power, electrical, warning, and caution) are being integrated into a single display along with their associated control function and corresponding labels. The operation of these systems is accomplished via interaction with MFD controls (bezel switches, touch screens, etc.) and software control labels or icons that appear on the display screen.
Carefully evaluate the design of these labels and their associated meanings to determine that they adequately convey and completely define the control function and system operation. Often, a single text message or acronym may not be sufficient to completely describe the function and operation of that control.
(A) There has also been a growing trend to use icons rather than text on some of these displays. The symbol used can often be difficult to interpret or require training for the pilot to remember what it means. The overuse of symbols may require the pilot to revert to a manual for interpretation. Therefore, ensure that pilots will be able to identify control functions with an acceptable level of accuracy and consistency and in a timely manner. If icons are used, there should be no reduction in the level of pilot performance when compared with performance obtained using text labeling, and can be measured using time to interpret and accuracy of interpretation of that control function.
(B) There has also been a trend toward using multifunction controls (softkeys) more in rotorcraft. Pilots must be able to quickly and reliably identify the function controlled by these software labels. Pilots should be capable of performing controlrelated tasks to the same performance standards that would result from the use of conventional controls, unless the decrement is inconsequential and the design enables other significant performance gains or design simplifications.
(C) Evaluate control markings to ensure application of a logical and consistent labeling convention throughout the cockpit. The evaluation should also consider electronic control labeling, particularly as applied across all display pages. It is important that the expected pilot population immediately and clearly understands the terminology chosen for that control function. The evaluation should verify that the terms chosen conform to standardized aviation conventions. A list of standard terms and acronyms accepted by certification authorities can be found in Appendix O of RTCA Document DO-229C, “Minimum Operational Performance Standard for Global Positioning System/Wide Area Augmentation System Airborne Equipment,” dated November 28, 2001.
(D) It is also important to have consistent function labels. A function should have the same name regardless of the display page on which it appears.
Perform evaluations to determine consistent placement of labels on the same key of the display when pages are changed. The evaluator should ensure that all identical functions that are available across multiple screens or pages are consistently mapped to the same control to the maximum extent possible. Failure to consistently position soft-key functions can increase the time required to search and find a given function and increase the likelihood of entry error. One must also assess whether frequently used Page MG 20 - 25
AC 29-2C, Chg 7 2/4/2016 functions are readily accessible. In most cases, frequently used functions will require a dedicated control to provide adequate accessibility.
(E) Conduct all of the assessments as early in the program as possible. In addition, these assessments should include a sample of test pilots that are not familiar with the system. This can aid in the determination of the intuitiveness of labels and potential for misinterpretation.
i. Sample HF Compliance Matrix. Figure AC 29-2 MG-20–3 shows a sample matrix and is not all-inclusive. An actual matrix will likely be more complex and longer depending on the type of project.
Regulatory Requirement Compliance Documentation § 29.771. Pilot compartment.
For each pilot compartment -
(a)The compartment and its equipment must allow each pilot to perform his duties without unreasonable concentration or fatigue;
√ √ Report No.
60-002 § 29.777. Cockpit controls.
Cockpit controls must be -
(b)Located and arranged with respect to the pilots’ seats so that there is full and unrestricted movement of each control without interference from the cockpit structure or the pilot’s clothing when pilots from 5’2” to 6’0” in height are seated.
√ √ Report No.
60-004 § 29.1321. Arrangement and visibility. (g) - If a visual indicator is provided to indicate malfunction of an instrument, it must be effective under all probable cockpit lighting conditions.
√ √ √ Report No.
60-004 § 29.1381. Instrument lights.
The instrument lights must - (a) Make each instrument, switch, and other devices for which they are provided easily readable;
and… √ √ Report No.
60-012 Page MG 20 -26
§ 29.1381. Instrument lights.
The instrument lights must - (b) Be installed so that - (1) Their direct rays are shielded from the pilot's eyes and (2) No objectionable reflections are visible to the pilot.
√ √ Report No.
