Certification and compliance verification are crucial components in ensuring safety within the aviation industry. The development of data processing algorithms for aviation certification addresses key challenges such as increasing system complexity, rapid technological advancements, human-machine interaction, and evolving regulatory standards. Flowcharts serve as a visual tool to map system components and their interactions, simplifying the identification of key checkpoints and enhancing understanding. They facilitate swift updates to certification processes, enabling the seamless integration of new technologies. By clearly delineating tasks between automated systems and human experts, flowcharts enhance collaboration and decision-making. Additionally, they assist regulatory bodies in adapting certification procedures to meet evolving safety and compliance standards. This paper analyzes the use of flowcharts within the System Safety Assessment for demonstrating compliance, as well as their role in automating the certification process for aviation systems, ensuring both safety and regulatory adherence.
Certification and compliance verification are vital aspects of the aviation industry, particularly in
the field of avionics. Avionics encompasses the electronic systems used in aircraft, including
communication, navigation, and flight control systems [
Certification authorities are organizations designated by regulatory bodies to conduct certification activities. They are responsible for evaluating and approving the compliance of aircraft, components, systems, and processes with the established standards and regulations. Examples include Aircraft Certification Office (ACO) of the Federal Aviation Administration (FAA) and
The FAA and the EASA are two prominent regulatory bodies in the aviation industry. Here's an overview of each: • •
The FAA responsibilities are the regulation and overseeing the civil aviation within the United States. The primary aim of FAA is to ensure the safety and efficiency of the national airspace system.
The EASA responsibilities are the promotion and maintaince of aviation safety in the European Union. It aims to harmonize aviation regulations across EU member states.
Both the FAA and EASA play crucial roles in regulating aviation safety, setting standards, and
overseeing the industry within their respective jurisdictions. They collaborate on various matters to
promote global aviation safety and harmonization of regulations [
Modern aircraft air navigation systems are increasingly complex, incorporating advanced
technologies and interconnected components. Certifying these complex systems demands a
thorough understanding of their interactions and potential failure modes. The analysis of diagnostic
processes for potential failures identification and predictions can be found in [
The aviation industry evolves rapidly, with new technologies and innovations emerging
constantly [
Human-machine interaction is another critical aspect. Automation in the certification process should strike a balance between human expertise and machine capabilities. While automation can improve efficiency and accuracy, it is essential to maintain human oversight and decision-making [9]. The example of automation in decision-making can be found in [10]. Flowcharts and data processing can outline the points where human intervention is required, ensuring a clear delineation of tasks between automated systems and human experts. This ensures effective collaboration and interaction between both parties, addressing complex scenarios and ensuring safety.
Additionally, the regulatory framework needs to keep pace with technological advancements and industry changes. Developing and updating regulations to address emerging technologies and ensuring that automated systems align with these regulations can be challenging. Flowcharts can help regulatory bodies visualize the certification process and identify where updates are needed. This proactive approach aids in adapting processes and standards to address new challenges and maintain safety.
By implementing flowcharts in software development for aviation certification, these challenges can be systematically addressed. Flowcharts provide a clear and visual representation of processes, making it easier to manage complexity, integrate new technologies, ensure human oversight, and align with evolving regulatory frameworks. Therefore, it was the aim of the paper to analyze the algorithm (flowchart) for the System Safety Assessment compliance demonstration (in our case, the Electric Shock Design Verification Procedure) and adapt it for software development in automating the certification process for aviation systems.
• • • • • • • •
To demonstrate compliance with EASA regulations for air navigation systems, several calculations and analyses can be performed. Here are some examples:
Radio Frequency (RF) Analysis: RF analysis involves assessing the electromagnetic compatibility and interference issues related to air navigation systems. It includes calculations to determine the frequency spectrum allocation, power levels, antenna patterns, and potential interference sources. This analysis ensures compliance with regulations regarding radio frequency usage and interference mitigation.
Signal Coverage Analysis: Signal coverage analysis is performed to assess the coverage area and signal strength of air navigation systems, such as navigation aids (e.g., VOR, DME) or communication systems (e.g., VHF, HF). It involves calculations to determine the signal propagation characteristics, including line-of-sight coverage, signal attenuation, and interference effects. This analysis ensures compliance with requirements for signal coverage and availability.
