# Equivalent Level Of Safety > Use when you must develop an Equivalent Level of Safety (ELOS) finding for a civil aircraft or system certification item that cannot show literal compliance with an applicable airworthiness regulation paragraph: state the regulation intent and its safety objective, quantify or qualify the achieved safety level of the design, list the compensating measures that close the gap, compute the safety margin against the numeric probability target (25.1309 catastrophic 1e-9 per flight hour) when the rule is quantitative, and return the finding recommendation (finding recommended, conditional, or not supportable) with the reasons list. Produces the per-item ELOS assessment with margin, compensation coverage and the verdict that gates the certification finding package. Trigger: equivalent level of safety, ELOS finding, deviation finding, regulation intent, compensating measure, non-literal compliance, safety margin, 21.21. - Skill: `ashfordeou/equivalent-level-of-safety` (Agent Skill, multi-file: 3 files) - Install (CLI): `npx skillmds@latest add ashfordeou/equivalent-level-of-safety` - Raw SKILL.md: https://api.skillmd.com/api/skills/ashfordeou/equivalent-level-of-safety/raw - Safety review: pending - Works with: Claude Code, Claude.ai, OpenAI Codex - Category: Coding & Dev Tools - License: Apache-2.0 - Author: ashfordeOU (https://skillmd.com/u/ashfordeou) - Updated: 2026-09-17 - Page: https://skillmd.com/skills/ashfordeou/equivalent-level-of-safety --- # Equivalent Level of Safety (systems-engineering-safety/certification/equivalent-level-of-safety) Use when the task is an Equivalent Level of Safety (ELOS) finding for a certification item whose design cannot show literal compliance with an applicable airworthiness regulation paragraph: the design meets the intent of the rule through compensating measures instead. This leaf implements the ELOS deviation-finding analysis in pure Python, stdlib only: regulation intent lookup, probability safety margin, compensation coverage and the finding recommendation. It pairs with systems-engineering-safety/certification/certification-basis (the applicable parts and the path), with systems-engineering-safety/certification/means-of-compliance (the MOC that carries the finding evidence) and with avionics/far-cs25/special-conditions (the novel-feature route this leaf is not). It takes the regulation item and the achieved safety level as given and evaluates the deviation. ## Domain quick reference - Regulation intent table (module constant INTENT_TABLE, paraphrase of the safety objective, never verbatim rule text): - 25.1309 quantitative: catastrophic target 1e-9 per flight hour, hazardous 1e-7, major 1e-5, targets keyed by the failure condition severity supplied as input. - 25.671 qualitative, intent severity hazardous: control system failure must not prevent continued safe flight and landing. - 23.1309 quantitative, normal category, same target table shape. - 25.683 qualitative, intent severity hazardous: control operation must not be adversely affected by structural deformation. - Any other paragraph is qualitative and needs an intent description override; intent severity defaults to major. - Safety margin: margin = target / achieved probability per flight hour. Margin 1.0 is the typical ELOS acceptance line (achieved at or better than target); the finding is always authority-approved in practice. - Margin in dB: margin_db = 10 * log10(target / achieved). - Expected compensating measures (EXPECTED_MEASURES, by severity and quantitative flag): catastrophic 3 quantitative / 2 qualitative, hazardous 2 quantitative / 1 qualitative, major 2, minor and none 1. - Compensation coverage: coverage = accepted measure types / expected count, capped at 1.0. Accepted types come from the MEASURE_RULES table: redundancy anchors quantitative catastrophic, hazardous and major items and any qualitative item; monitoring is accepted only with redundancy or an operating limitation; an operating limitation applies to qualitative items and needs a flight crew procedure; a flight crew procedure is accepted with redundancy or an operating limitation; a maintenance action counts only when it restores a degraded function before the next flight; an inspection interval counts for fatigue and aging items only (25.571, 25.573, 23.571). - Verdict ladder (elos_verdict): quantitative items PASS with margin >= 1.0 and coverage >= 1.0 and FAIL when margin < 1.0 regardless of measures; qualitative items PASS with coverage >= 1.0 and no primary safety function gap (redundancy or monitoring missing blocks the recommendation). Coverage between 0.5 and 1.0 is CONDITIONAL, below 0.5 is FAIL. Verdict text: PASS is finding recommended, CONDITIONAL is finding conditional, FAIL is finding not supportable. ## Workflow 1. Confirm the item context: the applicable regulation paragraph, the failure condition severity, and the achieved probability when the rule carries a numeric target (these come from the certification basis and the functional hazard assessment; this leaf does not re-derive them). 2. State the regulation intent with intent_for(paragraph, severity). The function returns quantitative, target_prob or intent_severity and the intent text; supply intent_severity_override and intent_description_override for paragraphs outside the table. 3. Compute the numeric margin with safety_margin(target, achieved) and margin_db(target, achieved) when the item is quantitative. 4. List the compensating measures for the item and run compensation_coverage(measures, paragraph, severity), which returns the 0..1 coverage score, the accepted measure types and the gaps against the expected measure set. 5. Run elos_verdict(paragraph, severity, achieved_probability, measures, overrides...) to get the verdict dict with margin, margin_db, coverage, verdict and reasons. 