Title: Aerospace Functional Safety | ISO 26262 Academy URL: https://iso26262.academy/features/concepts/aerospace-functional-safety Description: How civil aviation makes systems safe when no safe state is reachable in flight: 25.1309 failure conditions and probability targets, the FHA, PSSA and SSA chain, development assurance levels, DO-178C and DO-254, common cause analysis, fly-by-wire architectures and integrated modular avionics, then three honest comparison chapters against ISO 26262. --- Concept guide · 25.1309, ARP4754A/B, ARP4761A, DO-178C, DO-254 · 15 chapters # Aerospace Functional Safety Read the civil aviation safety stack the way an ISO 26262 engineer needs to read it: the rules, the risk model, the assurance levels, the architectures, and three comparison chapters that refuse the easy analogies. 15 Chapters 5 Failure condition classes 3 Common cause analyses 3 Comparison chapters Included in Expert [Start learning](https://iso26262.academy/register?plan=free&from=%2Fconcepts%2Faerospace-functional-safety&utm_source=website&utm_medium=cta&utm_campaign=features_concepts) See the chapters Inside the course 1. 01 **Why Aircraft Cannot Pull Over** 2. 02 **The Rulebook: Authorities and Standards** 3. 03 **Failure Conditions and Probability Targets** 4. 04 **The Safety Assessment Process** 5. 05 **Development Assurance and DALs** The short version ## Quick answers Is aerospace functional safety part of ISO 26262? No. Civil aviation runs on a separate legal and technical stack. The binding requirement lives in aviation regulation, notably the systems safety rule 25.1309 in 14 CFR Part 25 and the equivalent EASA Certification Specification, while the recognized methods live in industry standards such as ARP4754A and its newer revision for development assurance, ARP4761A for safety assessment, DO-178C for software, DO-254 for airborne electronic hardware and DO-160 for environmental qualification. ISO 26262 governs road vehicles and has no standing in an aircraft certification basis. This guide is written for automotive engineers precisely because the two stacks answer the same fear with different grammar. Does DAL A correspond to ASIL D? It does not, and Chapter 12 is the page's definitive statement of why. A development assurance level is assigned from an aircraft-level failure condition class that has no exposure or controllability parameters, and it obligates a development process. An ASIL is assigned to a hazardous event and its safety goal from severity, exposure and controllability, and it carries an item-level metric set that aerospace never defined. The ladders are analogous, because both scale rigor with consequence, so an engineer fluent in one recognizes the logic of the other immediately. The levels are not convertible, and any artifact reuse between the domains has to be argued through the objectives actually met. Keep going, free - [Article · 7 min read Functional Safety in Aerospace vs Automotive: An ISO 26262 Guide](https://iso26262.academy/blog/aerospace-vs-automotive-functional-safety-iso-26262) - [Demo exam · no account Test yourself with 7 exam-style questions](https://iso26262.academy/demo-exam) Why this course ## Why it pays for itself ### Stop the DAL to ASIL conversion slide Chapter 12 states the non-equivalence in full and gives you the five independent reasons behind it, so cross-domain claims in your program get argued through the objectives actually met rather than through matching letters. ### Borrow the fail-operational playbook properly Automated driving removes the attentive driver who made the safe state cheap. The architecture, partitioning and common cause chapters give you aviation's answers to that problem with their real prerequisites attached, not as slogans. ### Learn from investigations you can read for free The page is built on public accident reports, advisory material and regulation. Three of its hardest lessons, on routing concentration, on processing between redundant sensors, and on change impact climbing back to vehicle level, transfer directly to automotive work. After the course ## What you’ll be able to do ### Read an Aerospace Safety Argument Follow a claim from an aircraft-level failure condition through its probability objective, its allocation and its closing evidence, and know which document owns each step. ### Place DAL and ASIL Correctly Explain precisely why development assurance levels and ASILs are analogous ladders with non-convertible rungs, and shut down the conversion table before it reaches a slide. ### Attack Independence Assumptions Apply the zonal, particular risks and common mode mindset to your own redundant channels, including the physical routing questions automotive analyses often skip. ### Speak the Fail-Operational Vocabulary Use the command/monitor, self-checking pair, voting and degradation ladder patterns accurately when specifying fail-operational steering, braking or automated driving architectures. ### Judge What Transfers Across Domains Decide what aerospace evidence, methods and mechanisms genuinely help an ISO 26262 program, and what is a luxury of aviation economics or a claim that simply does not carry over. ### Treat Human Response as a Claim Recognize crew and driver response credit as an assumption owed evidence, and carry that discipline into every controllability judgment in a HARA. The curriculum · 15 chapters ## Chapter by chapter 1. 