9/23/10 rev. 0



# Federal Aviation Administration

Engine & Propeller Directorate

ENGINE & PROPELLER DIRECTORATE

CONTINUED AIRWORTHINESS ASSESSMENT PROCESS

HANDBOOK9/23/10 rev. 0

Revision History

Rev Description of Change Effective Date

0 Original Release 9/23/20109/23/10 rev. 0



### Table of Contents

1. PURPOSE 1

2. REFERENCES 1

3. DEFINITIONS 2

4. HAZARD LEVELS 5

5. DATA REVIEW AND PRELIMINARY RISK ASSESMMENT 6 5.1 Acquire and Review Event Data 6 5.2 Preliminary Risk Assessment (PRA) 6 5.3 Initiate Potential Safety Issue Investigation 8

6. CONTINUED AIRWORTHINESS ASSESSMENTS OF POWERPLANT AND APU INSTALLATIONS ON TRANSPORT CATEGORY AIRPLANES 9

7. CONTINUED AIRWORTHINESS ASSESSMENTS OF ENGINES, PROPELLERS, AND APUs ON SMA LL AIRPLANES AND ROTORCRAFT 9

7.1 General 9 7.2 Estimate the Number of Airplanes Exposed 11

7.3 Create Risk Model 11

7.4 Calibrate the Risk Model to Current Experience 12

7.5 Estimate the Uncorrected Fleet Risk Fact or and Uncorrected Individual Risk 12 7.6 Compare the Uncorrected Risks to Risk Guidelines 14 7.7 Identify Options for Mitigating Action 14

7.8 Estimate the Effects of Candidate Actions 14

7.9 Estimate Potential Risk Reduction 14 7.10 Implement and Monitor the Impact of the Corrective Actions 15 7.11 Verify Corrective Actio ns Were Effective 16 7.12 Follow-on Assessments and Responses 16

8. RISK GUIDELINES 17

8.1 General 17

8.2 Risk Guidelines for Immediate Action 17

9. PRIORITIZATION BASED ON RISK 19

10. CORRECTED RISK 209/23/10 rev. 0

11. CUMULATIVE RISK 21

12. ALTERNATIVE METHODS OF COMPLIANCE 22

13. INTER-DIRECTORATE COORDINATION 22
APPENDIX 1. POTENTIAL UNSAFE CONDITIONS 23

APPENDIX 2. EVENT HAZARD LEVELS AND DEFINITIONS FOR ENGINE, PROPELLER, AND APUs INSTALLED IN SMALL AIRPLANES 25

APPENDIX 3. EVENT HAZARD LEVELS AND DEFINITIONS FOR ENGINE AND APUs INSTALLED IN ROTORCRAFT 28

APPENDIX 4. HAZARD RATIO DEVELOPMENT 29
APPENDIX 5. ASSESSMENT EXAMPLES 32

APPENDIX 6. HISTORICALLY POTENTIALLY UNSAFE CONDITIONS FOR TURBINE ENGINES, PROPELLERS, AND APUs INSTALLED IN SMALL AIRPLANES 38

LIST OF TABLES

Table 1 18

Table 2 18

LIST OF FIGURES Figure 1 20 Figure 2 219/23/10 rev. 0

1 

## 1. Purpose
1.1 This handbook describes the Engine & Pr opeller Directorate (E&PD) Continued Airworthiness Assessment Process. Th is handbook provides guidance for risk determination and management during th e resolution of engine, propeller, and auxiliary power units (APU) continued ope rational safety (COS) issues as part of FAA’s Aircraft Certification Serv ice (AIR) Safety Management System (SMS) Monitor Safety/Analyze Data (MSAD) process. 1.2 The handbook supports the MSAD proce ss by requiring information on event severity and causal chain be documented in the MSAD program. 1.3 Continued airworthiness requires that sa fety concerns within the existing fleet be addressed and that the knowledge gained be applied for the benefit of future fleets. This handbook also provides gui dance for estimating the risks of potential safety issues; identifying a nd estimating the effects of corrective actions for all identified unsafe conditions; and verifying that the corrective actions were effective. This handbook is intended to present a tangible means of logically assessing and responding to the safety risks posed by unsafe conditions. 1.4 This handbook applies to the Engine Ce rtification Office (ECO) and Aircraft Certification Offices (ACOs) responsible for the continued operational safety of FAA-certified engines, pr opellers, and APUs. 

