## 2 Safety Analysis Approach  
From a system point of view, the ADS shall satisfy the applicable airworthiness specifications in order to guarantee the defined safety level in terms of failure events per flight hour with respect to any basic ADS functionalities. The safety assessment guidelines from ARP4761 are considered for the safety analysis presented in the present work. The certification specifications for commuter aircraft [1], applicable to the proposed ADS, defines the event severity and related probability. Failure conditions are classified according to the severity of their effects such as the following:  
1. No Safety Effect: failure conditions that have no effect on safety (i.e., that do not affect the operational capability of the aeroplane or increase the crew workload). 2. Minor: failure conditions that do not significantly reduce aeroplane safety and that involve crew actions that are well within their capabilities. Minor failure conditions may include, for example, a slight reduction in safety margins or functional capabilities; a slight increase in crew workload, such as routine flight plan changes; or some physical discomfort to passengers or the cabin crew. 3. Major: failure conditions that reduce the capability of the aeroplane or the ability of the crew to cope with adverse operating conditions to the extent that there would be, for example, a significant reduction in safety margins or functional capabilities, a significant increase in crew workload or in conditions impairing crew efficiency, discomfort to the flight crew, or physical distress to passengers or cabin crew, possibly including injuries. 4. Hazardous: failure conditions that reduce the capability of the aeroplane or the ability of the crew to cope with adverse operating, conditions to the extent that there would be a large reduction in safety margins or functional capabilities, physical distress or excessive workload such that the flight crew cannot be relied upon to perform their tasks accurately or completely, or serious or fatal injury to a relatively small number of the occupants other than the flight crew. 5. Catastrophic: Failure conditions that would result in multiple fatalities, usually with the loss of the aeroplane. Generally speaking, the airworthiness specifications deal with the probability of occurrence of the listed failure conditions in qualitative terms:  
* Probable: when a failure condition is expected to occur one or more times during the entire operational life of each aeroplane. * Remote: when a failure condition is expected to unlikely occur to each aeroplane during its total life but may occur several times when considering the total operational life of a number of aeroplanes of the same type. * Extremely Remote: when a failure condition is expected to unlikely occur to each aeroplane during its total life but may occur a few times when considering the total operational life of all aeroplanes of the same type. * Extremely Improbable: when a failure condition is so unlikely that it is not expected to occur during the entire operational life of all aeroplanes of one type. As a general guideline for reliability/safety objectives, airworthiness specification follows a logical relationship between the average probability per flight hour and the severity of failure condition effects [1] as follows:  
* failure conditions with no safety effects have no reliability safety requirement;
* failure conditions with minor effects may be probable;
* failure conditions with major effects must be no more frequent than remote;
* failure conditions with hazardous effects must be no more frequent than extremely remote;
* failure conditions with catastrophic effects must be extremely improbable;  
For each aircraft type (or category), the applicable airworthiness standards quantify the probability of occurrence in order to give clear targets for system reliability/safety analysis. It is obvious that a safety critical system must be designed with extremely improbable failure conditions that can lead to a catastrophic event.