ASTM F3230-17

Standard Practice for Safety Assessment of Systems and Equipment in Small Aircraft

SCOPE
1.1 This practice covers internationally accepted methods for conducting safety assessments of systems and equipment for “small” aircraft.  
1.2 The applicant for a design approval must seek the individual guidance of their respective CAA body concerning the use of this practice as part of a certification plan. For information on which CAA regulatory bodies have accepted this practice (in whole or in part) as a means of compliance to their Small Aircraft Airworthiness regulations (hereinafter referred to as “the Rules”), refer to ASTM F44 webpage (www.ASTM.org/COMMITTEE/F44.htm) which includes CAA website links.  
1.3 This standard does not purport to address all of the safety concerns, if any, associated with its use. It is the responsibility of the user of this standard to establish appropriate safety and health practices and determine the applicability of regulatory limitations prior to use.

General Information

• Status: Historical
• Publication Date: 14-Feb-2017
• ICS: 49.020 - Aircraft and space vehicles in general
• Technical Committee: F44 - General Aviation Aircraft
• Drafting Committee: F44.50 - Systems and Equipment

Standards Content (Sample)

NOTICE: This standard has either been superseded and replaced by a new version or withdrawn.
Contact ASTM International (www.astm.org) for the latest information
Designation: F3230 − 17
Standard Practice for
Safety Assessment of Systems and Equipment in Small
Aircraft
This standard is issued under the fixed designation F3230; the number immediately following the designation indicates the year of
original adoption or, in the case of revision, the year of last revision.Anumber in parentheses indicates the year of last reapproval.A
superscript epsilon (´) indicates an editorial change since the last revision or reapproval.
1. Scope 2.3 SAE Standards:
SAE ARP4761Guidelines and Methods for Conducting the
1.1 This practice covers internationally accepted methods
SafetyAssessmentProcessonCivilAirborneSystemsand
for conducting safety assessments of systems and equipment
Equipment
for “small” aircraft.
3. Terminology
1.2 The applicant for a design approval must seek the
individual guidance of their respective CAA body concerning 3.1 Terminology specific to this practice is provided below.
For general terminology, refer to Terminology F3060.
the use of this practice as part of a certification plan. For
information on which CAA regulatory bodies have accepted
3.2 Definitions of Terms Specific to This Standard:
this practice (in whole or in part) as a means of compliance to
3.2.1 aircraft type code, n—anAircraftType Code (ATC) is
their Small Aircraft Airworthiness regulations (hereinafter
defined by considering both the technical considerations re-
referred to as “the Rules”), refer to ASTM F44 webpage garding the design of the aircraft and the airworthiness level
established based upon risk-based criteria; the method of
(www.ASTM.org/COMMITTEE/F44.htm) which includes
defining an ATC applicable to this practice is defined in
CAA website links.
Specification F3061/F3061M.
1.3 This standard does not purport to address all of the
3.2.2 Catastrophic Failure Condition, n—a Catastrophic
safety concerns, if any, associated with its use. It is the
Failure Condition is one that would result in multiple fatalities
responsibility of the user of this standard to establish appro-
of the occupants, or incapacitation or fatal injury to a flight
priate safety and health practices and determine the applica-
crew member, normally with the loss of the aircraft.
bility of regulatory limitations prior to use.
3.2.3 complex system, n—a complex system is a system
whoseoperation,failuremodes,orfailureeffectsaredifficultto
2. Referenced Documents
comprehendwithouttheaidofanalyticalmethodsorstructured
2.1 Following is a list of external standards referenced
assessmentmethods,suchasFailureModesandEffectsAnaly-
throughoutthispractice;theearliestrevisionacceptableforuse
sis (FMEA) or Fault Tree Analysis (FTA); increased system
is indicated. In all cases later document revisions are accept-
complexity is often caused by such items as sophisticated
able if shown to be equivalent to the listed revision, or if
components and multiple interrelationships.
otherwise formally accepted by the governing civil aviation
3.2.4 conventional system, n—a conventional system is a
authority; earlier revisions are not acceptable.
system whose function, the technological means to implement
2.2 ASTM Standards: its function, and its intended usage are all the same as, or
F3060Terminology for Aircraft closely similar to, that of previously approved systems that are
F3061/F3061MSpecification for Systems and Equipment in commonly used.
Small Aircraft
3.2.5 design appraisal, n—adesignappraisalisaqualitative
appraisal of the integrity and safety of the system design; an
effective appraisal requires experienced judgment.
This practice is under the jurisdiction of ASTM Committee F44 on General
3.2.6 extremely improbable, n—extremely improbable
Aviation Aircraft and is the direct responsibility of Subcommittee F44.50 on
means that an event is considered so unlikely that it is not
Systems and Equipment.
anticipated to occur during the entire operational life of all
Current edition approved Feb. 15, 2017. Published March 2017. DOI: 10.1520/
