9/23/10 rev. 0 

Federal Aviation 

Administration

Engine & Propeller Directorate 

ENGINE & PROPELLER DIRECTORATE 

CONTINUED AIRWORTHINESS ASSESSMENT PROCESS 

HANDBOOK 
9/23/10 rev. 0 

Revision History 

Rev Description of Change Effective Date 

0 Original Release 9/23/2010 
9/23/10 rev. 0 

Table of Contents 

1. PURPOSE 1 

2. REFERENCES 1 

3. DEFINITIONS 2 

4. HAZARD LEVELS 5 

5. DATA REVIEW AND PRELIMINARY RISK ASSESMMENT 6 

5.1 Acquire and Review Event Data 6 

5.2 Preliminary Risk Assessment (PRA) 6 

5.3 Initiate Potential Safety Issue Investigation 8 

6. CONTINUED AIRWORTHINESS ASSESSMENTS OF 

POWERPLANT AND APU INSTALLATIONS ON 

TRANSPORT CATEGORY AIRPLANES 9 

7. CONTINUED AIRWORTHINESS ASSESSMENTS OF 

ENGINES, PROPELLERS, AND APUs ON SMALL 

AIRPLANES AND ROTORCRAFT 9 

7.1 General 9 

7.2 Estimate the Number of Airplanes Exposed 11 

7.3 Create Risk Model 11 

7.4 Calibrate the Risk Model to Current Experience 12 

7.5 Estimate the Uncorrected Fleet Risk Factor and Uncorrected Individual Risk 12 

7.6 Compare the Uncorrected Risks to Risk Guidelines 14 

7.7 Identify Options for Mitigating Action 14 

7.8 Estimate the Effects of Candidate Actions 14 

7.9 Estimate Potential Risk Reduction 14 

7.10 Implement and Monitor the Impact of the Corrective Actions 15 

7.11 Verify Corrective Actions Were Effective 16 

7.12 Follow-on Assessments and Responses 16 

8. RISK GUIDELINES 17 

8.1 General 17 

8.2 Risk Guidelines for Immediate Action 17 

9. PRIORITIZATION BASED ON RISK 19 

10. CORRECTED RISK 20 
9/23/10 rev. 0 

11. CUMULATIVE RISK 21 

12. ALTERNATIVE METHODS OF COMPLIANCE 22 

13. INTER-DIRECTORATE COORDINATION 22 

APPENDIX 1. POTENTIAL UNSAFE CONDITIONS 23 

APPENDIX 2. EVENT HAZARD LEVELS AND DEFINITIONS FOR 

ENGINE, PROPELLER, AND APUs INSTALLED IN SMALL AIRPLANES 25 

APPENDIX 3. EVENT HAZARD LEVELS AND DEFINITIONS FOR 

ENGINE AND APUs INSTALLED IN ROTORCRAFT 28 

APPENDIX 4. HAZARD RATIO DEVELOPMENT 29 

APPENDIX 5. ASSESSMENT EXAMPLES 32 

APPENDIX 6. HISTORICALLY POTENTIALLY UNSAFE 

CONDITIONS FOR TURBINE ENGINES, PROPELLERS, AND 

APUs INSTALLED IN SMALL AIRPLANES 38 

LIST OF TABLES 

Table 1 18 

Table 2 18 

LIST OF FIGURES 

Figure 1 20 

Figure 2 21 
9/23/10 rev. 0 

1 

1. Purpose 

1.1 This handbook describes the Engine & Propeller Directorate (E&PD) Continued 

Airworthiness Assessment Process. This handbook provides guidance for risk 

determination and management during the resolution of engine, propeller, and 

auxiliary power units (APU) continued operational safety (COS) issues as part 

of FAA’s Aircraft Certification Service (AIR) Safety Management System 

(SMS) Monitor Safety/Analyze Data (MSAD) process. 

1.2 The handbook supports the MSAD process by requiring information on event 

severity and causal chain be documented in the MSAD program. 

1.3 Continued airworthiness requires that safety concerns within the existing fleet 

be addressed and that the knowledge gained be applied for the benefit of future 

fleets. This handbook also provides guidance for estimating the risks of 

potential safety issues; identifying and estimating the effects of corrective 

actions for all identified unsafe conditions; and verifying that the corrective 

actions were effective. This handbook is intended to present a tangible means 

of logically assessing and responding to the safety risks posed by unsafe 

conditions. 

1.4 This handbook applies to the Engine Certification Office (ECO) and Aircraft 

Certification Offices (ACOs) responsible for the continued operational safety of 

FAA-certified engines, propellers, and APUs. 

2. References 

 Documents listed in paragraphs 2.1, 2.2, 2.3, 2.9, and 2.10 can be found in the

folder titled, “MSAD – Risk Analysis Supporting Data” on the ANE-110 

SharePoint site 

(https://avssharepoint.faa.gov/air/EPD/ANE110/COS/default.aspx). 

2.1. Technical Report on Propulsion System and APU-Related Aircraft Safety 

Hazards, dated October 25, 1999. 

2.2. 2nd Technical Report on Propulsion System and APU-Related Aircraft Safety 

Hazards, dated January 31, 2005. 

2.3. Paper, “Quantitative Analysis in the Absence of Data,” presented by Ann 

Azevedo, FAA, at the 23rd International System Safety Conference, August 

2005. 

2.4. MSAD Users Guide (available within the MSAD tool). 

2.5. The New Weibull Handbook, 5th edition, Dr. Robert B. Abernethy. 

2.6. WinSmith Weibull software. 

2.7. E&PD Risk Analysis spreadsheets. 

2.8. Order 8110.107, “Monitor Safety/Analyze Data,” dated March 12, 2010. 
9/23/10 rev. 0 

2 

2.9. AC No. 39-8, “Continued Airworthiness Assessments of Powerplant and 

Auxiliary Power Unit Installations of Transport Category Airplanes,” dated 

September 8, 2003. 

2.10. Policy PS-ANE100-1999-00006, “Risk Assessment for Reciprocating Engine 

Airworthiness Directives,” dated May 24, 1999. 

3. Definitions 

3.1 The following definitions apply to the information provided here. 

3.1.1 Compliance schedule. A timetable for performing specified corrective 

actions (e.g., maintenance, inspections, part replacements, alterations, 

etc.) to alleviate an identified unsafe condition. 

3.1.2 Continued airworthiness. The ongoing activities associated with 

ensuring a product remains in compliance with the intent of the 

applicable Product Design Standards. 

3.1.3 Continued Airworthiness Assessment Methodology (CAAM). The 

E&PD and Transport Airplane Directorate may use this methodology to 

identify unsafe conditions and determine when an “unsafe condition is 

likely to exist or develop in other products of the same type design” 

before prescribing corrective action in accordance with Title 14 of the 

Code of Federal Regulations (14 CFR) part 39. CAAM, which is 

described in AC 39-8, is used for products associated with the 

Powerplant or Auxiliary Power Unit (APU) Installations on Transport 

Category Airplanes. That AC applies to the identification, prioritization 

and resolution of unsafe conditions within the powerplant and APU 

installations of transport category airplanes.

3.1.4 CAAM level. The level of event outcome as defined by its effect on the 

aircraft, passengers, and crew of transport category airplanes. Note the 

more generic definition of hazard level below. 

3.1.5 Control program. The combination of compliance schedule and 

corrective actions needed to alleviate an identified unsafe condition. 

Note that the condition is no longer considered to be unsafe while it is 

being addressed by a control program developed under the guidelines of 

the process identified here. 

3.1.6 Event. The occurrence of a failure or other condition. Events typically 

trigger investigations that seek causes of a safety issue. The safety issue 

(or condition) is then evaluated for safety implications. 

3.1.7 Fatal Accident. An occurrence associated with the operation of an 

aircraft which takes place between the time any person boards the 

aircraft with the intention of flight and until such time as all such 

persons have disembarked, and in which any person (including those on 

the ground injured as a result of the essential operation of the flight) 

suffers a fatal injury. This definition excludes maintenance, ramp 
9/23/10 rev. 0 

3 

positioning and ground personnel movement, unless injuries are a direct 

result of the aircraft’s action or malfunction. 

3.1.8 Fatal injury. An injury that results in death within 30 days of the 

accident. 

3.1.9 Fleet Risk factor. A quantitative assessment output equal to the average 

number of future events expected to occur within a given time. Fleet 

risk factors can be differentiated into two types (see below) and typically 

cover the time required for problem resolution. However, in the case of 

uncorrected fleet risk factor and control program fleet risk factor for 

control programs that do not incorporate final corrective actions (e.g., 

recurring inspections), fleet risk factors usually cover a 20-year period 

or shorter interval corresponding to the expected life of the fleet. In AC 

39-8, fleet risk factor is called risk factor. 

3.1.9.1. Uncorrected fleet risk factor. The forecasted number of future 

events expected to occur in the entire worldwide fleet (or, if 

applicable, the relevant affected subfleet) if no corrective 

actions are incorporated. 

3.1.9.2. Control program fleet risk factor. The forecasted number of 

future events expected to occur in the entire worldwide fleet 

(or, if applicable, the relevant affected subfleet) during the 

control program. 

3.1.10 Hazard level. Level of event outcome, as defined by its effect on the 

aircraft, passengers, and crew. Hazard levels are defined as a function 

of the powerplant installation (i.e., transport airplane, rotorcraft, or small 

airplane). In reference 2.9, the hazard level is referred to as the CAAM 

level. 

3.1.11 Hazard ratio. The conditional probability that a particular failure mode 

will result in an event of a specific hazard level. 

3.1.12 Individual Risk. The risk per flight-hour or per flight. The per flighthour (or per flight) guidelines apply to the average of the fleet or 

subfleet suspected of having the unsafe condition. The terminology of 

individual risk is not meant to imply that the risk to an individual person 

is calculated. Rather, individual risk is normally calculated by dividing 

the fleet risk factor by the total number of flight-hours (or flights) within 

the assumed exposure period. In AC 39-8, individual risk is called per 

flight risk. 

3.1.12.1. Uncorrected individual risk. The forecasted number of future 

events per flight-hour (or per flight) expected to occur in the 

entire worldwide fleet (or, if applicable, the relevant affected 

subfleet) if no corrective actions are incorporated. 
9/23/10 rev. 0 

4 

3.1.12.2. Control program individual risk. The forecasted number of 

future events per flight-hour (or per flight) expected to occur in 

the entire worldwide fleet (or, if applicable, the relevant 

affected subfleet) during the control program. 

3.1.13 Malfunction type. A single initiating cause of a failure, defect or other 

abnormal condition on a type design that can affect one or more parts. 

One specific cause (such as a melt-related defect leading to fracture) that 

affects several different parts (5th stage disks and 6th stage disks, for 

example) within an engine type design is still considered a single 

malfunction type. However, multiple initiating causes for a single part 

(e.g., melt-related defect, high-cycle fatigue, corrosion, etc., for 5th stage 

disks) represent multiple malfunction types. Note that this use of the 

term “malfunction” attempts to cover the traditional definition referring 

to systems or components not functioning properly along with hardwareinduced failures. 

