SAE ARP4754B / ED-79B - Guidelines for Development of Civil Aircraft and Systems 5.2.3.2: 5.2.3.2 FDAL assignment with architecture consideration and functional failure sets

When a top-level function is split across two or more sub-functions that are independent, so that no one sub-function alone causes the top-level hazard, at least one may receive an FDAL below the top-level FDAL, although some allocations still require the full level. The prerequisites are the functional failure sets (FFS), their members and their independence: safety assessment identifies every FFS leading to each top-level failure condition, using qualitative analyses such as fault trees or dependence diagrams. An FFS is the development-error counterpart of a minimal cut set: a set of members whose potential development errors together cause the top-level condition; a failure condition may have one or several FFS, each with one or several members.