The Functional Hazard Assessment is the first document produced in an aircraft system's safety process. It is also the document most likely to contain errors that propagate silently through every subsequent assessment: into the PSSA, the SSA, and ultimately into the certification basis.
Understanding what an FHA is, what it must demonstrate, and where it typically goes wrong is foundational knowledge for any safety engineer working under ARP4761A.
What an FHA is
An FHA is a systematic examination of aircraft and system functions to identify failure conditions and classify their severity. The purpose is to establish the safety objectives that subsequent assessments (PSSA and SSA) must demonstrate are met.
The FHA operates at two levels:
Aircraft-level FHA. Examines the aircraft's functional requirements. For each function, it asks: what happens if this function fails? The answer determines the failure condition severity classification and, from that, the Development Assurance Level required of the system that provides the function.
System-level FHA. Examines the system's functional requirements in more detail. For each system function, it identifies all relevant failure modes, classifies their effects on the aircraft and on crew workload, and assigns severity classifications consistent with the aircraft-level FHA.
Both levels feed directly into the PSSA. If the FHA misclassifies a failure condition, for example assigning Major where Hazardous is correct, the PSSA will allocate an insufficient probability budget to that failure mode, the fault tree will be built to the wrong target, and the error will not be caught until late-stage review, if at all.
What ARP4761A requires
ARP4761A (the 2023 revision of ARP4761) provides the accepted means of compliance for safety assessment under ARP4754A. For the FHA, it requires that each failure condition entry address:
- Function: the specific aircraft or system function under analysis
- Failure condition: a description of the effect of the failure on the aircraft, crew, and passengers
- Phase of flight: the flight phase during which the failure condition applies (most severe phase must be identified)
- Severity classification: Catastrophic, Hazardous, Major, Minor, or No Safety Effect, per the criteria defined in ARP4761A §5.1
- DAL: the Development Assurance Level derived from the severity classification
- Rationale: the justification for the severity classification, with reference to the specific criteria applied
The rationale column is the most frequently neglected and the most frequently challenged during certification review. Stating that a failure condition is "Catastrophic" without explaining why the specific criteria for Catastrophic are met does not satisfy the standard.
Severity classification criteria
The five severity levels are defined in ARP4761A by their effects on the aircraft, crew, and passengers:
| Severity | Probability requirement | Typical effect | |---|---|---| | Catastrophic | < 1 × 10⁻⁹ per flight hour | Loss of aircraft or multiple fatalities | | Hazardous | < 1 × 10⁻⁷ per flight hour | Serious or fatal injury to a small number of occupants; large reduction in safety margins | | Major | < 1 × 10⁻⁵ per flight hour | Significant reduction in safety margins; physical distress to occupants | | Minor | No numeric requirement | Slight reduction in safety margins; some inconvenience to occupants | | No Safety Effect | No requirement | No effect on safety |
The probability requirements are system-level targets. They are not probabilities of the failure mode itself, but targets that the PSSA fault tree must demonstrate are achievable through the system architecture.
Common FHA errors
In practice, FHAs submitted for certification review fail on a predictable set of issues:
Severity underclassification. The most consequential error. A failure condition classified as Major when it should be Hazardous means the probability budget allocated in the PSSA is two orders of magnitude too lenient. Systems that pass safety review at this budget may not, in fact, be safe enough. This error typically results from insufficient consideration of combined failure modes or from analysing the wrong phase of flight.
Missing failure modes. FHAs constructed from SDD functional lists often omit failure modes that are not explicitly described in the SDD but are latent in the system architecture. Loss-of-function failures are almost always captured. Erroneous-function failures (hardover, uncommanded activation, incorrect output) are frequently missed.
Inconsistency between aircraft and system FHA. A failure condition classified as Catastrophic at the aircraft level must have a consistent classification at the system level. Where the two levels are produced by different engineers or different teams, classification drift is common and often undetected until the PSSA is partially complete.
Inadequate phase-of-flight analysis. Many failure conditions have different severity in different phases of flight. The FHA must identify the most severe phase and use that as the basis for classification. Using cruise-phase analysis for a failure condition that is most severe during approach is a systematic error in the classification methodology.
Rationale that cites the standard without applying it. Writing "classified as Hazardous per ARP4761A §5.1 criteria" is not rationale. The rationale must explain which specific effects of the failure condition correspond to which criteria in the standard, and why.
The relationship between FHA and PSSA
The FHA is not a standalone document. Its output, the severity classifications and DAL assignments, is the input to the PSSA. Every classification error in the FHA creates a corresponding error in the PSSA's safety requirements, probability budgets, and fault tree structure.
This is why FHA quality matters disproportionately. A PSSA can be correct in its methodology and still be wrong because the FHA it was built from had incorrect severity classifications. The most common downstream pattern is DAL misclassification errors in the PSSA's probability allocations, driven by severity underclassification in the FHA. When the error is discovered during final certification review, correcting it requires not just updating the FHA but rebuilding portions of the PSSA and potentially revisiting architecture decisions that were made on the basis of the incorrect safety requirements.
Catching FHA errors early, ideally during the first draft stage, is substantially cheaper and faster than catching them at design freeze. This is the primary value proposition of systematic FHA review tools: not producing the FHA faster, but catching the errors that would otherwise survive into the PSSA.
evidion automatically checks FHA entries for severity consistency, missing failure modes, and rationale completeness. If you are working on an ARP4761A assessment, join the pilot programme.