3.1.14 MSAD Process. The MSAD process was designed to filter, review, 

analyze, and trend aviation safety data. The MSAD process is described 

in the reference in paragraph 2.8. 

3.1.15 Powerplant installation. Each component that is necessary for 

propulsion or affects the control of the major propulsive units or the 

safety of the major propulsive units between normal inspections or 

overhauls. 

3.1.6 Product Design Standards. Those requirements delineated within the 

“Airworthiness Standards” (e.g., 14 CFR parts 23, 25, 27, 29, 33 and 35) 

and “Operating Rules” (e.g., 14 CFR parts 91, 121, 125, and 135) which 

regulate the physical and functional characteristics of airplanes, engines, 

and components thereof. 

3.1.17 Propulsion system. See Powerplant installation. 

3.1.18 Safety Issue. Cause(s), contributing factor(s), or finding(s) that led to, 

or could lead to, an unsafe outcome. Safety decisions are rendered on 

issues/causes, not events. For example, investigation of an 

uncommanded flight control surface movement—an event—might 

reveal that the cause was a circuit failure in the autopilot’s computer. 

Circuit failure is the safety issue/cause to evaluate for safety 

implications, and to take corrective action against. 

3.1.19 Unsafe Condition. A condition which, if not corrected, is reasonably 

expected to result in one or more serious injuries. 

3.1.19.1 Is reasonably expected. Has a probability of occurrence 

acceptable to neither the long-term risk guidelines listed within 

tables 1-2 of this handbook nor the intent of the applicable 

product design standards. 
9/23/10 rev. 0 

5 

3.1.19.2 Serious injuries. As defined by the National Transportation 

Safety Board (NTSB), any injury that: 

 a. requires hospitalization for more than 48 hours, 

commencing within seven days from the date the injury was 

received; 

 b. results in the fracture of any bone (except simple fractures 

of fingers, toes or nose); 

 c. involves lacerations that cause severe hemorrhages, nerve, 

muscle or tendon damage; 

 d. involves injury to any internal organ; or 

 e. involves second- or third-degree burns or any burns 

affecting more than five percent of the body surface, and 

 f. fatal injury. 

4. Hazard Levels 

4.1. The hazard levels classify events based on their actual outcome. Other methods , 

such as the assessment during certification of the worst anticipated outcome, are 

also used to classify the severity of events. Because different classification 

systems were developed independently, are based on either actual or projected 

outcomes, and have different purposes, there is not a one-to-one relationship 

between hazard levels and any given failure condition. For example, a disk burst 

may be classified as “catastrophic” or “hazardous” under certification 

assessments, but actual disk burst events may range in severity. Nevertheless, 

the intention of this handbook is to evaluate risk objectively, regardless of the 

classification system used. This risk evaluation includes severity of outcome and 

conditional probability of that outcome given the failure condition. Whether one 

starts with the assessment that disk bursts are catastrophic, or observes that there 

has been a specific hazard level disk burst in service, the risk assessment for a 

given outcome should be equivalent. The acceptable levels of safety and risk 

assessment methods differ between certification and continued airworthiness. 

Consequently, to avoid confusion, this handbook does not focus on certification 

classifications. Event hazard level definitions are based on the powerplant or 

APU installation as follows: 

4.1.1. For powerplant and APU installations of transport category airplanes use 

the CAAM levels defined in the reference in paragraph 2.2. 

4.1.2. For engines and propellers installed in Small Airplanes use the hazard 

level definitions of Appendix 2 of this handbook. 
9/23/10 rev. 0 

6 

4.1.3. For engines installed in rotorcraft use the hazard level definitions of 

Appendix 3 of this Handbook. 

5. Data Review and Preliminary Risk Assessment 

5.1. Acquire & Review Event Data. 

5.1.1 The MSAD program will acquire event data from existing FAA 

databases using an automated batch process. Directorate defined hazard 

criteria will be used to screen these databases for events of interest. If 

the hazard criteria matches a database record, an MSAD event record 

will be created and forwarded to the cognizant ECO or ACO (referred to 

herein as “ACO”) based on the product make and model. 

5.1.2 If an ACO becomes aware of a potential safety issue that is not sent by 

the MSAD program to his office, the ACO should enter the data 

manually into the MSAD program. 

5.1.2.1 The ACO should investigate to determine why the record was 

not sent to the ACO via the MSAD program. 

5.1.2.2 If the ACO identifies that an MSAD record exists that the 

existing hazard criteria matched, the ACO should inform MSAD 

IT support of the issue. 

5.1.2.3 If the ACO identifies that an MSAD record exists but the hazard 

criteria did not identify this event as a record that should be sent 

to the ACO, the ACO should inform the Directorate COS focal 

of a problem with the hazard criteria logic. 

5.1.2.4 The Directorate COS focal should revise the hazard criteria as 

needed. 

5.2. Preliminary Risk Assessment (PRA).

5.2.1 The ACO will perform the preliminary risk assessment to quickly 

identify any safety issues needing an emergency Airworthiness Directive 

(AD) or “Final rule; request for comment” (FRC). The PRA also 

determines whether an event indicates a potential safety issue requiring 

more investigation through the MSAD process. The assessment should 

take advantage of whatever data is immediately available. 

5.2.2 Prior examples of similar occurrences of the potential unsafe condition, 

and their associated airplane-level effects, should be reviewed to help 

with this determination. Historical hazard ratio data can be found in the

folder titled, “MSAD – Risk Analysis Supporting Data” on the ANE110 SharePoint site 

(https://avssharepoint.faa.gov/air/EPD/ANE110/COS/default.aspx). See 

appendix 4 for guidance on estimating the hazard ratio. 

5.2.3 Urgent Unsafe Condition is Identified. 
9/23/10 rev. 0 

7 

5.2.3.1 Upon identifying an unsafe condition, a decision should first be 

made as to whether immediate action is warranted. The 

magnitude of a required immediate action will be related to the 

severity of the condition and the likelihood of additional events 

occurring prior to the implementation of a longer-term solution. 

It is possible that, immediately following a potentially severe 

event, the likelihood of its recurrence cannot be adequately 

estimated. If it is possible to take immediate, practical, 

mitigating action while an initial assessment is being made, that 

action should be taken. An example was the unsafe condition 

posed by a thrust reverser inflight deployment on specific types 

of airplanes with wing-mounted high-bypass ratio engines. An 

accident resulted from an inflight thrust reverser deployment. 

Neither the failure(s) which lead to the thrust reverser deploying 

inflight nor the reasons why the inflight deployment resulted in 

the pilot losing control of the airplane could be readily 

determined. However, it was possible to take reasonable 

immediate action by “locking-out” the reversers. Reversers were 

subsequently allowed to be “unlocked” when system integrity 

was assured by requiring periodic checks of the entire thrust 

reverser system, including its fault indication features. The final 

corrective action was to incorporate system modifications to 

ensure that subsequent inflight deployments are not anticipated 

to occur within the fleet life of the airplane type. 

5.2.3.2 If the PRA finds that an urgent unsafe condition exists, the 

MSAD record should be assigned to the cognizant ASE to take 

immediate action. 

5.2.3.3 Once the immediate action is taken, the ASE should complete 

the steps outlined in this handbook beginning with paragraph 

5.3.2. 

5.2.4 Potential Safety Issue is Identified. If the PRA finds that a safety issue is 

likely to exist, the MSAD record should be assigned to the cognizant ASE 

for further action as defined in this handbook. 

5.2.5 Safety Issue Does Not Exist. If the PRA finds that a safety issue does 

not exist, the ASE must document the following information necessary 

to support future risk analyses and trending. 

5.2.5.1 Select the “CAAM level” of the event from the drop-down menu 

in the MSAD “Event Information” screen. In a future release of 

the MSAD program, “CAAM level” will be changed to the more 

generic “Hazard Level.” In the interim, select the appropriate 

hazard level (<3, 3, 4 or 5) under the MSAD “CAAM Level” 

drop-down menu based on hazard level definitions in paragraph 

4.
9/23/10 rev. 0 

8 

5.2.5.2 Document the causal chain in the MSAD “CAUSE” screen. 

Selections for part name and occurrence subcategories are 

provided for this purpose. Enter multiple rows as needed to 

describe the causal chain. In the comment field of each row, 

indicate whether this part/occurrence subcategory is the primary 

or contributing cause of the event. Note that E&PD specific part 

names and occurrence subcategories are available. The E&PD 

specific information is preceded with “EPD” and should be used 

whenever possible. Occurrence subcategory items with 

preceding “SCF” contain other generic descriptions that will be 

commonly used.

5.3 Initiate Potential Safety Issue Investigation. 

5.3.1 Determination that a potential safety issue exists should be followed by 

a determination of either the root cause(s) or contributing factors, or 

both. Preliminary information and details may be insufficient to identify 

appropriate corrective action. Therefore, it is often necessary to seek 

additional information to determine the root cause and other 

contributions to the potential safety issue. Safety issues may be caused, 

either in combination or separately, by improper design, manufacture, 

maintenance, or operation. The contribution of these individual 

elements should be evaluated to ascertain the probability of future 

occurrences, as well as the effectiveness of candidate corrective actions. 

Safety issues that are not mitigated by contributing or conditional factors 

may require expeditious action unless the root cause, failure distribution, 

and risk factor can be reasonably established. 

5.3.2 Root cause problem assessments may identify concerns in other 

products of the same or similar type design or usage. In these cases, 

consideration of corrective action beyond the initially-identified 

population may be necessary. 

5.3.2.1 Select the “CAAM level” of the event from the drop-down 

menu in the MSAD “Event Information” screen. See paragraph 

5.2.5.1 for additional details. 

5.3.3 Document the causal chain in the MSAD “CAUSE” screen. Selections 

for part name and occurrence subcategories are provided for this 

purpose. Enter multiple rows as needed to describe the causal chain. In 

the comment field of each row, indicate whether this part/occurrence 

subcategory is the primary or contributing cause of the event. Note that 

E&PD specific part names and occurrence subcategories are available. 

The E&PD specific information is preceded with “EPD” and should be 

used whenever possible. Occurrence subcategory items with preceding 

“SCF” contain other generic descriptions that will be commonly used. 
9/23/10 rev. 0 

9 

6. Continued Airworthiness Assessments of Powerplant 

and APU installations on Transport Category Airplanes 

6.1 Continued airworthiness assessments of powerplant and APU installations on 

Transport Category Airplanes must use the guidance of AC 39-8. See 

paragraph 7 below for additional information on risk analysis methods and 

calculations. 

6.2 Risk analysis results, including all supporting data (Weibull, risk analysis 

spreadsheet, hazard ratios, histograms, etc.) and assumptions used in the 

uncorrected risk and control program risk calculations for powerplant and APU 

installations on transport category airplanes must be forwarded to the E&PD 

Standards Staff (E&PDSS). This information is necessary to support collection 

of risk analysis “library data” as described in the MSAD Order. 

6.2.1 If the E&PD COS focal is asked to attend the Corrective Action Review 

Board (CARB) meeting, the risk analysis data must be forwarded to the 

E&PD COS focal prior to the meeting. Otherwise, the risk analysis data 

may be shared with the E&PDSS after the CARB meeting. 

