AC 27-1B, Chg 7 2/4/2014
(i) RTCA Document DO-178C, Software Considerations in Airborne Systems and Equipment Certification, dated December 13, 2011.
(ii) RTCA Document DO-254, Design Assurance Guidance for Airborne Electronic Hardware, dated April 19, 2000.
(ili) RTCA Document DO-297, Integrated Modular Avionics (IMA) Development Guidance and Certification Considerations, dated November 8, 2005.
c. Background. The FAA recognizes the importance of timely completion of an FHA to minimize TC, amended TC, STC, amended STC, and TSOA project delays and potential risks of redesigns required late in a project because of information obtained from the completed FHA. Applicants are expected to not only properly complete FHAs as early as possible to minimize the risks described above, but also obtain FAA acceptance of the FHAs.
d. When to create an FHA. The FAA expects a discussion of the FHA take place during the very early stages of the TC, amended TC, STC, amended STC project (i.e., during the Familiarization Briefing). This will provide the FAA with the necessary design safety aspects information while the development is still in the conceptual and requirements definition phases. Since the FHA process is designed to provide the system level safety and derived requirements, it is imperative that the applicant obtain FAA acceptance of the FHA as early as possible in the systems development (i.e., prior to submitting the certification plan). This will minimize the risk of the applicant's design requiring changes late in the program to satisfy safety requirements obtained from the completed FHA.
e. How to create an FHA.
(1) The process to create an FHA can be considered fairly complicated if doing it for the first time. This guidance presumes that an applicant is familiar with ARP 4761 and is looking for some additional guidance in recognizing some of the likely functions of each system and the associated failure conditions (FC) that should be reflected in a FHA. The table in Figure AC 27 MG 21-1 provides a snapshot of considerations an applicant should address when examining their design for a systematic safety review.
This table not a complete list nor are the FCs listed in the figure applicable for all designs.
(2) One additional item is the need to include a complete list of assumptions made when developing the FHA. These assumptions may include the intended aircraft (single or dual engine, existing certificated interfacing equipment), type of operation
(e.g., IFR, VFR, category A), crew composition (e.g., single pilot, dual pilot), etc. These should be listed in the front of the document prior to the functional failure conditions Page MG 21 - 2
(3) The set of tables in Figure AC 27 MG 21-1 provides examples of a format for the system level FHA as identified in the reference ARPs. Guidance is also included for typical entries for the columns with a short description of each as follows:
(i) ATA. This column was taken from the "Joint Aircraft System/Component (JASC) Code Table" document to provide a complete list of systems defined on an aircraft. It is not a typical column entry for an FHA and should not be considered as such. However, it provides a systematic approach to identify various aircraft systems.
(ii) Function Description. A concise description of the sub-functions for each top level system. For example, the oil system is made up of sub-functions such as oil pressure, oil temperature, and oil quantity.
(i) Failure Condition (FC). Typical entries in this column include "Loss of ...", "Unannunciated loss of ...", "Misleading data to the flight crew ...", "Malfunction of ...", along with environmental conditions (e.g., day and night VFR, IFR, Icing). This guidance encourages applicants to use this verbiage for standardization purposes and to minimize confusion in the review of FHAs.
(iv) Phase of Operation. In this column, the typical entries are Hover, Takeoff, Climb, Cruise, Descent, Approach/Landing, or any combination as appropriate.
(v) Effect of the Failure on the Aircraft, Crew and Occupants. Describe the effects of the failure on the aircraft, aircraft system, flightcrew workload, and occupant safety and comfort. The inclusion of mitigating design features within this column entry is not appropriate and should not be included. Instead, any mitigation required to meet the failure classification should be included in the System Safety Assessment. Each type of effect, not only the effect on flight crew workload, should be analyzed. The effect on the degradation of the system should not be overlooked, as this can result in a higher classification.
(vi) Classification of the FC. This is typically the most challenging entry in the process since it is completely qualitative and requires input from multiple subject matter experts. It requires the participation of various disciplines such as safety analysts, design engineers, engineers responsible for software or complex hardware, human factors specialists, and flight test personnel. After the applicant has determined the classification levels, the results must have concurrence from the certification authority.
This may require lengthy discussions and should occur very early in the certification process.
(A) Some appropriate entries are no effect (NE), minor (MIN), major (MAJ), hazardous (HAZ) or catastrophic (CAT). The definition for each can be found in section 27.1309 of this AC. Note that this column in Figure AC 27 MG 21-1 was intentionally left blank because of the variation of appropriate classifications for a similar failure condition.
