Here's what that means in practice — Page 41, Lesson 63

I want to walk you through the heart of how we actually prove an aeroplane's systems are safe enough to certify. This is the System Safety Assessment, and it's governed by a rule called CS 25.1309(b). Let's start with the big idea: the depth of the work you do will depend on many factors, and the two biggest ones are the degree of systems complexity and the degree of integration. Here's what that means in practice. If you're dealing with an aeroplane that has many complex or integrated systems, it's likely you'll need to develop a formal plan that describes the intended process. This isn't optional paperwork — it's a structured way to show the regulator exactly how you intend to prove safety. That plan should include three specific aspects. First, the functional and physical interrelationships of systems. That means you must map out how each system talks to the others and how they're physically connected. Second, the determination of detailed means of compliance, which may include the use of Development Assurance techniques. Third, the means for establishing the accomplishment of the plan — in other words, how you'll prove that you actually did what the plan said you would do. Now, let's talk about industry standards. There are a variety of acceptable techniques currently being used in industry. Some of these may or may not be reflected in the documents referenced in paragraphs 3b(3) and 3b(4). Here's the key point: this AMC — that's the Acceptable Means of Compliance — is not intended to compel you to use those documents. You're not forced to follow them. However, those documents do contain material and methods for performing the System Safety Assessment. When correctly applied, those methods are recognised by the Agency — that's the European Aviation Safety Agency — as valid for showing compliance with CS 25.1309(b). And the document in paragraph 3b(4) contains tutorial information on applying specific engineering methods, such as Markov Analysis and Fault Tree Analysis, which may be utilised in whole or in part. Let me pause on those two methods, because they're important tools. Markov Analysis is a way of modelling a system's behaviour over time, looking at the probability of transitioning between different states. Fault Tree Analysis is a top-down approach where you start with an undesired event and work backwards to identify all the combinations of failures that could cause it. Both are recognised ways to quantify safety. Now, the fourth aspect: acceptable application of Development Assurance methods. This is where things get really interesting. Paragraph 9b(1)(iii) requires that any analysis necessary to show compliance with CS 25.1309(b) must consider the possibility of three specific types of errors: requirement errors, design errors, and implementation errors. Here's the traditional approach. Errors made during design and development have historically been detected and corrected by exhaustive tests conducted on the system and its components, by direct inspection, and by other direct verification methods capable of completely characterising the performance of the system. That phrase "completely characterising" is crucial — it means you can test every possible state and behaviour of the system. Now, here's the catch. Those direct techniques may still be appropriate for simple systems — systems that perform a limited number of functions and are not highly integrated with other aeroplane systems. But for more complex or integrated systems, exhaustive testing may either be impossible, because all of the system states cannot be determined, or impractical, because of the number of tests which must be accomplished. Think about a modern fly-by-wire system with millions of possible states — you simply cannot test them all. So for these types of systems, compliance may be shown by the use of Development Assurance. And here's the critical principle that ties everything together: the level of Development Assurance should be determined by the severity of potential effects on the aeroplane in case of system malfunctions or loss of functions. That's the link between how much rigour you need and how bad the consequences could be. A system whose failure could cause a catastrophic outcome demands a much higher level of Development Assurance than one whose failure is merely annoying. Let me bring this together. The whole philosophy is a balance between probability and severity of failure conditions. The more severe the potential effect, the more rigorous your assurance must be. And the more complex and integrated the system, the more you'll need to rely on structured Development Assurance rather than exhaustive testing. That's the professional framework you'll be working within every time you certify a system.