6.2.2 Updates to the risk analysis should also be forwarded to the E&PDSS. 

6.2.3 If the control program includes inspections, document and monitor the 

predicted inspection findings as described in AC 39-8. 

6.3 Note that paragraph 6 does not apply to powerplant installations of transport 

category rotorcraft. See paragraph 7 for the methods to be used for powerplant 

installations in all rotorcraft. 

7. Continued Airworthiness Assessments of Engines, 

Propellers, and APUs installed on Small Airplanes and 

Rotorcraft 

7.1 General. 

7.1.1 It is usually necessary to work closely with the design approval holder 

and, if appropriate, the operators to adequately complete the steps 

outlined within the risk assessment process. This cooperative effort may 

take the form of: the FAA engineer overseeing the work of the 

manufacturer or designer; the FAA engineer and manufacturer working 

in concert; or the FAA engineer performing the analysis with or without 

input and guidance from the manufacturer. 

7.1.2 Any analysis, whether qualitative or quantitative, is only as accurate as 

the assumptions, data, and analytical techniques it uses. Therefore, these 

underlying assumptions, data, and analytic techniques should be 

identified and justified to ensure that the conclusions of the analysis are 

valid. The justification of the assumptions made should be an integral 

part of the analysis. Assumptions can be validated by using experience 
9/23/10 rev. 0 

10 

with identical or similar systems or components, with due allowance 

made for differences of design, duty cycle and environment. Where it is 

not possible to adequately justify the critical elements of the analysis, 

either conservatism should be built into the initial assumptions, or 

uncertainty in the data and assumptions should be evaluated to the 

degree necessary to demonstrate that the analysis conclusions are 

relatively insensitive to that uncertainty. It is essential that the analysis 

calibrate with experience to date. A quantitative risk analysis cannot be 

expected to credibly predict future events if it does not calibrate to actual 

experience. 

7.1.3 The intent of these assessments is to determine whether an unsafe 

condition exists (that is, whether the potential unsafe condition has a 

reasonable expectation of resulting in injury) and to ensure that an 

unsafe condition that represents the greater risk receives higher levels of 

attention and resources for its timely resolution than does one that 

represents a lower risk. 

7.1.4 There are a range of powerplant installations of small airplane and 

rotorcraft, including high performance twin turbine engine-powered 

aircraft to single reciprocating engine-powered aircraft. We have 

defined different risk guideline categories based on the engine or 

propeller malfunction, the engine type, and the aircraft type. These 

different categories recognize the different levels of safety permitted 

during the certification of aircraft engines, propellers, and small 

airplanes and rotorcraft. 

7.1.5 Risk analysis results, including all supporting data (e.g., Weibull, risk 

analysis spreadsheet, hazard ratios, and histograms) and assumptions 

used in the uncorrected risk and control program risk calculations must 

be forwarded to the E&PDSS. This information is necessary to support 

collection of risk analysis “library data” as described in the MSAD 

Order. 

7.1.5.1 If the E&PD COS focal is asked to attend the CARB meeting, 

the risk analysis data must be forwarded to the E&PD COS focal 

prior to the meeting. Otherwise, the risk analysis data may be 

shared with the E&PDSS after the CARB meeting 

7.1.5.2 Updates to the risk analysis should be forwarded to the 

E&PDSS. 

7.1.5.3 If the control program includes inspections, the predicted 

inspection findings should be documented and monitored as 

described in this handbook. 

7.1.6 The risk analyses described in this handbook can be performed using the 

WinSmith Weibull (WSW) software with or without one of the risk 

analysis spreadsheets developed by the E&PD. The E&PD risk analysis 
9/23/10 rev. 0 

11 

spreadsheets require the Weibull parameters (e.g., data from WSW), but 

offer more options for control programs. Other approaches may be 

used, such as the methodology of Policy PS-ANE100-1999-00006, but 

should be coordinated with the E&PDSS. The E&PD risk analysis 

spreadsheets are available in the folder titled “Risk Analysis Tools” on 

the ANE-110 SharePoint site 

(https://avssharepoint.faa.gov/air/EPD/ANE110/COS/default.aspx). 

7.2 Estimate the Number of Airplanes Exposed. Determine the number of 

airplanes for which the unsafe condition may exist or be expected to develop if 

no corrective action is taken. For example, airplanes with engine parts within a 

certain serial number range or airplanes with installed engines below a certain 

total cycles or total hours. Note that exposure means the possibility of 

occurrence, not the certainty of it. 

7.2.1 If the engine, propeller, or APU exposed to the potential safety issue is 

installed in airplanes from multiple risk guideline categories (see Table 1 

or 2) and the risk guidelines or hazard ratios are different, determine the 

number of airplanes exposed in each category. 

7.2.2 Data sources for information necessary to conduct a risk analysis include 

the manufacturer, aircraft bluebook, Airclaims, FAA websites, and the 

FAA registry. 

7.2.2.1 Small airplane demographic information (number of airplanes 

and utilization data) is available on the Small Airplane 

Directorate COS website. We recommend that the ASE work 

closely with the installing ACO in performing their COS duties. 

7.2.2.2 Rotorcraft demographic information (number of rotorcraft and 

utilization data) is on the Rotorcraft Directorate SharePoint site 

(https://avssharepoint.faa.gov/air/RCD/rotocraftriskanalysisdata/

default.aspx) 

7.2.3 See the reference in paragraph 2.3 on techniques for using secondary 

data to estimate the fleet demographic information. 

7.3 Create Risk Model. 

7.3.1 See the reference in paragraph 2.6 for information on Weibull analysis, 

failure distributions, and failure forecasting. This includes the 

definitions for the Weibull and failure forecasting terminology used in 

this handbook. 

7.3.2 The meaning of failure must be clearly defined in the analysis. For 

example, failure may mean part cracking, part fracture, fire, or engine 

shutdown. 

7.3.3 The ages (e.g., cycles or hours) of failures and suspensions (unfailed 

parts) of the suspect fleet are entered into Weibull software such as 
9/23/10 rev. 0 

12 

WSW. This software will determine the Weibull 2-parameter Beta and 

Eta Parameters and pve%. 

7.3.4 If the data includes more than 21 failures, use WSW to perform a 

distribution analysis. The distribution with the highest pve% should be 

used for the analysis. 

7.4 Calibrate the Risk Model to Current Experience. 

7.4.1 Calibrate the risk model to what has already happened (i.e., calibrate to 

the present risk). There will be a number of irrefutable facts within a 

problem. For instance, these facts may include the number of parts 

failed; the number of parts found cracked; and the number of parts found 

not cracked. If the model does not calibrate, the team should review 

further to determine which model assumptions may be in error. The 

model will not predict future risk reliably if it cannot calibrate to actual 

experience to date. 

7.4.1.1 If the calculated Present Risk Quantity is much larger than the 

observed number of failures, the Weibull analysis may not apply 

to the entire population (i.e., a batch problem). 

7.4.1.2 If you have a batch problem, you may have the wrong data set 

and the first priority is to identify the units in the batch. 

7.4.1.3 Once the suspect population is identified, the risk model is 

generally calibrated by adjusting the Weibull characteristic life 

or slope to match the experience to date. You should perform 

sensitivity studies to understand the impact this adjustment has 

on the risk analysis results. 

7.4.2 If no failures have occurred, the model can be conservatively calibrated 

to one failure. For example, if multiple parts have been found cracked, 

but not fractured, then calibrate the model to the number of cracks found 

and to one fracture. 

7.4.3 Present Risk Calculation Methods. 

7.4.3.1 The “Abernethy Risk – Quantity Expected” option in the WSW 

program can be used to calculate the present risk number of 

failures. 

7.4.3.2 The E&PDSS has developed a risk analysis spreadsheet that can 

be used to calculate present risk. 

7.5 Estimate the Uncorrected Fleet Risk Factor and Uncorrected Individual 

Risk. 

7.5.1 Use analytical techniques to estimate the uncorrected fleet risk factor—

the expected number of events if no action is taken to address the 

condition. This step takes the exposed population and estimates the 

number that are expected to experience the event. Fleet risk factors for 
9/23/10 rev. 0 

13 

other hazard levels are also calculated to allow for comparison to the 

risk guidelines in tables 1-2. Fleet risk factors for higher-level events 

are obtained by multiplying the event risk factor by the applicable 

hazard ratio. (See appendix 4 for guidance on estimating the hazard 

ratio.) In AC 39-8, the uncorrected risk guideline is called the long-term 

risk guideline. 

7.5.2 Failure rate data is often provided in failures per flight hour (flighthour), even though the failure rate itself is not directly a function of 

flight-hours. Therefore, ensure the event predictions take into account 

the frequency with which the actual stresses that cause failure will occur 

within the total exposure period. For example, a component failure 

mode may be predominantly a function of the number of times electrical 

power is applied to it. If so, the average power applications per flight 

hour should be the same between the source of the failure rate data and 

the subject application of that data, or an appropriate correction should 

be applied. 

7.5.3 For uncorrected fleet risk factor, a 20-year fleet life per aircraft may be 

assumed or another reasonable estimate of the actual fleet life may be 

used. Additionally, the fleet risk factor should be converted to risk per 

flight-hour to facilitate comparing risks on a common exposure basis. 

This is normally done by dividing the fleet risk factor by the total 

number of flight-hrs within the assumed exposure period. Compare the 

uncorrected individual risk to the uncorrected risk guidelines of the 

appropriate category listed in tables 1-2 to help establish the relative 

threat posed by the unsafe condition. 

7.5.4 The uncorrected fleet risk calculations may take credit for mandatory 

actions already in place that reduce the risk of the unsafe condition. For 

example, the risk reduction of mandatory inspections already published 

in the Airworthiness Limitations Section (ALS) of the Instructions for 

Continued Airworthiness (ICA) may be included in the uncorrected risk 

calculations. This may require more complex calculations, such as a 

simulation, to quantitatively predict the risk reduction of part 

inspections. 

7.5.5 Uncorrected Risk Calculation Methods. 

7.5.5.1 The “Abernethy Risk – Quantity Expected” option in the WSW 

program can be used to calculate the uncorrected risk (number of 

failures if no action is taken). 

7.5.5.2 The E&PDSS developed risk analysis spreadsheet can be used to 

calculate the uncorrected risk. 

7.5.5.3 Refer to appendix 5 of AC 39-8 for additional approaches to 

estimate the uncorrected risk factor. 
9/23/10 rev. 0 

14 

7.5.5.4 A simulation is necessary to quantify the risk when mandatory 

inspections are included in the uncorrected risk calculation. The 

E&PDSS can perform this calculation on behalf of the ACO. 

7.6 Compare the Uncorrected Risks to Risk Guidelines. 

7.6.1 If the probability of future level 3, 4, and 5 events per flight-hour are all 

below the uncorrected individual risk guidelines of the appropriate 

category listed in tables 1-2 of this handbook, consider an SAIB or other 

optional corrective action.

7.6.2 If the probability of future level 3, 4, or 5 events per flight-hour is above 

the uncorrected individual risk guidelines of the appropriate category 

listed in tables 1-2 of this handbook, the condition is unsafe and 

corrective action must be taken. 

