11/17/2011 AC 23.1309-1EAppendix 1APPENDIX 1.PARTIAL LIST OF FUNCTIONAL HAZARD ASSESSMENT (FHA) FOR CONSIDERATIONTO MEET 14 CFR PART 23 REQUIREMENTS FOR IFR CLASS I AIRPLANES*Note: This table is only intended to be a guide and is nota certification checklist since it may not include all the information necessary for an FHA on part 23 IFR Class Iairplanes with its various functions and itsintended use. This partial FHA does notreflect considerations needed to properlydevelop FHA. See paragraph 16 and its associatedsubparagraphs for more complete guidance. R =Reserved, intentionally left blank.A1-1AircraftFunctionClassification of Failure Conditions Analysis ConsiderationTotal Loss ofFunctionLoss of PrimaryMeans ofProvidingFunctionMisleadingand/orMalfunctionWithout WarningDisplay of attitudeinformation tocontrol roll andpitchCatastrophic Major Catastrophic For electronic displays, dual independent attitude systems generally meetrequirements for 14 CFR part 23, §§23.1301, 23.1309, & 23.1311 for airplaneswith less than 10 passengers and forconventional mechanical or analogelectromechanical systems. A singleattitude display meets 14 CFR part 91requirements to operate under IFR.If the certification basis includesAmendment 23-43 or later, two independent power sources are required by§ 23.1331. The requirement for two power sources in § 23.1331 are notapplicable for pitot-static pneumatic systems. Partial panel techniques may beused in some cases where it has been historically shown to be acceptable.Credit (mitigation) may be given for automatic flight control systems if thesystem can maintain stable attitude independent of the primary attitude display.Display ofdirectional headinginformationMajor Minor Major A hazardously misleading headingis usually when the accuracy error is greaterthan 10 degrees on the primary heading instrument and it is an undetected error.Assumes installation of a single stabilized heading system and only a nonstabilized magnetic compass to operateunder IFR for 14 CFR part 91. If thecertification basis includes Amendment 23-43 or later, two independent powersources are required by § 23.1331. Therequirement of two power sources of§ 23.1331 are not applicable for pitot-static pneumatic systems. Navigationassumed to be operating. See AC23-17C for additional information.11/17/2011 AC 23.1309-1EAppendix 1APPENDIX 1 (CONTINUED)*Note: This table is only intended to be a guide and is nota certification checklist since it may not include all the information necessary for an FHA on part 23 IFR Class Iairplanes with its various functions and itsintended use. This partial FHA does notreflect considerations needed to properlydevelop FHA. See paragraph 16 and its associatedsubparagraphs for more complete guidance. R =Reserved, intentionally left blank.A1-2AircraftFunctionClassification of Failure Conditions Analysis ConsiderationTotal Loss ofFunctionLoss of PrimaryMeans ofProvidingFunctionMisleadingand/orMalfunctionWithout WarningDisplay ofaltitudeinformationHazardous Minor Catastrophic For electronic displays, dual independent altitude systems generally meet requirementsfor 14 CFR part 23, §§ 23.1301, 23.1309, & 23.1311 and for conventional mechanical oranalog electromechanical systems. A single altitude display meets 14 CFR part 91requirements to operate under IFR. If thecertification basis includes Amendment 23-43or later, two independent power sources are required by § 23.1331. The requirement oftwo power sources of § 23.1331 are not applicable for pitot-static pneumatic systems.Existing single static systems that are heated have been historically acceptable based onsimilarity and may be used for programs thathave certification basis prior to Amendment23-42. If a single or dual air data computer isused, it must meet the requirements of thisAC with respect to safety and DAL.11/17/2011 AC 23.1309-1EAppendix 1APPENDIX 1 (CONTINUED)*Note: This table is only intended to be a guide and is nota certification checklist since it may not include all the information necessary for an FHA on part 23 IFR Class Iairplanes with its various functions and itsintended use. This partial FHA does notreflect considerations needed to properlydevelop FHA. See paragraph 16 and its associatedsubparagraphs for more complete guidance. R =Reserved, intentionally left blank.A1-3AircraftFunctionClassification of Failure Conditions