4 Effects of failures or malfunctions

  4.1.1 The limits of safe operation, special handling procedures and any operational restrictions should be examined and developed as a result of full-scale trials conducted by simulating possible equipment failures.

  4.1.2 The failures to be examined should be those leading to major or more severe effects as determined from the evaluation of the SSA in accordance with part C of these Interim Guidelines.

  4.1.3 Failures to be examined should be agreed between the craft manufacturer and the Administration and each single failure should be examined in a progressive manner.

  4.1.4 The failures to be examined should be single failure events unless a single failure has an immediate and inevitable secondary effect.

  4.1.5 If the manufacturer or Administration believes that a simulation of any failure or malfunction could endanger the craft or personnel, the effects of that failure or malfunction may be deduced by calculation and/or analysis in accordance with part C of these Interim Guidelines. In the event, the Administration may require that systems or procedures be introduced or changed to reduce the risk to a tolerable level or may impose operational limits to achieve the same result.

 Examination of each failure should result in:

• .1 Determining safe limits of craft operation at the time of failure or malfunction beyond which the failure or malfunction will result in a degradation of safety beyond a tolerable level.

• .2 Determining crew members' actions, if any, to minimize or counter the effect of the failure.

• .3 Determining craft or machinery restrictions to be observed with the failure present to enable the craft to continue to provide a place of refuge in the case of assisted and cargo craft and to enable the craft to continue to a place of refuge in the case of unassisted craft.

 Equipment failures should include, but not be limited to, the following:

• .1 total loss of propulsion power;

• .2 total loss of lift power;

• .3 total failure of control of one propulsion system;

• .4 involuntary application of full propulsion thrust (positive or negative) on one system;

• .5 failure of control of one directional control system;

• .6 involuntary full deflection of one directional control system;

• .7 failure of control of flight-trim control system;

• .8 involuntary full deflection of one flight-trim control system element;

• .9 total loss of electrical power; and

• .10 loss of flight instrumentation.

 In order to establish craft motions and direction of laying to wind and waves, for the purpose of determining the conditions of a craft evacuation, the craft should be stopped and all main machinery shut down for sufficient time that the craft's heading relative to wind and waves has stabilised. This test should be carried out on an opportunity basis to establish patterns of the design's "dead ship" behaviour under a variety of wind and sea states.

 Prior to and throughout the trial program a qualitative evaluation should be conducted as to the contribution of the operating compartment layout to the safe operation of the craft. Particular attention should be paid to the following:

• .1 operator comfort to minimise fatigue including noise, vibration levels, temperature and ventilation control;

• .2 visibility from operating position including any obstructions;

• .3 location of and forces required to operate primary controls;

• .4 accuracy and readability of all instrumentation; and

• .5 ease of use and interpretation of navigation and collision avoidance systems.