Altitude display

A System is A combination of inter-related items arranged to perform a specific function (ARP5754A, pl3). An example would be the Altitude display system (refer Section 4). 

The Level 4 SSA is at the aircraft level and is the responsibihty of the aircraft integrator. For a modification (e.g. STC), it is scoped to consider the performance of the new system as well as the interaction between all affected aircraft systems. Safety requirements are functionally decomposed in a hierarchical structure from product (i.e. aircraft) level to subsystem (e.g. altitude display system) to components (e.g. Altitude Display Unit). At Level 4 the safety requirements are those requirements generated from the aireraft Functional Hazard Analysis (FHA) based on required aircraft functions... 

This case study will consider only the functional requirements for providing barometric altitude readings in the upgraded system. Barometric (or pressure) altitude is used to determine Fhght Level and is based on a standard air-pressure datum. As detailed in Chapter 1, altitude is displayed on the pilot and co-pilot Primary Flight Display (PFD) and on the standby flight instrument. We will consider here only those requirements for display of primary barometric altitude display on each PFD. 

Reliability Fault Tree Analysis for loss of primary barometric altitude display (annunciated)... 

Event 3 As each DCU receives air data from both AlXl, a simultaneous loss of both ADC outputs must occur. In this case study, ADCl determines barometric pressure data from the port static port, while ADC2 uses the starboard static port (see Fig. 1.7 in Chapter 1). Problems with these inputs have not been considered to result in an annunciated loss of altitude display, as it is more likely that misleading data would be fed to the PFDs (unless data are out of bounds resulting in an error being raised). Hence, these inputs are considered only in the FTA for 4.1.1. c. 1. 

Each of these events represents a separate OR branch for loss of primary barometric altitude display. The FTA in Fig. 4.2 is proposed to represent the way these three events contribute to the top-level functional failure condition. Within the scope (see Step 1) of this assessment, each event was developed further by considering the LRUs involved and their data and power inputs, where applicable. 

Event 1 Loss of primary barometric altitude display (annunciated) FDAL B Event 2 Loss of DCU1 and DCU2 FDALB Event 3 Loss of ADC1 and ADC2... 

In Section 1.3, we defined a case study for an upgraded Attitude and Altitude Display System. One branch of the Safety Strategy of Fig. 2.4 is repeated in Fig. 5.3. 

As this case study is required to support a CS25.1309 safety assessment, it is suggested that a Functional FMEA at the system integration level (i.e. Level 3 in Fig. 1.1) would be more appropriate than a piece-part FMEA at the component level. ° This Functional FMEA will have the objective of searching for single failure conditions in the Barometric Altitude Display System which might cause a catastrophic failure at the aircraft level (i.e. Level 4 in Fig. 1.1). 

In Table 5.10 we identify the effect of the failure on the component (in column 7), then the effect on the Barometric Altitude Display System (column 8), and finally the effect at the aircraft level (column 9). Note in column 9 that we have elected to use the severity descriptor from Table 3.3 as it facilitates severity allocation in column 10. 

Table 5.10 Functional FMEA for the Barometric Altitude Display System ... 

Objective Find sii le source catastrophic feilures in the barometric altitude display system... 

In Chapter 2 we defined a case study for the upgraded Attitude and Altitude Display System in which one safety argument (i.e. Strategy S7) in Fig. 2.4 looked as shown in Fig. 6.2. 

In Chapter 2 we defined a case study for the upgraded Attitude and Altitude Display... 

With reference to Section 9.2.22, this is where we ensure that the integrated altitude display system has requirements allocated to each level of abstraction (refer to Fig. 1.3). 

With reference to Figs 1.8 and 1.9, if we specifically look at the components making up the altitude display system, then we will probably find that the PFD is an ETSO item (see ETSO-ClOb). If we then purchase an item with ETSO approval, we do need to tailor our requirements allocation approach by considering three aspects ... 

System FHA ID4.1.1a Loss of Primary Barometric Altitude Display (annunciated) Hazardous Extremely Remote None... 

System FHA ID4.1.1a Barometric Altitude Display Incorrect functioning (un-annundated) Catastrophic Extremely Improbable Although this failure mode is Extremely Improba ble, there is nevertheless a probability of its occurrence... 

Comparison with standby Altitude display EGPWS alert Pilots may believe misleading instrument Catastrophic 2x10-2 2 pilots, each having a general omission error probability of 1 X 10-2. Refer Table 10.1 TBD - To be compiled Note that one primary display receives pitot static data from same source as the standby display, so ensure pilots are able to diagnose correctly. Open... 

During the Safety Assessment process, various assumptions might have been made (e.g. MTBF as well as how the equipment will be operated and maintained) hazardous failure conditions would have been identified (e.g. loss of Altitude Display might be Extremely Improbable , but is still possible) and procedures would be prescribed to mitigate risks for through life safety (i.e. how to deal with failure scenarios when they do occur). 

For the Operator If we look at the Functional Hazard Analysis (Chapter 3), the Hazard Log entry might be Loss of Situational Awareness , of which the Altitude Display System is but one contributory cause. 

Functional safety. This is part of the overall safety that depends on the system or equipment under consideration operating correctly in response to its inputs. It considers functional hazards caused by loss of intended function, malfunction, response time/accuracy, etc. Systems may be safe in one application, but unsafe in another (e.g. consider loss of altitude display during a clear day, versus the same failure under instrument meteorological conditions (IMCs). Functional safety is strongly connected to system performance and its reliability. 

An example qualitative statement Software error in the altitude display could present a catastrophic situation and shall have a Development Assurance Level A. ... 

An operator may require a contractor to install and certify the installation of a single standby instrument (for attitude, airspeed and altitude display). 

---