Equivalent Level Of Safety

Equivalent Level of Safety (systems-engineering-safety/certification/equivalent-level-of-safety)

Use when the task is an Equivalent Level of Safety (ELOS) finding for a certification item whose design cannot show literal compliance with an applicable airworthiness regulation paragraph: the design meets the intent of the rule through compensating measures instead. This leaf implements the ELOS deviation-finding analysis in pure Python, stdlib only: regulation intent lookup, probability safety margin, compensation coverage and the finding recommendation. It pairs with systems-engineering-safety/certification/certification-basis (the applicable parts and the path), with systems-engineering-safety/certification/means-of-compliance (the MOC that carries the finding evidence) and with avionics/far-cs25/special-conditions (the novel-feature route this leaf is not). It takes the regulation item and the achieved safety level as given and evaluates the deviation.

Domain quick reference

• Regulation intent table (module constant INTENT_TABLE, paraphrase of the safety objective, never verbatim rule text):
  • 25.1309 quantitative: catastrophic target 1e-9 per flight hour, hazardous 1e-7, major 1e-5, targets keyed by the failure condition severity supplied as input.
  • 25.671 qualitative, intent severity hazardous: control system failure must not prevent continued safe flight and landing.
  • 23.1309 quantitative, normal category, same target table shape.
  • 25.683 qualitative, intent severity hazardous: control operation must not be adversely affected by structural deformation.
  • Any other paragraph is qualitative and needs an intent description override; intent severity defaults to major.
• Safety margin: margin = target / achieved probability per flight hour. Margin 1.0 is the typical ELOS acceptance line (achieved at or better than target); the finding is always authority-approved in practice.
• Margin in dB: margin_db = 10 * log10(target / achieved).
• Expected compensating measures (EXPECTED_MEASURES, by severity and quantitative flag): catastrophic 3 quantitative / 2 qualitative, hazardous 2 quantitative / 1 qualitative, major 2, minor and none 1.
• Compensation coverage: coverage = accepted measure types / expected count, capped at 1.0. Accepted types come from the MEASURE_RULES table: redundancy anchors quantitative catastrophic, hazardous and major items and any qualitative item; monitoring is accepted only with redundancy or an operating limitation; an operating limitation applies to qualitative items and needs a flight crew procedure; a flight crew procedure is accepted with redundancy or an operating limitation; a maintenance action counts only when it restores a degraded function before the next flight; an inspection interval counts for fatigue and aging items only (25.571, 25.573, 23.571).
• Verdict ladder (elos_verdict): quantitative items PASS with margin >= 1.0 and coverage >= 1.0 and FAIL when margin < 1.0 regardless of measures; qualitative items PASS with coverage >= 1.0 and no primary safety function gap (redundancy or monitoring missing blocks the recommendation). Coverage between 0.5 and 1.0 is CONDITIONAL, below 0.5 is FAIL. Verdict text: PASS is finding recommended, CONDITIONAL is finding conditional, FAIL is finding not supportable.

Workflow

1. Confirm the item context: the applicable regulation paragraph, the failure condition severity, and the achieved probability when the rule carries a numeric target (these come from the certification basis and the functional hazard assessment; this leaf does not re-derive them).
2. State the regulation intent with intent_for(paragraph, severity). The function returns quantitative, target_prob or intent_severity and the intent text; supply intent_severity_override and intent_description_override for paragraphs outside the table.
3. Compute the numeric margin with safety_margin(target, achieved) and margin_db(target, achieved) when the item is quantitative.
4. List the compensating measures for the item and run compensation_coverage(measures, paragraph, severity), which returns the 0..1 coverage score, the accepted measure types and the gaps against the expected measure set.
5. Run elos_verdict(paragraph, severity, achieved_probability, measures, overrides...) to get the verdict dict with margin, margin_db, coverage, verdict and reasons.
6. Summarize the finding for the certification finding package with finding_summary(item, verdict).

Worked example

A yaw damper channel cannot show literal compliance with 25.1309 at the catastrophic failure condition. Severity catastrophic, achieved probability 2e-10 per flight hour, compensating measures redundant-lane-monitoring and flight-crew-procedure:

• Intent: 25.1309 is quantitative; the catastrophic target is 1e-9 per flight hour (intent_for target_prob 1e-9).
• Margin: safety_margin(1e-9, 2e-10) = 5.0, margin_db 6.99 dB. The achieved 2e-10 is five times better than the 1e-9 target.
• Coverage: expected 3 measures for a catastrophic quantitative item; redundancy accepted, flight crew procedure accepted (paired with redundancy), monitoring missing. Coverage 2/3 = 0.667.
• Verdict: CONDITIONAL, with the missing monitoring measure in the reasons list.
• Add failure-monitoring as a third measure: monitoring is now accepted (redundancy present), coverage 1.0, verdict PASS (finding recommended). Summary: "ELOS finding for paragraph 25.1309 at catastrophic severity: safety margin 5.0 (6.99 dB) against the probability target. compensating measure coverage 1.0. verdict PASS (finding recommended)."

