The risk-classification layer of the AGL Failure Database. Divisions 01–21 establish what failed, where it failed, and why it failed. Division 22 establishes how serious the failure is, what it affects, how quickly it must be addressed and what level of operational or safety consequence it creates — turning a failure record into a prioritised engineering and maintenance response.
Key principle — Every failure record should pass through this logic: Failure → Severity → Criticality → Impact → Priority → Response → Recovery → Verification. Severity asks how serious the failure is; criticality asks how important the affected function is to safety and airport operation. Recording both — plus their downstream operational, safety, maintenance, financial and regulatory impact — is what allows this division to drive corrective-action priority rather than simply describing consequence after the fact.
A failure with a very high consequence that can significantly affect aircraft operations, critical AGL functionality, safety or runway availability.
Record: failure location, affected system, number of affected fixtures/circuits, safety impact, operational impact, downtime, response time, recovery time.
A failure causing significant degradation of system availability, operational capability or maintenance condition, but not necessarily representing the highest level of criticality.
Requires priority corrective action and closer monitoring.
A failure that affects equipment or system performance but has a limited immediate operational or safety consequence.
Planned corrective maintenance, subject to airport requirements and applicable operational limits.
A failure with limited effect on equipment performance, operation or maintenance.
Can normally be handled through routine maintenance/inspection, provided no safety or operational consequence exists.
A gradual reduction in performance or condition that has not yet developed into complete failure.
This category is particularly valuable because it allows the database to identify a problem before complete failure occurs.
A failure that occurs intermittently rather than continuously.
Record failure frequency, duration, conditions when failure occurs, alarm history, environmental conditions and operating state. Intermittent failures should receive particular attention because they may progress into permanent failures.
A failure or degraded condition that is not immediately apparent during normal operation and may remain undetected until a specific inspection, test, demand condition or secondary failure exposes it.
Latent failures are particularly important in safety-related systems because a system may appear healthy while an important hidden protection or redundancy function is unavailable.
A failure with a direct or potentially significant effect on aviation safety or safety-related AGL functionality.
Depending on the applicable operational context:
Safety-critical failures should receive the highest level of technical and operational attention.
A failure that significantly affects airport operations, even where the immediate safety consequence may be limited.
Safety-critical focuses on safety consequences. Operationally critical focuses on the ability to maintain required airport operations. A failure may be safety-critical, operationally critical, or both.
A failure with no significant immediate safety or operational consequence.
"Non-critical" does not mean "ignore." It still requires appropriate recording, evaluation, maintenance and trend monitoring.
Record whether the failure affects runway availability or usable runway lighting functionality.
Determine whether the failure affects taxiway usability or required lighting functionality.
This identifies the effect on aircraft movement/operation.
This should be a mandatory field for every failure.
This is broader than aircraft operation.
A control-system communication failure may not immediately affect the physical lights but may significantly affect airport operational monitoring.
Record the extent of equipment affected.
One failed LED driver → localized equipment impact. CCR failure affecting an entire series circuit → major equipment/system impact.
Record the maintenance burden created by the failure.
Record the financial consequence of the failure.
The financial impact should be recorded separately from severity. A low-safety-impact failure can still have a high financial impact.
Record the amount and significance of equipment/system downtime.
MTTR — Mean Time To Repair, Availability, Failure duration, Repeat downtime. This connects Division 22 with the reliability and maintenance analytics divisions.
The failure causes or potentially causes non-compliance with an applicable regulatory, operational, engineering or airport requirement.
The database should identify the specific requirement affected rather than simply marking a failure as "non-compliant."
Requirements, matrices and decision logic that apply across all 20 Division 22 topics.
These terms should not be treated as identical. Severity asks how serious the failure/consequence is. Criticality asks how important the affected function is to safety and airport operation.
Example
An individual non-critical sign LED failure may have Severity: Minor, Criticality: Non-critical. A failure affecting a critical aircraft guidance function could have Severity: Critical, Criticality: Safety-critical.