## 2. References
Documents listed in paragraphs 2.1, 2.2, 2.3, 2.9, and 2.10 can be found in the folder titled, “MSAD – Risk Anal ysis Supporting Data” on the ANE-110 SharePoint site ( https://avssharepoint.faa.gov/ai r/EPD/ANE110/COS/default.aspx )

. 2.1. Technical Report on Propulsion System and APU-Related Aircraft Safety Hazards, dated October 25, 1999.

2.2. 2nd Technical Report on Propulsion System and APU-Related Aircraft Safety Hazards, dated January 31, 2005.

2.3. Paper, “Quantitative Analysis in th e Absence of Data,” presented by Ann Azevedo, FAA, at the 23rd International System Safety Conference, August 2005.

2.4. MSAD Users Guide (available within the MSAD tool).

2.5. The New Weibull Handbook, 5 th edition, Dr. Robert B. Abernethy.

2.6. WinSmith Weibull software.

2.7. E&PD Risk Analysis spreadsheets.

2.8. Order 8110.107, “Monitor Safety/Analyze Data,” dated March 12, 2010.9/23/10 rev. 0

2 2.9. AC No. 39-8, “Continued Airworthine ss Assessments of Powerplant and Auxiliary Power Unit Installations of Transport Category Airplanes,” dated September 8, 2003.

2.10. Policy PS-ANE100-1999-00006, “Risk Assessment for Reciprocating Engine Airworthiness Directives,” dated May 24, 1999. 

## 3. Definitions
3.1 The following definitions apply to the information provided here. 3.1.1 Compliance schedule. A timetable for performing specified corrective actions (e.g., maintenance, inspectio ns, part replacements, alterations, etc.) to alleviate an id entified unsafe condition

. 3.1.2 Continued airworthiness. The ongoing activities associated with ensuring a product remains in comp liance with the intent of the applicable Product Design Standards.

3.1.3 Continued Airworthiness Asse ssment Methodology (CAAM). The E&PD and Transport Airplane Directorate may use this methodology to identify unsafe conditions and determine when an “unsafe condition is likely to exist or develop in other products of the same type design” before prescribing corrective action in accordance with Title 14 of the Code of Federal Regulations (14 CFR) part 39. CAAM, which is described in AC 39-8, is used fo r products associated with the Powerplant or Auxiliary Power Un it (APU) Installations on Transport Category Airplanes. That AC applies to the identification, prioritization and resolution of unsafe conditions within the powerplant and APU installations of transport category airplanes.
3.1.4 CAAM level. The level of event out come as defined by its effect on the aircraft, passengers, and crew of tran sport category airp lanes. Note the more generic definition of hazard level below. 3.1.5 Control program. The combina tion of compliance schedule and corrective actions needed to allevi ate an identified unsafe condition. Note that the condition is no longer c onsidered to be unsafe while it is being addressed by a control program developed under the guidelines of the process identified here.

3.1.6 Event. The occurrence of a failure or other condition. Events typically trigger investigations that seek causes of a safety issue. The safety issue (or condition) is then evaluated for safety implications.

