Aircraft Certification Service Flight Test Risk Management

10/05/2021 4040.26C the Director of the Aircraft Certification Service Compliance and Airworthiness Division (AIR - 700).

7. Flight Test Risk Management.

a. General. The AIR Flight Test Program’s Risk Management (RM) program is implemented in accordance with FAA Order 8040.4, Safety Risk Management , and is an integral part of the AIR Flight Test Program’s SMS. The RM program ensures that hazards are identified, eliminated, or their causes are sufficiently mitigated to an acceptable level. The AIR Flight Test Program RM process as described in Appendix C must be performed and documented for all ground and flight tests (such as certification, validation, familiarization, research flight activities, etc.) conducted under a Type Inspection Authorization (TIA) or Letter of Authorization (LOA).

The RM process applies not just to certification flight tests flown by FAA flight test crews but also those that are delegated to DER test pilots and flight analysts, since they must follow applicable orders. In addition, this process applies when FAA certification flight tests are conducted by a delegated organization in accordance with a TIA. Applicants who will be conducting flight tests under an ODA must include in their ODA procedures manual a Flight Test RM process that complies with this order.

b. RM Procedures. The RM process and principles are detailed in Appendix C. Essentially it consists of three steps.

(1) Determine the Risk for the testing. This consists of the following steps: (a) Determine the tests to be performed.

(b) Identify the hazards for those tests and consequences if the hazard occurs.

(c) Estimate the probability of those hazards occurring.

(d) Determine mitigations and emergency procedures for those hazards.

(e) Estimate the Risk level for the test based on the probability and consequence of the hazard occurring.

(2) Approve and document the RM plan. Management will approve the RM plan as adequate to eliminate or minimize the specific risk associated with planned testing. Test plan approval does not constitute RM plan approval. While the RM Plan may be included in a test plan or stand-alone document, the RM plan approval does not occur until TIA or LOA approval.

RM must be documented within or attached to the TIA or applicable LOA. Appendices D and E contain examples of accepted RM documentation forms; however, other formats may be acceptable.

Approval Authority. RM approval/signature must be commensurate with the pre-mitigation risk level. A Flight Test Section Manager has the discretion to retain RM plan approval for all risk levels, however, the authority to sign an RM approval may be delegated as follows: 10/05/2021 4040.26C • Low Risk - The project pilot or project FTE.

• Medium Risk - An SFSO or another FAA test pilot or FTE not involved with developing the RM Plan. The test pilot or FTE flying the test shall not approve their own RM plan for Medium risk tests.

• High - A Flight Test Section Manager (If the manager is flying the test, then another Section manager or higher level AIR-710 manager can approve).

(3) Accept risk for flight test execution. Risk acceptance for FAA personnel is an inherent responsibility of FAA flight test managers. For FAA flight test crews participating in ground or flight testing, the FAA will document acceptance of the residual risk via a specific Letter of Authorization (LOA). An LOA template for both TIA and non-TIA flights is provided in Appendix E.

c. Requirements. Applicants who are regularly engaged in activities requiring FAA certification flight tests should be encouraged to develop an FAA-accepted RM process.

(1) Projects involving applicants with an FAA-accepted RM process.

(a) To be found acceptable by the cognizant FAA Flight Test organization, the applicant’s RM process must comply, at a minimum, with the requirements of this order.

The FAA should ensure that appropriate items of the FAA Flight Test Briefing Guide (Appendix B) are incorporated in company-developed briefing guides. Acceptance of an applicant’s RM process must be formally documented (see Appendix F for an example).

(b) Order or company process changes: When changes to this order are made, previously accepted company RM processes should be reviewed to ensure they are still compliant with this order. If an applicant makes changes to their FAA-accepted RM process, then the applicant must forward the new process to the FAA to verify it still complies with this order.

(c) Project review. Acceptance of a company RM process does not relieve the FAA or an ODA of responsibility to review each project’s risk assessment in order to evaluate the possibility of additional hazards and/or mitigations.

(d) Operations. In cases where flight testing is conducted with a company that has an accepted RM process, all AIR flight test crewmembers are expected to follow that company’s process. Flight test managers and/or crews, however, always have the option to raise an issue with any flight test profiles, procedures, and/or limitations as necessary to satisfy FAA safety concerns. The FAA always has the option to halt testing if it is felt the tests are not being conducted safely. The approved risk level will dictate the level of review required to resume testing following settlement of the issue.

(2) Projects involving applicants without an FAA-accepted RM process. For those certification flight test projects where the applicant has no accepted RM process, the procedures specified in this order should be used to ensure proper RM. The RM process should be a collaborative effort between the applicant and the FAA.

10/05/2021 4040.26C d. References. In addition to the above-mentioned documents, the following resources are available when establishing a flight test risk management program: (1) Flight Test Safety Committee website ( http://www.flighttestsafety.org / ).

(2) Flight Test Safety Database website ( https://ftsdb.grc.nasa.gov/ ) (3) Society of Experimental Test Pilots (SETP) website ( https://www.setp.org / ) (4) Society of Flight Test Engineers (SFTE) website ( http://sfte.org / ) (5) FAA Order 8000.369B, Safety Management Systems . ( https://drs.faa.gov/ ), search for 8000.369B Definitions. The terms used within this order are defined in Appendix A.

8. Safety Event Reporting. AIR is dedicated to providing the highest level of safety while accomplishing all flight operations. A key element in promoting safety is sharing lessons learned and/or recommendations with all flight test personnel. Throughout AIR, flight test crewmembers must report not only accidents and incidents, but must also report Safety Significant Events (SSEs) in accordance with this order and the AIR Flight Test SMS. Below are details of the various reports.

a. SSE Report. The SSE report is the main reporting tool used to report all flight test safety events. An SSE is any flight test safety related event determined to be of significance to the flight test community. This includes accidents and incidents as defined in 49 CFR part 830, Initial Notification of Aircraft Accidents, Incidents, and Overdue Aircraft . It is also used to pass on any safety lessons learned for the flight test community. DERs, ODAs, and applicants with an FAA- accepted risk management process are strongly encouraged to submit SSEs in accordance with this order. To ensure all certification flight test personnel are kept informed of SSEs, DERs and ODAs are to report any SSE through the AIR flight test section responsible for their oversight.

DERs and ODAs may use the AIR-710 SSE Report format (available from the SFSO), or a suitable alternate format mutually agreed upon between the SFSO and the DER/ODA. The primary focus of SSE reporting is to expeditiously raise awareness of a potentially unsafe condition, to restart the RM process (as required), document and disseminate critical safety information, and preclude a repeat occurrence. Personal and applicant identifying information will be removed to ensure the confidentiality of SSE submitters. Proprietary data cannot and will not be shared outside the FAA. In the interest of sharing safety data, the FAA should also share their SSE data with applicants. Events to be reported include: (1) Accidents or incidents as defined by 49 CFR part 830.

(2) Ground or flight events whose outcome: (a) Affected the safety of a crewmember and/or test participant.

(b) Exposed an increase from the assessed and approved level of risk.

(c) Was unexpected and developed, or could have developed, into an unsafe condition.

10/05/2021 4040.26C (d) Resulted in aircraft damage.

(e) Resulted in injury to personnel, damage to equipment or property, loss of material, or loss of use.

(f) Produced lessons learned or recommendations which could be beneficial to the FAA and flight test community.

b. National Transportation Safety Board (NTSB) Reports. 49 CFR part 830 identifies unplanned or unexpected events that must be reported immediately to the NTSB. See 49 CFR part 830 for details of what data are required to be reported. If there is doubt as to “reportable,” a courtesy notification is prudent. Contact the NTSB Response Operations Center ( http://www.ntsb.gov ) and describe the event.

9. Accident Response Plan (ARP). All flight test operations must be conducted under an approved AIR ARP by Section or otherwise approved by AIR-710. The accident response plan reflects the pertinent steps to be taken by various office personel in case of an accident involving FAA personel. The accident response plan should be flexible enough to accommodate variations in the appropriate response. The plan should also account for variations in the organizational structure of the office or facility involved, and the resources available to those personnel tasked with implementing the response plan. In order to assure currency of contacts and procedures, a desktop exercise of the accident response plan must be performed annually and documented by memorandum to the FTPFSO.