Critical — immediate operational or safety risk
Major — significant availability/capability impact
Moderate — limited immediate consequence
Minor — limited effect, routine handling
Degradation / Intermittent / Latent — developing or hidden condition
Combining Severity + Safety Impact + Operational Impact determines response priority. This is a database framework, not a replacement for airport-specific operational requirements or applicable regulatory criteria.
| Severity | Safety Impact | Operational Impact | Suggested Priority |
|---|---|---|---|
| Critical | Critical | High | P1 — Immediate |
| Critical | High | High | P1 — Immediate |
| Major | High | High | P1/P2 — Urgent |
| Major | Moderate | High | P2 — Urgent |
| Moderate | Moderate | Moderate | P3 — Planned Priority |
| Minor | Low | Low | P4 — Routine |
| Degradation | Variable | Variable | Condition-based |
| Intermittent | Variable | Variable | Investigate/monitor |
| Latent | Potentially high | Potentially high | Test/verify urgently where safety-related |
| Non-critical | Low | Low | Routine |
Every failure should pass through this logic, step by step, before a final priority is assigned:
Not one of the 20 numbered topics, but added as an explicit database field because a failure with moderate consequence but very poor detectability can represent significant risk — e.g. a hidden bonding or insulation problem that produces no immediate visible outage.
These are separate, non-interchangeable measurements:
Failure detection → maintenance response
Maintenance start → repair completion
Failure occurrence → return to service
For each failure, the master record should capture the following, organised across seven blocks:
Division 22 sits above the other failure divisions as the risk/priority layer:
Recommended master database logic: Failure → Failure Mode → RCA → Root Cause → Severity → Criticality → Safety Impact → Operational Impact → Detectability → Downtime → Priority → Corrective Action → Verification → Closure. This makes Division 22 the risk and decision-making layer of the entire AGL Failure Database — ensuring the database does not merely count failures, but distinguishes between a minor component defect, a recurring degradation, a latent safety issue, a major operational outage and a truly critical AGL failure.
Quick answers about failure severity, criticality and response priority, as covered in Division 22 of the AGL Failure Database.
Division 22 is the risk-classification layer. It contains 20 published topics (FSC-01 to FSC-20) covering failure severity, behaviour, criticality, operational and safety impact, maintenance, financial and time impact, and regulatory or compliance impact, together with the priority matrix and decision logic that drive corrective-action response.
They fall into two groups of ten. Failure Classification (FSC-01 to FSC-10) covers critical, major, moderate and minor failure, degradation, intermittent and latent failure, and safety-critical, operationally critical and non-critical failure. Impact Classification (FSC-11 to FSC-20) covers runway, taxiway, aircraft-operation, safety, airport-operation, equipment, maintenance, financial, downtime and regulatory or compliance impact.
They are not identical. Severity asks how serious the failure or consequence is, while criticality asks how important the affected function is to safety and airport operation. An individual sign LED failure may be Minor severity and Non-critical, whereas a failure affecting a critical aircraft guidance function could be Critical severity and Safety-critical.
Critical means immediate operational or safety risk. Major means significant availability or capability impact. Moderate means limited immediate consequence, and Minor means limited effect with routine handling. Degradation, Intermittent and Latent describe developing or hidden conditions.
The priority matrix combines severity, safety impact and operational impact. Critical failures with critical safety impact and high operational impact are P1 (Immediate), major failures are P1/P2 or P2 (Urgent), moderate failures P3 (Planned) and minor failures P4 (Routine). Degradation is condition-based, intermittent faults are investigated and monitored, and latent failures are tested and verified urgently where safety-related. It is a database framework, not a replacement for airport-specific operational requirements or regulatory criteria.
Every failure is taken step by step through twelve questions: what failed, how severe, how it behaves, whether it is safety-critical, whether it is operationally critical, the runway or taxiway impact, the aircraft-operation impact, the airport-operation impact, the downtime, the maintenance and financial impact and the regulatory or compliance impact, before a final priority is assigned.
It is added as an explicit database field because a failure with moderate consequence but very poor detectability can represent significant risk, such as a hidden bonding or insulation problem that produces no immediate visible outage. Detectability ranges from immediately detectable through inspection, functional-test and specialised-test detection to intermittently detectable and latent or difficult to detect.
They are separate, non-interchangeable measurements. Response time runs from failure detection to maintenance response, repair time from maintenance start to repair completion, and downtime from failure occurrence to return to service.
A severity or criticality rating means little without understanding what the failed component protects — CAT I/II/III operations, runway availability, or a single non-critical fixture — real judgment means knowing the difference.
Take that knowledge further with Precision AGL Academy.
Learn how to connect:
Develop structured knowledge across AGL fundamentals, components, electrical systems, testing, photometry, troubleshooting, maintenance and commissioning.
Find the failure. Understand the cause. Build the engineering skill.
Please read before relying on any content on this page or on any record downloaded from it.