3.1.7 Fatal Accident. An occurrence a ssociated with the operation of an aircraft which takes place betw een the time any person boards the aircraft with the intention of flight and until such time as all such persons have disembarked, and in which any person (including those on the ground injured as a result of the essential operati on of the flight) suffers a fatal injury. This defi nition excludes maintenance, ramp9/23/10 rev. 0

3 positioning and ground personnel movement , unless injuries are a direct result of the aircraft’s action or malfunction. 3.1.8 Fatal injury. An injury that resu lts in death within 30 days of the accident. 3.1.9 Fleet Risk factor. A quantitative assessment output equal to the average number of future events expected to occur within a given time. Fleet risk factors can be differentiated into two types (see below) and typically cover the time required for problem re solution. However, in the case of uncorrected fleet risk factor and co ntrol program fleet risk factor for control programs that do not incorp orate final corrective actions (e.g., recurring inspections), fleet risk f actors usually cover a 20-year period or shorter interval corresponding to the expected life of the fleet. In AC 39-8, fleet risk factor is called risk factor.

3.1.9.1. Uncorrected fleet risk factor. The forecasted number of future events expected to occur in the entire worldwide fleet (or, if applicable, the relevant affect ed subfleet) if no corrective actions are incorporated. 3.1.9.2. Control program fleet risk fact or. The forecasted number of future events expected to occu r in the entire worldwide fleet (or, if applicable, the relevant affected subf leet) during the control program. 3.1.10 Hazard level. Level of event outcome, as defined by its effect on the aircraft, passengers, and crew. Hazar d levels are defined as a function of the powerplant installation (i.e., tran sport airplane, rotorcraft, or small airplane). In reference 2.9, the hazard level is referred to as the CAAM level. 3.1.11 Hazard ratio. The conditional probability that a particular failure mode will result in an event of a specific hazard level. 3.1.12 Individual Risk. The risk per flight -hour or per flight. The per flighthour (or per flight) guid elines apply to the average of the fleet or subfleet suspected of having the unsafe condition. The terminology of individual risk is not meant to imply that the risk to an individual person is calculated. Rather, individual ri sk is normally calculated by dividing the fleet risk factor by the total numbe r of flight-hours (o r flights) within the assumed exposure period. In AC 39-8, individual risk is called per flight risk.

3.1.12.1. Uncorrected individual risk. The forecasted number of future events per flight-hour (or per f light) expected to occur in the entire worldwide fleet (or, if applicable, the relevant affected subfleet) if no corrective actions are incorporated.9/23/10 rev. 0

4 3.1.12.2. Control program individual risk. The forecasted number of future events per flight-hour (or per flight) expected to occur in the entire worldwide fleet (or, if applicable, the relevant affected subfleet) duri ng the control program. 3.1.13 Malfunction type. A single initiating cause of a failure, defect or other abnormal condition on a type design that can affect one or more parts. One specific cause (such as a melt-relate d defect leading to fracture) that affects several different parts (5 th stage disks and 6 th stage disks, for example) within an engine type design is still co nsidered a single malfunction type. However, multiple initiating causes for a single part (e.g., melt-related defect, high-cycl e fatigue, corrosion, etc., for 5 th stage disks) represent multiple malfunction t ypes. Note that this use of the term “malfunction” attempts to cover the traditional definition referring to systems or components not func tioning properly along with hardwareinduced failures. 3.1.14 MSAD Process. The MSAD process was designed to filter, review, analyze, and trend aviation safety da ta. The MSAD process is described in the reference in paragraph 2.8. 3.1.15 Powerplant installation. Each component that is necessary for propulsion or affects the control of the major propulsive units or the safety of the major propulsive un its between normal inspections or overhauls. 3.1.6 Product Design Standards. Those requirements delineated within the “Airworthiness Standards” (e.g., 14 CFR parts 23, 25, 27, 29, 33 and 35) and “Operating Rules” (e.g., 14 CF R parts 91, 121, 125, and 135) which regulate the physical and functional char acteristics of airplanes, engines, and components thereof. 3.1.17 Propulsion system. See Po werplant installation. 3.1.18 Safety Issue. Cause(s), contributing factor(s), or findi ng(s) that led to, or could lead to, an unsafe outcome. Safety decisions are rendered on issues/causes, not events. For example, investigation of an uncommanded flight control su rface movement—an event—might reveal that the cause was a circuit failure in the autopilot’s computer. Circuit failure is the safety issue/cause to evaluate for safety implications, and to take corrective action against.