10. FAA Personnel Participation in Flight Testing. Only qualified flight test crewmembers can participate in the full range of flight test activities conducted by the FAA. Qualified flight test crewmembers include FTPs, FTEs, and HF Specialists in the Flight Test Flight Program who are current in accordance with Flight Test Operations Manual (FTOM) requirements. These requirements include medical certification, physiological, survival, and specific flight test training. Only qualified flight test crewmembers may participate on high-risk tests as defined in this order. FAA personnel (AIR ASEs, technical specialists, etc.) who are not qualified Flight Test Program crewmembers may only participate on medium- and low-risk tests if all of the following requirements have been met: a. Clear justification for the participation of those personnel.

b. For any flight conducted prior to completion of pressurization system certification requirements or where pressurization envelope may be a concern, those personnel must have completed physiological training, to include either altitude chamber or Portable Reduced Oxygen Training Enclosure.

c. Hold at least an FAA Class III Medical certificate.

d. All personnel participating in the flight must attend the preflight briefing, to include specific emphasis on emergency and egress procedures.

10/05/2021 4040.26C e. The Letter of Authorization, as required by this order, must be endorsed by their manager with final approval by the AIR Flight Test Program Executive (or his or her designee).

Digitally signed by LANCE

y

LANCE T T GANT Date: 2021.10.05 GANT 10:44:58 -05'00' Lance Gant Aviation Safety Director, Compliance and Airworthiness Division Aircraft Certification Service

1 0/05/21 4040.26C Appendix A Appendix A. Definitions and Abbreviations 1. The following terms are defined for the purposes of this order: • Cause – Condition that results in a hazard; source.

• Desktop review – A method of examining and determining the adequacy of a project flight test risk management plan which relies on individual review by the assigned safety reviewers.

• Effect – The result of the hazard; consequence.

• Emergency Procedures – The recommended steps in the event a hazard occurs to reduce the severity of the hazard effect (e.g., loss of control recovery procedure or technique).

• Hazard – A condition, event, object, or circumstance, which could lead to an unplanned or undesired effect or event (i.e., injury to personnel, damage to equipment or property, loss of material, or loss of function).

• Letter of Authorization (LOA) – FAA's internal method of authorizing FAA flight crewmembers to fly onboard non-FAA aircraft for purposes of specified tests and/or evaluations. A signed LOA denotes flight test management's acceptance of residual risk.

• Mitigations – The actions taken to reduce the severity of a hazard’s effect (e.g., spin chute) or the probability of a hazard’s occurrence (e.g., build-up). Actions directed at the causes of a hazard, as conscious and systematic steps to prevent escalation to a more dangerous condition and lower the risk to an acceptable level. This term is often used interchangeably in other documents with the term “Minimizing Actions” or “Minimizing Procedures.” • Probability – The likelihood of the hazard occurring, taking into account the amount of exposure to the hazard. Probability levels are shown below. These subjective probability levels are specific to the flight test environment and are NOT related to 14 CFR 2X.1309 values.

o Frequent – Often occurs o Probable – Likely to occur o Occasional – Infrequently occurs o Remote – Rarely occurs o Improbable – Unlikely to occur • Risk – A situation involving exposure to hazards; future impact of a hazard that is not controlled or eliminated. It can be viewed as future uncertainty created by a hazard.

• Risk Assessment – The process by which probability and severity of the pre-mitigation hazards are defined for a specific test. This results in a subjective expression of risk (typically high, medium, or low). The risk is expressed as: A - 1 1 0/05/21 4040.26C Appendix A o Low – Test or activity that presents no greater risk to personnel, equipment, or property than normal operations (presents no greater risk than the intended in-service operation).

o Medium – Test or activity that presents a greater risk to personnel, equipment, or property than normal operations and requires more than routine oversight.

o High – Test or activity that presents a significant risk to personnel, equipment, or property. This necessitates close oversight at all levels.

o Avoid – Test or activity which presents an unacceptable risk to personnel, equipment, or property. Flight test must not be conducted if the probability or consequence of the hazard cannot be reduced.

• Risk Management ( RM) – The process of identifying hazards and applying appropriate mitigations to either eliminate risk or reduce it to an acceptable level. RM includes all steps taken before, during, and after flight test that are designed to reduce current and future risk.

• RM Plan – A project-specific plan formulated using an accepted RM process to minimize or eliminate risks associated with planned testing. The RM plan may be documented either as part of an approved flight test plan or as a stand-alone RM plan.

• RM Process – This order defines the AIR-accepted process for managing flight test risk.

Other processes may be defined in writing by applicants and accepted by the FAA so long as they comply with the spirit and intent of this order.

• Severity – The consequence if the hazard occurs, expressed in terms of injury to personnel, damage to aircraft, reduction in safety margins, or increase in crew workload.

Typical levels of severity are shown below: o No Safety Effect – There is no impact on safety. No worse than normal operations.

o Minor – There is no significant effect on the aircraft or aircrew safety, but does slightly increase aircrew workload and/or decrease safety.

o Major – There is a significant reduction in safety margins; slight injuries to aircrew or minor damage to aircraft.

o Hazardous – There is a large reduction in safety margins; serious injury to aircrew or significant damage to aircraft.

o Catastrophic – There is loss of aircrew life or loss of aircraft.

• Safety Significant Event (SSE) – Any flight test safety related event occurring on any flight conducted by or with FAA certification personnel (or designees) determined to be of significance to the flight test community. Determination of significance is made in consultation with the SFSO and reported as outlined in this order.

• Safety Management System (SMS) – A formal top-down approach to managing safety risk and assuring the effectiveness of safety risk controls. The SMS includes systematic procedures, practices, and policies for the management of safety risk.

A - 2

1 0/05/21 4040.26C Appendix A • Safety Review Board (SRB) – A formal meeting of a group of people charged with the responsibility and authority to evaluate a project-specific Risk Management Plan to assess if all the possible hazards are defined and adequate mitigations are applied.

• Section Flight Safety Officer – The FAA FSO assigned to a particular section.

2. Abbreviation List Abbreviation Description A/C Aircraft ACAS Airborne Collision and Avoidance System ACO Aircraft Certification Office AED Aircraft Evaluation Division AFM Airplane Flight Manual AGL Above Ground Level AIR Aircraft Certification Service AOA Angle of Attack ARP Accident Response Plan ASE Aviation Safety Engineer ASRS Aviation Safety Reporting System CFR Code of Federal Regulations CFTP Certification Flight Test Plan CG Center of Gravity CofA Certificate of Airworthiness CRM Crew Resource Management DAR Designated Airworthiness Representative DER Designated Engineering Representative ECAM Electronic Centralized Aircraft Monitor EFIS Electronic Flight Instrumentation System EICAS Engine Indication and Crew Alerting System EMI Electromagnetic Interference FAA Federal Aviation Administration FADEC Full Authority Digital Engine Control FHA Failure Hazards Analysis FMEA Failure Modes and Effects Analysis FMS Flight Management System A - 3 1 0/05/21 4040.26C Appendix A Abbreviation Description FSO Flight Safety Officer FTE Flight Test Engineer FTP Flight Test Pilot FTPE Flight Test Program Executive (AIR-700 Director) FTOM Flight Test Operations Manual FTPFSO Flight Test Program Flight Safety Officer GPS Global Positioning System GW Gross Weight H/V Height/Velocity IAW In Accordance With IFR Instrument Flight Rules IMC Instrument Meteorological Conditions LOA Letter of Authorization LTA Lighter-Than-Air MIDO Manufacturing Inspection District Office Maximum Operating Limit Speed (Mach) M MO NASA National Aeronautics and Space Administration NOTAM Notice to Airman NSC National Safety Council NTSB National Transportation Safety Board ODA Organization Designation Authorization OEI One Engine Inoperative OPR Open Problem Report PFD Primary Flight Display PFTCB Pre-Flight Type Certification Board PIO Pilot Induced Oscillation PND Primary Navigation Display QA Quality Assurance RFI Radio Frequency Interference RM Risk Management RTO Rejected Takeoff A-4 1 0/05/21 4040.26C Appendix A Abbreviation Description SETP Society of Experimental Test Pilots SFSO Section Flight Safety Officer SFTE Society of Flight Test Engineers SMS Safety Management System SRB Safety Review Board SSA System Safety Assessment SSE Safety Significant Event TAWS Terrain Awareness and Warning System TCAS Traffic Alert and Collision Avoidance System THA Test Hazard Analysis TIA Type Inspection Authorization TM Telemetry TRB Technical Review Board TRR Test Readiness Review UM Unit Member (ref: FAA Order 8100.15 ODA Procedures ) Minimum Control Speed, Air V MCA V Minimum Control Speed, Ground MCG V Maximum Operating Limit Airspeed MO V Minimum Unstick Speed MU V Never Exceed Speed NE VMC Visual Meteorological Conditions VSRP Voluntary Safety Reporting Program WAT Weight/Altitude/Temperature A-5 1 0/05/21 4040.26C Appendix A Intentionally blank A - 6

