## 5 Safety Analysis
### ADS Safety Performance  
Starting from Table 4, the system safety assessment (SSA) can be performed using the FTA method and the results are analysed for all ADFs. An example of SSA is reported in Figure 5d for the synthetic function of AoA evaluation. According to the ADS parts and related MTBF, it can be noted that the unannotated loss of ADF3 has a failure rate of \(6.9\times 10^{-5}\), i.e., it can occur more than once over 14,500 flight hours. This result is much lower than the safety objective (one loss over 1,000,000 flight hours) reported in Table 5.  
Even though it is not always applicable, all ADFs identified in this work are safety-critical. It is clear that, using both the literature MTBF and manufacturer data, the simplex ADF FRs cannot satisfy the initial safety specifications summarized in Table 7. In order to overcome this problem, two possible solutions can be adopted: (1) redesign to identify parts with higher MTBF at the ADS level and (2) adopt a redundant ADS architecture at the aircraft level. From Figure 5, it is clear that, for ADF1, the leading part is the Pitot probe and the most critical sub-part is the anti-icing device. For ADF2, the leading part is the TAT probe and the most critical sub-part is the anti-icing device. The MTBF of latter critical sub-parts, \(6.8\times 10^{-5}\) and \(3.0\times 10^{-5}\) for the Pitot and TAT probe, respectively, should be increased by about two orders of magnitude to achieve the safety objectives, \(1.7\times 10^{-7}\) and \(1.3\times 10^{-7}\) for the Pitot and TAT probes, respectively. As the anti-icing solutions are based on heaters, consisting basically in a resistance immersed in the probe, they have high failure rates [44]. Compliance to the indicated required MTBF target may not be realistic [46] if other solutions [47] or interchangeable heaters are not considered. \begin{table}
\begin{tabular}{c l l l} \hline \hline
**ADS Part** & **ADS Sub-Part** & **Reliability Objectives** & **Compliant (with Data from Table 4)** \\ \hline \multirow{7}{*}{Pitot probe} & Probe and strut & \(<\)0.11 \(\times 10^{-6}\) & \multirow{3}{*}{YES (\(7.0\times 10^{-7}\))} \\  & Probe and strut & (from PSSA of ADF3/4) & \\  & & \(<\)0.11 \(\times 10^{-6}\) & \\  & Heater & (from PSSA of ADF3/4) & \\  & Sensing element (single) & \(<\)3.6 \(\times 10^{-4}\) & \\  & Wiring cable & (from PSSA of ADF2) & \\  & HW board (single) & \(<\)4.0 \(\times 10^{-4}\) & \\  & & (from PSSA of ADF3/4) & \\  & & \(<\)0.25 \(\times 10^{-6}\) & \\ ADC & Absolute pressure transducer & (from PSSA of ADF1) & \\  & & \(<\)0.17 \(\times 10^{-6}\) & \\  & Differential pressure transducer & (from PSSA of ADF3/4) & \\ \hline \hline \end{tabular}
\end{table} 
Table 6: Failure probability requirement for the ADS components for erroneous failure conditions. The present requirements are the most severe from those obtained with Fault Tree Analysis (FTA) presented in Figure 4.  
As far as the synthetic functions are concerned, as they depend on the airspeed measure or dynamic pressure from ADF1.2, both ADF3 and ADF4 FRs are limited by the Pitot probe's heating element. As a side result, from Figures 4c and 5c, it can be noted that a TAT with a single sensing element for ADF2 would not satisfy the safety requirements and, under this hypothesis, the TAT sensing element becomes a safety critical sub-part along with the anti-icing. To conclude, the most convenient way to fill the aforementioned gap in a short-term period is to adopt a redundant ADS architecture. Redundancy is a common practice in aeronautics, where safety-critical systems are designed to have extremely improbable failure rates (e.g., less than one catastrophic event per billion \(-10\times 10^{9}\) hours of operation for the CS25 aircraft category). Manufacturing and installing a system that complies with the safety requirements only with a duplex or triplex redundancy is thus widely accepted.