Performance Analysis: Performance analysis is conducted to evaluate the performance characteristics of air navigation systems. It includes calculations related to availability, accuracy, continuity, integrity of the system's operation. This analysis ensures compliance with performance requirements specified in the regulations, such as Required Navigation Performance or Surveillance Performance.
Interference Analysis: Interference analysis is performed to assess the potential interference sources that may affect the operation of air navigation systems. It involves calculations to determine the impact of external sources, such as other radio transmitters, radar systems, or electronic devices, on the performance and reliability of the navigation systems. This analysis ensures compliance with regulations regarding interference protection and system reliability. Risk Assessment: Risk assessment involves analyzing the potential hazards and associated risks related to air navigation systems. It includes calculations to estimate the probability and severity of hazards, such as system failures, communication errors, or navigation inaccuracies. This analysis helps identify and mitigate risks to ensure compliance with safety requirements.
System Safety Assessment (SSA): SSA is a comprehensive analysis that assesses the safety implications of air navigation systems. It involves various calculations and analyses. These can include fault tree analysis, analysis of failure modes and effects, hazard identification as well. SSA helps identify potential hazards, evaluate associated risks, and propose appropriate mitigations to ensure compliance with safety regulations.
The System Safety Assessment (SSA) is an important process in the field of aviation safety. It is conducted to identify and mitigate potential hazards associated with modifications made to aircraft systems. The EASA requires the submission of SSA reports for certain modifications to provide the continued and safe operation of aircraft. Here are some key points about SSA reports in EASA modifications:
Purpose: The primary purpose of an SSA report is to assess the safety implications of a modification to an aircraft system. It aims to identify potential hazards, evaluate associated risks, and propose appropriate mitigations to provide the continued safe operation of the aircraft.
Scope: SSA reports typically focus on modifications that affect the aircraft's systems, including avionics, electrical systems, flight controls, propulsion systems, and more. The • • • • • • • • report should cover all aspects of the modification's impact on the system's safety, including potential failure modes, effects, and criticality.
Methodology: The SSA process involves a systematic and structured approach to identify hazards and assess risks. It typically includes (but not limited) techniques such as Functional Hazard Assessment (FHA), Failure Modes and Effects Analysis (FMEA), Fault Tree Analysis (FTA). These methods help in identifying potential failure scenarios, their causes, and the associated risks.
Documentation: The SSA report should provide a comprehensive overview of the modification and its impact on the system's safety. It should include a description of the modification, its purpose, and the affected systems. The report should also document the hazard identification process, risk assessment, and proposed mitigations. Additionally, it should outline any necessary changes to procedures, maintenance, or training resulting from the modification.
Compliance with Regulations: EASA regulations, such as Part 21 and Part 25, outline the requirements for SSA reports. The reports should demonstrate compliance with these regulations and any applicable industry standards or guidelines. EASA may review the report and associated documentation to ensure that the modification meets the required safety standards.
Certification: Once the SSA report is submitted and approved by EASA, the modification can proceed to the certification phase. The certification process involves further evaluation and testing to ensure that the modification meets all safety requirements. The SSA report serves as an important basis for the certification process.
During the System Safety Assessment (SSA) for modifications under EASA, several CS-25 requirements are taken into account. CS-25 refers to the European Technical Standard Order (ETSO) for large aircraft certification. Here are some CS-25 requirements that are typically considered during the SSA process [11]:
CS 25.1309: This requirement focuses on the aircraft's systems and equipment. It states that the design and installation of systems and equipment must be such that they are free from hazards and do not adversely affect the aircraft's safe operation.
CS 25.1305: This requirement focuses on the aircraft's systems and equipment maintenance. It states that the systems and equipment design and installation must allow the easy inspection, maintenance, and servicing to ensure continued safe operation.
CS 25.1306: This requirement addresses the aircraft's systems and equipment instructions for continued airworthiness. It states that systems and equipment must have appropriate instructions for continued airworthiness that include maintenance, inspection, and overhaul instructions.