Second case, same item with achieved probability 3e-9: margin 0.333 below the 1.0 acceptance line, verdict FAIL with the margin reason regardless of measures. Third case, qualitative 25.671 control system item at hazardous severity with redundant-actuation and jam-detection-monitoring and no numeric probability: expected 1 measure, redundancy accepted and monitoring accepted with it, coverage 1.0, verdict PASS. Fourth case, inputs that raise ValueError: severity very-bad, and achieved probability 0 for a quantitative item.

Verification

• Confirm intent_for("25.1309", "catastrophic") returns quantitative with target_prob 1e-9 and that the hazardous and major severities key to 1e-7 and 1e-5.
• Confirm safety_margin(1e-9, 2e-10) returns exactly 5.0 and margin_db returns 6.99 dB (10 * log10(5)).
• Confirm the compensation rules per measure type: monitoring rejected without redundancy, operating limitation rejected without a crew procedure, maintenance action without a restore-before-next-flight qualifier rejected, inspection interval rejected off fatigue and aging items.
• Confirm the verdict branches: coverage 0.667 with a monitoring gap is CONDITIONAL and reaches PASS once monitoring is added; margin 0.333 is FAIL; coverage below 0.5 is FAIL; a primary safety function gap blocks a qualitative PASS.
• Confirm every non-physical input raises ValueError: unknown severity, non-positive or non-finite achieved probability on a quantitative item, non-positive or non-finite margin inputs, and an unknown paragraph with no overrides.
• Run the contract test offline: python3 scripts/test_equivalent_level_of_safety.py (34 tests, deterministic).

Related leaves

• systems-engineering-safety/certification/certification-basis: the applicable regulations and certification path that frame the item.
• systems-engineering-safety/certification/means-of-compliance: the MOC that carries the ELOS finding evidence in the compliance matrix.
• avionics/far-cs25/special-conditions: the FAR 25.17 / CS 25.17 novel feature special condition route, which this leaf does not use.
• systems-engineering-safety/arp4761a/functional-hazard-assessment: the severity rating and probability target inputs for the item.

Pitfalls

• Reading the verdict from coverage alone: a quantitative item with margin below 1.0 (the 3e-9 achieved case, margin 0.333) FAILs regardless of how many compensating measures are listed - the probability gap cannot be bought back by coverage.
• Accepting measures that the rules reject: monitoring without redundancy or an operating limitation, an operating limitation without a flight crew procedure, a maintenance action without a restore-before-next-flight qualifier, and an inspection interval off fatigue and aging items (25.571, 25.573, 23.571) all fail acceptance and reopen the coverage gap.
• Passing a qualitative item with a primary safety function gap: a missing redundancy or monitoring element blocks the recommendation even when coverage otherwise reaches 1.0.
• Forgetting the severity-keyed targets: the 25.1309 quantitative intent keys 1e-9 catastrophic, 1e-7 hazardous and 1e-5 major to the failure condition severity, so scoring a hazardous condition against the catastrophic target misstates the margin by two orders of magnitude.
• Treating a finding as self-approving: margin 1.0 is the typical ELOS acceptance line, but the finding is authority-approved in practice - this analysis recommends; it does not issue the finding.
• Calling this leaf for the novel-feature route or without inputs: ELOS is distinct from the FAR 25.17 / CS 25.17 special conditions path, takes the regulation item, severity and achieved safety level as given (it does not re-derive the FHA), and an unknown paragraph with no intent overrides raises ValueError.

Behavior contract (gate 3)

Run the deterministic contract test (stdlib unittest, offline):

python3 scripts/test_equivalent_level_of_safety.py

The test covers the intent table lookups and the override path, margin math and the dB conversion with the round-trip identity, measure type classification precedence, the compensation acceptance rules per measure type, the worked example anchors (margin 5.0 with coverage 2/3 CONDITIONAL turning PASS when monitoring is added, the 3e-9 margin FAIL, the qualitative 25.671 PASS), coverage capping, the primary safety function gate, and ValueError rejection of non-physical inputs.

Compliance

• Standards referenced, not reproduced: the intent table is a paraphrased summary at reference level of FAR-25 and CS-25 rule intent (25.1309, 25.671, 25.683 and the CS-25 counterparts), with no verbatim rule text.
• compliance: STANDARDS-REF, gated: false.