Functional hazard analysis for highly integrated aerospace systems

Functional Hazard Assessment (FHA) is being increasingly recommended (e.g. by the Aerospace Recommended Practice-ARP 4754 [SAE94]) as a means of performing hazard identification. However, many of the available example applications of this approach (including that given in ARP 4761 [SAE95]) are illustrated either for aircraft-level functions or sub-system functions with obvious and visible functional effects. Our experience is that it can be difficult to apply FHA for lower level aircraft systems (specifically at the level of the engine controller) where, due to the level of complexity and integration with other systems, the overall effects of functional failure are far from obvious. In this paper, we describe the problems we have encountered when applying FHA and the (partial) solutions we have proposed in order to overcome these problems