CS 25.1308: This requirement pertains to the aircraft's systems and equipment recording and reporting. It states that systems and equipment must have appropriate recording and reporting capabilities to facilitate the identification and resolution of malfunctions or failures.
In EASA certification, "Means of Compliance" (MoC) refers to the methods, procedures, or standards that an applicant can use to show compliance with the right regulations and requirements. It provides a way for the applicant to show that their product, system, or process meets the necessary safety and performance standards set by EASA.
Here are some key points to understand about Means of Compliance in EASA certification: • • • •
Demonstrating Compliance: EASA regulations, such as the Certification Specifications (CS), Airworthiness Codes, or Acceptable Means of Compliance (AMC), outline the requirements that need to be met for certification. The Means of Compliance provides the means for the applicant to demonstrate that their product or process complies with these requirements. Acceptance by EASA: The applicant needs to propose their chosen Means of Compliance to EASA for review and acceptance. EASA evaluates the proposed means to ensure that they adequately address the applicable regulations and requirements. If EASA accepts the proposed Means of Compliance, it becomes the approved method for demonstrating compliance.
Compliance Documentation: The applicant is required to document their chosen Means of Compliance in their certification application. This documentation should clearly describe how the proposed means satisfy the applicable regulations and requirements. It should include detailed procedures, test plans, analysis methods, or any other relevant information. Compliance Verification: EASA conducts a thorough review of the applicant's compliance documentation and may perform additional inspections, tests, or assessments to verify compliance. The verification process ensures that the proposed Means of Compliance are effective in demonstrating compliance with the regulations.
Means of Compliance provide a structured framework for applicants to demonstrate compliance with EASA regulations. They help ensure that the necessary safety and performance standards are met while allowing flexibility and innovation in the certification process [11].
To demonstrate compliance with shock hazard analysis for air-navigation equipment per EASA standards we need to identify the relevant EASA standards that govern shock hazard analysis for air-navigation equipment. For instance, EASA's Certification Specifications CS-25 and CS-23 provide guidelines for the design and certification of large and small aircraft, respectively. Classify the airnavigation equipment based on its intended use and potential exposure to shock hazards. This classification helps determine the level of testing and analysis required. For example, equipment installed in the cockpit may have different requirements compared to equipment installed in the passenger cabin. Then, conduct a thorough analysis of the equipment to identify potential shock hazards. This includes assessing the equipment's susceptibility to mechanical shocks during installation, operation, and maintenance. Consider factors such as vibration, impact, and handling during transportation. Compare the measured acceleration levels with the defined test criteria and EASA standards. Calculate the safety margin by subtracting the measured acceleration from the maximum allowable acceleration. Ensure that the safety margin is within the acceptable range specified by EASA standards. Prepare a comprehensive report documenting the shock hazard analysis process, including the test procedures, results, calculations, and compliance status with EASA standards. Include the measured acceleration levels, safety margin calculations, and evidence of compliance with the defined test criteria.
Figure 1 presents a schematic example of the definition and calculation process for shock hazard analysis of common Line Replaceable Unit (LRU), which will be incorporated into automated calculations during the certification process.
Grounding serves multiple purposes in electrical systems. It facilitates the safe return of current to the power source, establishes a common zero voltage reference for all electrical equipment, and connects various components of the aircraft, such as equipment case grounds, tubing, and ducting, to prevent the accumulation of voltage and effectively carry static, lightning, or fault current.
All airplanes must have a method for carrying electrical equipment return currents, fault currents, lightning, and electrostatic currents through electrically conductive paths other than the wiring and wire bundles depicted in Figure 2.
Grounding plays a crucial role in avionics systems as it serves multiple purposes. It minimizes voltage differences between LRUs (Line Replaceable Units), ensuring correct system operation. It protects against uncontrolled flow of normal or fault currents, preventing potential ignition sources in flammable environments. Grounding also safely controls the flow of lightning current, safeguarding against damage and ignition sources. Additionally, it prevents the accumulation of electrostatic or precipitation static charge, which could cause arcing and ignition in flammable atmospheres, as well as electromagnetic interference. Lastly, grounding shields sensitive equipment from EMI and HIRF energy sources, safeguarding against interference-induced malfunctions in onboard electronic systems.