7.7 Identify Options for Mitigating Action. 

7.7.1 Responses to identified safety issues can vary from an immediate 

mitigating reaction to an extensively considered final response. The 

control programs for most unsafe conditions may include initial, interim, 

and final actions. This handbook assists ASE’s with the evaluation of 

those actions and helps to verify that the actions are appropriate and 

timely to mitigate the unsafe condition. 

7.7.2 Some actions that have proven to be both practical and beneficial for 

immediate responses are inspections, placards, revisions or supplements 

to the Aircraft Flight Manual (AFM), staggering engines to obtain mixed 

life engines on a given airplane (for infant-mortality problems) and preflight checks. These actions are appropriate for follow-on actions, along 

with repair or replacement of the suspect components. 

7.8 Estimate the Effects of Candidate Actions. 

7.8.1 Evaluate candidate actions considered after an unsafe condition has been 

identified with the appropriate manufacturer, designer, or operators. 

This is to consider their capacity to reduce the future risk to acceptable 

levels. See tables 1-2 for control program risk guidelines (In AC 39-8, 

the control program risk guideline is referred to as short-term acceptable 

risk). From a technical perspective, several candidate actions may be 

available. The selected action(s) should consider issues such as 

confidence in the effectiveness of the corrective action; availability of 

the resources necessary to support the corrective action; and the ability 

of the operators to expediently and properly incorporate the corrective 

action. 

7.9 Estimate Potential Risk Reduction. Once the candidate actions have been 

identified, estimate the fleet risk factor and risk per flight-hour for the proposed 

mitigation program. This process should be performed for all actions under 

consideration, thereby allowing the effects of different programs to be 
9/23/10 rev. 0 

15 

compared. The objective is to keep the risks to the affected fleet below the 

applicable guidelines until final action can be incorporated to bring the product 

back to the level of safety intended by the product's original basis of 

certification. If none of the candidate immediate corrective action programs can 

achieve the needed risk reductions, consider more aggressive action, including 

grounding. 

7.9.1 Control Program Risk Calculation Methods. 

7.9.1.1 The type of analysis required to quantitatively evaluate the risk 

reduction varies from problem to problem. In some cases, a 

closed form risk calculation is possible. In other cases, a 

simulation may be necessary to assess the risk of the control 

program. 

7.9.1.2The WSW “Abernethy Risk – Quantity Expected” option can be 

used to calculate the control program risk for simple control 

programs, such as removal of all parts by a specific cycles-sincenew (CSN) count or after a specific number of additional cyclesin-service (CIS). 

7.9.1.3 The E&PDSS developed risk analysis spreadsheet can be used to 

calculate the control program risk. The spreadsheet provides 

additional options for control programs compared to WSW. 

7.9.1.4 A simulation is necessary to quantify the risk of certain control 

programs (e.g., when inspections or shop visit rate distributions 

are included in control program). Contact the E&PDSS to 

perform this calculation. 

7.9.2 Note that the control program risk calculation is required to quantify the 

risk reduction of the corrective actions being evaluated. It is not 

sufficient to state that the control program risk is below the control 

program risk guidelines . 

7.10 Implement and Monitor the Impact of the Corrective Actions. 

7.10.1 An airworthiness directive can be used to ensure all operators comply 

with the corrective actions defined in the control program. 

7.10.2 When feasible, track the rate of incorporation of the corrective action(s) 

to verify that the action is being implemented in a timely manner. If the 

action includes inspection, analyze inspection results to help quantify 

incipient failures and aid assessment of the extent of the problem. Track 

service experience to ensure that the rate of occurrence is being reduced; 

however, rate of occurrence may not be applicable in cases of rare 

events or small exposures. Service experience and inspection results 

should also be evaluated against expectations developed as a result of 

any quantitative or qualitative analysis performed as part of the action. 
9/23/10 rev. 0 

16 

7.10.3 Note that no method exists to ensure complete reporting to all interested 

parties. The inclusion of reporting requirements within the body of the 

AD itself will ensure that the operators report inspection findings to the 

FAA or design approval holder—consider this for those unsafe 

conditions of high risk where the inspection findings are necessary to 

evaluate the adequacy of actions. Although manufacturers will not 

automatically receive these findings, unless required by an AD, they 

may receive responses to reporting requests within a manufacturer's 

service bulletin. For more general reporting (e.g., determination of the 

effectiveness of a new repair procedure or whether new problems are 

being introduced due to the corrective action), the principal inspectors at 

affected airlines (for the FAA), or the manufacturer’s Field Service 

Representatives can provide direct insights into the effects of mandated 

corrective actions. 

7.11 Verify Corrective Actions Were Effective. 

7.11.1 Any experience that deviates significantly from expectations or 

assumptions is grounds to revise the assessment. Since an initial 

reaction may not be the complete response to the unsafe condition, a 

complete validation of the effectiveness of any initial corrective action 

may not be feasible prior to taking additional action. Continue to 

monitor field experience and inspection results to ensure that any interim 

action (i.e., inspection) continues to validate assumptions and 

predictions, or to alleviate any consequence of any extra conservatism 

built into an initial assessment. Final action (part modification or 

replacement) carries with it an assumption that the causal factors have 

been effectively eliminated or mitigated with regard to their ability to 

result in an unsafe condition. Track field experience s to validate this 

assumption. Take care to ensure that any unforeseen adverse impacts of 

corrective actions are identified and evaluated. 

7.12 Follow-on Assessments and Responses. 

7.12.1 In many circumstances, the initial actions taken in response to an unsafe 

condition may be insufficient to effectively mitigate the risk to 

acceptable levels. Therefore, follow-on responses and actions may be 

required. The risk assessment process described above should be 

applied to the decisions involved in the use of actions, whether initial or 

follow-on. A more complete understanding of the problems and 

contributing factors to the unsafe condition at later points will most 

likely be available. Initial responses may be based upon limited or 

partial data, and later steps are usually based upon information that is 

more complete. 

7.12.2 The FAA response to an unsafe condition should be based on a technical 

understanding of the problem and should require an appropriate 

implementation schedule that is consistent with the risk assessment. 
9/23/10 rev. 0 

17 

When performing a follow-on assessment, the fact that exposure time 

has elapsed between the initial and follow-on assessments should not be 

used to justify unduly extending the duration of the control program. 

The exposure time for evaluating the risk for follow-on actions is the 

amount of time required to complete the entire correction program (i.e., 

any initial, interim and final actions). The objective throughout the 

entire correction program is to keep the risks below the applicable 

guidelines until the product is brought back to the level of safety 

intended by the product’s original basis of certification. Establish the 

schedule for follow-on actions such that these applicable guidelines will 

be met. 

8. RISK GUIDELINES. 

8.1 General. 

8.1.1 There are uncorrected and control program guidelines for fleet risk 

factor and individual risk. These guidelines help establish whether a 

condition is unsafe and if immediate action is necessary. They also 

establish acceptable risk for control programs. There are guidelines for 

level 3, 4, and 5 events. Note that the level 3 guideline covers events 

predicted to be at least level 3 (i.e., levels 3, 4 and 5 events). The level 4 

guideline covers events predicted to be at least level 4 (i.e., levels 4 and 

5 events). This is necessary to assess the true risk exposure. 

8.1.2 The per flight-hour guidelines apply to the average of the fleet or 

subfleet suspected of having the unsafe condition. The fleet risk factor 

guidelines apply to the aggregate fleet or subfleet suspected of having 

the unsafe condition. 

8.1.3 Control programs should be acceptable to all the applicable control 

program risk guidelines. For large fleet sizes, the fleet risk factor 

guideline will likely be the limiting value. For small fleets, it is likely 

that the risk per flight-hour guideline will be the limiting value. 

8.1.4 These guidelines should not be regarded as targets or typical values. 

The control program values should usually be lower than these 

guidelines unless a lower value would result in extreme resource 

availability difficulties. Any reasonable action which reduces the risk 

should be included as part of the control program (keeping in mind the 

principles of prioritization of resources). 

8.2 Risk guidelines for Immediate Action. 

8.2.1 If the uncorrected fleet risk factor for the affected fleet would exceed the 

applicable control program fleet risk factor within 60 days, or the risk 

per flight-hour to which airplanes would be exposed during that same 

60-day period would exceed the applicable hazard level guideline, 

consider immediate action. The immediacy of this action may vary from 
9/23/10 rev. 0 

18 

before the next flight to within 60 days depending on the nature and 

level of risk. If a quantitative assessment of the risk is unavailable, the 

decision as to the necessity of immediate action should be made based 

on objective judgment and expert opinion. This initial analysis is not 

meant to take the place of the complete and in-depth analysis typically 

performed during the continuing assessment of the risk posed by the 

identified unsafe condition. It is meant to give a best-estimate relative 

ranking compared to the overall contributions of all unsafe conditions, 

and to indicate whether continued operation without immediate 

corrective action is acceptable. 

Table 1. Risk Guidelines for Engines, Propellers, and APUs installed on Small Airplanes 

(e.g., Part 23) 

Fleet 

Risk Factor

Individual Risk 

(Per flight-hr)

Fleet 

Risk Factor

Individual Risk 

(Per flight-hr)

Fleet Risk 

Factor

Individual Risk 

(Per flight-hr)

Turbine engines, propellers, APUs installed on 

multi-turbine engine powered small airplanes

Uncorrected Risk Guideline -- 1.E-07 -- 1.E-08 -- 1.E-09

Control Program Risk Guideline 1.0 4.E-04 1.0 4.E-05 0.1 4.E-06

Turbine engines, propellers installed on single 

turbine engine powered small airplanes(1)

Uncorrected Risk Guideline -- 5.E-07 -- 1.E-07 -- 1.E-08

Control Program Risk Guideline 6.0 8.E-04 3.0 4.E-04 0.3 4.E-05

Recip engines, propellers installed on multi-recip 

engine powered small airplanes

Uncorrected Risk Guideline -- 5.E-06 -- 1.E-06 -- 1.E-07

Control Program Risk Guideline 10.0 8.E-04 5.0 4.E-04 0.5 4.E-04

Recip engines, proepllers installed on single recip 

engine powered small airplanes (2)

Uncorrected Risk Guideline -- 5.E-05 -- 1.E-05 -- 1.E-06

Control Program Risk Guideline 14.0 8.E-04 7.0 4.E-04 0.7 4.E-04

(1) Excludes IFSD and Loss of Power Event. IFSD and Powerloss Event rate > 0.1/1000 hrs. should be investigated and 

corrective action implemented to maintain safe operation

(2) Excludes IFSD and Loss of Power Event. IFSD and Powerloss Event rate > 1/1000 hrs. should be investigated and 

corrective action implemented to maintain safe operation

Category

Level 3 Guidelines Level 4 Guidelines Level 5 Guidelines

Table 2. Risk Guidelines for Engines and APUs installed in Rotorcraft (e.g., Part 27, 29) 

Fleet 

Risk Factor

Individual Risk 

(Per flight-hr)

Fleet 

Risk Factor

Individual Risk 

(Per flight-hr)

Fleet 

Risk Factor

Individual Risk 

(Per flight-hr)

Turboshaft engines, APUs installed on multiturbine engine powered Rotorcraft

Uncorrected Risk Guideline -- 1.E-07 -- 1.E-08 -- 1.E-09

Control Program Risk Guideline 1.0 4.E-04 1.0 4.E-05 0.1 4.E-06

Turboshaft engines installed on single engine 

powered Rotorcraft (1)

Uncorrected Risk Guideline -- 5.E-07 -- 1.E-07 -- 1.E-08

Control Program Risk Guideline 6.0 8.E-04 3.0 4.E-04 0.3 4.E-05

Recip Engines installed on Rotorcraft (2)

Uncorrected Risk Guideline -- 5.E-05 -- 1.E-05 -- 1.E-06

Control Program Risk Guideline 14.0 8.E-04 7.0 4.E-04 0.7 4.E-04

(1) Excludes IFSD and Loss of Power Event. IFSD and Powerloss Event rate > 0.1/1000 hrs. should be investigated and 

corrective action implemented to maintain safe operation

(2) Excludes IFSD and Loss of Power Event. IFSD and Powerloss Event rate > 1/1000 hrs. should be investigated and 

corrective action implemented to maintain safe operation

Category

Level 3 Guidelines Level 4 Guidelines Level 5 Guidelines
9/23/10 rev. 0 

19 

9. Prioritization Based on Risk 

9.1 Figure 1 provides a useful means to graphically compare unsafe conditions 

based on risk calculations and the risk guidelines, helping to establish priorities. 