3.1.19 Unsafe Condition. A condition whic h, if not corrected, is reasonably expected to result in one or more serious injuries. 3.1.19.1 Is reasonably expected. Ha s a probability of occurrence acceptable to neither the long-term risk guidelines listed within tables 1-2 of this handbook nor the intent of the applicable product design standards.9/23/10 rev. 0

5 3.1.19.2 Serious injuries. As define d by the National Transportation Safety Board (NTSB), any injury that:

a. requires hospitalization for more than 48 hours, commencing within seven days from the date the injury was received;

b. results in the fracture of any bone (except simple fractures of fingers, toes or nose);

c. involves lacerations that cause severe hemorrhages, nerve, muscle or tendon damage;

d. involves injury to any internal organ; or

e. involves second- or thir d-degree burns or any burns affecting more than five percent of the body surface, and

f. fatal injury.



## 4. Hazard Levels

4.1. The hazard levels classify events based on their actual outcome. Other methods , such as the assessment duri ng certification of the wors t anticipated outcome, are also used to classify the severity of events. Because different classification systems were developed independently, ar e based on either actual or projected outcomes, and have different purposes, there is not a one-to-one relationship between hazard levels and any given failure condition. For example, a disk burst may be classified as “catastrophi c” or “hazardous” under certification assessments, but actual disk burst events may range in severity. Nevertheless, the intention of this handbook is to eval uate risk objectivel y, regardless of the classification system used. This risk ev aluation includes severity of outcome and conditional probability of that outcome gi ven the failure condition. Whether one starts with the assessment that disk burst s are catastrophic, or observes that there has been a specific hazard level disk burst in service, the risk assessment for a given outcome should be equivalent. The acceptable levels of safety and risk assessment methods differ between certif ication and continue d airworthiness. Consequently, to avoid confusion, th is handbook does not focus on certification classifications. Event hazard level definitions are based on the powerplant or APU installation as follows:

4.1.1. For powerplant and APU installations of transport cate gory airplanes use the CAAM levels defined in th e reference in paragraph 2.2.

4.1.2. For engines and propellers installed in Small Airplanes use the hazard level definitions of Appendix 2 of this handbook.9/23/10 rev. 0

6 4.1.3. For engines installed in rotorcraft use the hazard level definitions of Appendix 3 of this Handbook. 

## 5. Data Review and Preliminary Risk Assessment

5.1. Acquire & Review Event Data. 5.1.1 The MSAD program will acquire event data from existing FAA databases using an automated batch process. Directorate defined hazard criteria will be used to screen these databases for events of interest. If the hazard criteria matches a database record, an MSAD event record will be created and forwarded to th e cognizant ECO or ACO (referred to herein as “ACO”) based on the product make and model. 5.1.2 If an ACO becomes aware of a potentia l safety issue that is not sent by the MSAD program to his office, the ACO should enter the data manually into the MSAD program. 5.1.2.1 The ACO should investigate to determine why the record was not sent to the ACO via the MSAD program.

5.1.2.2 If the ACO identifies that an MSAD record exists that the existing hazard criteria matched, the ACO should inform MSAD IT support of the issue.

5.1.2.3 If the ACO identifies that an MS AD record exists but the hazard criteria did not identify this event as a record that should be sent to the ACO, the ACO should info rm the Directorate COS focal of a problem with the ha zard criteria logic.

