AC 437.55-1 Table A-2. Hazard example: pilot incapacitation Hazard description Risk before mitigation measures Risk elimination or mitigation Risk after mitigation measures Sev Like Risk measures Sev Like Risk Vehicle motion could exceed I D High Implementing all of the following E Low the pilot's tolerance level and Catastrophic Remote reduces the risk to required levels: Catastrophic Extremely lead to pilot disorientation or - Training the pilot in an Remote loss of consciousness, resulting aerobatic airplane to prepare for in temporary or permanent loss similar high rates of roll and g.
of control of the vehicle. tolerance.
- Establishing operating limitations to assure that the pilot is not subjected to excessive stresses.
- Using cockpit displays to warn the pilot of excess rates of motion.
- Using cockpit displays to issue abort signal when roll exceeds operating limits of XX.
AC 437.55-1 Table A-3. Hazard example: flight control display Hazard description Risk before mitigation measures Risk elimination or mitigation measures Risk after mitigation measures Sev Like Risk Sev Like Risk Flight control display is lost or D High Implementing all of the following reduces I E Low provides erroneous data during Catastrophic Remote the risk to required levels: Catastrophic Extremely rocket-powered portion of flight - Aborting the mission if the display is Remote because of hardware failure or lost.
software fault, leading to flight - Using independent ground support outside of operating area or systems to monitor vehicle conditions.
possible vehicle loss. - Having both the pilot and computer systems perform manual and automated checks to ensure that hardware and software are in a safe state and functioning properly before initiating engine start, including checking safetycritical circuits, components, inhibits, interlocks, exception limits, safing logic, memory integrity, and program Confirming that flight control display software will meet requirements for operating properly with invalid inputs, out of range inputs, boundary value inputs, invalid outputs, timing errors, out of sequence commands, divide by zero errors, or greater-than-allowed
- Developing procedures for mission abort and conduct training on abort procedures.
AC 437.55-1 Table A-4. Hazard example: lightning strike Hazard description Risk before mitigation measures Risk elimination or mitigation Risk after mitigation measures Sey Like Risk measures Sev Like Risk Natural or triggered lightning D High Implementing all of the following E Low could strike the vehicle in flight Catastrophic Remote reduces the risk to required levels: Catastrophic Extremely leading to flight safety system - Developing procedures to Remote malfunction; guidance, monitor and report navigation, and control failure; meteorological conditions to the or general electrical system mission conductor.
failure. Any of these events - Developing procedures to meet could result in vehicle loss. the natural and triggered lightning commit criteria specified in 14 CFR Part 417, appendix G.
- Conducting training on those procedures.
AC 437.55-1 Table A-5. Hazard example: turbopump component wear Hazard description Risk before mitigation measures Risk elimination or mitigation Risk after mitigation measures Sev Like Risk measures Sev Like Risk Tolerance stack up, D High Implementing all of the E Low contamination, or component aging could lead to wear in Catastrophic Remote required levels: following reduces the risk to Catastrophic Extremely Remote turbopump bearings and other - Using long-life bearings to components, leading to loss of minimize wear.
the engine or fire caused by - Developing procedures to increased heat in an oxygen perform routine teardown and environment and resulting in inspection of the bearings and possible vehicle loss. components during the qualification tests of the engine to ensure continued reliable operation.
Developing contamination control procedures.
Conducting training on those procedures.