ARP4761 and ARP4761A Comparison
What changed between SAE ARP4761 and ARP4761A, the guidelines for the civil aircraft safety assessment process, and where both fall short.
SAE ARP4761 and its successor ARP4761A give guidelines and methods for conducting the safety assessment process on civil aircraft, systems, and equipment. This page summarizes the differences between them, and an adapted approach that addresses their shortcomings.
Two representations of a very similar process
Both versions describe the safety assessment as a V-model, and fundamentally they are different representations of a very similar process. The notable similarities are:
- Each has two tiers of Functional Hazard Assessment (FHA).
- Both are represented as a V-model.
The notable differences are:
- On the left side of the V-model, ARP4761 shows 3 levels of Fault Tree Analysis (FTA) and Common Cause Analysis (CCA), while ARP4761A shows 2 tiers: a Preliminary Aircraft Safety Assessment (PASA) and a Preliminary System Safety Assessment (PSSA).
- On the right side, ARP4761 shows 3 levels of FTA and CCA, while ARP4761A shows 2 tiers: a System Safety Assessment (SSA) and an Aircraft Safety Assessment (ASA).
- ARP4761 identifies the Failure Modes and Effects Analysis (FMEA) and Failure Modes and Effects Summary (FMES) specifically. In ARP4761A, these can be assumed to be part of the SSA and ASA.
The main difference, the number of tiers, does not represent a fundamental change in approach. In practice, the number of tiers is chosen based on the type of system or systems being developed.
Differences summary
| Subject | ARP4761 | ARP4761A |
|---|---|---|
| Applicability | ”It is primarily associated with showing compliance with FAR/JAR 25.1309. The methods outlined here identify a systematic means, but not the only means, to show compliance. A subset of this material may be applicable to non-25.1309 equipment." | "It may be used when addressing compliance with certification requirements (e.g., 14 CFR/CS Parts 23, 25, 27, 29 and 14 CFR Parts 33, 35, CS-E and CS-P). It may also be used to assist a company in meeting its own internal safety assessments standards.” |
| In-service safety assessment | No mention of a separate in-service safety assessment. | References ARP5150, “Safety Assessment of Transport Airplanes in Commercial Service”, and ARP5151, “Safety Assessment of General Aviation Airplanes and Rotorcraft in Commercial Service”. |
| Tiers | Two tiers are shown. | Two tiers are shown. However, there is now an Aircraft FHA (AFHA) and a System FHA (SFHA), rather than just an FHA, and the PASA and ASA are introduced to analyze integrated systems. |
| Model-Based Safety Analysis (MBSA) | No mention of model-based safety analysis. | Introduces model-based safety analysis and a Failure Propagation Model (FPM). Its hierarchical, iterative, and progressive nature is highlighted as an advantage over other analysis techniques. |
| Systems Theoretic Process Analysis (STPA) | No mention of STPA. | SAE AIR6913, “Using STPA During Development and Safety Assessment of Civil Aircraft”, and ASTM WK60748, “New Guide for Application of Systems-Theoretic Process Analysis to Aircraft”, exist separately, but are not referenced, to remain “technology neutral”. |
| Single event effects analysis | No mention of single event effects analysis. | References AIR6219, “Development of Atmospheric Neutron Single Event Effects Analysis for use in Safety Assessments”. |
| Analysis of development and design errors (FDAL and IDAL) | In ARP4754A, not in ARP4761. | In ARP4761A, not in ARP4754B. However, the FDAL and IDAL approach has not changed, and does not account for the FDAL and IDAL reductions for Part 23 airworthiness levels 1 to 4 and Part 27 classes I to IV. |
| Depth of analysis | Specifies that the approach (qualitative, quantitative, or both) should be established. ARP4761 Figure 4 gives guidance on major failure conditions. | More explicit about the relationship between the failure condition classification and the depth of analysis. Defers to advisory circular material. |
| Minimum Equipment List (MEL) and Master Minimum Equipment List (MMEL) | Mentioned in ARP4761 F.5.2, “a scheduled maintenance example”. | Explains the relationship between dispatch relief time and the exposure time derived from a fault tree analysis. Introduces a specific risk analysis, as opposed to an average risk analysis, to derive exposure time. References ARP5107B, “Guidelines for Time-Limited-Dispatch (TLD) Analysis for Electronic Engine Control Systems”. |
| Electrical Wiring Interconnection System (EWIS) | Precedes the regulatory changes that introduced the EWIS concept, following the TWA 800 (1996) and Swissair 111 (1998) accidents. | Applies safety analysis techniques to EWIS. EWIS applies to Part 25, not Part 23, but the concept is particularly relevant to Urban Air Mobility aircraft. |
| Human factors | Mentioned in ARP4761 D.6, “FTA analysis definition”. Otherwise not considered. | Takes credit for flight crew and maintenance crew following documented procedures. The evaluation of human factors is deferred, and neither intentional nor unintentional deviation is considered. |
| Cascading effects analysis | No explicit mention, although considering the cascading effects of a failure condition is standard practice. | Explicitly requires analysis of the system-level, aircraft-level, and multi-system effects of failure modes, combinations of failure modes, and failure conditions. |
An adapted approach
Despite the popularity of approaches based on ARP4761 and ARP4761A, in our experience they have the following shortcomings:
- You do not know how safe the aircraft is until late in the design and development lifecycle, when changes are costly.
- They cannot react to unanticipated change.
- The aircraft can be over-designed, which affects reliability, or under-designed, which affects safety.
- Design decisions are not guided by safety.
- Development assurance for software and complex hardware involves very little requirements validation.
Our adapted approach incorporates model-based safety analysis, such as STPA, and is more iterative than ARP4761 and ARP4761A:
Its benefits are:
- An iterative, step-by-step assessment, repeated as necessary to remove conservatism and show compliance with probability budgets.
- Support for decisions throughout the design and development lifecycle.
- Rapid reassessment, and the ability to assess the impact of changes.
- A safety process harmonized with Model-Based Systems Engineering (MBSE) for requirements validation.
- Support for the design and development of autonomous and semi-autonomous aircraft, and digital safety.
The approach is described in full in our holistic safety analysis for Urban Air Mobility and our regulations and standards gap analysis.