5.1.2.4 The Directorate COS focal should revise the haza rd criteria as needed.

5.2. Preliminary Risk Assessment (PRA). 5.2.1 The ACO will perform the preliminary risk assessment to quickly identify any safety issues needing an emergency Airworthiness Directive (AD) or “Final rule; request for comment” (FRC). The PRA also determines whether an event indicat es a potential safe ty issue requiring more investigation through the MS AD process. The assessment should take advantage of whatever da ta is immediately available. 5.2.2 Prior examples of similar occurr ences of the potential unsafe condition, and their associated airplane-level e ffects, should be reviewed to help with this determination. Historical hazard ratio data can be found in the folder titled, “MSAD – Risk Analysis Supporting Data ” on the ANE110 SharePoint site ( https://avssharepoint.faa.gov/ai r/EPD/ANE110/COS/default.aspx )

. See appendix 4 for guidance on estim ating the hazard ratio. 5.2.3 Urgent Unsafe Condition is Identified.9/23/10 rev. 0

7 5.2.3.1 Upon identifying an unsafe condition, a decision should first be made as to whether immediate action is warranted. The magnitude of a required immediat e action will be related to the severity of the condition and the likelihood of additional events occurring prior to the implementa tion of a longer-term solution. It is possible that, immediatel y following a potentially severe event, the likelihood of its recu rrence cannot be adequately estimated. If it is possible to take immediate, practical, mitigating action while an initial assessment is being made, that action should be taken. An example was the unsafe condition posed by a thrust reverser inflight deployment on specific types of airplanes with wing-mounted high-bypass ratio engines. An accident resulted from an inflight thrust reverser deployment. Neither the failure(s) which lead to the thrust reverser deploying inflight nor the reasons why the inflight deployment resulted in the pilot losing control of th e airplane could be readily determined. However, it was possible to take reasonable immediate action by “locking-out” th e reversers. Reversers were subsequently allowed to be “unlocked” when system integrity was assured by requiring periodic checks of the entire thrust reverser system, including its faul t indication features. The final corrective action was to incorporate system modifications to ensure that subsequent inflight deployment s are not anticipated to occur within the fleet life of the airplane type.

5.2.3.2 If the PRA finds that an ur gent unsafe condition exists, the MSAD record should be assigned to the cognizant ASE to take immediate action. 5.2.3.3 Once the immediate action is taken, the ASE should complete the steps outlined in this handbook beginning with paragraph 5.3.2. 5.2.4 Potential Safety Issue is Identified. If the PRA finds that a safety issue is likely to exist, the MSAD record sh ould be assigned to the cognizant ASE for further action as defined in this handbook. 5.2.5 Safety Issue Does Not Exist. If the PRA finds that a safety issue does not exist, the ASE must document the following information necessary to support future risk analyses and trending. 5.2.5.1 Select the “CAAM level” of the event from the drop-down menu in the MSAD “Event Information” screen. In a future release of the MSAD program, “CAAM level” will be changed to the more generic “Hazard Level.” In the interim, select the appropriate hazard level (<3, 3, 4 or 5) under the MSAD “CAAM Level” drop-down menu based on hazard level definitions in paragraph 4.9/23/10 rev. 0

8 5.2.5.2 Document the causal chain in the MSAD “CAUSE” screen. Selections for part name and occurrence subcategories are provided for this purpose. Enter multiple rows as needed to describe the causal chain. In the comment field of each row, indicate whether this part/occurr ence subcategory is the primary or contributing cause of the event. Note that E&PD specific part names and occurrence subcategories are available. The E&PD specific information is preceded with “EPD” and should be used whenever possible. Occurrence subcategory items with preceding “SCF” contain other generic descriptions that will be commonly used.