1 0/05/21 4040.26C Appendix B Appendix B. FAA Flight Test Briefing Guide The following Flight Test Briefing Guide is a detailed list of most things that should be covered in a thorough pre- and post-flight briefing. This briefing guide may also be used for ground test.

Some items may not apply, such as chase plane, or you may have items unique to your program that are beyond the scope of this list. Some items may be covered in detail during the TRB/SRB process; therefore, the following briefing guide should be tailored to fit your program.

PRE-FLIGHT 1. General/Admin: • Date/Flight number/test number.

• Time hack.

• Test Objective.

• Overall risk level.

• Roll Call/call sign(s).

o Pilot in command, seat assignments, and rules for in-flight changes o Co-pilot o Test Director o FTE(s)/specialists (instrumentation, photographer, etc.)

o Chase Pilot o Observer(s) o Ground personnel (TM, crash/rescue, ATC, camera/video, maintenance, etc.)

• Newcomers to aircraft. Arrange safety briefing.

• Crew fit to fly, crew rest, crew duty day (flight crew and TM room participants).

• Personal safety equipment (e.g., helmets, parachutes, and their wind limits).

• Ground personnel (see above) responsibilities.

• Security Concerns/Requirements.

2. TIA/LOA signed.

3. Review times: Station, start, takeoff, test area, landing.

4. Test aircraft (A/C) configuration and status: • Test aircraft info (type/model/serial number/registration/etc.).

• Flight Squawks.

• Open maintenance items.

• Test Instrumentation status (e.g., Pressure transducers, strain gages, smoke generators, ice probes).

• Instrumentation calibrations currency (e.g., pitot-static).

• Inoperative test aircraft systems.

• Temporary operating limitations.

• Conformity inspection (currency of the inspection).

• Airworthiness certificate.

B - 1 1 0/05/21 4040.26C Appendix B • Changes since last flight (e.g., maintenance, instrumentation, software, etc.).

• Weight and Balance /CG.

o Takeoff & target gross weight & cg for test.

o Cargo/ballast configuration and movement.

• Fuel on board/refueling options.

• Thrust rating.

5. Local Info: • Local airfield environment (runway conditions and surrounding obstructions).

• Aircraft takeoff performance versus existing conditions.

• Communications: primary/secondary/emergency/test area frequencies.

• Test area: (boundaries, terrain features, obstacles).

• Test mission profile.

• Weather/Forecast: o Takeoff field o Test Area o Landing field o Alternate field o Go/no-go requirements o Sunrise/sunset • NOTAMs.

• Fuel requirements (return to base/min on deck).

• Recovery and landing.

• Primary/alternate/emergency landing sites.

• Expected landing time/crew fatigue.

6. Test Condition Details: • Flight test plan reviewed.

• Applicant’s flight test report reviewed.

• Lessons learned reviewed again.

• Detailed review of flight cards: o Who will fly and exchange of control.

o Instrumentation/data requirements.

o Initial conditions/set-up.

o Tolerances (Airspeed, Altitude, GW/cg, Wind, etc.).

o Test parameter limits/design limits.

o Review of flight test techniques.

o Review unique recovery/emergency procedures.

o AFM/TIA/LOA or special test limitations.

o Test restrictions (airspace, altitudes, airspeed/mach, etc.).

o Buildup to final conditions.

o Test predictions.

o Expected test results.

o Terminate, Recover, and/or Knock-it-off criteria and procedures (including ground personnel).

o Crew Resource Management (CRM) (who is watching what. Who makes what calls).

B - 2

1 0/05/21 4040.26C Appendix B o Review test risk assessment /THAs.

o Optional – Operational Risk Management Review.

7. Chase/Support Aircraft: • Type/registration.

• Crew/call sign.

• Normal duties/procedures.

• Position.

• Rendezvous point/join-up.

• Intra-flight communications.

• Fuel plan.

• Emergency procedures (lost sight/comm, inadvertent IMC, mid-air, search and rescue).

8. Emergencies/Contingencies: • Emergency recovery procedures (primary/secondary)(e.g., spin chute minimum, call-outs).

• Aircraft recovery device procedures (spin chutes).

• Crew escape/egress features/procedures (bail-out or on ground, bail-out minimums).

• Rallying point after egress.

• Emergency/survival equipment.

• Local crash rescue crews briefed on aircraft and procedures.

• Nearby emergency airfields.

• TM room duties.

• Accident Response Plan in place and available.

• Optional – Operational Risk Management Review.

POST-FLIGHT 9. Landing/Flight/Block times.

10. Aircraft Status: • Aircraft squawks.

• Instrumentation squawks.

• Post-flight inspection results.

11. Discussion of test conduct: • Safety Review/Discussion.

• Review all test cards.

o Were all test points executed satisfactorily?

o Were any limits approached or exceeded?

o Are any visual or other inspections required? (e.g., due to exceedance).

o Were the required data gathered?

o Was build-up adequate?

o Was risk level accurate?

o Are any repeats necessary?

B - 3 1 0/05/21 4040.26C Appendix B • Were there any unusual events?

• What events prompted questions that were never adequately answered?

• Chase/ground observations.

12. Discussion of results: • Data analysis observations.

• Regulatory compliance.

13. Safety Reports Required: • Accident/incident/SSE/VSRP/ASRS.

14. Lessons Learned and CRM discussion.

15. Plan for next flight.

B - 4 1 0/0 5/21 4040.26C Appendix C Appendix C. AIR Flight Test Risk Management Process 1. Purpose. This appendix more fully describes the Risk Management (RM) process for flight test and flight-test-related operations within AIR. This appendix will first describe some basic principles for RM, then describe in more detail the steps in the RM process at each stage of flight test (prior to flight testing, during flight testing, and after flight testing), including a more detailed description of the SRB. For definitions of terms used in this appendix, refer to Appendix A of this order.

2. Principles. All flight test risk management within AIR will be based on the following principles: a. Accept no unnecessary risks . An “unnecessary risk” is any risk that, if taken, will not contribute meaningfully to the task.

b. Reduce risks to an acceptable level . Risk is a part of flight test, but identifying risk causes and effects, followed by effective mitigations, allows flight testing to be accomplished in a safe and efficient manner.

c. Manage risks as early in a project as possible . It is easier to accomplish many RM objectives when you begin to address them early in the program, such as the concept and planning stages. For example, if safety and mitigations for flight test are considered when designing an aircraft, it is much easier to incorporate safety equipment such as spin chutes or instrumentation instead of trying to add those things when the aircraft is complete.

d. Risk Management acceptance should be made at the appropriate level . Acceptance of residual risk should be made at a level commensurate with the premitigated level of risk (i.e., the higher the premitigated risk, the higher the level of management acceptance).

e. Focus on test-related risk . Flight test risk management should focus on the test-unique hazards that are more likely to occur due to the configuration being tested and the test technique(s) being performed. Risk associated with the normal flying operations need not be specifically addressed.

f. Review all plans . Risk Management plans should be subjected to a safety review process in which project and non-project personnel review the flight test plan(s) to identify potential hazards.

g. Utilize all available resources . Review the results of previous tests for lessons learned.

