System Design and Analysis
2.1.3 In the early years of aviation, airplane systems were evaluated to specific requirements: to the “single fault” criterion or to the fail-safe design concept, which are explained below. As later-generation airplanes developed, their designers added more safety-critical functions, which generally resulted in an increase in the complexity of the systems designed to perform these functions. A safety-critical function was a function whose failure when required would result in a catastrophic condition. The potential hazards to the airplane and its occupants, in the event of failure of one or more functions provided by a system, had to be considered, as did the interaction between systems performing different functions. To assess the safety of a complex system—and the adequacy of system redundancy to meet the fail-safe criterion—the FAA began assigning statistical probabilities to system failures in AC 25.1309-1, dated September 7, 1982. The agency’s primary objective was to ensure that the proliferation of safety-critical systems would not increase the probability of a catastrophic accident. The FAA assigned numerical values to the qualitative probabilistic terms in the requirements, for use in those cases where the impact of system failures is examined by quantitative methods of analysis. However, numerical values were intended to supplement, not replace, qualitative methods based on engineering and operational judgment. See appendix A for a historical perspective of the use of statistical probabilities in system safety assessment.
6.2.2 Each system function should be examined with respect to the other functions performed by the system, because the loss or malfunction of multiple functions performed by the system could result in a more severe failure condition than the failure of a single function. In addition, each system function should be examined with respect to functions performed by other airplane systems because the loss or malfunction of different but related functions, provided by separate systems, may affect the severity of failure conditions postulated for a particular system.
Вот именно оно
7.4 Common Cause Failure Considerations.
An analysis should consider the application of the fail-safe design concept described in paragraph 2.2 of this AC. The analysis should also give special attention to ensuring the effective use of design and installation techniques that would prevent single failures or other events from damaging or otherwise adversely affecting more than one redundant system channel, more than one system performing operationally similar functions, or any system and an associated safeguard.
When considering such common cause failures or other events, consequential or cascading effects should be taken into account. Cascading effects are the set of effects resulting from the propagation of an initiating condition (e.g., a failure or initiating event).
Some examples of potential sources of common cause failures or other events would include the following:
• Rapid release of energy from concentrated sources, such as uncontained failures of rotating parts (other than engines and propellers) or pressure vessels,
• Pressure differentials,
• Non-catastrophic structural failures,
• Loss of environmental conditioning,
• Disconnection of more than one subsystem or component by overtemperature protection devices,
• Contamination by fluids,
• Damage from localized fires,
• Loss of power supply or return (for example, mechanical damage or deterioration of connections),
• Failure of sensors that provide data to multiple systems,
• Excessive voltage,
• Physical or environmental interactions among parts,
• Requirements, design, implementation, installation, flightcrew or ground crew operations, maintenance, and manufacturing errors, or
• Events external to the system or to the airplane.
B.1.6.1 Zonal Safety Analysis (ZSA).
The objective of zonal safety analysis is to ensure that equipment installations within each zone of the airplane meet an adequate safety standard with respect to design and installation standards, interference between systems, and maintenance errors. The analysis also needs to consider the risk that various installers may make with decisions regarding routing, supporting a harness, clearances, etc. In those areas of the airplane where multiple systems and components are installed in close proximity, it should be ensured that the zonal safety analysis identifies any failure or malfunction, which by itself is considered sustainable, but could have more severe effects by adversely affecting other adjacent systems or components.