01 **Why Aircraft Cannot Pull Over** The physical asymmetry that reshapes every downstream decision: a road vehicle can often reach a controlled stop, while a function needed for continued safe flight and landing has to keep working until the aircraft is down. - Reachable safe state - Fail-passive vs fail-operational - Availability as a safety property 2. 02 **The Rulebook: Authorities and Standards** Who holds the authority to say an aircraft is safe, how 14 CFR and the EASA Certification Specifications state the required outcome, and how advisory material and the SAE and RTCA/EUROCAE standards supply the recognized methods. - 25.1309 as the anchor rule - Law vs guidance vs standards - The loose automotive cousinships 3. 03 **Failure Conditions and Probability Targets** The unit of analysis in aviation is the aircraft-level failure condition, not a component fault. Five severity classes attach an inverse staircase of probability objectives, plus two qualitative rules that shape architectures more than the numbers do. - No Safety Effect through Catastrophic - The inverse probability staircase - No single failure, and crew awareness 4. 04 **The Safety Assessment Process** How a paper budget at aircraft level becomes requirements on real computers, valves and inspection intervals: the FHA, PSSA and SSA chain, fault trees run first as a design calculator and then in reverse as evidence. - FHA, PSSA and SSA roles - Fault trees as allocation engine - Derived safety requirements 5. 05 **Development Assurance and DALs** The second axis, for the failure mode no probability model can see: development error. Why rigor is scaled by consequence, how FDAL attaches to functions and IDAL to items, and what independence has to be shown before any allocation claim. - Functions first, items second - Independence prerequisites - Validation vs verification 6. 06 **DO-178C: Software Assurance** Software gets no failure rate, so the standard scales auditable objectives instead. The plan set written for the authority, the lifecycle data the auditors sample, requirements-based verification, and structural coverage read as an adequacy metric rather than a target to farm. - Objective counts by level - The plan set and lifecycle data - Coverage gaps as findings to diagnose 7. 07 **DO-254: Hardware Assurance and Qualification** The hardware half splits in two: assuring the correctness of logic you designed, and qualifying any box against the environment it flies through. The simple and complex distinction, what levels A and B add, how commercial parts get in, and the radiation physics that scales with altitude. - Simple vs complex hardware - Environmental qualification categories - Neutron flux, ECC and scrubbing 8. 08 **Common Cause: Zones, Risks and Separation** Every multiplied small number in the previous chapters assumed independence. The zonal, particular risks and common mode analyses attack that assumption from three directions, and one public 1989 investigation shows what happens when the assumption is wrong. - ZSA, PRA and CMA - Debris footprints and routing - The documented limits of dissimilarity 9. 09 **Architectures That Fly** The reusable redundancy vocabulary that decades of fly-by-wire practice produced, two published architecture patterns that answer the same question differently, and the sensor and power layers underneath that decide whether any of it holds. - Command/monitor and voting patterns - Control law degradation ladders - Where the weak link really sits 10. 10 **Integrated Modular Avionics and Partitioning** What changes when many functions of different criticality share one computer: partitioned responsibility, robust temporal and spatial separation, bounded shared-resource interference, deterministic networking, and the direct lineage to automotive hypervisors. - Roles on a shared platform - Time, space and interference - The shared multicore problem 11. 11 **Certification in Practice** The instruments that turn evidence into permission to fly, how oversight is staged and delegated across a program, the in-service feedback loop that runs for decades, and a sober account of the public case where the system failed. - Certification basis and means of compliance - Staged reviews and delegation - The in-service reporting loop 12. 