Hazard function

In contrast, two or more unique operator actions should be required to start any potentially hazardous function or sequence of functions. Hazardous actions should be designed to minimize the potential for inadvertent activation they should not, for example, be initiated by pushing a single key or button (see the preceding discussion of incremental control). 

The Level 4 SSA is at the aircraft level and is the responsibihty of the aircraft integrator. For a modification (e.g. STC), it is scoped to consider the performance of the new system as well as the interaction between all affected aircraft systems. Safety requirements are functionally decomposed in a hierarchical structure from product (i.e. aircraft) level to subsystem (e.g. altitude display system) to components (e.g. Altitude Display Unit). At Level 4 the safety requirements are those requirements generated from the aireraft Functional Hazard Analysis (FHA) based on required aircraft functions... 

The functional approach stems from the fact that any system (or item) is merely the embodiment of a set of functions. A Functional Hazard Analysis (FHA) is a systematic, comprehensive top-down examination of each function of the system to consider the effects and probability of a functional failure, malfunction and/or normal response to unusual or abnormal external factors [AMC25.1309 para lOb(l)]. 

Step 1 define the scope of the Functional Hazard Analysis... 

Identification of functions (and the compilation of the functional tree) is further complicated by the fact that the preliminary FHA considers only functional hazards and, when issued, often receives criticism for hazards not yet identified (but which will be once hazard identification techniques such as the ZSA, CCA and PRA are employed) to the maturing design. 

It addresses only functional hazards. The determination of the hazard severity level does not attempt to account for the system failures necessary for its occurrence it only seeks to determine the appropriate limits for probability of occurrence for a given hazard. 

Wilkinson, P.J., Kelly, T.P., 2005. Functional Hazard Analysis for Highly Integrated Systems, (A Paper on FHA Application on an Engine Controller). University of York. 

Scharl, A., Stottlar, K., Kady, R. Functional Hazard Analysis (FHA Methodological Tutorial. In International System Safety Training Symposium (August 4—8, 2014), NSWCDD-MP-14-00380, St. Louis, Missouri, http //issc2014.system-safety.org/83 Functional Hazard Analysis Common% 20Process.pdf. 

Prove the accomplishment of Functional Hazard Analysis (FHA) safety targets ... 

In most civil aviation System Safety Assessments, this event originates from a Function Hazard Analysis (FHA, see Chapter 3), but it can also come from any other hazard identification technique (e.g. ZS A or PRA). An FTA is a deductive approach (i.e. top down) that determines how a given state (i.e. the undesired event) can occur. It does not identify all failures in a system in a way that inductive tproaches (such as an FMEA) would. 

Although system architectural features (e.g., redundancy, monitoring and partitioning) are used to help prove the safety objectives set in the Functional Hazard Analysis (see Table 3.3), it is practically impossible to guarantee the correctness and completeness of requirements definition or design implementation. 

This step involves the Safety Engineer highlighting to the Test Pilot and/or the HF Specialist all failure conditions identified via techniques such as the Functional Hazard Analysis (FHA) (Chapter 3), Failure Modes and Effects Analysis (EMEA) (Chapter 5), Common Mode Analysis (CMA) (Chapter 6), Particular Risk Analysis (PRA) (Chapter 7) and Zonal Safety Analysis (ZSA) (Chapter 8). 

For the Operator If we look at the Functional Hazard Analysis (Chapter 3), the Hazard Log entry might be Loss of Situational Awareness , of which the Altitude Display System is but one contributory cause. 

Functional Hazard Analysis A Functional Hazard Analysis (FHA) is defined [SAE ARP4761 para 3.2] as a systematic, comprehensive examination of a system s functions to identify and classify potential Failure Conditions which the system can cause or contribute to, not only if it malfunctions or fails to function, but also in its normal response to unusual or abnormal external factors. 

The fault hazard analysis (FHA)—also referred to as the functional hazard analysis—method follows an inductive reasoning approach to problem solving in that the analysis concentrates primarily on the specific and moves toward the general (TAI 1989). The FHA is an expansion of the FMEA (Stephenson 1991). As demonstrated in the previous chapter, the FMEA is concerned with the critical examination and documentation of the possible ways in which a system component, circuit, or piece of hardware may fail and the effect of that failure on the performance of that element. The FHA takes this evaluation a step further by determining the effect of such failures on the system, the subsystem, or personnel. In fact, when a FMEA has already been completed for a given system and information on the adverse safety effect of component or human failures is desired for that system, the safety engineer can often utilize the data from the FMEA as an input to the FHA. 

The FHA process usually begins with the establishment of a list of system or subsystem functions. Hazards are then postulated on the basis of the failure and/or likelihood of failure of each function. Then, the overall probable effect of the hazard on the system and those operating it (i.e., people) is derived. Once identified, this overall probable effect is known as the failure condition. The severity of the failure condition is assessed and a hazard severity classification is assigned to it. This severity class will determine the maximum allowable probability for each failure condition. In extremely critical systems or operations, such as an elevator braking device/system or materials-handling operations, for example, very low maximum allowable probabilities identified in an FHA will mandate the prohibition of single-point failures. 

A conprehensive product release process ensures that products are very mamre when released. Parallel to the comprehensive quality management process the safety process starts with general safety requirements which are checked for applicability and allocated to the project respectively. It continues with several tasks like performance of an Functional Hazard Assessment, production of an hardware RAM Modelling and Prediction Report and a Failure Modes, Effects and Criticality Analysis for a typical configuration and the use of the previously mentioned hazard checklist. Finally all issues of the product release checklist are to be fulfilled to get the official release. 

---