60-010 § 29.1555. Control markings. (a) Each cockpit control, other than primary flight controls or control whose function is obvious, must be plainly marked as to its function and method of operation.
√ √ √ Report No.
60-010 Figure AC 29 MG 20-3. Sample HF Compliance Matrix Page MG 20 - 27
CHAPTER 3
AIRWORTHINESS STANDARDS
TRANSPORT CATEGORY ROTORCRAFT
MISCELLANEOUS GUIDANCE (MG) AC 29 MG 21 GUIDANCE ON CREATING A SYSTEM LEVEL FUNCTIONAL HAZARD ASSESSMENT (FHA).
a. Purpose.
(1) This MG provides guidance for developing a system level functional hazard assessment (FHA) and is derived from the Society of Automotive Engineers (SAE) Aerospace Recommended Practices Document (ARP) 4761, Guidelines and Methods for Conducting the Safety Assessment Process on Civil Airborne Systems and Equipment. This MG helps answer the questions of when and how to complete a system level FHA. The FHA approach provided in this MG utilizes the Air Transportation Association (ATA) chapter code structure. In this MG, we provide a FHA table format that lists the most commonly used functions for each major system type and associated information identified in ARP 4761.
(2) This MG describes acceptable guidance for developing an FHA for an aircraft and its systems, in support of compliance with 14 CFR 29.1301 and 29.1309, and other applicable regulations. An applicant for a type certificate (TC), amended TC, supplemental type certificate (STC), amended STC, and technical standard order authorization (TSOA) may use SAE ARP 4754a, Guidelines for Development of Civil Aircraft and Systems, dated December 21, 2010, in conjunction with applicable ACs, to comply with the regulations.
b. References and Related Documents.
(1) Applicable regulations: 14 CFR 29.1301 and 29.1309.
(2) Applicable ACs.
(i) AC 20-115C, Airborne Software Assurance.
(ii) AC 20-152, RTCA, Inc., Document RTCA/DO-254, Design Assurance Guidance for Airborne Electronic Hardware.
(iii) AC 20-170, Integrated Modular Avionics Development, Verification, Integration, and Approval Using RTCA/DO-297 and Technical Standard Order-C153.
(3) Industry Standards (or latest FAA recognized version).
Page MG 21 - 1
AC 29-2C, Chg 7 2/4/2016
(i) RTCA Document DO-178CB, Software Considerations in Airborne Systems and Equipment Certification, dated December 13, 2011.
(ii) RTCA Document DO-254, Design Assurance Guidance for Airborne Electronic Hardware, dated April 19, 2000.
(iii) RTCA Document DO-297, Integrated Modular Avionics (IMA) Development Guidance and Certification Considerations, dated November 8, 2005.
c. Background. The FAA recognizes the importance of timely completion of an FHA to minimize TC, amended TC, STC, amended STC, and TSOA project delays and potential risks of redesigns required late in a project because of information obtained from the completed FHA. Applicants are expected to not only properly complete FHAs as early as possible to minimize the risks described above, but also obtain FAA acceptance of the FHAs.
d. When to create an FHA. The FAA expects a discussion of the FHA take place during the very early stages of the TC, amended TC, STC, amended STC project (i.e., during the Familiarization Briefing). This will provide the FAA with the necessary design safety aspects information while the development is still in the conceptual and requirements definition phases. Since the FHA process is designed to provide the system level safety and derived requirements, it is imperative that the applicant obtain FAA acceptance of the FHA as early as possible in the systems development (i.e., prior to submitting the certification plan). This will minimize the risk of the applicant’s design requiring changes late in the program to satisfy safety requirements obtained from the completed FHA.
e. How to create an FHA.
(1) The process to create an FHA can be considered fairly complicated if doing it for the first time. T his guidance presumes that an applicant is familiar with ARP 4761 and is looking for some additional guidance in recognizing some of the likely functions of each system and the associated failure conditions (FC) that should be reflected in a FHA. The table in Figure AC 29 MG 21- 1 provides a snapshot of considerations an applicant should address when examining their design for a systematic safety review.