The descriptions of this section use the risk guidelines for turbine engines, and 

propellers installed on multi-turbine engine small airplanes (see Table 1), but 

the concepts apply to all the risk guidelines. Figure 1 uses the level 4 risk 

guidelines for turbine engine, propellers, and APUs installed in multi-engine 

small airplanes; a similar graph for other risk guidelines can be prepared. 

9.2 High Risk. A level 4 event is a likely occurrence when its risk plots in the area 

to the right of the sloped line in Figure 1 (i.e., greater than 1.0 predicted events, 

or fleet risk factor). Furthermore, the malfunction is beginning to contribute 

more risk than the aggregate risk from all other causes, including contributions 

from the crew, when it plots in the area above the top horizontal line in Figure 1 

(i.e., above 4E-5 per flight-hour). In these instances, immediate actions, as 

described in this handbook, may be necessary. Similar values can be 

established for level 5 events, an order of magnitude below the associated level 

4 values; i.e., the high-risk area for level 5 events is greater than 0.1 predicted 

events, or above 4E-6 per flight-hour. These values equate to the control 

program acceptable risk guidelines. 

9.3 Excessive Risk. Exposure within the enclosed envelope in Figure 1 (i.e., to the 

left of the sloped line and above the bottom horizontal line) imposes sufficient 

risk to warrant concern and mandatory action. 

9.4 Reasonable Risk. Risk factors of 1.0 level 4 events in 100 million aircraft 

flight-hrs (1E-8) meet the uncorrected individual risk guidelines. (This assumes 

no other aspects of the original basis of certification have been violated.) The 

equivalent value for level 5 events is 1 in a billion flight-hrs (1E-9). Note that 

the uncorrected risk guideline for type certification may sometimes appear less 

restrictive. However, as noted earlier, comparing certification and continued 

airworthiness assessments and guidelines can be confusing and misleading. For 

example, the additional accuracy potentially afforded to continued airworthiness 

assessments over certification assessments must be compensated for within the 

guidelines. 
9/23/10 rev. 0 

20 

FIGURE 1. Aircraft Threat Comparison

10. Corrected Risk 

10.1 The final goal in resolving an unsafe condition is the development and 

implementation of corrective actions that, when fully incorporated, minimize 

the probability of future events to less than the uncorrected individual risk 

guidelines. Interim measures, such as recurring inspections, are often effective 

in providing immediate risk reduction to a high-risk problem. However, do not 

rely on recurring inspections to serve as a final corrective action unless there is 

no practicable alternative. If the interim measures minimize the probability of 

additional events to below the uncorrected individual risk guidelines, the 

incorporation of the final corrective actions can be delayed to minimize 

resource impact. The completion of all actions to correct the unsafe condition 

should be done as soon as feasible and in accordance with the risk guidelines 

and principles. The actions shall return the product to the level of safety 

intended by that product's original basis of certification, unless an exemption 

from that basis is found to be in the public interest. 

1.0E-10

1.0E-09

1.0E-08

1.0E-07

1.0E-06

1.0E-05

1.0E-04

1.0E-03

1.0E+031.0E+041.0E+051.0E+061.0E+071.0E+081.0E+09

Number of Aircraft Flights (exposure)

Level 4 Occurrence Rate (events per flight hr.)

Reasonable Risk

High Risk

Excessive Risk
9/23/10 rev. 0 

21 

11. Cumulative Risk 

11.1 If there are several unsafe conditions being resolved concurrently on the same 

powerplant installation, the combined risk of those various conditions may 

represent an unacceptable risk level for that airplane type, even if each taken 

individually does not. Furthermore, repeated exposure to risk levels acceptable 

against any single unsafe condition could be reasonably expected to result in an 

unacceptable risk of serious injury somewhere in the life of the worldwide fleet 

with its various unsafe conditions. The Poisson distribution explains the 

statistical variation associated with average prediction for rare events (see figure 

2 below). A 0.1 fleet risk factor guideline equates to a 9.5 percent probability of 

one or more events. If, during the life of a fleet, there are seven different 

malfunctions which are each managed to a risk factor of 0.1 events (i.e., 

cumulative forecast of 0.7 events), then it is likely that a event will occur at 

some point due to one of these malfunctions. Additionally, for an event forecast 

of 0.7, there is a 16 percent probability of two or more events and a three 

percent probability of three or more events. 

0

0.1

0.2

0.3

0.4

0.5

0.6

0.7

0.8

0.9

1

0 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 1

Expected Number of Failures (Event Forecast)

Zero Events

One or More Events

T wo or More Events

T hree or More Events

FIGURE 2. Event Probability vs. Event Forecast (Fleet Risk Factor) 

11.2 It is neither expected nor required to calculate cumulative risk nor track 

cumulative risk across the life of the fleet. The intent of this section is to 

recognize that acceptable risk levels should be regarded as upper limits, to be 

allowed only when reducing the risk further would result in undue burden. The 

goal of risk analysis is not to find the most lenient program possible within 
9/23/10 rev. 0 

22 

acceptable risk levels. Since no guidelines have been developed on cumulative 

risk, the guidelines published in this handbook apply to individual unsafe 

conditions being addressed by a control program (although the individual unsafe 

condition may apply to several products). 

12. Alternative Methods of Compliance (AMOC) 

12.1 The objective of an AMOC is to allow an operator or manufacturer to propose 

an alternative corrective action to that prescribed in an AD. The intent of the 

AMOC is to enable approval of options that were not necessarily conceived of 

at the time of AD issuance, but which provide an equivalent level of safety to 

that afforded by the AD. The risk assessment process described in this 

handbook can be used to help determine if a proposed AMOC affords an 

equivalent level of safety. AMOCs should not result in an increase of the total 

risk assessed against the unsafe condition. 

13. Inter-Directorate Coordination 

13.1 Different risk management objectives may lead to differences of opinions 

between directorates as to the appropriate actions to address identified unsafe 

conditions, or to the timing of those actions. Because of the inter-involvement 

of both directorates with most unsafe conditions, especially those that are highly 

installation-dependent, we recommend close coordination to resolve these 

differences. However, if differences persist after inter-directorate coordination 

and discussion of the assumptions, available data and objectives, the final 

control program decisions rest with the directorate with the most relevant 

specialized technical expertise. This means that the E&PD is responsible for 

making the final control program decisions for unsafe conditions caused 

primarily by shortcomings within the engine type design. When significant 

installation-dependency of an engine-related unsafe condition exists , the E&PD 

should address any installation concerns raised by the cognizant airplane or 

rotorcraft directorate. For unsafe conditions caused primarily by shortcomings 

in the airplane type design, exclusive of the engine type design, the cognizant 

airplane or rotorcraft directorate is responsible for making the final control 

program decisions. The primary responsibility must be respected by both 

directorates. Directorates should avoid a writing competing ADs against the 

same unsafe condition. 
9/23/10 rev. 0 

23 

APPENDIX 1. 

POTENTIAL UNSAFE CONDITIONS 

1. Purpose. This appendix provides the user with an overview of potentially unsafe 

conditions. Issuance of an AD, in accordance with Part 39, requires that an unsafe 

condition exist in a product and the condition is likely to exist or develop in other 

products of the same type design. This appendix presents material that can be used in 

reviewing actual or potential problems to determine if they should be identified as unsafe 

conditions. Unsafe conditions may result from design, manufacturing, operational or 

maintenance deficiencies as well as unforeseen changes in operations or the operating 

environment. 

2. Identification of Potential Unsafe Conditions 

2.1 At least three areas of information can be used as a guide in identifying 

potential unsafe conditions. The first, and most visible, includes conditions 

which alone or in combination with other contributing factors have led to 

accidents. Such conditions or combinations have clearly been demonstrated to 

be unsafe. The second includes conditions that have significantly increased the 

probability of, but not directly caused, serious injuries. If such “contributing 

conditions” occur frequently enough, this too is an unsafe condition. The 

majority of ADs are intended to correct this type of unsafe condition. The third 

area of information involves hazards identified as part of the product’s 

certification program. 

2.2 Given the size and complexity of today’s worldwide air transportation system, it 

would be unusual for an identified unsafe condition to be limited to a single 

airplane or engine. Examples of singular events where AD action would not be 

expected are those caused by gross negligence or a rare meteorological 

phenomenon. 

2.3 Conditions specified as potentially unsafe. The FAA has defined certain 

specific conditions as potentially unsafe based upon previous service experience 

and relevant certification assessments: 

2.3.1 Potential unsafe conditions identified during certification assessments. 

Certification assessments often identify and classify failure and 

operating conditions according to the severity of the impacts they are 

expected to have on the continued operational safety of the airplane. 

Very severe conditions are assigned to categories such as “catastrophic,” 

“preventing continued safe flight and landing,” or “critical” because of 

their potential to directly cause serious injuries to multiple persons. 

Severe conditions are assigned to categories such as “emergency” or 

“hazardous” because of their potential to either directly cause serious 

injuries to a limited number of persons or to impair the ability of the 

flightcrew to perform their tasks. Therefore, the occurrence of any of 

these conditions in service is by definition a potentially unsafe condition 

regardless of the actual outcome. More moderate conditions are 
9/23/10 rev. 0 

24 

assigned to categories such as “abnormal” or “major.” The occurrence 

of any moderate conditions in service at a high frequency may be 

considered a potentially unsafe condition if a reasonable potential exists 

for it to contribute to a more serious event. 

2.3.2 Historical potentially unsafe conditions. Appendix 6 of this handbook 

lists conditions considered to be potentially unsafe for engines and 

propellers installed in multi-turbine engine-powered small airplanes. 
9/23/10 rev. 0 

25 

APPENDIX 2 

EVENT HAZARD LEVELS AND DEFINITIONS FOR ENGINE, PROPELLER, 

AND APUs INSTALLED IN SMALL AIRPLANES 

1. Purpose 

1.1 This appendix outlines the definitions of propulsion system and APU 

malfunctions or related incidents, in certain cases coupled with crew error or 

other aircraft system malfunctions, resulting in the following consequences to 

the aircraft or its passengers/crew.