Analysis ConsiderationTotal Loss ofFunctionLoss of PrimaryMeans ofProvidingFunctionMisleadingand/orMalfunctionWithout WarningDisplay of airspeedinformationMajor.May be Hazardousfor higherperformanceairplanes.Minor Major.May be hazardousor catastrophic forhigherperformanceairplanes.For electronic displays, dual independentairspeed systems generally meetrequirements for 14 CFR part 23,§§ 23.1301, 23.1309, & 23.1311 and forconventional mechanical or analog electromechanical systems. A single airspeeddisplay meets 14 CFR part 91 requirements to operate under IFR. If thecertification basis includes Amendment 23-43 or later, two independent powersources are required by § 23.1331. Thetwo power sources in § 23.1331 are notapplicable for pitot-static pneumatic systems. Classification is usually Major, ifoverspeed and underspeed airspeed alerting is acceptable (alerting may beprovided by inherent aerodynamic qualities or independent alerting system);otherwise, loss of function, malfunction, or misleading of information isHazardous. It may be catastrophic when combined with the loss of stall warningor overspeed warning functions. Assumes no vertical speed indicator. Existingsingle pitot static systems that are heated have been historically acceptable basedon similarity and may be used for programs that have certification basis prior toAmendment 23-42. If a single or dual air data computer is used, it must meet therequirements of this AC with respect to safety and DAL.Display of FlightPath VectorMinor R Major Providing the other normal cues remains for primary flight information, loss of thesensor should remove the flight path vector. The pilot should recognize it and useother displays. Misleading indication could cause the pilot to temporarilymaneuver the aircraft using erroneous guidance information.Display of rate-ofturn informationMinor Minor Minor Rate-of-turn display is generally required to operate under 14 CFR part 91 IFRrequirements unless a third attitude is installed. If the certification basis includesAmendment 23-43 or later, two independentpower sources are required. In IMC,misleading rate-of-turn information is consider to be Minor if there is a functionalattitude display.Display of slip-skidinformationMinor Minor Minor R11/17/2011 AC 23.1309-1EAppendix 1APPENDIX 1 (CONTINUED)*Note: This table is only intended to be a guide and is nota certification checklist since it may not include all the information necessary for an FHA on part 23 IFR Class Iairplanes with its various functions and itsintended use. This partial FHA does notreflect considerations needed to properlydevelop FHA. See paragraph 16 and its associatedsubparagraphs for more complete guidance. R =Reserved, intentionally left blank.A1-4AircraftFunctionClassification of Failure Conditions Analysis ConsiderationTotal Loss ofFunctionLoss of PrimaryMeans ofProvidingFunctionMisleadingand/orMalfunctionWithout WarningDisplay of timeinformationMinor Minor Minor RDisplay of primarynavigationinformationMajor Major.Minor, if twonavigationsystems areinstalled.Major for CAT IILS. Hazardous ormajor dependingon type of WAASoperations.Two navigation systems are generally installed to support navigation, but two are notrequired for 14 CFR part 91 operations. DualILS receivers below Category I limits arerequired with single antenna for part 91 operations. See AC 20-138B for more guidanceon WAAS operations.Display ofnavigationinformation on MFDMinorR Minor Pilot should cross check with the coursedeviation indicator and other navigation sources.Weather displays forsituation awarenessMinor Minor Minor Pilot is responsible to use standardprocedures. It is used for only strategic planning andoperation and is not intendedfor tactical maneuvering.Terrain Awarenessand WarningSystem(TAWS)Minor RMajor The loss of that system should be no greater than 10-3per average flight hour, and thepossibility of misleading information on the display due to undetected or latent failuresshould be no greater than 10-4per average flight hour. For a Class A TAWS, the softwaredevelopment assurance level should be at least to Level C as defined in RTCA DO-178Bor an acceptable alternative approved by the FAA. For Class B TAWS, the softwaredevelopment assurance level should be at least to Level D providing the required alertsand visual annunciations are independent of the terrain