12 **Aerospace vs Automotive: Risk Models** Two grammars for the same fear. A single worst-credible-effect judgment with a numeric objective on one side, three discretized parameters and an ASIL on the other, and the definitive statement of why the two ladders do not convert. - Failure condition vs hazardous event - Where exposure and the human live - The DAL to ASIL mapping trap 13. 13 **Aerospace vs Automotive: Metrics and Mechanisms** What each domain counts and what each domain builds. There is no SPFM, LFM or PMHF in aerospace and no per-condition numeric budget in ISO 26262, yet both write the same latent fault physics and pull different levers on it. - Metrics that do not cross the aisle - Number literacy and unit traps - Two mechanism cultures 14. 14 **Aerospace vs Automotive: Process and Ecosystem** The system around the engineering: who checks and how often, the volume and cost arithmetic that decides which architectures are affordable, how the two supply chains distribute safety work, and the two learning cultures. - Oversight geometries - Volume economics - Five imports worth stealing 15. 15 **The One-Page Story** The whole machine running as one machine, traced through a single illustrative pitch-control function from the hazard sentence to the directive that still watches it decades later, followed by the reference card to come back to. - End-to-end illustrative rail - Consolidated reference card - Where to read the primary sources Built for ## Who this guide is for - ISO 26262 engineers working on fail-operational steering, braking or automated driving architectures - Safety managers who have to answer cross-domain questions about DO-178C, DO-254 or DAL claims - Suppliers moving parts, platforms or people between automotive and aerospace programs - Architects evaluating redundancy, voting and partitioning patterns for mixed-criticality platforms - Anyone who needs the honest version of "how does aviation do it" rather than aviation worship ## Frequently Asked Questions Common questions about Aerospace Functional Safety Because for the functions that keep an aircraft flying, cutting power is not a safe state, it is a handover. Some functions can fail passively or be shed when their loss is acceptable, but where a required capability must remain available until landing, availability itself becomes part of the safety property. That single constraint explains why the domain invests in voting, monitoring, dissimilarity and graceful degradation ladders instead of detect-and-shut-down. It is also why automated driving programs, which remove the driver who made the controlled stop cheap, keep rediscovering the same architecture vocabulary at automotive cost points. No, and the mirror image is also true. Aerospace never defined item-level architectural metrics: each failure condition carries a probability objective, the preliminary assessment breaks that objective into allocations, and the system safety assessment closes it with a quantified fault tree whose basic events come from component failure rate data and service experience. ISO 26262 attaches no numeric probability target to a hazardous event and instead measures the item with SPFM, LFM and PMHF. Chapter 13 walks both sides, including the shared latent fault physics underneath, and flags the unit traps that make careless cross-domain comparisons look rigorous while meaning nothing. Fifteen chapters. The first eleven build the aviation stack: why no safe state is reachable in flight, the authorities and standards, failure conditions and their probability targets, the safety assessment chain, development assurance and DALs, DO-178C software assurance, DO-254 and environmental qualification, common cause analysis, fly-by-wire architectures, integrated modular avionics and partitioning, and certification in practice with its in-service loop. Three comparison chapters then put aerospace and ISO 26262 side by side on risk models, on metrics and mechanisms, and on process and ecosystem. A closing chapter runs one illustrative function end to end and leaves you a reference card. No. It is educational material built from public regulatory text, public standards overviews, published accident investigations and the open engineering literature, and it says so explicitly on the page. It explains and paraphrases in its own words rather than reproducing clause text, requirement wording or determination tables from purchased standards. Revisions and accepted means of compliance vary by project and jurisdiction, so it does not replace the standards themselves or agreement with the applicable certification authority. ## Start the course today A free account unlocks one full concept guide, 3 work product templates, 1 guided process, the Markov simulator, and 5 practice exams per month. The Pro and Expert plans unlock more of the 78-guide library. No credit card required. [Start learning](https://iso26262.academy/register?plan=free&from=%2Fconcepts%2Faerospace-functional-safety&utm_source=website&utm_medium=cta&utm_campaign=features_concepts) [View Pricing Plans](https://iso26262.academy/pricing)