Functional Hazard Analysis for Highly Integrated Aerospace Systems

Evidence of comprehensive hazard identification is a crucial component of any aerospace certification argument. Historically, in the early stages of the aerospace safety assessment process, hazard identification has been performed through use of hazard checklists – derived from lists of previously identified or experienced hazards. The arguments used in support of this approach are predominantly based upon the amount of accumulated experience (i.e. to a large extent we know how aerospace systems fail) and the stability of the underlying domain (i.e. aerospace systems don’t change a great deal from instance to instance). However, this is a reactive rather than pro-active approach to identifying hazards. Also, when looking at complex and highly integrated subsystems of an aircraft (such as a single engine controller), the lower-level hazardous failure modes are less well understood and not as stable. Completeness of the hazard identification process for such subsystems is therefore a concern.