SAE ARP1834

Description / Abstract: ARP1834 provides general guidance for the selection, approach to, and performance of various kinds of F/FA of digital systems and equipment. Its prime objective is to present several industry-acceptable, cost-effective methods for identifying, analyzing, and documenting digital-equipment failure modes and their effects. The analysis techniques and considerations presented here are directed to digital-equipment hardware faults and failures exclusively.

ARP1834 is not intended as an exhaustive treatment of the enormously complex process involved in the analytical failure evaluation of complete digital systems, nor as a universally applicable, definitive listing of the necessary and sufficient steps and actions for such evaluation.

ARP4761 provides updated methods and processes for use on civil aircraft safety assessment. When analyzing these types of systems, ARP4761 should be used in lieu of this ARP.

ARP1834 addresses the following areas of consideration in the preparation and performance of F/FA's for digital equipment:

a. Possible Analysis Approaches: Top-Down andor Bottom-Up (Section 3)

b. Fault/Failure Modes, as they affect equipment operation and performance (Section 4)

c. Fault Monitoring Methodology: Reasons for, types of, and effectiveness (Section 5)

d. Analysis Methods: Preparation for, types of, effectiveness and coverage (Section 6)

Use of ARP1834 Guidelines for Safety Certification:

If this document is used as guidance for analyses involved in achieving digital-equipment safety certification by a regulatory agency, early coordination with that agency should be initiated to establish the scope and level of analysis effort that will be required to show compliance. Specific applications of F/FA processes discussed herein (and quite possibly others omitted here) will need to be negotiated on a case-by-case basis between the applicant and the agency, and between the prime contractor and his subcontractor or equipment supplier.

For digital systems performing functions that are critical and/or essential (see 3.2.1), it may not be possible to demonstrate compliance with safety-certification requirements without the use of design techniques aimed at producing a fault-tolerant system. A goal for these design techniques is the possible reduction or elimination of the need for part-level FMEA. This consideration is of pivotal importance, because thorough, accurate and dependable FMEA of contemporary microcircuits is not a feasible undertaking (see 6.1.3.6.1). The depth of the F/FA required to show compliance will be strongly influenced by such techniques. Typical design techniques which may be used in various combinations include:

a. System Architecture

(1) Similar Redundancy

(2) Dissimilar Redundancy

(3) Signal Consolidation or "Voting"

(4) Hardware Functional Partitioning

b. Fault Detection and Isolation

(1) Comparison Monitoring between redundant elements

(2) In-line test and monitoring

(3) In-line reasonableness checks

c. Fault Response

(1) System reconfiguration

(2) Operational mode changing

(3) System shutdown

Although such design considerations are outside the scope of this document, they must be taken into account by system designers and analysts in meeting overall system-safety objectives and in establishing the level of effort required for the F/FA.