Consult colleagues within the FAA, Designated Engineering Representatives (DER)/Unit Members (UM), applicant flight test personnel or other flight test organizations who may have conducted similar tests. Examine flight test organizations’ databases. The NASA Flight Test Safety Database and Flight Test Safety Committee websites are recommended as references for development of RM plans.

C - 1 1 0/0 5/21 4040.26C Appendix C h. Allow time for critical thinking . Risk Management should not be a last minute activity.

Use of past RM plans should not be blindly applied. The value of Risk Management is in the preparation by the team members prior to presenting the results for review and acceptance.

3. Risk Management Process—Prior to Flight Testing: a. Identify the test technique involved . Example: Minimum Control Speed Air—Static (V Static). Generally, risk associated with specific flight test techniques results in a higher MCA risk than that associated with operational flying. This test technique will be identified in the test plan. However, there may be risks associated with flying a test aircraft that result strictly from the aircraft’s configuration or the environment into which it is flown and these hazards and hazardous conditions must also be considered—in which case the words “test technique” would be broadened to include “normal” flight operations. An example of this would be an aircraft— which is otherwise capable of and normally flown in known icing conditions—being flown purposely into heavy icing conditions.

b. Identify the hazard(s) associated with the test technique . Example: Loss of control.

Ask, “What adverse events might happen when accomplishing this test technique?” Note that one test procedure or technique may have several hazards and each should be addressed (e.g., another hazard with this test technique would be engine failure caused by inlet distortion, or fuel starvation).

c. List the cause(s) of each hazard . Ask, “What might cause that hazard to happen?” Example: Reducing speed below stall. Keep asking, “what may cause it?”, even for other causes themselves, until all causes are identified.

d. List the effect of each hazard. Ask, “What will be the effect?” Example: Ground impact, loss of crew/aircraft. These should be related to either injury/loss of life or damage to aircraft/property.

e. Perform a risk assessment by: (1) Estimating the probability of each hazard occurring. Defined as improbable, remote, occasional, probable, or frequent.

(2) Estimating the severity of the consequences of each hazard, if it occurs. Defined as no safety effect, minor, major, hazardous, or catastrophic.

(3) Defining the risk of each hazard as a function of the probability and severity.

Defined as LOW, MEDIUM, HIGH, or AVOID.

(a) Risk assessment. Figure C-1 is a notional depiction of how probability and severity are combined to produce a simplified, overall description of risk. For example, if the severity is “Hazardous” and the probability is “Remote,” the risk level would be Medium. Other methods of depicting risk may be used.

C - 2 1 0/0 5/21 4040.26C Appendix C Figure C-1. Risk Assessment Catastrophic Hazardous Major Severity Minor No Safety Effect Frequent Probable Occasional Remote Improbable Probability (b) The risk assessment (probability, severity, risk) is assigned prior to risk mitigation. This is to ensure the proper level of management oversight. It is also common (and recommended) to assign a risk level after mitigations to illustrate the effect of those mitigations.

(c) Contributors to consider when performing risk assessments. The following list contains examples of factors that should be considered in assigning a risk rating to specific test techniques. This is not a comprehensive list, but a beginning list of items to consider.

1 Complexity/workload associated with the flight test technique or maneuver.

2 Altitude and airspeed in relation to terrain and/or aircraft recovery equipment.

3 Configuration (gross weight, center of gravity, etc.).

4 Environment (weather, air traffic control, particular airport conditions, darkness, turbulence, etc.).

5 Aircraft internal environment (smoke, temperature, pressurization level, noise, etc.).

6 Design maturity.

7 Test condition sequencing. (Has proper “buildup” been considered?)

8 Adverse system or software effects.

9 Specific aircraft limitations.

10 Consequence of failure in technique, system, or structure.

C - 3 1 0/0 5/21 4040.26C Appendix C 11 Intentional failure conditions.

12 Simulator/lab results/historical experiences/predictive studies.

13 FAA and company test pilot proficiency/currency/familiarity with the type of test aircraft.

f. Describe the steps for mitigation of hazards . Develop controls that mitigate identified risks. Mitigations are actions to minimize, understand, prepare, or respond to causes of the hazards. They are actions the flight test crew has control over or events that the test crew can confirm have occurred (e.g., lab testing, simulator evaluations). Mitigations will address reducing either the probability of a hazard or cause occurring, or the severity of the effect, or both. Mitigations should be detailed and specific in nature. The following items should be considered when formulating mitigations. This is not a comprehensive list, but a beginning list of items to consider.

(1) Set limits on test conditions (e.g., minimum weather, altitude, minimum/maximum speed, maximum angle of attack, minimum crew size).

(2) Clearly define and brief “knock-it-off” criteria and who will make calls.

(3) Review test procedure and techniques and specific steps to reduce the risk.

(4) If practical, practice the test procedures and techniques in an appropriate simulator or on another aircraft first.

(5) Design the test for a conservative build-up of maneuver parameters.

(6) For build-up tests, utilize technically qualified personnel to evaluate the data and plan for subsequent tests. Allow adequate time to evaluate the build-up test points prior to continuing tests.

(7) Provide predictions and expectations to prepare participants. Update performance predictions with flight test data when possible.

(8) Provide special training and consultation (e.g., Upset Prevention and Recovery, spin training).

(9) Provide special safety equipment and training (helmets, goggles, masks, oxygen, escape provisions, parachutes, fire extinguishers, etc.).

(10) Use of chase plane to provide visual data and alerts.

(11) Use of photo/video coverage.

(12) Use of telemetry or onboard instrumentation to monitor the tests in “real time” by either onboard personnel or ground monitors.

Install hardware to protect structure and personnel (e.g., V tailskid).

(13) MU C - 4 1 0/0 5/21 4040.26C Appendix C (14) Limit personnel on board to the absolute minimum required to conduct the test safely.

(15) Schedule flight crews based on pilot qualifications and recent experience relative to the required tests being conducted.

(16) Request a thorough briefing of the applicant’s testing, techniques, and results. On tests that are highly dependent on pilot precision or technique, consider having the applicant’s pilot conduct the initial tests or demonstrate an example and observe his or her performance before conducting the tests yourself.

Note: There may not be applicant test data to review if conducting concurrent testing (see Order 8110.4) or research. However, even with concurrent tests, there may be analytical predictions or simulation results to review.

(17) On certain potentially hazardous ground tests (e.g., high energy RTOs), experienced ground crews should be included in the preflight briefing and be immediately available to support the tests if necessary (e.g., cooling fans, fire trucks, aircraft jacks). The ground crews should be briefed regarding when support will be required and who can order support. Evaluate the location of ground equipment and crews with regard to safety.

(18) Ensure local emergency personnel are briefed, on standby, and/or nearby for quick response.

(19) Review weight and balance computations and requirements. While particularly important on critical handling qualities tests at the extremes of the weight/cg envelope and on Weight/Altitude/Temperature (WAT)-limited performance tests, weight and balance should be reviewed for all flight test events.

(20) Check the security of any ballast installations.

(21) Minimize the number of actual engine cuts during runway performance testing if spool-down thrust can be properly accounted for by analysis and related systems failures can be accurately simulated.

(22) All participating crewmembers must be briefed on oxygen use/location and should practice donning masks in the test aircraft prior to actually having to use them. For high altitude flights or pressurization testing, crewmembers should have current physiological training.

(23) For over-water flights, all crewmembers must be briefed on the location of water survival equipment and trained on its use, if necessary. Provide water survival gear if flying more than gliding distance from land.

(24) Test personnel involved with cold/hot weather testing should be briefed on appropriate survival skills and be properly equipped to endure the anticipated environment. If flying in these environments, adequate survival gear must be provided. Use of a buddy system is desirable to monitor other crewmembers for physiological problems (e.g., frost bite, heat stroke, hypothermia).