display(s). If the required alertsand visual annunciations are integrated on thedisplays, the DAL should be at least LevelC. NOTE: A terrain display is not mandatory for Class B equipment. See AC 23-18 formore information.11/17/2011 AC 23.1309-1EAppendix 1APPENDIX 1 (CONTINUED)*Note: This table is only intended to be a guide and is nota certification checklist since it may not include all the information necessary for an FHA on part 23 IFR Class Iairplanes with its various functions and itsintended use. This partial FHA does notreflect considerations needed to properlydevelop FHA. See paragraph 16 and its associatedsubparagraphs for more complete guidance. R =Reserved, intentionally left blank.A1-5AircraftFunctionClassification of Failure Conditions Analysis ConsiderationTotal Loss ofFunctionLoss of PrimaryMeans ofProvidingFunctionMisleadingand/orMalfunctionWithout WarningCommunication Minor.Total loss ofnavigation andcommunication isHazardous.Minor Major, if data link.Otherwise, Minor.Future installations may use data link for primary functions and voice for secondary.Traffic informationfor situationawarenessMinor Minor Minor to Majordepending on theintended functionof the alertwarning or cautionsignal.Pilot is responsible to use standard “see and avoid procedures”.Traffic information is notan approved substitute for traffic avoidance. See the applicable AC and TSO foradditional guidance.Mode A or CTransponderMinor R Minor to Majordepending on theintended functionof signals from thetransponder.Air traffic control may receive misleading orloss of airplane identification, or altitude,which increases their workload. An incorrect resolution advisory may increase pilotworkload in another aircraft. See the applicable AC and TSO for additional guidance.Display of radioaltitudeinformationMinor R Minor Not required for 14 CFR part 91 operations, Category I ILS. Loss of function may affectother equipment that depends upon radio altimeter.11/17/2011 AC 23.1309-1EAppendix 1APPENDIX 1 (CONTINUED)*Note: This table is only intended to be a guide and is nota certification checklist since it may not include all the information necessary for an FHA on part 23 IFR Class Iairplanes with its various functions and itsintended use. This partial FHA does notreflect considerations needed to properlydevelop FHA. See paragraph 16 and its associatedsubparagraphs for more complete guidance. R =Reserved, intentionally left blank.A1-6AircraftFunctionClassification of Failure Conditions Analysis ConsiderationTotal Loss ofFunctionLoss of PrimaryMeans ofProvidingFunctionMisleadingand/orMalfunctionWithout WarningDisplay of verticalspeed informationMinorR Minoror Major. Not required for most 14 CFR part91 operations. May be major classification whenrequired by the operational requirements ofparts 91 (Category II), 121, and 135 and it isconsidered required equipment essential to safe operation.Display of flightguidance commands(Category Ioperation)Minor R Major Not required for 14 CFR part 91 operations, Category I ILS. For Category II ILS, anautopilot or flight director is required.Minor for loss of flight guidance commands forCategory I operations providing the other normal cues remains for primary flightinformation. Loss of the sensor should remove the guidance command. The pilot shouldrecognize it and use other displays. Misleading indication could cause the pilot totemporary maneuver the airplane if using erroneous guidance information.AutopilotMinor, withwarning. Major,without warning.R Major, single axisand limitedauthority.Hazardous, multiaxis and limitedauthority.Catastrophic, ifauthority isunlimited.Malfunction effects of autopilot hardoversare very dependent on the design andinstallation details. Maximum inputs (hardovers) or (slowovers) toaircraft primarycontrol surfaces should not exceed aircraft structural limits. See AC 23.17C under section23.1329 for additional information.Autopilot guidanceor flight director cueon displayMinor Minor Major for pitch.Minor for roll.Pilot must monitor autopilot operation anddisconnect autopilot to recover flightpromptly. May cause go around and reductions in safety margins.11/17/2011 AC 23.1309-1EAppendix 1APPENDIX 1 (CONTINUED)*Note: This table is only intended to be a guide and is nota certification checklist since it may not include all the information necessary for an FHA on part 23 IFR Class