aircraft of one type.
F3230-17.
For referenced ASTM standards, visit the ASTM website, www.astm.org, or
contact ASTM Customer Service at [e-mail]. For Annual Book of ASTM
Standards volume information, refer to the standard’s Document Summary page on AvailablefromSAEInternational(SAE),400CommonwealthDr.,Warrendale,
the ASTM website. PA 15096, http://www.sae.org.
Copyright © ASTM International, 100 Barr Harbor Drive, PO Box C700, West Conshohocken, PA 19428-2959. United States
F3230 − 17
3.2.7 extremely remote, n—extremely remote means that an 3.2.17 redundancy, n—the term redundancy refers to the
event is not anticipated to occur to each aircraft during its total presence of more than one independent means for accomplish-
life, but may occur a few times when considering the total ingagivenfunction;eachmeansofaccomplishingthefunction
operational life of all aircraft of the type. need not be identical.
3.2.18 remote, n—remote means that the event is not antici-
3.2.8 failure condition, n—a failure condition is a condition
pated to occur at each aircraft during its total life, but may
having an effect on the aircraft or its occupants or both, either
occur several times when considering the total operational life
direct or consequential, which is caused or contributed to by
of all aircraft of the type.
one or more failures or errors; the severity of a failure
condition may be affected by flight phase, relevant adverse
3.2.19 similarity, n—thetermsimilarityreferstoacondition
operational or environmental conditions, or other external
where the equipment type, form, function, design, and instal-
events, or combinations thereof.
lation have only minor differences to previously approved
equipment.Thesafetyandoperationalcharacteristicsandother
3.2.9 Hazardous Failure Condition—a Hazardous Failure
qualities of the new installation should have no appreciable
Conditionisonethatwouldreducethecapabilityoftheaircraft
effects on the airworthiness of the aircraft.
or the ability of the crew to cope with adverse operating
3.2.20 simple system, n—a simple system is a system that
conditions to the extent that there would be: a large reduction
can be evaluated by only qualitative analysis and that is not a
insafetymarginsorfunctionalcapabilities;physicaldistressor
complex system; functional performance is determined by
excessive workload such that the flight crew cannot be relied
combination of tests and analyses.
upon to perform their tasks accurately or completely; or,
serious or fatal injuries to a relatively small number of persons
3.2.21 single failure, n—a single failure is considered to be
other than the flight crew.
anyoccurrence,orsetofoccurrences,that:cannotbeshownto
be independent from each other; affects the operation of
3.2.10 installation appraisal, n—an installation appraisal is
components, parts, or elements of a system such that they can
a qualitative appraisal of the integrity and safety of the
nolongerfunctionasintended;or,resultsininadvertentsystem
installation; any deviations from normal industry-accepted
operation.
installation practices should be evaluated.
4. Basic Information
3.2.11 Major Failure Condition, n—a Major Failure Condi-
NOTE 1—Table 1 provides correlation between various Aircraft Type
tionisonethatwouldreducethecapabilityoftheaircraftorthe
Codesandtheindividualrequirementscontainedwithinthissection;refer
ability of the flight crew to cope with adverse operating
to 3.2.1. For each subsection, an indicator can be found under each ATC
conditions to the extent that there would be: a significant
character field; three indicators are used:
reductioninsafetymarginsorfunctionalcapabilities;asignifi- An empty cell ( ) in all applicable ATC character field columns
indicates that an aircraft must meet the requirements of that subsection.
cantincreaseinflightcrewworkloadorinconditionsimpairing
A white circle (○) in multiple columns indicates that the requirements
the efficiency of the flight crew; discomfort to the flight crew;
of that subsection are not applicable to an aircraft only if all such ATC
or, physical distress to passengers or cabin crew, possibly
character fields are applicable.
including injuries.
A mark-out (×) in any of the applicable ATC character field columns
indicates that the requirements of that subsection are not applicable to an
3.2.12 Minor Failure Condition, n—a Minor Failure Con-
aircraft if that ATC character field is applicable.
dition is one that would not significantly reduce aircraft safety,
Example—AnaircraftwithanATCof1SRLLDLNisbeingconsidered.
and which involves crew actions that are well within their
Since all applicable columns are empty for 4.1, that subsection is
applicable to the aircraft. Since the “1” airworthiness level column, the
capabilities; Minor Failure Conditions may include: a slight
“L” stall speed column, and the “D” meteorological column for 4.2.1 all
reduction in safety margins or functional capabilities; a slight
contain white circles, then that subsection is not applicable; however, for
increase in crew workload, such as routine flight plan changes;
an aircraft with anATC of 1SRMLDLN, 4.2.1 would be applicable since
or, some physical discomfort to passengers or cabin crew.
the “M” stall speed column does not contain a white circle.
4.1 Failure Condition Classification—An assessment of the