C - 5 1 0/0 5/21 4040.26C Appendix C (25) Verify conformity. How long has it been since the conformity on the test aircraft configuration was last conducted? Has anything changed since the design was reviewed?

(26) When elevated risk flight testing requires airfield takeoffs (e.g., field performance takeoffs, landings, V , V , braking tests, etc.), or includes maneuvers where it is possible MU MCG for the test aircraft to become airborne, all efforts should be made to avoid flying over densely populated airport environments. For these tests, select a suitable airfield without significant population density in close proximity to the airport boundaries.

(27) Is the test condition really needed in its present form? Has concurrent testing been considered IAW FAA Order 8110.4? Can it be done adequately in the lab or simulator or even by analysis instead?

g. Describe any emergency procedures to accomplish if the hazard occurs or escalates, despite mitigation steps . For example, for a spin test you would describe the specific spin recovery procedures and the use of the spin chute to effect recovery. Continue the emergency procedures assessment to include bailout, egress, etc. The EPs should focus on the preservation of life over minimizing damage to the air vehicle if corrective actions can’t preclude an escalation of a more dangerous condition. See Appendix D for more examples.

h. Re-Evaluate test procedures and techniques to determine if safer alternatives exist .

Determine if there are any other safer alternatives to achieve the same data required, especially for newly-created test techniques. This re-evaluation and refinement can be performed through means such as historical research, pre-test simulator testing, and additional build-up test points.

i. Document and Accept RM.

(1) Formalize RM plan . The input of this step should be an approved test plan and a proposed RM plan. Each TIA/LOA must have an RM plan. The level of detail within an RM plan should be consistent with test complexity and safety risk. These plans should be an integral part of a project test plan (such as a section in the test plan) or a stand-alone document that is referenced in the test plan. The risk assessments contained in the RM plan are often called Test Hazard Analysis (THA) sheets. Appendix D shows two examples of formats found to be acceptable but these examples are not the only way to document an RM plan. The objective of the RM plan is to document the details used to manage test risk and then communicate the details simply, clearly, and explicitly to test crews and those accepting the TIA/LOA risk. The output of this step should be an RM plan that has been reviewed by FAA project flight test personnel and is consistent with this order.

(2) Review of RM plan . The input of this step should be an RM plan that is ready for review by the person accepting risk for the TIA/LOA. The two methods for review of an RM Plan are by a desktop review or by conduct of a Safety Review Board (SRB). A desktop review is a method where stakeholders receive the RM plan and each review it individually. Their comments or concurrence are captured as an output of the review. An SRB is a meeting where the RM plan is reviewed and discussed by stakeholders in real-time. For TIA/LOA tests that have risk levels of LOW, a desktop review of the RM plan is usually sufficient. An SRB is the preferred method of RM plan review for TIA/LOA tests classified as MEDIUM or HIGH.

C - 6 1 0/0 5/21 4040.26C Appendix C Regardless of risk level, the final decision as to whether a desktop review or SRB should be held is at the discretion of the person accepting risk for the TIA/LOA as defined in 7.b.2 of this document. For any RM plan review, the key is the preparation done by the team members for the review. Technical details and issues should be resolved prior to any RM plan review (unless they have no impact on testing) in order to permit a clear focus on the safety aspects of the TIA/LOA tests. The output of this step should be an RM plan that has been appropriately vetted by stakeholders and can be accepted.

(a) Desktop review of RM Plan . When a desktop review is appropriate, the RM plan should be routed through appropriate stakeholders for review, comment, and, if acceptable, concurrence. This review can take place either in parallel or serially. The person accepting the risk for the TIA/LOA will be the last to concur after all other stakeholders have concurred on the plan. For the purposes of a desktop review, stakeholders are defined as FAA flight crew assigned to the program, DERs if applicable, and discipline engineers involved with the project.

(b) Safety Review Board assessment of RM plan (SRB). The SRB is the method that provides an opportunity to review the safety of the flight test program in a real-time meeting (face-to-face or virtual) after the test team has determined that they are ready for testing.

Experience has shown that knowledgeable non-project personnel who are involved in similar projects provide valuable contributions to this process. They can identify areas possibly overlooked by the project.

1 Membership . Attendance for an SRB needs to be appropriately sized. The minimum attendance for an SRB shall be the person accepting the risk (as defined in section 7.b.2 of this Order) and the FAA flight test crew assigned to the project. If testing is being delegated to DERs, they should be in attendance. If the DERs are unavailable, it is recommended they provide acknowledgement and agreement to the RM Plan. Anyone involved in the project may attend the SRB and provide input, but focus on the purpose of the SRB needs to be maintained.

2 Agenda . A sample SRB agenda is provided in Appendix H.

(3) Review of RM plan for applicants with an FAA-Accepted RM Process . If an applicant has an FAA-accepted RM process per paragraph 7.c. of this order, the FAA will be invited to participate in the applicant’s process. It is not required that the FAA repeat a full review of the applicant’s RM plan as listed in sub-paragraph (2) above. However, FAA flight test crewmembers should perform enough review to be comfortable that TIA/LOA risks have been properly identified and mitigated. Additionally, it is still required that the RM plan be accepted by the FAA before FAA personnel participate in the testing. Therefore, the person accepting the TIA/LOA risk may require more in-depth review of the applicant’s RM plan.

(4) Accept RM Plan . Acceptance of the RM plan will be documented on the TIA and/or LOA (including non-TIA flights), as defined in Appendix E.

4. Risk Management Process—During the Conduct of Flight Testing.

a. Proper use of pre-flight briefing checklists . The FAA flight test crew must use a preflight briefing checklist that effectively covers safety aspects of the test. Appendix B contains C - 7 1 0/0 5/21 4040.26C Appendix C a comprehensive recommended checklist. This checklist should be customized for the particular project as it may have items that are not applicable and it may be missing project-specific items.

When flights are scheduled in blocks, the whole briefing guide can be used for the first flight and for subsequent flights in the same block, only appropriate parts of the briefing guide need be used, as necessary.

b. Maintaining configuration/conformity . To achieve safe operation, it is important to maintain the conformity of the aircraft prior to and during flight testing, particularly when project delays occur. Conformity and inspection requirements identified in Block 12 Part 1 of the TIA must be carefully reviewed when project delays are encountered. Prior to conducting flight tests, flight test personnel should verify aircraft conformity via an appropriate form signed by a Manufacturing Inspection District Office (MIDO)/ODA quality assurance (QA) representative or, alternatively, by direct communication with the MIDO/designated airworthiness representative (DAR)/ODA QA, where necessary.

c. Constantly re-assess risk . Risk contributors and assumptions should be checked for accuracy during the conduct of flight testing programs. New contributors (e.g., unplanned weather) should be considered through an appropriate operational risk management evaluation.

If, at any time, it becomes apparent that the risk involved in any test event has been underestimated, that test event should be discontinued and the risk reevaluated. The post-flight briefing for such an event must include reference to any risk levels that were inaccurately assessed or considered unsatisfactory or reported via SSE (or applicant approved system). The RM process must then be reevaluated for adequacy. Approval to fly the event on a subsequent flight is contingent on reassessing the risk and risk mitigation measures and may require a repeated formal RM review and acceptance in accordance with this order. It should be stressed that any ground or flight crewmember has the ability to stop the test process at any time if they feel the risk of continuing is unacceptable.

d. Procedures for changes to test profile. RM is a deliberate team approach. However, in situations where it may be necessary to make changes to the flight test points (between flights and/or in-flight) due to unusual circumstances and operational considerations (such as remote locations, aircraft availability, weather), these changes are only permitted if they fall within the scope of the previously approved RM plan, without an increase of risk, and with concurrence of all test crewmembers. Involvement of the appropriate ACO disciplines/specialists is preferable if questions of benefit are raised, or increased risk is suspected. Care must be taken that all foreseeable scenarios are considered in making this determination; changes should not exceed the limits of the approved test plan nor compromise build-up to the desired test condition.