During the installation and maintenance process, it is the responsibility of the equipment manufacturer to provide the design organization with parameters for the devices. These parameters will be incorporated into the installation and maintenance procedures.
Common steps that can be automated using software such as Mathcad, MATLAB, or similar programs were reviewed. As an example, lets consider automation process for certification and data processing for Distance Measuring Equipment (DME).
If the DME contains potential hazardous voltages, there shall be a maximum of 0.030 resistance from any structures to the chassis ground pin interfacing with the airplane (main static ground). Potentially hazardous voltages for equipment frame are defined as equal to or greater than 30 V of alternative current (AC) peak or 52.5 V direct current (DC).
Honeywell computed the resistance from all metallic structures within each LRUs back to the main static ground at the intermediate disconnect. This demonstrated that the 30 m requirement was (greatly) exceeded, partially due to the datum being at the intermediate disconnect rather than the main static ground of the connectors AC/DC [12].
The first step considers the installation in the airplane and determines conductivity and whether the installation is in a startle hazard area (generally, an area where a startle shock would result in a hazard such as falling from a cargo door, etc.).
The second step selects an appropriate human electrical model. This is typically limited to 500 for a wet area and 1000 for a dry area based on 115 VAC, 400 Hz.
The third step determines the input power impedance and the chassis ground resistance. The power line length is the key variable in determining worst-case resistance values. The system is analyzed to determine the appropriate equivalent circuit model to be used. The voltage drops calculated are used to calculate fault current levels in the system and to determine shock hazard verification factors. Figure 3 represents the typical electrical circuit representation used for the shock hazard analysis.
After calculation, we can proceed to the fourth step of using the flow chart in Figure 4.
By integrating this flowchart, it becomes possible to develop software that automates the verification process in Shock Hazard Analysis while incorporating data processing for efficient evaluation. The flowchart, combined with robust data handling, addresses the key questions outlined in the four-step process. In the initial stage of software development, the flowchart s steps, supported by data processing techniques, are followed to establish a clear representation of how the software is guided through each phase of the creation and verification process. For this study, we utilized the data processing algorithm to develop a mathematical model in MATLAB Simulink [13]. This approach allowed us to a logically and a mathematically validate the data processing algorithm, ensuring its accuracy and consistency through simulation and collect data for an adjacent investigations. As a result, we were able to thoroughly test and refine the data processing algorithm, confirming its effectiveness in achieving the desired outcomes [14, 15].
Step 1. For example, in the program space we can chose following: • • •
Electric Frequency The electric frequency measures the frequency at which the system is in operation. It is the frequency at which the system is configured and is usually 400 Hz (50 or 60 Hz) for an airplane environment.
Human current (Ih) The human current measures the current flowing through a human in the event he/she is in direct contact with a fault circuit. It can be determined by using Ohms Law (V = IR) as referenced from the Fundamental of Electric Circuits where [16]: ℎ = / .
(1) Exposure Time The exposure time is determined by the protective device trip chart showing the time a fault will occur until protective device(s) activate. The ratio of the fault current (IFault) to the protective device current specifications (Idevice) is used to determine the current overload rating. The current overload rating can be found from the equation below: = / . (2)
The current overload rating is used to determine the time of exposure. The time of exposure is based on protective device trip curves in device user manual.
For this calculation in Simulink, that shown on Figure 5, we have three options to choose from, depending on the incoming data configuration and the parameters outlined in Table 1. The result will be automatically determined and verified based on the data processing algorithm's logic.
Step 2. Determine if the installation/maintenance environment is in a Startle Area. For example, a navigation LRUs installation area is considered as a non-startle area. If the result is YES - program will transfer to Step 3. If the result is NO - program will transfer to Step 4.
The following condition in Simulink is represented by binary (Boolean) values and allows for manual selection of the environment condition where the equipment will be installed. It is manually controlled using a switch in accordance with Figure 6.
Step 3. Next, based of flowchart (Figure 4), it is compare human current (Ih) with the Startle Reaction current (Is) threshold. Is the human current less than the startle reaction current ℎ < . The startle reaction current threshold limits are given in Table 1. If the answer is YES esign is considered acceptable, if NO it requires a redesign.
