
• Dependency Diagrams (DD),
• M arkov Analysis (MA),
• Failure Mode and Effects Analysis (FMEA) , and
• Failure Mode and Effects Summary (FMES) .

CMRs

A Certification Maintenance Requirement (CMR) is a mandatory periodic task, required to maintain the safety of the aircraft, which is established during the design certification of the aircraft as an operating limitation of the type certificate.

The maintenance requirements, and the necessary interval between these focused maintenance activities in order to ensure adequate safety coverage, are derived by the System Safety Program.

The use of periodic maintenance or flight crew checks to detect significant latent failures when they occur is undesirable and should not be used in lieu of practical and reliable failure monitoring and indication.

CMRs are identified within the PSSA and verified within the SSA.

MMEL

A Master Minimum Equipment List (MMEL) regulates the dispatch of aircraft with inoperative equipment.

It defines the aircraft equipment allowed to be inoperative under certain conditions for a specific aircraft.

RTCA DO-178B

RTCA DO-178B utilizes Software Development Assurance Levels defined by the application of SAE ARP 4761.

• A - Software whose anomalous behavior, as shown by the system safety assessment process, would cause or contribute to a failure of system function resulting in a catastrophic failure condition for the aircraft
• B - Software whose anomalous behavior, as shown by the system safety assessment process, would cause or contribute to a failure of system function resulting in a hazardous/severe-major failure condition for the aircraft
• C - Software whose anomalous behavior, as shown by the system safety assessment process, would cause or contribute to a failure of system function resulting in a major failure condition for the aircraft
• D - Software whose anomalous behavior, as shown by the system safety assessment process, would cause or contribute to a failure of system function resulting in a minor failure condition for the aircraft
• E - Software whose anomalous behavior, as shown by the system safety assessment process, would cause or contribute to a failure of system function with no effect on aircraft operational capability or pilot workload

RTCA has formed subcommittee SC-205 to produce DO-178C and DO-248C.

RTCA DO-254

RTCA DO-254 utilizes Hardware Development Assurance Levels defined by the application of SAE ARP 4761.

• A - Hardware functions whose failure or anomalous behavior, as shown by the hardware safety assessment, would cause a failure of system function resulting in a catastrophic failure condition for the aircraft
• B - Hardware functions whose failure or anomalous behavior, as shown by the hardware safety assessment, would cause a failure of system function resulting in a hazardous/severe-major failure condition for the aircraft
• C - Hardware functions whose failure or anomalous behavior, as shown by the hardware safety assessment, would cause a failure of system function resulting in a major failure condition for the aircraft
• D - Hardware functions whose failure or anomalous behavior, as shown by the hardware safety assessment, would cause a failure of system function resulting in a minor failure condition for the aircraft
• E - Hardware functions whose failure or anomalous behavior, as shown by the hardware safety assessment, would cause a failure of system function with no effect on aircraft operational capability or flight crew workload

For more information contact Blake Palmer.