This table is not a complete list nor are the FCs listed in the figure applicable for all designs.
(2) One additional item is the need to include a complete list of assumptions made when developing the FHA. These assumptions may include the intended aircraft (single or dual engine, existing certificated interfacing equipment), type of operation
(e.g., IFR, VFR, category A), crew composition (e.g., single pilot, dual pilot), etc. These should be listed in the front of the document prior to the functional failure conditions matrix.
Page MG 21 - 2
(3) The set of tables in Figure AC 29 MG 21-1 provides examples of a format for the system level FHA as identified in the reference ARPs. Guidance is also included for typical entries for the columns with a short description of each as follows:
(i) ATA. This column was taken from the “Joint Aircraft System/Component (JASC) Code Table” document to provide a complete list of systems defined on an aircraft. It is not a typical column entry for an FHA and should not be considered as such. However, it provides systematic approach to identify various aircraft systems.
(ii) Function Description. A concise description of the sub-functions for each top level system. For example, the oil system is made up of sub-functions such as oil pressure, oil temperature, and oil quantity.
(iii) Failure Condition (FC). A goal of this guidance is to encourage the author of an FHA to use the verbiage established in this guidance as a means to provide some standardization and minimize confusion when reviewing FHAs. Typical entries in this column include “Loss of …”, “Unannunciated loss of …”, “Misleading data to the flight crew …”, “Malfunction of …”, along with environmental conditions (e.g., day and night VFR, IFR, Icing).
(iv) Phase of Operation. In this column, the typical entries are Hover, Takeoff, Climb, Cruise, Descent, Approach/Landing, or any combination as appropriate.
(v) Effect of the Failure on the Aircraft, Crew and Occupants. Describe the effects of the failure on the aircraft, aircraft system, flightcrew workload, and occupant safety and comfort. The inclusion of mitigating design features within this column entry is not appropriate and should not be included. Instead, any mitigation required to meet the failure classification should be included in the System Safety Assessment. Each type of effect, not only the effect on flight crew workload, should be analyzed. The effect on the degradation of the system should not be overlooked, as this can result in a higher classification.
(vi) Classification of the FC. This is typically the most challenging entry in the process since it is completely qualitative and requires input from multiple subject matter experts. It requires the participation of various disciplines such as safety analysts, design engineers, engineers responsible for software or complex hardware, human factors specialists, and flight test personnel. After the applicant has determined the classification levels, the results must have concurrence from the certification authority.
This may require lengthy discussions and should occur very early in the certification process.
(A) Some appropriate entries are no effect (NE), minor (MIN), major (MAJ), hazardous (HAZ) or catastrophic (CAT). The definition for each can be found in section 29.1309 of this AC. Note that this column in Figure AC 29 MG 21-1 was intentionally left blank because of the variation of appropriate classifications for a similar failure condition.
Page MG 21 - 3
AC 29-2C, Chg 7 2/4/2016
(vii) Supporting Material. For those failure conditions whose aircraft behavior effects are not well defined, additional supporting material (e.g., simulation, studies, flight test) should be defined to validate the chosen classification.
(viii) Verification Method. For each failure condition, the applicant should determine how the aircraft or system design would satisfy the safety objective. Some example entries are provided in Figure AC 29 MG 21-1 such as detailed documents or report numbers used in the supporting material section.
Page MG 21 - 4
ATA 22-00-00 – AUTO FLIGHT SYSTEM ATA Function Description Failure Condition (FC) Phase of Operation Effect of the Failure on the Aircraft, Crew and Occupants Classification of the FC Notes (assumptions) Supporting Material Verification Method 2211 Autopilot Computer Loss of autopilot. ALL The detection of the loss of system by the crew could be delayed long enough to significantly reduce the safety margins or functional capabilities.
Analysis and Flt Test Malfunction (hardover) in a single axis.
Hover, TO App/Lnd Aircraft responds with a rapid attitude change, resulting in a possible departure from stable flight, or impact with terrain or ground-based obstacles.