Iairplanes with its various functions and itsintended use. This partial FHA does notreflect considerations needed to properlydevelop FHA. See paragraph 16 and its associatedsubparagraphs for more complete guidance. R =Reserved, intentionally left blank.A1-7AircraftFunctionClassification of Failure Conditions Analysis ConsiderationTotal Loss ofFunctionLoss of PrimaryMeans ofProvidingFunctionMisleadingand/orMalfunctionWithout WarningAutopilot, inabilityto disengage withA/P disconnectswitchMajor Major Major The pilot is assumed to overcome the servo slip clutches in both pitch and roll and ableto maintain control of aircraft. Minor if the circuit breaker to disconnect the autopilot isreadily available in flight.Electrical-Electronicprimary poweredflight controlsCatastrophicMinor Hazardous tocatastrophicAssumes redundant electrical/electronic primary flight control systems with no manualreversion that provide independent control for each axis. Hazardous for loss of onechannel on the lateral or longitudinal axis.Some fly-by-wire system designs may incorporate many solutions which mitigate theseverity of the loss of a single channel.They may have three or four independentchannels for pitch and roll, so the loss ofone has little functional effect and control canbe maintained with a single channel, although normally with the loss of some envelopeprotections. Additionally there may be mitigating factors such as inherent stabilitywhich can reduce hazards.StabilityaugmentationVariable Minor Variable It needs to be evaluated on acase-by-case basis since it depends on aircraft stability andhandling characteristics when installed andrequired to meet minimum performance andflight handling requirements.Stick pusher Hazardous, if lossis not annunciated.Major if the stallwarning isfunctioning.Minor, if failureis annunciatedand the stallwarning isfunctioning.Minor Catastrophic tohazardous if thepilot is able tooverride or able forquick disconnect.The system is installed to protect against a hazardous stall characteristic and/orunrecoverable catastrophic condition such as adeep stall. Assumes dual systems toprevent single-failure modes. Stick pushermalfunction with or without warning can becatastrophic depending on phase of flight and system attributes. Airplane response tostick pusher may be considered and pilot procedures may mitigate to a lower failurecondition.11/17/2011 AC 23.1309-1EAppendix 1APPENDIX 1 (CONTINUED)*Note: This table is only intended to be a guide and is nota certification checklist since it may not include all the information necessary for an FHA on part 23 IFR Class Iairplanes with its various functions and itsintended use. This partial FHA does notreflect considerations needed to properlydevelop FHA. See paragraph 16 and its associatedsubparagraphs for more complete guidance. R =Reserved, intentionally left blank.A1-8AircraftFunctionClassification of Failure Conditions Analysis ConsiderationTotal Loss ofFunctionLoss of PrimaryMeans ofProvidingFunctionMisleadingand/orMalfunctionWithout WarningStick shakers withStall warningMajor withoutother means ofstall warning andunannunciatedloss of stallwarning.Minor forannunciated lossof stall warningMajor withoutother means ofstall warning andunannunciatedloss of stallwarning.Minor forannunciated lossof stall warningMajor withoutother means ofstall warning.Assumes that inherent airplane characteristicsdo not exist so the pilot is aware of beingclose to stall (for example, stick force changes, buffeting, etc.).Trim controlMinor Minor Major, if manualtrim. Catastrophicor hazardous forelectrical.Studies have shown trim runaways are nota significant problem if pilot takes quickcorrective action. Major, for trim runawaysif there is a trim-in-motion aural alert.Hazardous or catastrophic for trim runawayswithout a failure indication depending ontrim authority and phase of flight.Gear controlMajor Minor Major RBrake controlMajor, forairplanes6,000lbs. Minor, forairplanes6,000lbs.Major. Could beminor, if thrustreversers areinstalled.MajorElectronic anti-skid and brake systems can cause significant ground handling problems ifthey malfunction under adverse conditions due toasymmetrical loading. Light airplanesbraking loss is not as significant and can be reviewed on a case-by-case basis.Display of trimindicationsMinor Minor Variable Each airplane has to be reviewedon a