Plain questions in. Plans and analyses filled in.

Each autopilot works the same way. The tool reads what the project already holds: the aircraft and system functions, the failure conditions and their classifications, the architecture, and for the zonal and particular risk work, the CAD model. It works out everything that can be worked out, then asks only the questions that need an engineer's judgment. Each question comes with the choices real programs use, an explanation of each choice, and what picking it will change. Answers record who gave them and when, and the analyses they fill stay open for review and signature.

Plan Autopilot: the program's safety plans

The System Safety Program Plan, the Human Factors Plan and the Reliability and Maintainability Plan, written from the answers in the layout of the ARP 4754B example plan, in our own words.

• The certification basis comes first. Part 25, Part 23 by level and propulsion, Part 27 and 29, SC-VTOL and others. The classifications, probability targets and DALs in the plan come from the same engine the fault trees and DAL assignment use, so the plan and the analysis cannot disagree.
• Every assessment is defined. For the AFHA, PASA, system FHAs, PSSAs, common cause analyses, SSAs and ASA, and for each part of the human factors and reliability work: what it does, the inputs it needs and where they come from, and the outputs it must produce and who uses them. It is written as a paragraph each and drawn as a diagram.
• Diagrams in the style of the ARP 4761A and ARP 4754B examples, redrawn from the answers: the assessment through the development phases, the assessment beside the development process, DAL assignment, validation and verification, and configuration management.
• Multi-system failure conditions planned with interdependence analysis, MAC or CoFFE, as the program chooses.
• A plan, not a status report. The plan says what the program will do and ends with the outputs to accept. Where the work stands goes in a separate status report, read from the project.
• A cover page with document control and approvals by role, a table of contents, lists of tables and figures, one revision per issue, and export to Word.

ZSA Autopilot: zonal safety from the CAD model

The tool places every part in its zone from the CAD model, links each part to its system, and takes how bad losing each system is from its FHA. Then it asks, zone by zone, only the real questions, each shown on the model:

• a fluid unit or line above an electronic unit whose loss matters;
• two lanes of the same function in the same zone, where one fire, leak or burst could take both;
• a hot duct or unit close to a fuel or hydraulic line;
• a zone with fuel or hydraulic fluid in it, and where a leak goes.

Each answer opens a design change, closes the finding with a mitigation, or accepts it with the reason. Particular risks that reach a zone are named and left to the PRA, not asked twice. The zone's row in the ZSA is written from the answers.

PRA Autopilot: particular risks on the CAD model

For each particular risk, the tool works out on the CAD model what the event could reach:

• Rotor burst: the parts inside the fragment zones AC 20-128A asks for, out to the fragment range, for each engine;
• Tire burst and wheel-well fire, from the risk volumes;
• Fire in the hold;
• Bird strike: the parts behind the forward-facing surfaces;
• Lightning: the parts near the likely attachment points.

It asks only where one event reaches more than one lane of the same job: protect it, move a lane, or accept it with the reason the standard allows. Each risk's row in the PRA is written from the answers.

HF Autopilot: human factors through the design cycle

The human factors work in the order the design cycle needs it, built from the functions, the failure conditions with a crew effect and the flight phases:

• who does each aircraft function: the crew, the automation, or both;
• the crew procedures, normal and for each failure the crew has to deal with;
• workload in every flight phase, from task times you measure or estimate, never filled in by the tool;
• how each crew task can go wrong, how the crew would notice, and how they recover;
• how the crew is told about each failure condition (14 CFR 25.1322);
• the 14 CFR 25.1302 questions for each flight deck control and display, and reach and view;
• the workload functions and factors of Part 25 Appendix D, then the minimum flight crew.

The crew actions the safety analysis counts on are listed and checked before they are given credit.

What the autopilots do not do

They do not make engineering decisions. Fault trees and requirements are generated deterministically from the model: same inputs, same results, every number traceable. Where the AI drafts text, it is grounded in the standards and your architecture, and nothing it drafts counts until an engineer accepts it. How that works is on the AI guardrails page.