## 2 Safety Analysis Approach
The numerical value of the corresponding probability of occurrence per flight hour is related to the aircraft category and its mission. For example, the CS25 and FAR25 aircraft categories demonstrate that the catastrophic event is less than \(1\times 10^{-9}\) per flight hour. As far as the proposed ADS is concerned, quantification of the probability of occurrence per flight hour is imposed by the aircraft integrator's system specification document [30] as follows:  
* loss (or undetected, annunciated loss) air data function shall be less than \(1\times 10^{-5}\);
* erroneous (or detected, unannuciated loss) air data function shall be less than \(1\times 10^{-6}\). In the present work, the ADS is studied from a safety point of view considering only nominal operations or loss of functionalities, whereas degraded performances are not addressed here. The Functional Hazard Assessment (FHA) is the first step in the safety analysis process [31] performed by the aircraft integrator at the aircraft level. At the system level, the FHA is performed in order to identify failure conditions and to classify them at the aircraft level, in agreement with the A/C integrator, according to their severity. Classification of the failure conditions establishes the safety requirements (or objectives) that the operative ADS shall meet. As an example, possible loss of the air data function of airspeed calculation are evaluated and classified in accordance with its effect at the aircraft level. The second step [31] is the Preliminary System Safety Assessment (PSSA), with the allocation of system function (from the FHA safety objectives) to system items. Item safety requirements are then allocated to a lower level (hardware and software). This allocation to system items is performed using the Fault Tree Analysis (FTA) method with the aim of determining the item reliability requirements. To this purpose, the FTA can be built following the _top-down_ or _bottom-up_ approaches [31]. In the first case, the defined functional safety requirement (at the top level) is split down to the single items, whereas in the second case, from known sub-items' failure rates, reliabilities at higher levels are derived up to the top level function. These two steps represent a standard _top-down_ approach [31]: from the safety requirements at the system level (FHA), several safety objectives are derived for the single system items (PSSA). On the other hand, the _bottom-up_ analysis is used in the system safety assessment (SSA) that verifies if the selected system architecture meets the safety requirements as defined in the FHA and PSSA. The SSA exploits the results of other analysis, such as the Failure Modes and Effect Analysis (FMEA), able to identify failure modes and rates of system items and their effects at higher levels. As an example, the FMEA could provide very low-level analyses of how the failure rate of a single sub-item is derived, while the FTA of SSA will propagate those characteristics to higher levels (e.g., item) and again to the system functionality (e.g., airspeed calculation). As a final step [31], the SSA results are compared with the PSSA objectives in order to evaluate possible redesign at the system level (e.g., change items) or at the aircraft level (e.g., redundancy).