The mathematical model at this step uses an If/Else block, which is essential for verifying the condition described above. This step directly influences the result of our entire the data processing algorithm, meaning subsequent steps are not considered. The example in Figure 7 shows with a grey light that the program skipped this step and stopped at the condition check of Step 4.
Step 4: Next step is comparing human current (Ih) with the Let-Go/Respiratory Paralysis current (Ilg) limits. Is the human current less than the Let-Go/Respiratory Paralysis current ℎ < Let-Go limits define the minimum current level flowing through a person that causes the person to not be able to voluntarily let go when in contact with a fault circuit. This condition arises as the current causes the muscles to contract and form a firm grip [17].
Respiratory Paralysis occurs when electric currents pass through the chest causing breathing problems due to contraction of respiratory muscles. Respiratory paralysis is not a hazard to a person for a short time, but develops into a hazardous situation if contact is maintained for over two minutes due to involuntary contraction of respiratory muscles. System frequency, defines the threshold current levels for Let-Go/Respiratory Paralysis Limits (Table 1). If the answer is YES esign is considered acceptable, if NO it requires proceeding to Step 5.
The logic of this step is almost identical to the previous one using If/Else blocks, but the nuance is that a negative result leads us to the next step of checking the system's operability, whereas a positive result exits the calculation and indicates the safety of the design choice according to our conditions. In the example in Figure 8, the system s negative response is shown, indicated by the color of the control light.
Step 5. Determination of Time in Let-Go/Respiratory Paralysis (Tlg) is less than 7.2 seconds < 7.2 seconds.
The Time in Let-Go/Respiratory Paralysis is the maximum amount of time a human will be in contact until protective device(s) activate. Installed protective device(s) may be in the form of a circuit breaker, or an internal fuse within a component. As an added safety margin, it is recommended Let- Go/Respiratory Paralysis threshold be limited to a maximum of 7.2 seconds [18]
Table 1 below lists the threshold human current levels at the given frequencies that do not cause a shock hazard resulting in a startle reaction, Let-Go/Respiratory Paralysis, or ventricular fibrillation. The actual value of (Tlg) is equivalent to the protective device trip time. If the answer is YES it requires proceeding to Step 6, if NO it requires a redesign.
The condition in Step 5 in Simulink (Figure 9) is the inverse of Step 4 (Figure 8), meaning that a negative result of the check now exits the program from the calculation and warns about the conditions for continuing of airworthiness. However, a positive result allows the transition to the next step of the system safety check, which is indicated by the color of the signal lamp.
Step 6 as shown on Figure 10 is comparing human current to Ventricular Fibrillation current (Ivf) threshold limit: ℎ < ? Ventricular Fibrillation occurs when the heart is affected by the current passing through it and causing one or more sections to function out of synchronization with other parts. The irregular function may cause the affected parts to cease and cause death. The use of a defibrillator becomes important in recovery process [18]. The ventricular fibrillation limits define the maximum current flowing through the human that will not cause ventricular fibrillation and are defined by Table 2 below. If the answer is YES than design is considered acceptable, if NO it requires a redesign.
At the final step, Simulink uses the data from previous steps and the initial conditions to provide an accurate result, as it determines whether the proposed design can be used and whether the calculations are safe for demonstrating compliance with airworthiness standards.
In Figure 10, the light indicates YES the design is safe, which is also verified by blocks and the control light in Figure 11.
Threshold limits used in the preceding shock hazard verification procedure is given in Table 1. The table contains limits specified by the: • •
International Electro-technical Commission (IEC) - A prominent global organization publishing standards of electrical and electronic related technologies.
Underwriters Laboratories Inc (UL) - Publishers for the most prominent standards for electrical technologies in North America.
The steps outlined in this flowchart play a crucial role in the software development process by integrating both program creation and data processing [19, 20]. They provide a visual representation of the program's logical flow, enabling programmers to understand how various components interact. By visualizing the logic and data flow, these flowcharts help identify key decision points and efficiently incorporate conditional statements, loops, and data processing mechanisms. This allows for better planning of the program's structure before actual coding begins, ensuring an organized and coherent design. Flowcharts also enhance collaborative development, serving as a valuable communication tool among team members. Moreover, they assist in debugging and troubleshooting by helping programmers trace program execution, monitor data processing, and identify potential errors. Overall, flowcharts are essential in developing well-structured, efficient programs that accurately implement the intended logic while ensuring smooth data handling.