5. Risk Management Process—After Completion of Flight Testing.

a. Post-flight debriefing is critical in the flight test process . A thorough debrief reviews and documents what was accomplished during the test, how successful the tests were, and how well the test was run. Pay particular attention to the effectiveness of the RM process. Questions should be addressed, such as: (1) “Were the risk levels accurate for what was done?” C - 8 1 0/0 5/21 4040.26C Appendix C (2) “Were there any new hazards encountered?” (3) “Are there any new mitigations that can or should be implemented?” b. Capturing of lessons learned . There are always lessons to be learned during the conduct of flight test. Disciplined flight testers spend the time to pass these lessons along to others, in hopes of improving the safety of future flight test projects. Many avenues exist for capturing lessons learned, including: (1) Verbal or documented debrief to your SFSO and other co-workers.

(2) Use of the SSE reporting procedures discussed in paragraph 8 of the body of this order.

(3) Formal feedback to the internet-based National Aeronautics and Space Administration (NASA) Flight Test Safety Database.

(4) Feedback to applicant’s safety officer and/or lessons-learned database.

c. Program Debrief . In the same sense that each flight should be debriefed at the conclusion of a test program, a stand-alone debriefing event should also be planned examining the test program as a whole. The goal of this event should be to review the test program in its entirety from initial planning to completion. Participants should include, at a minimum, ground and flight test personnel, program management, and discipline engineers, with representatives from all organizations involved in the flight test program. If an event, or series of events, of interest included other organizations (such as maintenance, fire rescue, or air traffic control), effort should be made to include appropriate personnel from those organizations. Items to be discussed should include, but not be limited to: validity of initial assumptions, effectiveness of test planning, risk assessment/alleviation efforts, lessons learned, difficulties encountered during testing, unexpected events or results, and recommendations for the planning and conduct of future test programs of a similar nature. The results of this meeting should be documented and if appropriate, shared more broadly through venues such as the NASA Flight Test Safety Database, and the SETP/SFTE Flight Test Safety Workshop.

C - 9 1 0/0 5/21 4040.26C Appendix C Intentionally blank C - 10 10/05/21 4040.26C Appendix D Appendix D. Examples of Risk Management Plans Note: The examples contained in this appendix are not required formats. They are designed to show various ways to document a project-specific Risk Management plan.

Example 1 - Sample risk management plan in table format Test: [Description of test or test maneuver—can also be added as another column in the table below; can also assign a number to the test, for easy reference. Example: Minimum Control Speed Air—Static (V Static) ] (Project # XXXX) MCA Author: [Name, phone] RISK MANAGEMENT 3 4 1 2 Cause Effect Risk Mitigation Emer Proc Hazard Probability Severity Describe Describe Describe the Describe the Describe State Describe how the risk is minimized. Describe what “what the “what effect of the chances of the severity of the the Include all pertinent factors. will be done IF might might hazard hazard consequences overall Example (partial): the hazard happen to cause that Example: occurring. if the hazard risk. 1. The pilots must be familiar with occurs to reduce adversely hazard to Ground Example: Example: the aircraft’s handling occurs the severity.

affect the happen?” . impact, loss Occasional Example: High characteristics at low - speed, high Example: safety of Example: of crew/ Catastrophic AOA, and stall departure recovery Reduce AOA, the test?” Poor aircraft techniques. increase speed, Example: technique. 2. Pre - flight briefing to include and retard Loss of Unexpected engine failure procedures, the throttle as control air vehicle quick - start procedure, along with necessary to response. ditching procedures. maintain Wind 3. Lat - Dir handling qualities and directional gradient or stall characteristics testing control, etc.

shear completed.

4. etc.

Notes: (1) Likelihood that the risk will occur—Improbable, Remote, Occasional, Probable, or Frequent.

(2) Consequence if the hazard occurred—No Safety Effect, Minor, Major, Hazardous, or Catastrophic.

(3) Combination of Probability and Severity—Low, Medium, High, Avoid. Refer to Figure C-1 in Appendix C. Note that these definitions are used to assign the level of risk prior to consideration of risk mitigation effects.

(4) This column is your plan of action if the event still occurs.

D - 1 10/05/21 4040.26C Appendix D Example 2 – Sample risk management plan in one-page-per-hazard format This example has sections for weather, crew size, and emergency equipment. These examples are shown to convey that a variety of options are available to those performing risk management.

Hazard Number: 1 Risk Assessment Test Plan: Aero 1 Catastrophic High Avoid High Medium Low Flight Test Hazardous Avoid High Medium Medium Low Technique: V Static.

MCA Major High High Medium Medium Low Hazard: Loss of Minor Medium Medium Medium Low Low control.

No Safety Effect Low Low Low Low Low Cause: Low Severity Frequent Probable Occasional Remote Improbable altitude stall.

Probability Effect: Ground impact, Loss of aircraft and crew.

Mitigations and Minimizing Procedures : 1. The pilots must be familiar with the aircraft's handling characteristics at low-speed, high angle-of-attack, and stall departure recovery techniques.

2. Monitor structural loads real-time.

3. Pre-flight briefing to include engine failure procedures, the quick-start procedure, along with ditching procedures (if over water).

4. Directional control handling qualities testing and Light / Aft stall characteristics will be completed prior to any V MCA tests.

5. Entry altitude should be a minimum of xxxx ft AGL.

6. Spin-chute (if installed) must be operational and pilot familiar with its operation.

7. Minimum crew only.

8. etc.

Emergency Procedures : Reduce angle-of-attack, increase airspeed and retard throttle as necessary to maintain directional control.

Weather Requirement and/or Flight Conditions: VMC, no clouds below.

Minimum Essential Aircrew: YES NO Parachutes Required: YES NO RISK: LOW MEDIUM HIGH AVOID D-2

1 0/05/2 1 4040.26C Appendix E Appendix E. Example Letter of Authorization (LOA)

Federal Aviation

Administration

Memorandum

Date: Month-Date-Year [AIR-71X Flight Test Personnel Listed Below, or] To: Name, Title, AIR-71X Name, Title, AIR-71X From: Name, Manager, Organization, Office Code Prepared by: Name, Title, AIR-71X Authorization of Flight Test Crewmembers to Conduct Flight Test in the Subject: Make/Model Aircraft/Rotorcraft, Project # XXXXXXXX 1. You are authorized to conduct flight tests of the [Make/model] aircraft/rotorcraft, in support of [TIA, production test, etc.] for project number [XXXXXX].

2. Specific tests include certification testing of [provide a summary of planned tests].

3. This testing is authorized during the period of [Month date range and year]. You should coordinate with your manager to ensure that you remain current and proficient to perform all planned flight tests in accordance with the AIR Flight Test Operations Manual (latest revision) and specific CFTP prerequisites (i.e., simulator build up).

4. The following flight test crewmembers are authorized to conduct this testing: a. Name, FTP/FTE, AIR-71X b. Name, FTP/FTE, AIR-71X c. Name, FTP/FTE, AIR-71X 5. The highest premitigated risk of these flights is [ Low / Medium/High ] as determined by the FAA approved/accepted flight test risk management plan [XXXXX revY] in accordance with FAA Order 4040.26. Below are identified hazards and planned risk mitigations: RISK ASSESSMENT, RISK MITIGATION, AND OPERATING LIMITATIONS E - 1 1 0/05/2 1 4040.26C Appendix E General Risk Mitigations: [EXAMPLES BELOW] 1. The applicant pilot will be pilot-in-command.

2. The pilot is experienced in type and familiar with the local operating area and nearby airfields.

3. A thorough pre-flight briefing will be conducted, to include crew resource management consideration, with an emphasis on lookout doctrine and responsibilities.

4. The flight will be conducted fully within the limitations contained in the FAA approved Aircraft Flight Manual.

5. The flight will be flown in the KXXX local operating areas. The terrain and obstacles will be reviewed by the FAA crew and safety pilot.

6. All planned maneuvers have been cleared by the applicant and will be accomplished within existing limitations.

Specific Test Hazards and Risk Mitigations: [LIST UNIQUE TEST HAZARDS AND MITIGATIONS OR REFERENCE APPROVED FLIGHT TEST RISK MITIGATION PLAN] Hazard 1 : XXXXXXX • Describe hazard and risk level before minimizing procedure taken into account.

