SAE AIR5120 - 6 -
The entry into service and support and maturation of an EMS will affect the reliability and validity of the system. If use of
the functions is not fully integrated into the in-service environment, the overall reliability and validity of the system will be
compromised. Issues related to integration into service and support and maturation are addressed in Sections 6 and 7.
3.2 General Validity and Reliability Requirements
EMS reliability needs to be evaluated at the system functional level in contrast to evaluating the inherent reliability of each
hardware and software element. An EMS cannot be more reliable than its most unreliable hardware or software element.
This is still true if the system includes redundancy to accommodate element malfunction.
EMS reliability is a function of ‘false alarms’ and ‘missed detections’. False Alarms lead to time and money being spent
verifying or trouble shooting a problem that does not exist. Although specific requirements are system and operator
dependent, the target EMS false alarm rate on some of today’s applications is no more than 2% of all the
messages/alarms generated as a result of the faults monitored by the EMS. Provisions should be made during the
requirements phase to consider the impact on the ROI and optimize accordingly.
EMS ‘missed detections’ result in equipment problems that go undetected. Missed detections generally have less impact
than ‘false alarms’ since most equipment is designed to degrade slowly and equipment problems are eventually detected
by the EMS or by the operating or maintenance crews. EMS ‘missed detections’ only become significant if the problem
causes severe secondary damage or catastrophic equipment failure. Failure modes associated with severe or
catastrophic failure usually make up only a small percentage of the equipment failure rate. Typically, these failure modes
are well scrutinized during the EMS system design to avoid missed detections. This scrutiny is driven by the criticality of
these failure modes and usually results in the EMS functions for these failure modes becoming part of the flight critical
crew alerting system.
False Alarms have a far greater potential of negative consequences than Missed Detections. Therefore, as a guiding
principle, EMS designers should focus considerable effort on avoiding false alarms even to the extent that missed
detections are tolerated. As will be discussed later in this document, the EMS designer (in conjunction with the OEM)
must make many decisions during the system and hardware/software design phases that directly impact reliability.
4. DESIGN AND DEVELOPMENT ACTIVITIES
4.1 System Specification
The operator/customer/OEM, in conjunction with the EMS designer, will normally create a system specification that
defines the requirements of the overall system. It is recommended that EMS reliability and validity requirements be
specified as part of the system specification. Specifications should include acceptable false alarm and missed detection
rates, detection and diagnostic capabilities, and key implementation requirements (i.e., hardware, software and system
integration). In each case, it is important that the system specification clearly identifies the requirements so that the
system configuration and approach are selected to ensure that the requirements are met. The integration of the EMS with
other existing or planned aircraft or engine systems such as the engine control, aircraft busses, and logistics management
systems should also be clearly identified. Dependency on other systems has to be considered in the design and testing of
the EMS and will have an effect on the reliability and validity of the system.
The system specification should also identify how the EMS information and data will be integrated into and used in the
engine’s operational and maintenance procedures. The reliability of the EMS in meeting the target improvement in LCC
will be affected by how the data and information is used. Particular attention should be paid to interface architecture since
different suppliers or organizations are often responsible for portions of the system to be integrated. All these activities
have to be carried out with the engine Design Authority (DA/OEM).
Each specific application will carry slightly different reliability and validity goals determined by safety, cost and ROI
considerations. These reliability and validity goals need to be established in the early stages of the design process and
can then be used by the EMS designer to determine the implementation, hardware and software architectures, and
testing levels.
The Acceptance Test Specification should be developed once the system specification has been prepared. This should
include testing to address the reliability and validity requirements.