In this paper, we analyzed the data processing algorithm (flowchart) for demonstrating compliance with the System Safety Assessment, specifically focusing on the Electric Shock Design Verification Procedure. Additionally, we adapted this flowchart for software development to automate the certification process for aviation systems. The implementation of flowcharts, combined with data processing, has been crucial in software development for controlling the certification process. These flowcharts provide a clear, visual representation of complex systems and their interactions, enabling a better understanding of critical checkpoints, potential failure modes, and data flow.
Flowcharts have been instrumental for regulatory bodies such as EASA and FAA in visualizing, updating, and adapting certification processes to keep pace with evolving industry standards and regulations. By incorporating data processing, this approach enhances real-time evaluation, ensuring regulatory frameworks remain robust and flexible.
Using flowcharts within software development has streamlined the certification process, addressing key challenges and creating a more efficient, effective, and adaptable system for certifying aviation technologies. This method sets a new benchmark for managing modern aviation certification, ensuring safety, compliance, and technological innovation are upheld. [9] Aeronautical Decision-Making. URL: https://www.faa.gov/sites/faa.gov/files/04_phak_ch2.pdf. [10] Y. Averyanova, Y. Znakovska, Decision-Making Automation for UAS Operators Using Operative Meteorological Information. Congreso Internacional de Tecnologias e Innovación. 3468 (2023) 139 149. [11] Certification Specifications (CSs). URL: https://www.easa.europa.eu/en/document-library/easyaccess-rules/online-publications/easy-access-rules-large-aeroplanes-cs-25?page=5T. [12] C.K. Alexander, M.N. Sadiku, Fundamentals of Electric Circuits. McGraw-Hill Companies, (2013). [13] A. Riabko, Comparative analysis of SIFT and SURF methods for local feature detection in satellite imagery, CEUR Workshop Proceedings, 3732 (2024) 21 31. https://ceur-ws.org/Vol3732/paper02.pdf. [14] A. Riabko, Methods of satellite images segmentation analysis, in: Proceedings of 7th IEEE International Conference on Methods and Systems of Navigation and Motion Control (MSNMC), Kyiv, Ukraine, 2023, pp. 163 167. doi: 10.1109/MSNMC61017.2023.10329167. [15] Avionics requirements for Civil aircraft. URL: https://www.eurocontrol.int/publication/avionics-requirements-civil-and-state-aircraft. [16] F. Dalziel, Electric Shock Hazard. IEEE Spectrum, 1972. doi:10.1109/MSPEC.1972.5218692. [17] IEC 479, Effects of Current on Human Beings and Livestock, International Electrotechnical
Commission (IEC). Technical Report, 1994. [18] J.E. Bridges, G.L. Ford, I.A. Sherman, M. Vainberg, Electrical Shock Safety Criteria, in: Proceedings of the first International Symposium on Electric Shock Safety Criteria, Pergamon Press, 1985. [19] O. Sushchenko, Y. Bezkorovainyi, V. Golitsyn, N. Kuzmenko, Y. Averyanova, M. Zaliskyi, Integration of MEMS Inertial and Magnetic Field Sensors for Tracking Power Lines, in: Proceedings of IEEE XVIII International Conference on the Perspective Technologies and Methods in MEMS Design (MEMSTECH), Polyana, Ukraine, 2022, pp. 33 36, doi: 10.1109/MEMSTECH55132.2022.10002907. [20] N. Kuzmenko, I. Ostroumov, Y. Bezkorovainyi, O. Sushchenko, Airplane Flight Phase Identification Using Maximum Posterior Probability Method, in: Proceedings of IEEE 3rd International Conference on System Analysis & Intelligent Computing (SAIC), Kyiv, Ukraine, 2022, pp. 1 5, doi: 10.1109/SAIC57818.2022.9922913.