System Design and Analysis
Этот документ должны преподавать начиная с института чтобы таких рассуждений не было
2.1.3 In the early years of aviation, airplane systems were evaluated to specific requirements: to the “single fault” criterion or to the fail-safe design concept, which are explained below. As later-generation airplanes developed, their designers added more safety-critical functions, which generally resulted in an increase in the complexity of the systems designed to perform these functions. A safety-critical function was a function whose failure when required would result in a catastrophic condition. The potential hazards to the airplane and its occupants, in the event of failure of one or more functions provided by a system, had to be considered, as did the interaction between systems performing different functions. To assess the safety of a complex system—and the adequacy of system redundancy to meet the fail-safe criterion—the FAA began assigning statistical probabilities to system failures in AC 25.1309-1, dated September 7, 1982. The agency’s primary objective was to ensure that the proliferation of safety-critical systems would not increase the probability of a catastrophic accident. The FAA assigned numerical values to the qualitative probabilistic terms in the requirements, for use in those cases where the impact of system failures is examined by quantitative methods of analysis. However, numerical values were intended to supplement, not replace, qualitative methods based on engineering and operational judgment. See appendix A for a historical perspective of the use of statistical probabilities in system safety assessment.
6.2.2 Each system function should be examined with respect to the other functions performed by the system, because the loss or malfunction of multiple functions performed by the system could result in a more severe failure condition than the failure of a single function. In addition, each system function should be examined with respect to functions performed by other airplane systems because the loss or malfunction of different but related functions, provided by separate systems, may affect the severity of failure conditions postulated for a particular system.