ARP4761A surveillance
ARP4761A safety assessment evidence review for surveillance equipment
This review reads a surveillance equipment package against ARP4761A and reports the safety-assessment gaps a reviewer would raise. It is meant for the supplier's safety or certification team, run before submittal or during a finding response. It examines the hazards tied to transponder and ADS-B behavior, the failure analysis behind their classification, and the trace between the safety requirements and the failure conditions that produced them. You leave with a standards map, a gap list, and an ordered path to close the open objectives.
When this review is needed
- A surveillance equipment package needs its ARP4761A safety-assessment posture read before submittal.
- The hazard of transmitting false position through ADS-B was assessed lightly and a reviewer wants it substantiated.
- Failure analysis does not distinguish a transponder that stays silent from one that reports incorrect data.
- A finding response depends on knowing which surveillance safety objectives the current analysis answers.
The problem
Surveillance equipment can create a hazard for aircraft other than the one it is fitted to, because a transponder or ADS-B unit that broadcasts wrong position feeds the wider air-traffic picture. Safety assessments built around the host aircraft often underweight that external effect, and the failure analysis rarely separates a unit going silent from one confidently reporting bad data. Those are different conditions with different consequences, and folding them together produces a classification ARP4761A will not accept.
What gets reviewed
- Functional hazard assessment covering effects on other aircraft, not only the host
- Failure analysis separating loss of transmission from erroneous transmission
- Severity classification for false-position and false-identity conditions
- Safety requirements traced to the surveillance failure conditions that generated them
- The link between the safety assessment and the development-assurance evidence it drives
- Configuration control so the assessed and submitted baselines match
What gets validated
- The hazard assessment accounts for effects on other aircraft, not just the host installation
- Loss of transmission and erroneous transmission are assessed as distinct failure conditions
- The severity assigned to a false-position or false-identity condition is supported by analysis
- Safety requirements trace to the surveillance failure conditions they address
- The safety assessment and development-assurance evidence reference a consistent function set
Evidence normally required
- The surveillance equipment certification plan and its ARP4761A objectives
- The functional hazard assessment and supporting failure analysis
- Safety requirement sets with their origin traceability
- Any analysis of external effects on surrounding traffic
- The development-assurance evidence the safety assessment feeds
Common discrepancies
- A hazard assessment scoped to the host aircraft that overlooks the effect of false position on other traffic
- Loss of transmission and erroneous transmission classified as a single condition
- A false-identity severity asserted without failure analysis behind it
- A safety requirement that does not trace to a surveillance failure condition
What is at stake
An external-effect hazard that is understated because the assessment stayed host-centric draws a finding that reopens the classification and its allocations. A silent transponder and a mis-reporting one carry different severities, so an analysis that treats them alike leaves at least one condition wrongly rated, and the rework lands late in the program.
Move from findings to resolution
Identify gaps against the means of compliance.
How the work runs
Widen the hazard scope
Check that the assessment covers the effect of surveillance output on surrounding traffic, not only the host aircraft.
Separate silence from error
Distinguish loss of transmission from erroneous transmission and assess each on its own.
Support the severities
Confirm failure analysis backs the classification of false-position and false-identity conditions.
Order the closures
Sequence so the widened hazard scope precedes the requirement traces built on it.
What the buyer receives
- A standards map tying each ARP4761A objective to the surveillance safety evidence that answers it
- A gap list naming the understated external hazard or conflated failure condition for each open objective
- A closure order that widens the hazard scope before the requirement traces above it
Who uses the output
- Safety and certification engineers assembling the surveillance submittal
- Engineering leads deciding how to scope the external-effect hazard
- Compliance managers tracking safety-objective closure before a finding response
How the work fits into the transaction or program
The review runs before submittal or after a first finding, giving the surveillance team a clear read on whether the assessment captures the external effect that makes surveillance hazards distinctive. Its closure order steers the certification plan to widen the hazard scope first, before the requirement traces that follow from it.
Start with a single asset
Confirm requirements trace through verification.
Jurisdiction-specific considerations
FAA and EASA both scrutinize false-position and false-identity behavior given its effect on the traffic system, and the mandates each references can shape how the hazard is framed. The review notes where an assessment sufficient for one authority may need a wider external-effect treatment for the other.
Regulatory limits
The review maps evidence to ARP4761A objectives and identifies gaps. It does not set a hazard classification on the authority's behalf, agree a compliance finding, or make an airworthiness determination on the surveillance equipment.
What this review does not cover
- Authoring the functional hazard assessment or failure analysis
- Modeling the external air-traffic effects itself
- Agreeing the safety classification with the authority
Specific to this review
- Surveillance hazards are unusual in that the worst case affects other aircraft, so a host-centric safety assessment misses the condition that drives the classification.
- A silent transponder and one confidently broadcasting wrong data are different failure conditions, and treating them as one is a frequent ARP4761A finding.
- False identity, not just false position, is a distinct surveillance failure condition that host-focused assessments routinely omit.
Sources
SAE International. Safety assessment methods (FHA, PSSA, SSA, FTA, FMEA) supporting development assurance level assignment.
SAE International. Development assurance process at aircraft and system level, including requirements capture and validation.
U.S. Government (eCFR). Type certificates, STCs (Subpart E), TSO authorizations (Subpart O), PMA (Subpart K), and export airworthiness approvals (Subpart L).
Frequently asked questions
Our assessment covers failures on our own aircraft. Isn't that the scope?
For most equipment it is, but surveillance output feeds the wider traffic picture, so a transponder or ADS-B failure can create a hazard for other aircraft. ARP4761A expects that external effect to be assessed, and an assessment scoped only to the host will read as incomplete.
Relevant glossary terms
Related pages
Where this fits
Talk to an engineer who has done this work
We will walk through your current state, the records or evidence involved, and a scoped first engagement.
Talk through the aircraft, records, evidence, deadline, and next useful step.