SAE ARP4761A / EUROCAE ED-135 — Guidelines for Conducting the Safety Assessment Process
Issuing body: SAE International (jointly with EUROCAE as ED-135). Recognised by: FAA via AC 25.1309-1A (Arsenic) lineage and project certification plans; EASA via AMC 25.1309. Invoked as the means of compliance with 14 CFR 25.1309 / CS-25.1309 (equipment, systems, and installations). Jurisdiction: International.
Edition note: the catalogue record names ARP4761 (1996). The current edition is ARP4761A / ED-135, issued 20 December 2023 — the first revision in 27 years, developed jointly with ARP4754B. This brief covers the current A revision. The manifest maps the record to this brief.
What it is
ARP4761A is the industry standard method for the safety assessment process: the systematic analysis that proves an aircraft's systems are safe enough — that catastrophic failures are "extremely improbable" and hazardous ones "extremely remote," in the quantitative language of 25.1309. It defines a structured sequence of analyses performed across the development life cycle, each feeding the next, producing the safety case the authority reviews. Every transport-airplane program runs this process; it is the single most examined artifact in a certification audit after the type design itself.
Scope: who it applies to
System safety engineers, aircraft/system developers, and integrators on programs subject to 25.1309/CS-25.1309 — transport airplanes, and by extension Part 23/27/29 and eVTOL programs that invoke the same safety objectives. Triggers: new aircraft development, new systems, and any change whose failure effects need re-evaluation.
Key requirements and compliance obligations (the process chain)
- Aircraft Functional Hazard Assessment (AFHA) — new as a formal step in A: identify aircraft-level functions and classify the severity of their loss/malfunction (catastrophic through minor).
- System Functional Hazard Assessment (SFHA) — the former single FHA, now the system-level counterpart: failure conditions for each system function, with severity classification.
- Preliminary Aircraft Safety Assessment (PASA) and Preliminary System Safety Assessment (PSSA) — allocate safety requirements (including DAL assignments) to architecture; verify the proposed architecture can meet the FHA-derived objectives before detailed design.
- Aircraft Safety Assessment (ASA) and System Safety Assessment (SSA) — the closing verification: fault trees, Markov analyses, and dependency analyses demonstrating the as-built design meets the quantitative targets (e.g., ≤10⁻⁹ per flight hour for catastrophic).
- Analytical methods:
- Fault Tree Analysis (FTA) — top-down deductive analysis of failure-condition causes.
- Failure Modes and Effects (and Criticality) Analysis — FMEA/FMECA — bottom-up inductive analysis.
- Common Mode Analysis (CMA) — including zonal safety analysis (ZSA) and particular risk analysis (PRA): lightning, HIRF, fire, uncontained engine failure, bird strike.
- Cascading Effects Analysis (CEA) — new formal method in A.
- Model-Based Safety Analysis (MBSA) — new formal method in A, aligning safety analysis with model-based systems engineering.
- DAL assignment — FDAL/IDAL assignment appendix (new in A) standardises how assurance levels flow from severity classifications.
- In-service loop: ARP4761A covers development; in-service safety assessment is addressed by ARP5150A/ARP5151A (referenced, not covered).
Quantitative targets the process must meet (from 25.1309/AMC): catastrophic — extremely improbable (≤10⁻⁹/fh); hazardous — extremely remote (≤10⁻⁷/fh); major — remote (≤10⁻⁵/fh). Single failures must not cause catastrophic conditions (fail-safe design principle).
Penalties and consequences of non-compliance
Certification-gate enforcement: an inadequate safety assessment blocks the 25.1309 compliance finding and therefore type certification. Post-certification discovery of unassessed hazards drives ADs; systematic concealment is certification fraud.
Version / edition status and live changes (verified 2026-09-30)
- Current: ARP4761A / ED-135 (20 December 2023). Supersedes ARP4761 (1996). Key deltas: AFHA/PASA/ASA aircraft-level processes formalised; MBSA and CEA added; FDAL/IDAL appendix added; title broadened from "airborne" to "aircraft."
- Industry is mid-migration: major OEMs are updating internal safety processes from ARP4761 to ARP4761A. New programs should plan on A; in-flight programs under the 1996 edition should agree transition terms with their authority.
- No further revision announced.
Related certifications (from the engineering catalogue)
Aerospace flagship/license certifications (A&P, CEng via RAeS) do not test ARP4761A. System-safety competence is employer/role-based. Flagged honestly.
Honest flags
- Quantitative probability targets come from 25.1309/AMC 25.1309, not from ARP4761A itself — the standard provides the method, the regulation provides the targets.
Original ETS reference writing, verified against public sources on 2026-09-30. Thin sourcing is flagged inline. Not legal advice — confirm current editions with the issuing body.