6. Summarize the finding for the certification finding package with finding_summary(item, verdict). ## Worked example A yaw damper channel cannot show literal compliance with 25.1309 at the catastrophic failure condition. Severity catastrophic, achieved probability 2e-10 per flight hour, compensating measures redundant-lane-monitoring and flight-crew-procedure: - Intent: 25.1309 is quantitative; the catastrophic target is 1e-9 per flight hour (intent_for target_prob 1e-9). - Margin: safety_margin(1e-9, 2e-10) = 5.0, margin_db 6.99 dB. The achieved 2e-10 is five times better than the 1e-9 target. - Coverage: expected 3 measures for a catastrophic quantitative item; redundancy accepted, flight crew procedure accepted (paired with redundancy), monitoring missing. Coverage 2/3 = 0.667. - Verdict: CONDITIONAL, with the missing monitoring measure in the reasons list. - Add failure-monitoring as a third measure: monitoring is now accepted (redundancy present), coverage 1.0, verdict PASS (finding recommended). Summary: "ELOS finding for paragraph 25.1309 at catastrophic severity: safety margin 5.0 (6.99 dB) against the probability target. compensating measure coverage 1.0. verdict PASS (finding recommended)." Second case, same item with achieved probability 3e-9: margin 0.333 below the 1.0 acceptance line, verdict FAIL with the margin reason regardless of measures. Third case, qualitative 25.671 control system item at hazardous severity with redundant-actuation and jam-detection-monitoring and no numeric probability: expected 1 measure, redundancy accepted and monitoring accepted with it, coverage 1.0, verdict PASS. Fourth case, inputs that raise ValueError: severity very-bad, and achieved probability 0 for a quantitative item. ## Verification - Confirm intent_for("25.1309", "catastrophic") returns quantitative with target_prob 1e-9 and that the hazardous and major severities key to 1e-7 and 1e-5. - Confirm safety_margin(1e-9, 2e-10) returns exactly 5.0 and margin_db returns 6.99 dB (10 * log10(5)). - Confirm the compensation rules per measure type: monitoring rejected without redundancy, operating limitation rejected without a crew procedure, maintenance action without a restore-before-next-flight qualifier rejected, inspection interval rejected off fatigue and aging items. - Confirm the verdict branches: coverage 0.667 with a monitoring gap is CONDITIONAL and reaches PASS once monitoring is added; margin 0.333 is FAIL; coverage below 0.5 is FAIL; a primary safety function gap blocks a qualitative PASS. - Confirm every non-physical input raises ValueError: unknown severity, non-positive or non-finite achieved probability on a quantitative item, non-positive or non-finite margin inputs, and an unknown paragraph with no overrides. - Run the contract test offline: python3 scripts/test_equivalent_level_of_safety.py (34 tests, deterministic). ## Related leaves - systems-engineering-safety/certification/certification-basis: the applicable regulations and certification path that frame the item. - systems-engineering-safety/certification/means-of-compliance: the MOC that carries the ELOS finding evidence in the compliance matrix. - avionics/far-cs25/special-conditions: the FAR 25.17 / CS 25.17 novel feature special condition route, which this leaf does not use. - systems-engineering-safety/arp4761a/functional-hazard-assessment: the severity rating and probability target inputs for the item. ## Pitfalls - Reading the verdict from coverage alone: a quantitative item with margin below 1.0 (the 3e-9 achieved case, margin 0.333) FAILs regardless of how many compensating measures are listed - the probability gap cannot be bought back by coverage. - Accepting measures that the rules reject: monitoring without redundancy or an operating limitation, an operating limitation without a flight crew procedure, a maintenance action without a restore-before-next-flight qualifier, and an inspection interval off fatigue and aging items (25.571, 25.573, 23.571) all fail acceptance and reopen the coverage gap. - Passing a qualitative item with a primary safety function gap: a missing redundancy or monitoring element blocks the recommendation even when coverage otherwise reaches 1.0. - Forgetting the severity-keyed targets: the 25.1309 quantitative intent keys 1e-9 catastrophic, 1e-7 hazardous and 1e-5 major to the failure condition severity, so scoring a hazardous condition against the catastrophic target misstates the margin by two orders of magnitude. - Treating a finding as self-approving: margin 1.0 is the typical ELOS acceptance line, but the finding is authority-approved in practice - this analysis recommends; it does not issue the finding. - Calling this leaf for the novel-feature route or without inputs: ELOS is distinct from the FAR 25.17 / CS 25.17 special conditions path, takes the regulation item, severity and achieved safety level as given (it does not re-derive the FHA), and an unknown paragraph with no intent overrides raises ValueError. ## Behavior contract (gate 3) Run the deterministic contract test (stdlib unittest, offline): python3 scripts/test_equivalent_level_of_safety.py The test covers the intent table lookups and the override path, margin math and the dB conversion with the round-trip identity, measure type classification precedence, the compensation acceptance rules per measure type, the worked example anchors (margin 5.0 with coverage 2/3 CONDITIONAL turning PASS when monitoring is added, the 3e-9 margin FAIL, the qualitative 25.671 PASS), coverage capping, the primary safety function gate, and ValueError rejection of non-physical inputs. ## Compliance - Standards referenced, not reproduced: the intent table is a paraphrased summary at reference level of FAR-25 and CS-25 rule intent (25.1309, 25.671, 25.683 and the CS-25 counterparts), with no verbatim rule text. - compliance: STANDARDS-REF, gated: false.