case-by-case basis. The most severe case is thephase of flight before takeoff. After takeoff, the trim position indication is not as criticalbecause the pilot will adjust the trimposition to relieve the control forces.Display of gearindicationsMinor R Minor R11/17/2011 AC 23.1309-1EAppendix 1APPENDIX 1 (CONTINUED)*Note: This table is only intended to be a guide and is nota certification checklist since it may not include all the information necessary for an FHA on part 23 IFR Class Iairplanes with its various functions and itsintended use. This partial FHA does notreflect considerations needed to properlydevelop FHA. See paragraph 16 and its associatedsubparagraphs for more complete guidance. R =Reserved, intentionally left blank.A1-9AircraftFunctionClassification of Failure Conditions Analysis ConsiderationTotal Loss ofFunctionLoss of PrimaryMeans ofProvidingFunctionMisleadingand/orMalfunctionWithout WarningDisplay of fuel levelindicationMinor Minor Minor Pilot is required to calculate fuel range and endurance during normal flight planningoperations.Display ofpowerplantindicationtachometerMinor Minor Minor Assumes fixed pitch propeller and reciprocating engine; otherwise, a propeller governorwill maintain the engine r.p.m. Turbofan and turbojet engines may need r.p.m. data forinflight restart capability. Refer to 14 CFR part 23, § 23.1311.Display ofpowerplant CylinderHead Temperature(CHT)Minor Minor Minor Assumes a CHT indicator is required. Refer to 14 CFRpart 23, § 23.1305.Display ofpowerplantindication coolanttemperatureMinor Minor Minor Refer to14 CFR part 23, § 23.1305.Display ofpowerplantindication oilpressureMinor Minor Minor Assumes oil temperature is used as a backup.Display ofpowerplantindication oiltemperatureMinor Minor Minor Assumes oil pressure is used as a backup.11/17/2011 AC 23.1309-1EAppendix 1APPENDIX 1 (CONTINUED)*Note: This table is only intended to be a guide and is nota certification checklist since it may not include all the information necessary for an FHA on part 23 IFR Class Iairplanes with its various functions and itsintended use. This partial FHA does notreflect considerations needed to properlydevelop FHA. See paragraph 16 and its associatedsubparagraphs for more complete guidance. R =Reserved, intentionally left blank.A1-10 

# )AircraftFunctionClassification of Failure Conditions Analysis ConsiderationTotal Loss ofFunctionLoss of PrimaryMeans ofProvidingFunctionMisleadingand/orMalfunctionWithout WarningDisplay ofpowerplantindication manifoldpressureMinor Minor Minor Assumes backup use of CHT, Engine Gas Temperature (EGT), and possible fuel flowreadings if installed.Display ofpowerplant air inlettemperatureMinor Minor Minor RDisplay ofpowerplantindication fuelpressureMinor Minor Minor RDisplay ofpowerplantindication fuel flowMinor Minor Major Manifold pressureand r.p.m. or torque indicationscan be used as an emergency backupto control power until a safe landing can be made.Display ofpowerplant firewarningMajor Major Major Required for commuter category and part 23 turbojetpowered airplanes using specialconditions. Part 23 airplanes usually have one fire warning system on board.Display ofpowerplantindication thrustMinor Minor Hazardous System is not normally used in part23 airplanes. Torque, Engine Pressure Ratio (EPR),EGT, or Turbine Inlet Temperature (TIT), fuel flow, and r.p.m. are normally displayed.11/17/2011 AC 23.1309-1EAppendix 1APPENDIX 1 (CONTINUED)*Note: This table is only intended to be a guide and is nota certification checklist since it may not include all the information necessary for an FHA on part 23 IFR Class Iairplanes with its various functions and itsintended use. This partial FHA does notreflect considerations needed to properlydevelop FHA. See paragraph 16 and its associatedsubparagraphs for more complete guidance. R =Reserved, intentionally left blank.A1-11AircraftFunctionClassification of Failure Conditions Analysis ConsiderationTotal Loss ofFunctionLoss of PrimaryMeans ofProvidingFunctionMisleadingand/orMalfunctionWithout WarningDisplay ofpowerplant thrustreverser positionNo effect No effect Major No certification credit is given for enhanced performance when a thrust reverser isinstalled.Thrust reversal Minor Minor Variable(inadvertentdeployment)No certification credit is given for enhanced performance when a thrust reverser isinstalled. No credit can