Minimizing Procedures/Mitigations: • Minimizing element 1.

• Minimizing element 2.

• Minimizing element 3.

Emergency Procedures: • Applicable emergency or recovery procedures.

Hazard 2 : XXXXXXX • Describe hazard and risk level before minimizing procedure taken into account.

Minimizing Procedures/Mitigations: • Minimizing element 1.

• Minimizing element 2.

• Minimizing element 3.

Emergency Procedures: • Applicable emergency or recovery procedures.

Risk Level (after minimizing procedures taken into account): Extreme (Avoid) High Medium Low X Distribution List: AIR-71X AIR-710 E - 2 1 0/05/21 4040.26C Appendix F Appendix F. Example Letter Accepting Company Risk Management Process [Date] Mr. I. M. Safety Director of Safety Applicant Aircraft Company P.O. Box 9999 Applicantville, USA Subject: FAA Acceptance of [Applicant’s] Risk Management Policy and Procedures, Flight Test Safety Program Reference: [Applicant’s letter submitting process] Dear Mr. Safety: We have reviewed and accept [Applicant] Report No. XXXX [Applicant’s Risk Management Process document] submitted in your letter referenced above. This document defines the formal safety program for Engineering Flight Test and contains the procedures for risk mitigation of flight and ground tests. This document meets the specified requirements of Order 4040.26.

If this document is revised in the future, please submit a copy of the revised document to our office for review and acceptance. If you have any questions, please contact [SFSO name] at [Phone number].

Sincerely, [Name] Manager, XXX Flight Test Section, AIR-7XX F - 1 1 0/05/21 4040.26C Appendix F Intentionally blank F - 2

1 0/05/21 4040.26C Appendix G Appendix G. Typical Examples of Flight Tests at Various Risk Levels Note: These are typical examples only, provided here for general guidance. The actual risk category must be evaluated on a case-by-case basis and it may be different from these examples depending on actual project-specific circumstances.

HIGH RISK • Stall characteristics: o Aft cg accelerated stalls with rapidly changing dynamic conditions.

o On aircraft equipped with unproven stall/high AOA protection or barrier systems that are masking potential deep stalls.

o High altitude stalls on aircraft with potential engine flameout problems.

o With critical ice shapes.

High speed tests above V /V /M .

• NE MO MO V tests at low altitude, particularly dynamic V .

• MCA MCA • Flight control malfunction testing during takeoff and landing phases of flight, and asymmetric deployment of roll controls at high speeds.

• Ice shape testing, especially during the takeoff phase where special procedures are required.

• Maximum energy RTOs where wheel/brake fires are a possibility.

Actual V fuel cuts for takeoff performance.

• 1 • Autopilot malfunction tests at low altitudes.

• WAT limited takeoffs with actual engine cuts.

V test at low thrust to weight ratios.

• MU V tests.

• MCG • Nose-wheel steering malfunction tests.

• Spin testing.

• Lateral-directional testing on aircraft that can achieve extremely large sideslip angles.

• Dynamic lateral stability testing (Dutch rolls) on aircraft that are extremely unstable under certain conditions.

• In-flight thrust reverser deployments.

• Systems installation (with unproved design aspects) where the Failure Hazards Analysis (FHA), Systems Safety Analysis (SSA) or Failure Modes and Effects Analysis (FMEA) have identified catastrophic events.

• Stall characteristics with asymmetric wing store configurations.

• H/V envelope determination.

• Helicopter low speed testing.

• Autorotation.

• PIO Testing.

• Max Crosswind Landings.

G - 1

1 0/05/21 4040.26C Appendix G MEDIUM RISK • Any tests involving low altitude operations (e.g., tower fly by).

• Icing tests flown behind a tanker (formation flying with potential restricted vision).

• Engine out operations at low altitude.

• In-flight unusable fuel tests that result in engine flameout.

• Emergency electrical power landings at night using standby instruments and reduced lighting (both external and internal).

• Emergency descents to demonstrate high altitude special conditions (possible physiological effects).

• Unimproved runway field performance.

• High-G acrobatic tests.

• Abnormal flight control configuration testing. Includes pitch and roll disconnects or manual reversion for hydraulic systems.Natural ice test flights on unprotected surfaces.

• Cockpit and cargo smoke evacuation tests.

• Engine water ingestion tests.

• Asymmetric thrust reverser deployments on the ground.

• Abnormal operations of various onboard systems.

• Flights involving Full Authority Digital Engine Control (FADEC) testing (Electromagnetic Interference (EMI), software, etc.).

• Terrain Awareness and Warning System (TAWS).

High thrust to weight ratio V tests (tail strikes).

• MU • Traffic Alert and Collision Avoidance System (TCAS) using airborne target.

LOW RISK • Basic system function tests (electrical, hydraulic, fuel, environmental, anti-ice, avionics, etc.).

• High altitude airspeed calibrations (e.g., trailing cone).

• Climb performance/speed power, etc.

• Avionics follow-on tests that do not require handling qualities or high speed flight beyond V (e.g., TCAS (no intruder/target aircraft), FMS).

MO G - 2 4040.26C 10/05/21 Appendix G Table G-1 – Recommendations for Low Risk Testing This table contains recommendations for low risk testing. Low risk does not mean there are no hazards and therefore, no appropriate mitigations. Mitigations such as build-up, day before night, high before low, etc., should be considered. The Flight Safety/Risk Management TIA requirement may be satisfied by referencing the applicable INDEX from the table below for repetitive, low risk flight tests in the Risk Assessment block on the Type Inspection Authorization or in other flight test planning documents. In consideration of the above, this implies no flight operations outside the normal flight envelope of the test aircraft are required and all test points will honor AFM limitations, including weight and balance considerations.

When flight characteristics or handling qualities are not altered because of the modification(s) to the test aircraft, the table may be referenced. If flight characteristics or handling qualities are altered, then the table is not applicable and a more formal risk assessment must be accomplished prior to TIA signature.

Note: All operations must adhere to basic 14 CFR part 91 requirements (cloud clearance, visibility, safe altitudes, etc.)

Note: This table may only be used for the specific types of tests listed.

WEATHER TEST/OPERATING AREA REQUIREMENTS & INDEX TYPE OF TEST REMARKS ALTITUDE RANGE FLIGHT CONDITIONS Where VMC requirements apply, VMC day testing should precede VMC night testing. No operations below 500’ AGL (excluding approach and landing), no high sink rates below 1500’ AGL. At discretion of test crew, rotorcraft tests may be conducted below Within gliding distance of 500' AGL where nature of test requires such exception, and has Avionics land for aircraft not equipped been thoroughly pre-briefed.

(including FMS VMC (Day or Night) A for overwater ops or not TCAS testing limited to VMC Day conditions. No flight involving functional GPS, (See remarks) capable of sustained OEI formation flying or intruder/target aircraft.

TCAS II) flight Testing in IMC may be performed when system integrity has been proven (successful ground EMI/RFI tests) and means other than the system being tested are available to fly under IFR. However, for the first takeoff and the first landing, the weather conditions are limited to no lower than circling minimums.

G-3 4040.26C 10/05/21 Appendix G WEATHER TEST/OPERATING AREA REQUIREMENTS & INDEX TYPE OF TEST REMARKS FLIGHT ALTITUDE RANGE CONDITIONS Night evaluation Within the National Airspace B of cockpit System or test area VMC Night Excludes emergency electrical system evaluation.

lighting acceptable to flight crew VMC day testing should precede VMC night testing. May be EMI for cabin medium risk if EMI could adversely affect critical systems such as Within the National Airspace electrical fly-by-wire flight controls or FADEC.

System or test area VMC (Day or Night) C systems Testing in IMC may be performed when system integrity has been acceptable to flight crew (See remarks) installations proven (successful ground EMI/RFI tests). However, for the first takeoff and the first landing, the weather conditions are limited to no lower than circling minimums.