1.2 It is important to emphasize that all event classification is based on what 

actually occurred rather than what might have occurred. Do not inflate the 

hazard level for an event in the name of conservatism; this is likely to lead to 

confusion and dissension and a reduction in the ability to differentiate between 

the risks posed by different unsafe conditions. 

2. Hazard Levels 

2.1 Level 5. An occurrence resulting in fatalities, usually with the loss of the 

airplane. 

2.2 Level 4. 

2.2.1 Forced landing of a multi-engine installation. Forced landing of a multiturbine engine installation is defined as the inability to continue flight 

where imminent landing is obvious, but aircraft controllability is not 

necessarily lost (e.g., total power loss due to fuel exhaustion will result 

in a "forced landing”). An air turn back or diversion due to a 

malfunction is not a forced landing, since there is a lack of urgency and 

the crew has the ability to select where they will perform the landing.1 

However, off-airport landings are almost always forced landings. 

2.2.2 Actual loss (hull loss) of aircraft (as opposed to economic) while 

occupants were on board. 

2.2.3 Serious injuries including life threatening injuries. 

2.3 Level 3. 

2.3.1 Substantial damage to the aircraft or second unrelated system. 

2.3.1.1 "Substantial damage" in this context means damage or structural 

failure that adversely affects the limit loads capability of a 

primary structural element, the performance or flight 

characteristics of the aircraft, and that would normally require 

major repair or replacement of the affected components. 

 

1

 Where it is unclear whether the landing was forced, it may be helpful to consider whether the pilot had 

any alternative to landing at the closest airport . 
9/23/10 rev. 0 

26 

(Typically not considered “substantial damage” are engine 

failure damage limited to the engine or mount system, bent 

fairings or cowlings, dented skin, small puncture holes in the 

skin or fabric, or damage to landing gear associated with runway 

departures, wheel, tires, flaps, engine accessories on the failed 

engine, brakes or wing tips). 

2.3.1.2 Damage to a second unrelated system must impact the ability to 

continue safe flight and landing. Coordination and agreement 

between the engine/propeller/APU manufacturer and the 

airframe manufacturer may be required to properly categorize 

events related to second system damage. 

2.3.1.3 Small penetrations of aircraft fuel lines or aircraft fuel tanks, 

where the combined penetration areas exceed two square inches. 

The concern is exhaustion of fuel reserves. Assistance of the 

airframe manufacturer should be sought when questions arise. 

2.3.1.4 Damage to a second engine (cross-engine debris) which results 

in a significant loss of thrust or an operational problem requiring 

pilot action to reduce power. Minor damage which was not 

observed by the crew during flight and which did not affect the 

ability of the engine to continue safe operation for the rest of the 

flight is excluded, being considered a level 2 event. 

2.3.2 Uncontrolled fires – which escape the fire zone and impinge flames onto 

the wing or fuselage, or act as ignition sources for flammable material 

anticipated to be present outside the fire zone. 

2.3.3 Rapid depressurization of the cabin. 

2.3.4 Permanent loss of thrust or power greater than one propulsion system. 

2.3.5 Temporary or permanent inability to climb and fly 1000 feet above 

terrain (increased threat from terrain, inclement weather, etc.) along the 

intended route that results in restricted capability (i.e., multiple 

propulsion system malfunctions or single propulsion system 

malfunctions). 

2.3.6 Any temporary or permanent impairment of aircraft controllability 

caused by propulsion system malfunction, thrust reverser in-flight 

deployment, propeller control malfunction, or propulsion system 

malfunction coupled with aircraft control system malfunction, abnormal 

aircraft vibration, or crew error. 

2.3.7 Malfunctions or failures that result in smoke or other fumes on the flight 

deck that result in a serious impairment. Serious impairment includes 

the loss of crew’s ability to see flight deck instrumentation or perform 

expected flight duties. Purely psychological aspects of the concern of 
9/23/10 rev. 0 

27 

odors, etc., are not to be included; nor are concerns about long-term 

exposure. 

3. General Notes Applicable to All Event Hazard Levels. 

3.1 The severity of aircraft damage is based on the consequences and damage 

that actually occurred.

 3.2 Injuries resulting from an emergency evacuation rather than from the 

event that caused the evacuation are not considered in evaluating the severity of 

the event. It is recognized that emergency evacuations by means of the slides 

can result in injuries, without regard to the kind of event precipitating the 

evacuation.
9/23/10 rev. 0 

28 

APPENDIX 3 

EVENT HAZARD LEVELS AND DEFINITIONS FOR ENGINE AND APUs 

INSTALLED IN ROTORCRAFT 

1. Level 5.

1.1 Fatal accident 

2. Level 4. 

2.1 Serious injuries 

2.2 Rotorcraft destroyed 

3. Level 3. 

3.1 Substantial damage to rotorcraft.

4. General Notes Applicable to All Event Hazard Levels.

3.1 NTSB definitions for serious injuries, destroyed, and substantial damage are 

used. 

3.2 Injuries resulting from an emergency evacuation rather than from the event that 

caused the evacuation are not considered in evaluating the severity of the event. 

It is recognized that emergency evacuations by means of the slides can result in 

injuries, without regard to the kind of event precipitating the evacuation. 
9/23/10 rev. 0 

29 

APPENDIX 4 

HAZARD RATIO DEVELOPMENT 

1. Purpose. This appendix describes methodologies to estimate the hazard ratio for use 

in risk assessments.

2. General. 

2.1 The hazard ratio converts the basic event fleet risk factor to a fleet risk factor 

for a specific hazard level (e.g., Level 4 event). It does this by estimating the 

conditional probability of a specific hazard level event given the occurrence of 

the basic event. Developing a hazard ratio will require considerable engineering 

judgment. The hazard ratio strongly influences the quantitative assessment 

results and, therefore, should have a sufficient validation basis or be assessed 

conservatively. Hazard ratios are used for hazard levels 3, 4 and/or 5, as is 

appropriate, to establish the appropriate comparison of the risk of the unsafe 

condition to the risk guidelines shown in tables 1 and 2 in the body of this 

handbook. 

2.2 ASEs should use hazard ratios appropriate for their airworthiness concern. The 

ASE should determine the hazard ratios from service history if adequate service 

history is available on the specific or similar engine make/model and 

installation (single or multi-engine installation). Collaboration with the TC 

holder, subject matter experts, including the installing product ACO or 

directorate, is critical to developing appropriate hazard ratios. As a process 

check, ASEs should compare calculated hazard ratios against the hazard ratios 

provided in the folder titled, “MSAD – Risk Analysis Supporting Data” on the 

ANE-110 COS SharePoint site. Consider the SharePoint site hazard ratio data as 

a general guide not a replacement for more specific guidance and assessments 

for a particular aircraft type, environment, or operating condition. 

2.2.1 Under-reporting of Failures and Defects. Service difficulty reporting 

(SDR) is not mandatory for the types of operations typical of small 

airplanes and rotorcraft. We expect significant under-reporting of 

failures and defects in most situations. This under-reporting may have a 

direct impact on the hazard ratios—we expect that most Level 3, Level 4 

and Level 5 outcomes will be reported, however, outcomes below Level 

3 may be under-reported. ASEs should use experience and engineering 

judgment to make adjustments to account for under-reporting. 

2.3 When insufficient service history is available, ASEs should use the hazard ratios 

provided in the ANE-110 SharePoint site. These hazard ratios may not cover 

every defect or failure an ASE will encounter. In this situation, the ASE should 

use the best available information to estimate the hazard ratios. When working 

with the SharePoint site hazard ratios, the ASE must understand whether the 

hazard ratio is from the base event or from an accident. If the hazard ratio is 
9/23/10 rev. 0 

30 

based on the assumption that an accident has occurred, the ASE must adjust the 

hazard ratio to account for the ratio of base events that lead to accidents. The 

TC holder may be able to provide data to support the hazard ratio adjustment.

3. Hazard Ratio Development. 

3.1 The following methods should be employed to establish the hazard ratio for a 

given hazard level (X): 

3.1.1 At least one level X or higher event has occurred. 

3.1.1.1 Data. Use the value obtained by dividing the number of level X 

or higher events by the total number of events. 

3.1.1.2 Analysis. If analysis suggests the true hazard ratio, that ratio 

may be used. For example, for a particular airplane, a propeller 

blade will pass through the fuselage if it is released within a 90° 

arc. The hazard ratio (assuming level 4 for serious injury to 

passengers seated in the plane of the propeller) would then be 

90°/360°=0.25 level 4 events given a blade release. This method 

has particular value where little data exists. Note that when the 

hazard ratio obtained by analysis differs significantly from what 

would be calculated from the observed data, we strongly suggest 

using observed data to establish the hazard ratio. 

3.1.2 No level X or higher events have occurred. 

3.1.2.1 Next event assumption. When no industry-wide data are 

available or suitable, a conservative hazard ratio may be 

established by assuming the next event would be level X or 

higher (e.g., 0:4 becomes 1:5). There may be cases where this 

method is overly conservative. 

3.1.2.2 Analysis. Engineering analysis may allow for accurate 

estimation of the hazard ratio. 

4. Notes on Hazard Ratio Development. 

4.1 Communication between the engine/propeller/APU manufacturer, installer, 

operators and the FAA is often necessary, especially if no appropriate historical 

hazard ratio is available. Additionally, it may be necessary to use engineering 

judgment to assess the impact of unique features of a specific powerplant or 

APU installation. 

4.1.1 Hazard ratios for use in engine installations in rotorcraft have been 

developed. NTSB accident data reviewed covered the 10 year time 

period of October 1996 – September 2005. 

5. Use of the Hazard Ratio. Use of the hazard ratio allows the conversion of the base 

level event to an event of a specific hazard level. For example, if, using the methods 

outlined above, the level 4 hazard ratio is estimated at 2/6 (.33), the fleet risk factor for 
9/23/10 rev. 0 

31 

the base event can be converted to a fleet risk factor for level 4 events by multiplying the 

base event fleet risk factor by the hazard ratio.
9/23/10 rev. 0 

32 

APPENDIX 5 

ASSESSMENT EXAMPLES 

1. Purpose. 

1.1 This appendix provides step-by-step examples of the risk assessment process 

detailed in this handbook, taking the reader through several typical fictitious 

service problem scenarios from identification to resolution. 

1.2 The examples shown below are from AC 39-8 appendix 7. Accordingly, 

CAAM hazard ratios and CAAM risk guidelines are used in the examples. The 

general methodology for risk assessment is the same for all E&PD products, 

regardless of the installation. For engines, propellers, or APUs installed in 

small airplanes and rotorcraft, use powerplant or APU hazard ratios and risk 

guidelines specific to category of airplane/rotorcraft installation instead of 

transport airplane installation hazard ratios/risk guidelines. 

1.3 Additional examples are available in the folder titled “Risk Analysis Training” 

on the ANE-110 SharePoint site 

(https://avssharepoint.faa.gov/air/EPD/ANE110/COS/default.aspx). 

