In-flight upset - 154 km west of Learmonth, WA, 7 October 2008,

2.4.5 Safety assessment activitiesGeneral processThe safety assessment activities conducted by manufacturers when developingaircraft systems occur in three phases 106 :• Functional hazard assessment (FHA). The FHA identifies the failure conditionsassociated with a system that could have repercussions at the aircraft level. 107More specifically, it identifies the functions of the system and the failureconditions for each of the functions 108 , determines the adverse effects of eachfailure condition, and classifies the level of the effects (that is, catastrophic,hazardous, major, or minor). Based on these results, the FHA generates safetyrequirements in terms of the maximum allowed probability of the failurecondition (for example, a hazardous failure condition should not occur at aprobability higher than ‘extremely remote’, see section 2.3.3).• Preliminary system safety assessment (PSSA). The PSSA evaluates theproposed system design and determines how failures within the existing designcould lead to the failure conditions, and whether the FHA’s probability-basedsafety requirements can be met by the proposed design. Additional requirementscould be introduced to ensure the safety requirements will be met.• System safety assessment (SSA). The SSA is a systematic examination of thesystem, its architecture and installation. It summarises all of the significantfailure conditions and their effects on the aircraft, and is based on the FHA andPSSA. Whereas the PSSA is conducted to derive design requirements anddetermine whether the system design could reasonably be expected to meet therequirements, the SSA is conducted to demonstrate that the safety requirementshave been met. Results of simulation and testing activities conducted forverification and validation purposes are also included in the SSA where relevant.A key part of the PSSA is the use of fault tree analysis 109 or other similar top-downmethods for identifying the failure scenarios, or combinations of failures and/orother factors, that could lead to each of the failure conditions. Where quantitativeestimates of failures are derived, a fault tree analysis is also used to determinewhether the relevant probability-based safety requirements can be met. In additionto a top-down approach, a bottom-up approach is also used to determine howequipment failures could potentially lead to the failure conditions of concern. This106A detailed description of the three phases is provided in ARP4761, released in December 1995(section 2.6.2).107A FHA is firstly done at the aircraft level. Based on this analysis, decisions are made regarding therequired aircraft systems. The results of the aircraft-level FHA flow down to the system-levelFHA.108In a FHA, failure conditions were generally described in terms of basic ways in which the functionmay not be adequately performed. Typical examples were loss of function, undetected loss offunction, function not performed when required, or malfunction (function not performedcorrectly).109Fault tree analysis is a very widely used top-down method for determining system reliability inmany industries. It involves reasoning backwards from a specific event (known as a ‘top event’) tothe combinations of factors that can lead to that event, and representing these factors in a graphicalformat. It often involves determining the overall probabilities that the top event will occur. Furtherdetails are provided in NASA (2002) and ARP 4761.- 93 -