AAP 7001.054 Annex D to Sect 2 Chap 12 Enclosure 4 Criticality1 DAL2 Fit II - 101 I,S,A,T4 Function I - 102 I,S,A,T Proc Validation 32/-33/-34 II - 102 I, T Loads I - 131 / 141 / 200 / 253 S, A, T Vibrations II - 151 / 221 S, A, T Aeroacoustic II - 152 / 222 S, A, T HERO I - 153 S, A, T EMI/EMC I - 154 / 224 S, A, T Temperature I - 155 / 223 S, A, T Carrier Suitability I - 132 / 260 S, A, T Aeroelasticity Aeroelastic I - 120 / 143 / 210 S, A, T Captive Carriage, Flying Qualities & Performance Flying/Handling Qualities I B 142 / 230 / 251 S, A, T Performance & Drag III B 240 S, A, T Employment and Jettison5,6 Release / Firing Dispense I A 110 / 144 / 271 / 274 S, A, T Launch I A 110 / 161 / 272 S, A, T Gun Firing I A 162 / 273 S, A, T Jettison I A 110 / 280 S, A, T Freestream Coefficients & Ballistics I7 A 141 / 291 / 292 / 293 S, A, T System or Discipline Supporting Discipline Fit & Function Structural & Environmental Ballistic & OFP V&V MIL-HDBK 1763 Test Mode3 In-Range Envelope V&V Table D1 Summary of Failure Criticality & Design Assurance Levels 1 2 3 4 5 6 7 See Table D2 Categories of Mishap Severity Design Assurance Levels are iaw RTCA/DO-178 and RTCA/DO-254. See application principles of SAE ARP 4754 and Figure C1. S = Similarity, A = Analysis, I = Inspection, T = Test To be completed prior to Source Selection. Sufficient analyses and testing shall be accomplished such that the safety of the employment and selective jettison system presents an improbable hazard to the releasing aircraft and ground based personnel and facilities during the life of the aircraft stores capability. Sufficient analyses and testing shall be accomplished such that the safety of the emergency jettison system presents an improbable hazard to the releasing aircraft and ground based personnel and facilities during the mission. Traceability of models, wind tunnel, ground and flight test to Minimum Safe Separation, Minimum Safe Release Height and Safety Templates is required. 12D-1 Draft Copy as of 11 Nov 02 AAP 7001.054 Annex D to Sect 2 Chap 12 Enclosure 4 CONDUCT ADVERSE EFFECT REVIEW Compile a list of air armament systems to determine if they are essential or non-essential to safe operations. Does the operation of the installed equipment adversely affect equipment essential to safe operation? CONCEPTUAL/FUNCTIONAL DESIGN REVIEW * Functional Baseline Yes Unacceptable No No Does the operation of the installed equipment adversely affect nonessential equipment? Does a means exist to inform the users of the effect via visual (flags, lights, displays) or aural methods (horns, bells, voice)? Yes No Yes CONDUCT FUNCTIONAL HAZARD ASSESSMENT PRELIMINARY DESIGN REVIEW * “Design-to” Baseline Will any probable failure or malfunction result in a CATASTROPHIC or CRITICAL failure condition? Yes Significant Design Change No Will any probable failure or malfunction result in a MAJOR failure condition? No Non-Significant Design Change Yes Yes Do ADF AEO or ASCENG have experience with this technology? No Is system complexity HIGH? Yes No CONDUCT SAFETY ANALYSIS These failure consequences will impose design constraints CRITICAL DESIGN REVIEW * “Build-to” Baseline Qualitative & Quantitative Analyses * Qualitative Analyses * FHA Summary Safety Analysis LEVEL A / B LEVEL C LEVEL D DO-178 Design Assurance Levels - based on failure levels = levels of engineering rigour * See also Hazard Matrix and Approval Levels at Tables D3 and D4 Figure D1 Air Armament System Safety Assessment Program 12D-2 Draft Copy as of 11 Nov 02 AAP 7001.054 Annex D to Sect 2 Chap 12 Enclosure 4 Mishap Severity Categories Description Environmental, Safety, Cost8 and Health Result Criteria Category Catastrophic I Critical II (Hazardous) Marginal III (Major) Negligible IV (Minor) Effect on Aircraft & Occupants of failure condition Could result in death, permanent total disability, loss exceeding $1M, or irreversible severe environmental damage that violates law or regulation. Prevention of continued safe flight or landing of the aircraft Loss of aircraft and/or fatalities Could