Page MG 21 - 3
AC 27-1B, Chg 7 2/4/2014
(vii) Supporting Material. For those failure conditions where the aircraft's resulting behavior or effects are not well defined, additional supporting material (e.g., simulation, studies, flight test) should be provided to validate the chosen classification.
(viii) Verification Method. For each failure condition, the applicant should determine how the aircraft or system design would satisfy the safety objective. Some example entries are provided in Figure AC 27 MG 21-1 such as detailed documents or report numbers used in the supporting material section.
Page MG 21 - 4
Note: Not all ATA chapters or subchapters have been included. Also, the italicized entries are not usually included in the failure condition description but in the systems description or assumptions section.
ATA 22-00-00 - AUTO FLIGHT SYSTEM Failure Phase of Effect of the Failure on Classification Supporting Verification Function ATA Condition Operation the Aircraft, Crew and of the FC (assumptions) Material Method Description (FC) Occupants 2211 Autopilot Loss of The detection of the loss Analysis and ALL Flt Test Computer autopilot. of system by the crew could be delayed long enough to significantly reduce the safety margins or functional capabilities.
(hardover) Malfunction in a single axis. App/Lnd Hover, TO rapid attitude change, resulting in a possible departure from stable flight, or impact with Aircraft responds with a Analysis and Flt Test terrain or ground-based obstacles.
Substantial increase in aircrew workload to recover from the resulting unusual attitude.
Minimal effect on occupants as they will be required to be seated and belted during this phase of operation.
Figure AC 27 MG 21-1. Generic Examples by ATA.
Page MG 21 - 5
AC 27-1B, Chg 7 2/4/2016 Note: Not all ATA chapters or subchapters have been included. Also, the italicized entries are not usually included in the failure condition description but in the systems description or assumptions section.
ATA 22-00-00 - AUTO FLIGHT SYSTEM Failure Phase of Effect of the Failure on Classification Notes Supporting Verification ATA Function Condition Operation the Aircraft, Crew and of the FC (assumptions) Material Method Description (FC) Occupants Malfunction Aircraft responds with a Analysis and Cruise rapid attitude change, Flt Test (hardover) in a single resulting in a possible axis. flight. departure from stable Substantial increase in aircrew workload to recover from the resulting unusual attitude prior to departure from stable flight.
Unrestrained occupant injuries resulting from the abrupt attitude changes of the aircraft.
Figure AC 27 MG 21-1. Generic Examples by ATA.
Page MG 21 - 6
Note: Not all ATA chapters or subchapters have been included. Also, the italicized entries are not usually included in the failure condition description but in the systems description or assumptions section.
ATA 22-00-00 - AUTO FLIGHT SYSTEM Failure Phase of Effect of the Failure on Classification Notes Supporting Verification ATA Description Function Condition Operation the Aircraft, Crew and of the FC (assumptions) Material Method (FC) Occupants Malfunction Aircraft responds with a Analysis and (slowover) Hover, TO slow attitude change, Flt Test in a single App/Lnd attitude situation. This resulting in an unusual axis. could result in an airspeed, attitude or yaw outside the approved limits (depart stabilized flight) or result in a ground impact.
Substantial increase in aircrew workload to recognize and recover from the resulting unusual attitude prior to departure from stable flight and without impacting the ground.
2212 Pitch Attitude loss of pitch Annunciated ALL unaugmented pitch Aircraft reverts to Flt Test Analysis and Control stabilization. control.
Slight increase in aircrew workload to maintain pitch attitude.
Occupants may encounter some slight discomfort.
Figure AC 27 MG 21-1. Generic Examples by ATA.
Page MG 21 - 7
AC 27-1B, Chg 7 2/4/2016 Note: Not all ATA chapters or subchapters have been included. Also, the italicized entries are not usually included in the failure condition description but in the systems description or assumptions section.
ATA 22-00-00 - AUTO FLIGHT SYSTEM Failure Phase of Effect of the Failure on Classification Notes Supporting Verification Function ATA Description Condition Operation the Aircraft, Crew and of the FC (assumptions) Material Method (FC) Occupants ated loss of Unannunci- ALL Significant reduction in safety margins due to the Flt Test Analysis and pitch delay in pilot reaction to stabilization. take control.
Significant increase in aircrew workload due to the delayed recognition and recovery of pitch attitude.
Occupants may encounter some slight discomfort.
2216 Trim Autopilot Loss of autopilot ALL Slight reduction in safety margins due to loss of Gnd and Flt Test trim (IFR). finite control.
Aircrew workload may increase significantly due to loss of automatic control.
Occupants may encounter some slight discomfort.