2. Example 1: Compressor Disk Fracture. 

2.1 An 8th stage compressor disk installed in a low-bypass turbofan engine 

fractures during takeoff roll. The fracture occurs prior to V1, and the takeoff is 

safely aborted. The fractured disk has 12,508 cycles part life. The fracture is 

uncontained, but does not cause any damage to the aircraft, or injury to any 

passenger or crew. Control is maintained at all times, and the aircraft stops on 

the runway. Failure investigation reveals the disk fractured in low-cycle fatigue 

due to corrosion. The investigation further indicates the corrosion occurred 

because the failed part had not been properly coated during manufacture. The 

problem is identified and corrected in production; however, the risk posed by 

other improperly-coated parts in service must be assessed. 

2.2 Estimate the number of aircraft exposed. Initial evaluation of the extent of the 

problem detects no known manufacturing process changes that might have 

accounted for the coating problem. However, this part number disk is processed 

at a dedicated coating facility (i.e., the facility produces only this part), and 

while all disks of this part number are potentially at risk, the problem is not 

considered to extend to other part numbers (no evidence of any problems with 

the parts produced by other facilities). Four hundred and thirty-three (433) 

disks (including spares) of the suspect part number are currently in service and 

are considered to be at risk of a repeat event. 

2.3 The engine manufacturer immediately performs a Weibull analysis using a 

typical fatigue wearout slope against the population of current disks. This 

analysis gives a material property life distribution to input into a Monte Carlo 

simulation. The simulation runs a computer model of the fleet forward in time. 
9/23/10 rev. 0 

33 

This model predicts 1.3 additional disk fractures if all current parts are allowed 

to remain in service until their certified retirement life (15,000 cycles). 

Calibration of this risk model (by backing up the simulation to the start of 

service and running the fleet model to the present) gives a prediction of 0.95 

events to date (versus 1 occurred), which is judged to be indicative of a valid 

model. 

2.4 Estimate the uncorrected risk and risk per flight. While this event did not result 

in serious injury or other CAAM level 4 or 5 event, historical data available at 

the time on similar disk fractures over the previous 15 years (see the CAAM 

report referenced in AC 39-8 paragraph 2b(1)) indicate a record of seven 

CAAM level 3 and 4 events out of a total of 10 uncontainments due to lowbypass ratio turbofan high-pressure compressor fractures. Four of those events 

(40 percent) resulted in hull loss or fatality (CAAM level 4) due to on-ground 

fire; one (10 percent) was also CAAM level 5 (hull loss/multiple fatalities). 

Structural review by the engine manufacturer predicts that fracture of this 8th 

stage disk would be expected to result in uncontainment 100 percent of the time. 

Coordination with the aircraft manufacturer, validated by the Transport 

Airplane Directorate, indicates that, for this installation (wing-mounted engine), 

50 percent of the uncontainments would be at least CAAM level 3, and 80 

percent of the level 3 events would be hull loss/injury events (level 4). The 

assumption is made that 40 percent of the events (0.50 level 3 x 0.80 level 4 

given level 3 = 0.40) would be expected to result in serious injury or other 

CAAM level 4 event. 10 percent of all events are assumed to be level 5 (0.40 

level 4 x 0.25 level 5 given level 4 = 0.10). Since 1.3 events are predicted, and 

40 percent of those would be expected to result in a CAAM level 4 event, 0.52 

level 4 events would be expected if no action is taken (1.3 x 0.40 = 0.52), and 

0.13 level 5 events. There are two at-risk engines per aircraft, and the 433 disks 

have an average of 5000 cycles remaining until retirement. Therefore, the 

average per-flight risk of a CAAM level 4 (or higher) event if no action is taken 

is 4.8E-7 [0.52 / (433 disks x 5000 cycles/disk / 2 cycles/flight) = 4.8E-7]. Note 

that the spare disks are included in the analysis. While these level 4 risks are 

clearly in the region where action must be taken, the per-flight risk is below the 

guideline for immediate action (4E-6 per-flight for CAAM level 4 events), so 

the disks are allowed to remain in service while an inspection and replacement 

plan is developed. CAAM level 3 events are also calculated: there are 0.65 

level 3 (or higher) events predicted (1.3 events x 0.50 at least level 3 = 0.65), 

with a per-flight risk of 6.0E-7 [0.65 / (433 disks x 5000 cycles/disk / 2 

cycles/flight) = 6.0E-7]. 

2.5 Estimate effects of candidate actions. Over the next few weeks, while a plan is 

being developed, a number of retired disks are located and inspected, along with 

several disks in engines currently undergoing scheduled shop visits. One disk is 

found to have a crack resulting from a corrosion pit. These inspection findings, 

along with structural modeling by the engine manufacturer, allow for a more 

refined quantitative analysis, including initiation and propagation distributions. 
9/23/10 rev. 0 

34 

The Monte Carlo simulation is revised and performed against a number of 

inspection and replacement scenarios to find one that acceptably mitigates the 

risk of serious injury. The engine manufacturer submits a plan to the E&PD 

which calls for replacement of the disks at next shop visit, with engines above 

10,000 cycles part life to be removed no later than within the next 2,000 cycles. 

The simulation predicts that this plan would result in 0.18 uncontainments, of 

which 0.09 would be at least level 3 (0.50 level 3 x 0.18 = 0.09), 0.07 would be 

level 4 (0.40 level 4 x 0.18 events = 0.07), and .02 would be level 5 (0.10 level 

5 x 0.18 events = 0.02). Both the level 3 and level 4 predictions are below the 

risk guidelines (see table 1, paragraph 9 in AC 39-8); the level 5 risk is well 

controlled within the level 4 exposure. This plan calls for an aggressive 

production schedule of replacement disks. Shop visit capacity will also be 

strained but is expected to be capable of meeting the increase in inducted 

engines with only minor schedule disruptions. The engine manufacturer issues 

a Service Bulletin recommending disk replacement to the above schedule. 

2.6 Implement and monitor corrective action plan. The E&PD reviews the 

assumptions and results of the risk analysis. Though the E&PD would like to 

further reduce the risk of this event, it agrees that a more aggressive schedule 

would result in significant service disruptions. The E&PD issues an NPRM, 

followed by an AD, to mandate the engine manufacturer’s Service Bulletin. 

Disks are inspected as they are replaced, with the results compared at regular 

intervals to the month-by-month predicted crack findings from the Monte Carlo 

simulation. Subsequent inspection findings indicate the initial risk analysis is 

somewhat conservative. However, both the engine manufacturer and the E&PD 

believe that no alleviation of the disk replacement schedule should be pursued 

due to the potential seriousness of another event. After nine months, the E&PD 

also requests a comparison of the actual shop visit (disk replacement) rate with 

the predictions from the risk analysis. The actual is found to be within two 

percent of the predicted, so no additional action is taken. After four and onehalf years, the last of the suspect disks is replaced. No additional events have 

occurred during that period. 

3. Example 2: Boost Pump Wiring Chafing. 

3.1 Inspection of a fuel leak problem on a transport aircraft revealed that the leak 

was the result of a conduit burn through caused by an electrical arc between the 

conduit and a boost pump wire inside the conduit that had chafed completely 

through the insulation. The penetrated conduit lies within the fuel tank, thus 

raising a concern about a possible fuel tank ignition. A different airplane type 

had experienced an unexplained catastrophic fuel tank ignition eight years 

earlier. 

3.2 Estimate the number of aircraft exposed. The boost pump wiring on this 

airplane type is common to all models. The worldwide fleet includes about 

3000 airplanes with two engine models and a variety of derivatives. Since the 

vibration characteristics for the different engine types which might affect 
9/23/10 rev. 0 

35 

chafing is not known, it must be assumed that all airplanes in the fleet could be 

affected. The analyst has a total of three inspection records. Two of the 

inspections had been performed prior to the one that indicated conduit 

penetration. A Weibull analysis of the data indicates a strong wearout mode 

(i.e., the likelihood of chafing increases with the age of the wiring). The 

Weibull analysis predicts 0.92 burned-through conduits should have occurred to 

date, which calibrates with the actual experience. The analysis as applied to the 

fleet indicates that airplanes with more than 30,000 hours contribute 

significantly to the overall risk of a bare wire event. Although only one airplane 

has been found with a burned-through conduit, the analysis indicates that there 

may be 76 airplanes still flying with undetected exposed wires. The analyst 

concludes that the entire fleet should be included in the actions to control the 

situation. 

3.3 Since there is no life limit on the fuel tank wiring, the statistical analysis 

described in (a) predicts that 76 bare wire events are already latent in the fleet 

and many more will occur in the remaining life of the fleet. Information gained 

in investigation of a similar situation in a different airplane type shows that the 

wing tanks on the airplane type where the bare wire was found are in a 

flammable condition for three percent of each flight. The center tanks are 

flammable for 30 percent of each flight. 

3.4 Estimate the uncorrected risk factor and risk per flight. There is no known 

experience of a bare wire event causing an ignition event; therefore, the analyst 

must estimate the hazard ratio—the conditional probability of an ignition event 

given that a bare wire event has occurred. This is conservatively accomplished 

by assuming that an ignition event in one of the predicted 76 airplanes flying 

with bare wires is imminent. The hazard ratio, which can also be expressed as 

the conditional probability (CP) of an ignition event, is estimated by using the 

model developed by the analysis to compute how long each airplane predicted 

to have a bare wire has been flying after the event occurred. The analyst 

determines that the total after-event flight hours accumulated by the 76 

airplanes predicted by the model to have bare wires is 624,217 hours. Thus, CP 

is estimated to be 1/624,217  1.6E-6. This is a conservative approach, but the 

only objective estimate of CP available to the analyst. The only actual fuel tank 

ignition event on this airplane type resulted in a level 5 event. Although the 

airplane was on the ground at the time of the ignition, a number of passengers 

were killed and the airplane was destroyed. No cause for the accident was 

recorded. Therefore, the analyst concludes that any ignition source in a fuel 

tank will have level 5 potential. From this information, the risk can be now be 

calculated for any length of time, including the next 60 days to determine if 

immediate action is warranted. (The guideline for immediate action, as defined 

in paragraph 9g of the main body, applies to a 60-day period.) This airplane 

accumulates, on average, 341 hours in a 60-day period. The Weibull analysis 

estimates that 6 additional bare wires will develop over the next 60 days. 

 76 latent bare wires in the fleet plus 6 more in 341 fleet hours = 82 
9/23/10 rev. 0 

36 

 1.6E-6 per-hour probability of ignition event given bare wire 

 341 hours operation 

 = 82 x 1.6E-6 x 341 = 0.045 level 5 events in the next 60 days of US fleet-wide 

operation. 

 The risk does not exceed the short-term acceptable level 4 risk guideline 

(remember, level 5 risk must at least meet level 4 guidelines) within the next 60 

days. However, since the event in question has a high injury forecast, the 

analyst concludes that immediate mitigating action is necessary. 