3.2.13 Negligible Failure Condition, n—a Negligible Fail-
ure Condition is one that would have no procedural or aircraftandsystemfunctionsmustbeperformedtoidentifyand
classify the various failure conditions associated with each
operational effect on the flight crew so as to interfere with the
reliable performance of published and trained duties, or on the function; refer to 3.2.8 and Table 2. A Functional Hazard
operationorcapabilitiesoftheaircraft;however,theeventmay Assessment (FHA) in accordance with the methodology out-
result in an inconvenience to aircraft occupants. lined in SAE ARP4761 is one means of performing this
assessment; however, other simpler methodologies (for
3.2.14 probable, n—probable means that the event is antici-
example,adesignandinstallationappraisal)maybeemployed
pated to occur one or more times during the entire operational
as appropriate to the complexity and criticality of the sys-
life of each aircraft.
tem(s).
3.2.15 qualitative analysis, n—a qualitative analysis relies
4.2 Classification-Based Analyses—Based on the results of
onanalyticalprocessesthatassesssystemandaircraftsafetyin
the assessment per 4.1, the depth of analysis required to show
an objective, non-numerical manner.
compliance may be determined using Fig. 1 and the Assess-
3.2.16 quantitative analysis, n—a quantitative analysis re- ment Levels defined in Table 3.
liesonanalyticalprocessesthatapplymathematicalmethodsto 4.2.1 In showing compliance with the provisions of 4.2, for
assess the system and aircraft safety. Negligible Failure Conditions (refer to 3.2.13), a design and
F3230 − 17
TABLE 1 ATC Compliance Matrix, Section 4
Airworthiness Level Number of Type of Stall Speed Cruise Meteorological Altitude Maneuvers
Engines Engine(s) Speed Conditions
Section
12 34 S M R T L M H L H D N I L H N A
4.1
4.2CC C
4.2.1CC C
4.2.2CC C
4.2.3CC C
4.2.3.1CC C
4.2.3.2CC C
4.2.3.3CC C
4.2.3.4CC C
4.2.4CC C
4.2.4.1CC C
4.2.4.2CC C
4.2.4.3CC C
4.2.5CC C
TABLE 2 Failure Condition Classifications
Classification of Failure Conditions
A A A A A
Negligible Minor Major Hazardous Catastrophic
Effect on Aircraft No effect on Slight reduction in Significant reduction Large reduction in Normally with hull
operational functional in functional functional loss
capabilities or safety capabilities or safety capabilities or safety capabilities or safety
margins margins margins
Effect on Occupants Inconvenience for Physical discomfort Physical distress to Serious or fatal Multiple fatalities
Classification passengers for passengers passengers, injury to an
Considerations possibly including occupant
injuries
Effect on Flight No effect on flight Slight increase in Physical discomfort Physical distress or Fatal injury or
Crew crew workload or use of or a significant excessive workload incapacitation
emergency increase in impairs ability to
procedures workload perform tasks
A
Refer to Section 3.
installation appraisal to establish independence from other history of either the equipment being analyzed or of a similar
functions is necessary for the safety assessment. In general, design is usually acceptable for showing compliance. It is the
common design practice provides physical and functional applicant’s responsibility to provide data that: is accepted,
isolation from related components which are essential to safe
approved, or both; and, supports any claims of similarity to a
operation.
previous installation.
4.2.2 In showing compliance with the provisions of 4.2, for
4.2.3.2 For systems that are not complex, and where simi-
Minor Failure Conditions (refer to 3.2.12), a design and
larity arguments cannot be used, “qualitative occurrence argu-
installation appraisal to establish independence from other
ments”maybepresentedtodemonstratethattheMajorFailure
functions is necessary for the safety assessment.This appraisal
Conditions of the system, as installed, are consistent with the
should consider the effects of system failures on other systems
requirements of Table 4; for example, redundant systems may
and their functions. In general, common design practice
qualify for this approach.
provides physical and functional isolation from related com-
4.2.3.3 For systems that are complex and possess low
ponents which are essential to safe operation.
redundancy (for example, a system with a self-monitoring
4.2.3 In showing compliance with the provisions of 4.2, for
microprocessor), a qualitative functional Fault Tree Analysis
Major Failure Conditions (refer to 3.2.11), a qualitative analy-
(FTA) or Failure Modes and Effects Analysis (FMEA) sup-
sis (refer to 3.2.15) must be performed to determine compli-
portedbyfailureratedataandfaultdetectioncoverageanalysis
ance with the requirements of Table 4; in certain
must be presented to demonstrate that the Major Failure
circumstances, a quantitative analysis (refer to 3.2.16) may
Conditions of the system, as installed, are consistent with the
also be required. There are several methods of performing a
requirements of Table 4.
valid qualitative analysis.
4.2.3.4 A Qualitative Analysis of a redundant system is
4.2.3.1 A “similarity argument” allows validation of a
usually complete if it shows isolation between redundant
requirement by comparison to the requirements of similar
system channels and satisfactory reliability for each channel.
certified systems. A similarity argument gains strength as the
Forcomple
...