result in permanent partial disability, injuries or occupational illness that may result in hospitalisation of at least three personnel, loss exceeding $200K but less than $1M, or reversible environmental damage causing a violation of law or regulation. Reduction of aircraft or crew ability to cope with adverse operating conditions Large reduction in safety margins Physical distress or workload such that the flight crew can not be relied upon to perform its tasks accurately or completely Serious injury or death of a relatively small proportion of the occupants Could result in injury or occupational illness resulting in one or more lost work day(s), loss exceeding $10K but less than $200K, or mitigatible environmental damage without violation of law or regulation where restoration activities can be accomplished. Reduction of aircraft or crew ability to cope with adverse operating conditions Significant reduction in safety margins Reduction in the ability of the flight crew to cope with adverse operating conditions impairing their efficiency Injury to occupants Could result in injury or illness not resulting in a lost work day, loss exceeding $2K but less than $10K, or minimal environmental damage not violating law or regulation. No significant degradation of aircraft or crew ability Slight reduction in safety margins Slight increase in crew workload Physical effects but no injury to occupants Mishap Probability Levels Description Frequent Level A Probable B Occasional C Remote D Improbable E Extremely Improbable - Specific Individual Item Likely to occur often in the life of an item, with a probability of occurrence greater than 10-1 in that life. Will occur several times in the life of an item, with a probability of occurrence less than 10-1 but greater that 10-2 in that life. Likely to occur some time in the life of an item, with a probability of occurrence less that 10-2 but greater than 10-3 in that life. Unlikely but possible to occur in the life of an item, with a probability of occurrence less than 10-3 but greater than 10-6 in that life. So unlikely, it can be assumed occurrence may not be experienced, with a probability of occurrence less than 10 -6 in that life. Unlikely to occur with a probability of occurrence is less than 10-9 in that life Fleet or Inventory Continuously experienced. Will occur frequently. Will occur several times. Unlikely, but can reasonably be expected to occur. Unlikely to occur, but possible. Unlikely to occur. Table D2 Mishap Severity Categories And Probability Levels 8 The cost figures are based on MIL-STD-882D and are therefore indicative values for planning purposes. 12D-3 Draft Copy as of 11 Nov 02 AAP 7001.054 Annex D to Sect 2 Chap 12 Enclosure 4 Severity Probability Catastrophic Critical Hazardous Marginal Major Negligible Minor Frequent / Probable Extreme Extreme High Medium Occasional Extreme High Medium Low Remote High Medium Medium Low Improbable Medium Medium Low Low Extremely Improbable Medium Low Low Low Table D3 Air Armament Hazard Matrix9 Risk Level Description Approval Level Extreme Unacceptable Risk. Imperative to suppress risk to an acceptable level. AA High Acceptable with risk mitigation strategy. Operation requires written, time limited waiver. Medium Acceptable with risk mitigation strategy. Low Routine in-service operations. HS(Aero) – Acquisition / D/AT&E10 CDR ARDU – D/A/OT&E (via Test Plan) WSMGR / OAAR / TAR – OT&E / In-service (via ASCCERT) DASCENG / OAAR Delegate11 / DAR CENGR– OT&E / Inservice (via ASC Clearance & ASCCERT) DASCENG / COAST / COASE – D/A/OT&E (via ASC Clearance & Test Plan) Approval based on Design Engineer Judgement of Significance Table D4 Assumed Approval Levels Based on Consequence of a Probable Event 9 10 11 Further guidance with respect to Aviation Risk Management is at DI(AF) OPS 1-19 For uncertified aircraft store combinations (ie pre ASCCERT) an Issues Paper would seek authority acceptance during systems development. OAAR Delegate = as approved by FEGCDR iaw DI(G) OPS 2-2 - WGCDROPS typically 12D-4 Draft Copy as of 11 Nov 02