4 Effects of failures or malfunction

 The limits of safe operation, special handling procedures and any operational restrictions should be examined and developed as a result of full-scale trials conducted by simulating possible equipment failures.

 The failures to be examined should be those leading to major or more severe effects as determined from evaluation of FMEA or similar analysis.

 Failures to be examined should be agreed between the craft manufacturer and the Administration and each single failure should be examined in a progressive manner.

 Examination of each failure should result in:

• .1 determining safe limits of craft operation at the time of failure, beyond which the failure will result in degradation beyond safety level 2;

• .2 determining crew member's actions, if any, to minimize or counter the effect of the failure; and

• .3 determining craft or machinery restrictions to be observed to enable the craft to proceed to a place of refuge with the failure present.

 Equipment failures should include, but not be limited to, the following:

• .1 total loss of propulsion power;

• .2 total loss of lift power (for ACV and SES);

• .3 total failure of control of one propulsion system;

• .4 involuntary application of full propulsion thrust (positive or negative) on one system;

• .5 failure of control of one directional control system;

• .6 involuntary full deflection of one directional control system;

• .7 failure of control of trim control system;

• .8 involuntary full deflection of one trim control system element; and

• .9 total loss of electrical power.

Failures should be fully representative of service conditions and should be simulated as accurately as possible in the most critical craft manoeuvre where the failure will have maximum impact.

 In order to establish craft motions and direction of laying to wind and waves, for the purposes of determining the conditions of a craft evacuation, the craft should be stopped and all main machinery shut down for sufficient time that the craft's heading relative to wind and waves has stabilized. This test should be carried out on an opportunity basis to establish patterns of the design's "dead ship" behaviour under a variety of wind and sea states.