Where VMC requirements apply, VMC day testing should precede Basic systems In accordance with VMC/IMC Day or D VMC night testing. These tests are simple functional tests similar functional tests Certificate limitations Night to production flight testing or return to service after maintenance.

High altitude VMC Day E airspeed IAW Certificate limitations calibration Cockpit evaluation for VMC/IMC Day or Where VMC requirements apply, VMC day testing should precede F IAW Certificate limitations layout or human Night VMC night testing.

factors issues Function and VMC/IMC Day or G Normal operating envelope Reliability (F&R) Night G-4 1 0/05/21 4040.26C Appendix H Appendix H. Pre-Flight Type Certification Board (PFTCB)/Risk Management Review (RM Review) 1. Background Multi-disciplinary test readiness reviews are critical elements of any ground or flight test program. These reviews provide important technical information that support a flight test risk management review. For purposes of this order, test readiness reviews are synonymous with Pre- Flight Type Certification Boards (PFTCB), Technical Review Boards (TRB), Test Readiness Reviews (TRR), Airworthiness Reviews, etc. When combined with a review of Flight Test Safety/Risk Management, the resultant meeting crosses several technical disciplines and functional organizations. (e.g., PFTCB, SRB, etc.)

In recent experience, it has been observed that the content and focus of a flight test safety/risk review would often deviate toward subjects that were not flight test safety related. It is important to draw a distinction between items that are important for test readiness and those that are safety focused. For the purpose of this order, a Pre-Flight Type Certification Board (PFTCB) serves as the vehicle to discuss test readiness. A PFTCB is normally used to evaluate a project’s readiness to enter TIA testing. A PFTCB is generally a project management-led responsibility supported by flight test, whereas Flight Test Safety/Risk Management Review (aka Safety Review Board or SRB) is the responsibility of Flight Test supported by project personnel.

As mentioned previously in this order, the purpose of the Risk Management Review is to allow for the people who are authorized to accept risk to review the test risks identified along with the classification and the mitigations of those risks. The RM Review is chaired by the person(s) authorized to approve the level of risk identified for the testing. For the FAA, the person who is authorized to approve test risk is defined in section 7.b.(2) of this Order. An RM Review is led by the flight test organization and supported by discipline engineers and project managers. If a combined PFTCB and SRB is to be scheduled, sufficient time should be scheduled to accomplish both. The SRB, normally scheduled toward the end of the meeting, must not be rushed.

2. Pre-Flight Type Certification Board (PFTCB) Based on each project, the audience for the PFTCB will vary. The PFTCB is normally chaired by the FAA program manager with attendance from the applicant, DERs, DARs, FAA engineers, and inspectors. The purpose of a PFTCB is to get engineering approval that the aircraft and its systems are ready to test based on the specified plans.

The test review board includes an evaluation of the current status of the following: • Research and development on systems and components presented for test.

• Engineering type design.

• Component qualification/bench testing.

• System architecture analysis and safety assessments.

• Necessary type design, qualification reports, analyses, and other compliance findings have been reviewed and approved by the FAA or FAA designees.

H - 1 1 0/05/21 4040.26C Appendix H • Applicant has completed sufficient company flight testing to ascertain that design shows compliance.

• Conformity inspection requirements for testing have been identified.

• Applicable test plans have been reviewed and approved.

3. Safety Review Board The SRB is chaired by the Flight Test Section RM approval authority (see 7b on page 2). While these are recommendations, project specific details may influence the format/agenda.

a. Stand-Alone SRB Agenda (1) Program Overview • Description of modification • Verify test rediness review has been held to verify 14 CFR 21.35(a) testing has been completed • Brief safety-related results from company testing (2) Test Plan Review • Purpose and Objectives • Method of Test • Test limitations • Limitations from baseline design (if applicable) • Changes from baseline design (if applicable) • Success Criteria • Go / No-Go Criteria (instrumentation, test support requirements, etc.)

• Schedule (3) Test Article • Configuration, especially as related to test hazards such as control rigging • Review any Open Problem Reports (OPR) related to system software and airborne electronic hardware (AEH). Verify the FAA team has reviewed and concurred with any OPRs.

(4) Safety Review • Test Hazard Analysis Review • Risk Assessment (5) Safety Equipment availability and applicability to the test/environment (6) Review of decisions and actions. Meeting minutes will be generated and placed in the project file.

H - 2 1 0/05/21 4040.26C Appendix H b. List of Potential Attendees for an SRB and reviewers for a Desktop RM Review • RM Review chairperson (person(s) authorized to approve the level of risk identified for the testing) • Project manager and/or project engineer • Project flight test crew (FTP and FTE) and other flight test personnel who will be participating in the test • Other flight test section representative(s) (if assigned project pilot or FTE are unavailable) • FAA discipline engineers (propulsion, airframe, systems, etc.)

• Independent SMEs that may be outside observers with the appropriate experience to provide an independent review of safety issues • Project manufacturing inspection district office (MIDO) or manufacturing inspection satellite office (MISO) specialist • Applicant representative(s) o Main project POC o Applicant flight test personnel • Flight Test Designees (when delegated) • Project Aircraft Evaluation Division (AED) pilot, if appropriate • SFSO c. Blended PFTCB/SRB Agenda If a Blended PFTCB/SRB is proposed, the FAA Program Manager and SRB Chairperson should consider the following agenda: (1) Program Overview (PFTCB) - Led by Program Manager • Description of Modification • Engineering Status • Company Flight Test Data • Design Maturity Review o System/Aircraft Safety Assessment (2X.1309) o Qualification testing o Iron bird/systems integration testing o Software testing o AEH testing (2) Test Plan Review(PFTCB) - Led by flight test team • Purpose and Objectives • Method of Test • Success Criteria • Technical Go / No-Go Criteria • Schedule (3) Test Article (PFTCB) - Led by Program Manager • Configuration • Airworthiness Status H - 3 1 0/05/21 4040.26C Appendix H (4) Safety Review (SRB) - Led by SRB Chairperson • Test Hazard Analysis Review • Risk Assessment H - 4 1 0/05/21 4040.26C Appendix I Appendix I. Administrative Information 1. Distribution. This order is distributed to the branch level in AIR.

2. Authority to Change This Order. The issuance, revision, or cancellation of the material in this order is the responsibility of the AIR Compliance and Airworthiness Division (AIR-700).

3. Suggestions for Improvements. Please forward all comments on deficiencies, clarifications, or improvements regarding the contents of this order to: a. The AIR Directives Management Officer at 9-AWA-AVS-AIR-DMO@faa.gov or ---------------------- - b. The FAA Directive Feedback System at https://ksn2.faa.gov/avs/dfs/Pages/Home.aspx.

Your suggestions are welcome. FAA Form 1320-19, Directive Feedback Information , is located in Appendix J of this order for your convenience.

4. Records Management. Refer to FAA Order 0000.1, FAA Standard Subject Classification System ; FAA Order 1350.14, Records Management ; or cognizant Records Management Officer (RMO)/Directives Management Officer (DMO) for guidance regarding retention or disposition of records.

I - 1 1 0/05/21 4040.26C Appendix H Intentionally blank I - 2 1 0/05/21 4040.26C Appendix J Appendix J. Directive Feedback Information Please submit any written comments or recommendation for improving this directive, or suggest new items or subjects to be added to it. Also, if you find an error, please tell us about it.

Subject: FAA Order 4040.26C, Aircraft Certification Service Flight Test Risk Management To: 9-AWA-AVS-AIR-DMO@faa.gov or complete the form online at https://ksn2.faa.gov/avs/dfs/Pages/Home.aspx Please check all appropriate line items: An error (procedural or typographical) has been noted in paragraph on page

□

.

Recommend paragraph on page be changed as follows:

□

In a future change to this Order, please cover the following subject:

□

(Briefly describe what you want added.)

Other comments:

□

I would like to discuss the above. Please contact me.

□

Submitted by: Date: Telephone Number: Routing Symbol: FAA Form 1320-19 (10-98) J - 1 1 0/05/21 4040.26C Appendix J Intentionally blank J - 2