3.5 Estimate effects of candidate actions. The analyst uses the information 

generated above to establish an inspection and repair plan that will meet the risk 

guidelines. The analyst determines that if all airplanes older than 65,000 flight 

hours (126 airplanes) are inspected and repaired within 20 days, the risk factor 

is decreased more than 40 percent. Additional inspections are also proposed: 

Airplanes with 55,000 but <65,000 flight hours (152 airplanes) should be 

inspected within 45 days. Airplanes with 45,000 but <55,000 flights (116 

airplanes) should be inspected within 90 days. Airplanes with 38,000 but 

<45,000 flights (154 airplanes) should be inspected within 180 days. Airplanes 

with 30,000 but <38,000 flights (283 airplanes) should be inspected within one 

year. Airplanes with 1 but <30,000 flights (2062 airplanes) should be inspected 

by the time the airplane reaches 30,000 flights. There are 0.09 level 5 events 

expected in the fleet within the full inspection period. Because this is a 

conservative analysis (no events to date, but one assumed, among other 

conservatism), this prediction is judged to be acceptable for a level 5 risk 

exposure. 

3.6 Implement and monitor corrective action plan. A telegraphic AD is issued to 

implement the proposed inspection plan. An updated analysis made from the 

information obtained from the inspections indicates that the safety objectives 

will not be met without adjustments to the inspection schedule. The original 

AD is amended to show the following: All airplanes older than 65,000 flight 

hours to be inspected and repaired within 20 days. Airplanes with 55,000 but 

<65,000 flight hours should be inspected within 40 days. Airplanes with 45,000 

but <55,000 flights should be inspected within 60 days. Airplanes with 38,000 

but <45,000 flights should be inspected within 90 days. Airplanes with 25,000 

but <38,000 flights should be inspected within 180 days. Airplanes with 1 but 

<25,000 flights should be inspected by the time the airplane reaches 25,000 

flights. This new inspection schedule brings the safety objective back to the 

original expectation of 0.09 level 5 events within the inspection period. 

3.7 The corrective action taken to eliminate the wearout problem consists of a 

Teflon sleeve over the original wire bundle. Since there has been no time to 

prove that the corrective action will be effective in the long term, the fleet will 

require inspections to ensure that the safety objectives are maintained in the 

future. Therefore, the AD is further amended to require that the conduits and 
9/23/10 rev. 0 

37 

wiring be inspected at 30,000 flights since new or last replacement of the 

wiring. 
9/23/10 rev. 0 

38 

APPENDIX 6 

HISTORICALLY POTENTIALLY UNSAFE CONDITIONS FOR TURBINE 

ENGINES, PROPELLERS, AND APUs INSTALLED IN SMALL AIRPLANES 

1. Purpose. 

1.1 This appendix outlines the major propulsion system malfunction definitions as 

developed by the Aerospace Industries Association (AIA) Committee on 

Continued Airworthiness Assessment Methodologies (CAAM), PC342. These 

definitions were developed for transport airplane propulsion systems. However, 

these definitions also apply to turbine engines, propellers, and APUs installed 

on small airplanes. This appendix is intended to provide examples not to be an 

inclusive or prescriptive checklist; it may not include all the information 

relevant to the failure conditions of a specific airplane with its various functions 

and its intended use. 

2. Single Propulsion System Event. 

2.1 Uncontained. A significant safety event that initiates from an uncontained 

release of debris from a rotating component malfunction (e.g., blade, disk, 

spacer, impeller, or drum/spool). To be categorized as uncontained, the debris 

must pass completely through the nacelle envelope. Parts that puncture the 

nacelle skin but do not escape or pass completely through are considered 

contained. Fragments that pass out of the inlet or exhaust opening without 

passing through any structure are not judged to be "uncontained.” Starter and 

gearbox uncontainments are excluded. 

2.2 Engine overspeed. Engine acceleration to a rotor speed above that sanctioned in 

the type certificate datasheet. 

2.3 Case rupture. A significant safety event that initiates from a sudden rupture of a 

high-pressure vessel or case with the resultant release of high-pressure gases 

into the under-cowl cavity. Case ruptures resulting from uncontained release of 

debris from a rotating component malfunction are excluded. Case ruptures 

include those events that propagate from fatigue-type cracks as well as ruptures 

related to secondary malfunctions (e.g., flame impingement). See paragraph 2.4 

below. 

2.4 Case burnthrough. Case burnthrough is defined as a local case penetration that 

initiates from local overtemperature of the case external wall due to an internal 

engine malfunction (e.g., fuel nozzle leakage, internal bearing compartment 

fires, titanium fires). Burnthroughs are distinguished from ruptures by their 

lack of an explosive release of high-pressure gas. A common cause of case 

burnthrough is localized penetration due to fuel nozzle malfunction. Events 

involving accessory component cases also contribute to this category; for 

example, sump fires that propagate internally and result in burnthrough of 

piping or that initiate gearbox fires. The key aspect, whether in the primary gas 
9/23/10 rev. 0 

39 

path or accessories, is that fire initiates from an internal malfunction and 

proceeds to burn through a case, tube or gearbox to reach external regions. 

2.5 Under-cowl fire. A safety-significant propulsion system fire-related event 

involving combustion external to the engine casings. Under-cowl fires are those 

that occur within the nacelle and on the engine side of the strut or installation 

fire barrier/wall. Internal pylon fires, including events where fuel leaks from 

the pylon and initiates a fire under the cowl, are excluded. Under-cowl may be 

within fire zones or flammable fluid zones. Tailpipe fires, and hot air leaks 

resulting in fire warnings, without combustion, are excluded from the definition 

and documented separately. Fires that remain internal to the engine casing are 

excluded. 

2.6 Flammable fluid leak. Leak of fuel, oil or hydraulic fluid into the pylon or dry 

bay, or under the engine cowls, which could credibly lead to a fire. Leaks 

collected from shrouds and components and drained directly overboard by a 

dedicated drain are excluded due to the lack of fire safety concern. Drips and 

seeps are also excluded. In-tank leakage is excluded. 

2.7 Compartment overheat/air leak. High-pressure or temperature air leaks due to 

casing or high-pressure/temperature air duct system malfunctions within the 

nacelle or in the pylon. 

2.8 Engine separation. Separation of the engine, with or without the strut/pylon. 

Events resulting from ground contact are excluded. 

2.9 Cowl separation. Separation of nacelle components, such as inlets, cowls, 

thrust reversers, exhaust nozzles, or tail plugs. Separation of relatively small 

sections of skin, blow-out panels or other small pieces that are unlikely to 

hazard continued safe flight and landing are excluded. Events resulting from 

ground contact are excluded. 

2.10 Propulsion system malfunction and inappropriate crew response (PSM+ICR). 

A significant safety event initiating from a single propulsion system 

malfunction (excluding propeller system), which, by itself, does not hazard the 

aircraft, but is compounded by inappropriate crew response (i.e., crew did not 

execute checklist/normal flying duties). A typical example of PSM+ICR is an 

IFSD followed by inappropriate crew response that caused the aircraft to crash. 

Not counted are cases of gross error negligence (such as deciding to take off 

with an engine known to be inoperative). See the AIA/AECMA Project Report 

on PSM+ICR (November, 1998) for additional examples. 

2.11 Crew error. A significant safety event caused by a propulsion system 

malfunction or improper operation that was caused by an inappropriate crew 

action, excluding sabotage, gross negligence and suicide. Not counted are 

events where inappropriate crew action causes a propulsion system malfunction 

through very indirect means such as flying the airplane into the ground or 

running the airplane into equipment on the taxiway/runway. 
9/23/10 rev. 0 

40 

2.12 Reverser/beta malfunction – in-flight deploy. A significant safety event 

wherein a thrust reverser deploys in-flight, or a propeller enters beta mode inflight (exclusive of design intent). 

2.13 Reverser/beta malfunction – failure to deploy. A significant safety event 

resulting from the failure of a thrust reverser to deploy or a propeller to enter 

beta mode when commanded. 

2.14 Tailpipe fire. Fire within the tailpipe, where visible sustained flames exit the 

tailpipe. Engine surge/stall and hot starts resulting in a “glow” are excluded, as 

are events resulting from deicing fluid ingestion. 

2.15 False/misleading indication. Indication that was appreciably different from 

reality, to the point where an indication difference was noticed by the pilot or 

subsequent investigation. This included parameters that were higher than 

actuality, lower than actuality or completely absent, and also discrete warnings 

or alerts that were falsely present or absent. Individual EICAS messages were 

excluded since these were very type-specific and numerous. 

3. Multiple-Engine Powerloss Event. 

3.1 Environmental. A significant safety event initiating from essentially 

simultaneous power loss from multiple propulsion systems for an environmental 

cause (e.g., bird, ice, rain, hail, or volcanic ash ingestion). 

3.2 Maintenance. A significant safety event initiating from multiple propulsion 

system powerloss from clearly improper maintenance (e.g., failure to restore oil 

system integrity after inspection). 

3.3 Other/unknown. A significant safety event initiating from multiple propulsion 

system powerloss for reasons other than those characterized elsewhere, or 

where the initiating event(s) are unknown. This includes unrelated events of 

engine powerloss within the same flight. 

4. APU System Event.

4.1 A significant APU-related safety event as follows: 

4.1.1 Uncontained. An uncontained rotating component malfunction that 

allows debris to exit through the APU containment casings. 

4.1.2 Axial uncontained. Major rotating components that exit the APU 

containment casings in an axial direction (i.e., without penetrating the 

case). 

4.1.3 Overspeed. Acceleration of a rotor beyond the speed sanctioned in the 

Type Certificate Data Sheet. 

4.1.4 Fire. Combustion external to the APU casings. Tailpipe fire data and 

hot air leaks resulting in fire warnings, without combustion, are 

excluded from the definition and documented separately. 
9/23/10 rev. 0 

41 

4.1.5 Tailpipe fire. Fires within the tailpipe and exiting the tailpipe, where 

flames are visible. Hot starts resulting in a “glow” are excluded. 

4.1.6 Compartment overheat. High-temperature air leaks due to casing highpressure/temperature air duct system malfunctions within the APU. 

5. Propeller System Event. 

5.1 An event that initiates from a malfunction or misuse of the propeller system as 

follows: 

5.1.1 Propeller separation/debris release. Separation of single or multiple 

blades, or large piece thereof, due to blade or hub malfunction. Note 

that events occurring after groundstrike are included for their 

information on their threat to the aircraft or its occupants. 

5.1.2 Autofeather/pitch lock. Propeller system malfunction leading to 

inability to control the propeller. Control hunting is excluded as a 

normal product behavior. 

5.1.3 Propeller system malfunction plus inappropriate crew response 

(Propeller PSM+ICR). A significant safety event initiating from a 

propeller system malfunction which, by itself, does not hazard the 

aircraft, passengers, or crew, but is compounded by inappropriate crew 

response. 

5.1.4 Crew error. A significant safety event caused by a propeller system 

malfunction or improper operation that was caused by an inappropriate 

crew action, excluding sabotage, gross negligence and suicide (e.g., 

operation in beta mode in violation of operating instructions). Not 

included are events where inappropriate crew action causes a propeller 

system malfunction through very indirect means such as flying the 

airplane into the ground or running the airplane into equipment on the 

taxiway/runway. 

6. Propulsion System Fume Event. Significant smoke and/or fumes on the flight deck 

or cabin that are generated by the propulsion system.