Substantial increase in aircrew workload to recover from the resulting unusual attitude.
Minimal effect on occupants as they will be required to be seated and belted during this phase of operation.
Analysis and Flt Test Figure AC 29 MG 21-1. Generic Examples by ATA.
Page MG 21 - 5
AC 29-2C, Chg 7 2/4/2016 Note: Not all ATA chapters or subchapters have been included. Also, the italicized entries are not usually included in the failure condition description but in the systems description or assumptions section.
ATA 22-00-00 – AUTO FLIGHT SYSTEM ATA Function Description Failure Condition (FC) Phase of Operation Effect of the Failure on the Aircraft, Crew and Occupants Classification of the FC Notes (assumptions) Supporting Material Verification Method Malfunction (hardover) in a single axis.
Cruise Aircraft responds with a rapid attitude change, resulting in a possible departure from stable flight Substantial increase in aircrew workload to recover from the resulting unusual attitude prior to departure from stable flight.
Unrestrained occupant injuries resulting from the abrupt attitude changes of the aircraft.
Analysis and Flt Test Figure AC 29 MG 21-1. Generic Examples by ATA.
Page MG 21 - 6
ATA 22-00-00 – AUTO FLIGHT SYSTEM ATA Function Description Failure Condition (FC) Phase of Operation Effect of the Failure on the Aircraft, Crew and Occupants Classification of the FC Notes (assumptions) Supporting Material Verification Method Malfunction (slowover) in a single axis.
Hover, TO App/Lnd Aircraft responds with a slow attitude change, resulting in an unusual attitude situation. This could result in an Analysis and Flt Test airspeed, attitude or yaw outside the approved limits (depart stabilized flight) or result in a ground impact.
Substantial increase in aircrew workload to recognize and recover from the resulting unusual attitude prior to departure from stable flight and without impacting the ground.
2212 Pitch Attitude Control Annunciated loss of pitch stabiliza tion.
ALL Aircraft reverts to unaugmented pitch control.
Slight increase in aircrew workload to maintain pitch attitude.
Occupants may encounter some slight discomfort.
Analysis and Flt Test Figure AC 29 MG 21-1. Generic Examples by ATA.
Page MG 21 - 7
AC 29-2C, Chg 7 2/4/2016 Note: Not all ATA chapters or subchapters have been included. Also, the italicized entries are not usually included in the failure condition description but in the systems description or assumptions section.
ATA 22-00-00 – AUTO FLIGHT SYSTEM ATA Function Description Failure Condition (FC) Phase of Operation Effect of the Failure on the Aircraft, Crew and Occupants Classification of the FC Notes (assumptions) Supporting Material Verification Method Unannunc iated loss of pitch stabiliza tion.
ALL Significant reduction in safety margins due to the delay in pilot reaction to take control.
Significant increase in aircrew workload due to the delayed recognition and recovery of pitch attitude.
Occupants may encounter some slight discomfort.
Analysis and Flt Test 2216 Autopilot Trim Loss of autopilot trim (IFR).
ALL Slight reduction in safety margins due to loss of finite control.
Aircrew workload may increase significantly due to loss of automatic control.
Occupants may encounter some slight discomfort.
Gnd and Flt Test Figure AC 29 MG 21-1. Generic Examples by ATA.
Page MG 21 - 8
ATA 22-00-00 – AUTO FLIGHT SYSTEM ATA Function Description Failure Condition (FC) Phase of Operation Effect of the Failure on the Aircraft, Crew and Occupants Classification of the FC Notes (assumptions) Supporting Material Verification Method Unannunci ated malfunction (runaway).
Hover, TO App/Lnd Aircraft responds with a rapid attitude change, resulting in a possible departure from stable flight, or impact with terrain or ground-based obstacles.
Substantial increase in aircrew workload to recover from the resulting unusual attitude.
Occupant injuries and possible death resulting from the abrupt attitude changes of the aircraft and possible ground impact.
Analysis and Flt Test Figure AC 29 MG 21-1. Generic Examples by ATA.
Page MG 21 - 9