be given for a warning.Display ofpowerplant torqueMinor Minor Major Misleading torquecould affect takeoff performance.Display ofpowerplant propellerblade angleNo safety effect No safety effect No safety effect System isnot normally used in part 23 airplanes. Propeller governor wouldcontrol r.p.m.Electronic displaysof significantpowerplantparametersMinor toHazardousR Hazardous Reversionary display isconsidered not available. If the risk of possible engine failuredue to pilot mishandling can be mitigated byappropriate procedures or by EEC, the lossof function may be major or minor.Visual warnings,cautions, and alertsR R R Failure conditions depend on the criticalityof systems being monitored and pilot actionrequired.Display of airtemperatureMinor R Minor R11/17/2011 AC 23.1309-1EAppendix 1APPENDIX 1 (CONTINUED)*Note: This table is only intended to be a guide and is nota certification checklist since it may not include all the information necessary for an FHA on part 23 IFR Class Iairplanes with its various functions and itsintended use. This partial FHA does notreflect considerations needed to properlydevelop FHA. See paragraph 16 and its associatedsubparagraphs for more complete guidance. R =Reserved, intentionally left blank.A1-12AircraftFunctionClassification of Failure Conditions Analysis ConsiderationTotal Loss ofFunctionLoss of PrimaryMeans ofProvidingFunctionMisleadingand/orMalfunctionWithout WarningOverspeed warning Minor Minor Minor Airspeed may be used as abackup to the overspeed warning for continued safe flight andlanding. Crew recognizes conditions byother equipment and procedures.Primary weatherradarMinor to Majordepended on theintendedoperationsR Major The loss could be major when the equipment is required by operational regulations. Also,Air Traffic guidance in some locations might not be available to provide hazardousweather information. It could be minorif there are appropriate AFM limitations.Flight InformationService WeatherMinor Minor Minor Normal operating procedures should states that the weather information should be usedonly as a strategic planning tool for pilot decision.Electronic Chart onthe MFDMinorMajor, if paperlesscockpit.Minor, if backupavailableMajor with ownship position.While we are not requiring any backup,we strongly recommend that AFMS normalprocedure section recommend that the pilot carry a paper backup with at least all othernecessary information to make a successful approach at their destination or alternateairport. In addition, the AFMS should contain emergency procedures for loss of approachcharts on the MFD. A backup to the electronic charts on the MFD could be an ElectronicFlight Bag with charts, paper approach charts of the destination and alternate airports, or apilot simply make notes of minimums andall other necessary information to make asuccessful approach at their destination or alternate airport. When the own-ship positionis shown, it is not considered the primary navigation display, so a primary navigationdisplay is required.11/17/2011 AC 23.1309-1EAppendix 1APPENDIX 1 (CONTINUED)*Note: This table is only intended to be a guide and is nota certification checklist since it may not include all the information necessary for an FHA on part 23 IFR Class Iairplanes with its various functions and itsintended use. This partial FHA does notreflect considerations needed to properlydevelop FHA. See paragraph 16 and its associatedsubparagraphs for more complete guidance. R =Reserved, intentionally left blank.A1-13AircraftFunctionClassification of Failure Conditions Analysis ConsiderationTotal Loss ofFunctionLoss of PrimaryMeans ofProvidingFunctionMisleadingand/orMalfunctionWithout WarningAural warnings Major R Major Aural alerts tend to be reserved for required flight crew’s immediate corrective action.Failure conditions depend on the criticality ofthe system. Crew recognizes conditions byother equipment and procedures.Electrical systemindicationMinor Minor Major Depends on crew reference and analysis.Vacuum pressureindicationMinor Minor Major Provides an indication that flightinstruments are operating within power source limits.Electrical power Catastrophic, ifprimary flightinstruments requireelectrical power.Hazardous forIFR. Dependsupon capabilityof secondarypower system.InstallationdependentDepends on electrical system loads and the criticality of the functions.