Appendix A Safety Assessment

A1 General This section provides material that may be useful in supporting the safety assessment activities identified in Section 13. A2 Identification of Failure Conditions The following “failures” should be considered for applicability when establishing Failure Conditions as indicated in Section 13: Loss of autopilot in single or multiple axes Loss of guidance in single or multiple axes Loss of thrust control Partial loss or degradation of autopilot function A failure resulting in unintended autopilot commands in a single axis or multiple axes simultaneously (e.g., hardover, slowover, and oscillatory failure modes) A failure resulting in unintended guidance commands in a single axis or multiple axes A failure resulting in unintended thrust control A sustained out-of-trim condition with the autopilot engaged without a warning An autopilot disengagement in an out-of-trim condition Autopilot disengagement without a warning Inability to disengage the autopilot or autothrust function Un-commanded engagement of an autopilot or autothrust Jamming or loading of primary flight controls Un-intended thrust asymmetry A typical Failure Condition statement may be of the form: ‘{Failure}’ during ‘{Phase of Flight}’ that ‘{Effect}’ when ‘{Mitigation Consideration}’ Failure Conditions may result from failures within the FGS or from failure associated with aircraft interfacing systems or components (e.g., navigation receivers, attitude heading reference systems, flight management systems, hydraulics, electrical systems, etc.). A3 Considerations when Assessing the Severity of Failure Condition Effects The Failure Condition definition is complete (as defined in AMC 25.1309) when the effects resulting from “failure” are identified. A complete definition of the Failure Condition and its effect will then support the subsequent Failure Condition classification. When assessing the effect that results from a failure, the following items should be considered for various phases of flight: The impact of the loss of control, or unintended control, on the structural integrity of the aeroplane as a result of simple loading or as a result of excitation of aerodynamic or structural modes, both at the time of occurrence and while the flight continues. Implications of the aeroplane response in terms of attitude, speed, accelerations, flight path, and the impact on the occupants and on flight crew performance. Degradation in the stability or other flying qualities of the aeroplane. The duration of the condition. The aircraft configuration. The aircraft motion cues that will be used by the flight crew for recognition. Availability, level, and type of alerting provided to the flight crew. Expected flight crew corrective action on detection of the failure. Failure Conditions may include the following characteristics: “Hardover” effects - typically considered to significant and are readily detectable by the flight crew based on the resulting aircraft motion or guidance cues. “Slowover” effects - typically not readily detected by the flight crew. The effect may involve departures from intended flight path that are not initially detectable by aircraft motion alone, and may only be detectable by motion cues when a significant flight path deviation has occurred or by the provision of an appropriate flight crew alert. “Oscillatory” effects – typically a repetitive motion or guidance condition not related to intended guidance or control. The magnitude, period and duration of the condition and any mitigation considerations will determine the final effect. “Loss of” effects – typically the removal of control, guidance or functionality that may have an immediate effect or may not be immediately apparent to the flight crew. Section 14 provides guidance on crew recognition considerations. A4 Failure Condition Classification The following are examples of the type of Failure Condition effects that have been identified in previous aeroplane certification programs. The specific number and type of Failure Condition may vary with aeroplane type, aeroplane system architecture and FGS system design philosophy (e.g., failure detection, redundancy management, failure annunciation, etc.). A4.1 Catastrophic Failure Conditions The following effects have been assessed Catastrophic in previous aeroplane certification programs: A load on any part of the primary structure sufficient to cause a structural failure preventing safe flight and landing (Refer to CS 25.302). Unrecoverable loss of flight path control. Exceedance of VDF/MDF. Flutter or vibration that causes a structural failure preventing safe flight and landing (Refer to CS 25.302). A temporary loss of control (e.g., stall) where the flight crew is unable to prevent contact with obstacles or terrain. Deviations in flight path from which the flight crew are unable to prevent contact with obstacles, terrain, or other aircraft.

A4.2 Hazardous Failure Conditions The following effects have been assessed Hazardous in previous aeroplane certification programs: Exceedance of airspeed halfway between VMO and VDF or a Mach number halfway between MMO and MDF. A stall, even if the flight crew is able to recover safe flight path control. A load factor less than zero. Bank angles of more than 60 degrees en route or more than 30 degrees below a height of 300 m (1000 ft). above an applicable airport elevation. Degradation of the flying qualities of the aeroplane that excessively increases flight crew workload. Failure that could result in a RTO and high speed overrun (e.g., 110 km/h (60 kt)). A flight path deviation that requires a severe manoeuvre to prevent contact with obstacle, terrain or other aircraft. NOTE: Severe manoeuvre includes risk of serious injury or death of a small number of occupants. A4.3 Major Failure Conditions The following effects have been assessed Major in previous aeroplane certification programs: A flight path deviation, a required recovery manoeuvre, which may result in passenger injuries (e.g., consideration should be given to phases of flight where the occupants may reasonably be moving about the aeroplane or be serving or consuming hot drinks). Degradation of the flying qualities of the aeroplane that significantly increase flight crew workload.

[Amdt 25/4]