Figure AC 27 MG 21-1. Generic Examples by ATA.
Page MG 21 - 8
Note: Not all ATA chapters or subchapters have been included. Also, the italicized entries are not usually included in the failure condition description but in the systems description or assumptions section.
ATA 22-00-00 - AUTO FLIGHT SYSTEM Failure Phase of Effect of the Failure on Classification Notes Supporting Verification ATA Description Function Condition Operation the Aircraft, Crew and of the FC (assumptions) Material Method (FC) Occupants Unannuncia Aircraft responds with a Analysis and -ted Hover, TO rapid attitude change, Flt Test malfunction App/Lnd resulting in a possible departure from stable (runaway). flight, or impact with terrain or ground-based obstacles.
Substantial increase in aircrew workload to recover from the resulting unusual attitude.
Occupant injuries and possible death resulting from the abrupt attitude changes of the aircraft and possible ground impact.
Figure AC 27 MG 21-1. Generic Examples by ATA.
Page MG 21 - 9
AC 27-1B, Chg 7 2/4/2016 Note: Not all ATA chapters or subchapters have been included. Also, the italicized entries are not usually included in the failure condition description but in the systems description or assumptions section.
ATA 22-00-00 - AUTO FLIGHT SYSTEM Failure Phase of Effect of the Failure on Classification Notes Supporting Verification Function ATA Condition Operation the Aircraft, Crew and of the FC (assumptions) Material Method Description (FC) Occupants Gnd and Flt 2250 Aerody- Loss of A significant reduction in namic Load stability Hover system margins is Test Alleviating augmenta- expected because of the (Stability tion (VFR). inherent instability of Augmenta- most rotorcraft in hover.
tion) The aircraft will lose short-term stability requiring a significant increase in workload is expected to maintain control.
Occupant injuries resulting from the abrupt attitude changes of the aircraft and possible ground impact.
Figure AC 27 MG 21-1. Generic Examples by ATA.
Page MG 21 - 10
Note: Not all ATA chapters or subchapters have been included. Also, the italicized entries are not usually included in the failure condition description but in the systems description or assumptions section.
ATA 22-00-00 - AUTO FLIGHT SYSTEM Failure Phase of Effect of the Failure on Classification Notes Supporting Verification Function ATA Description Condition Operation the Aircraft, Crew and of the FC (assumptions) Material Method (FC) Occupants Unannunci- The information to the Analysis and ated loss of Hover flight crew could be Flt Test stability delayed long enough for augmenta- the aircraft to attain an tion (IFR). unusual attitude, which significantly reduces the safety margins or functional capabilities.
The aircrew workload would significantly increase in order to recognize and recover from an unusual attitude and regain stable flight.
Occupant injuries resulting from the abrupt attitude changes of the aircraft and possible ground impact.
Figure AC 27 MG 21-1. Generic Examples by ATA.
Page MG 21 - 11
AC 27-1B, Chg 7 2/4/2016 Note: Not all ATA chapters or subchapters have been included. Also, the italicized entries are not usually included in the failure condition description but in the systems description or assumptions section.
ATA 22-00-00 - AUTO FLIGHT SYSTEM Failure Phase of Effect of the Failure on Classification Notes Supporting Verification ATA Function Condition Operation the Aircraft, Crew and of the FC (assumptions) Material Method Description (FC) Occupants Malfunction Aircraft responds with a Analysis and (hardover) Hover, TO rapid attitude change, Flt Test in a single App/Lnd resulting in departure axis. from stable flight and possible ground impact.
Substantial increase in aircrew workload to recover from the resulting unusual attitude prior to departure from stable flight and possible ground impact.
Occupant injuries and possible death resulting from the abrupt attitude changes of the aircraft and possible ground impact.
Figure AC 27 MG 21-1. Generic Examples by ATA.
Page MG 21 - 12
Note: Not all ATA chapters or subchapters have been included. Also, the italicized entries are not usually included in the failure condition description but in the systems description or assumptions section.
ATA 22-00-00 - AUTO FLIGHT SYSTEM Failure Phase of Effect of the Failure on Classification Notes Supporting Verification ATA Description Function Condition Operation the Aircraft, Crew and of the FC (assumptions) Material Method (FC) Occupants Malfunction Aircraft responds with a Analysis and Cruise rapid attitude change, Flt Test (hardover) resulting in an unusual in a single axis. stable flight. attitude or departure from The aircrew workload would significantly increase in order to recognize and recover from an unusual attitude and regain stable flight.
Figure AC 27 MG 21-1. Generic Examples by ATA.
Page MG 21 - 13