5.3 Initiate Potential Safety Issue Investigation. 5.3.1 Determination that a potential safe ty issue exists should be followed by a determination of either the root cause(s) or contributing factors, or both. Preliminary information and details may be insufficient to identify appropriate corrective action. Therefore, it is often necessary to seek additional information to determ ine the root cause and other contributions to the potential safety issue. Safety issues may be caused, either in combination or separately, by improper design, manufacture, maintenance, or operation. The c ontribution of these individual elements should be evaluated to as certain the probability of future occurrences, as well as the effectiven ess of candidate corrective actions. Safety issues that are not mitigated by contributing or conditional factors may require expeditious action unless the root cause, failure distribution, and risk factor can be reasonably established. 5.3.2 Root cause problem assessments may identify concerns in other products of the same or similar type design or usage. In these cases, consideration of corrective acti on beyond the initially-identified population may be necessary. 5.3.2.1 Select the “CAAM level” of the event from the drop-down menu in the MSAD “Event Information” screen. See paragraph 5.2.5.1 for additional details.

5.3.3 Document the causal chain in the MSAD “CAUSE” screen. Selections for part name and occurrence subcategories are provided for this purpose. Enter multiple rows as needed to describe the causal chain. In the comment field of each row, indi cate whether this part/occurrence subcategory is the primary or contributi ng cause of the event. Note that E&PD specific part names and occurr ence subcategories are available. The E&PD specific information is preceded with “EPD” and should be used whenever possible. Occurrence subcategory items with preceding “SCF” contain other generic descripti ons that will be commonly used.9/23/10 rev. 0

9 

## 6. Continued Airworthiness Assessments of Powerplant and APU installations on Transport Category Airplanes

6.1 Continued airworthiness assessments of powerplant and APU installations on Transport Category Airplanes must us e the guidance of AC 39-8. See paragraph 7 below for additional inform ation on risk analysis methods and calculations. 6.2 Risk analysis results, including all supporting data (Weibull, risk analysis spreadsheet, hazard ratios, histograms , etc.) and assumptions used in the uncorrected risk and control program ri sk calculations for powerplant and APU installations on transport category airpla nes must be forwarded to the E&PD Standards Staff (E&PDSS). This informa tion is necessary to support collection of risk analysis “library data” as described in the MSAD Order.

6.2.1 If the E&PD COS focal is asked to attend the Corrective Action Review Board (CARB) meeting, the risk analys is data must be forwarded to the E&PD COS focal prior to the meeting. Otherwise, the risk analysis data may be shared with the E&PDSS after the CARB meeting. 6.2.2 Updates to the risk analysis shoul d also be forwarded to the E&PDSS. 6.2.3 If the control program includes in spections, document and monitor the predicted inspection findings as described in AC 39-8. 6.3 Note that paragraph 6 does not apply to powerplant installa tions of transport category rotorcraft. See paragraph 7 for the methods to be used for powerplant installations in all rotorcraft. 

## 7. Continued Airworthiness Assessments of Engines, Propellers, and APUs installed on Small Airplanes and Rotorcraft

7.1 General. 7.1.1 It is usually necessary to work cl osely with the design approval holder and, if appropriate, the operators to adequately complete the steps outlined within the risk assessment process. This cooperative effort may take the form of: the FAA engineer overseeing the work of the manufacturer or designer; the FAA engineer and manufacturer working in concert; or the FAA engineer perf orming the analysis with or without input and guidance from the manufacturer. 7.1.2 Any analysis, whether qualitative or quantitative, is only as accurate as the assumptions, data, and analytical t echniques it uses. Therefore, these underlying assumptions, data, and analytic techniques should be identified and justified to ensure that the conclusions of the analysis are valid. The justification of the assu mptions made should be an integral part of the analysis. Assumptions can be validated by using experience9/23/10 rev. 0

10 with identical or similar systems or components, with due allowance made for differences of design, duty cy cle and environment. Where it is not possible to adequately justify the critical elements of the analysis, either conservatism should be bui lt into the initial assumptions, or uncertainty in the data and assump tions should be evaluated to the degree necessary to demonstrate th at the analysis conclusions are relatively insensitive to that uncertaint y. It is essential that the analysis calibrate with experience to date. A quantitative risk analysis cannot be expected to credibly predict future events if it does not calibrate to actual experience.

7.1.3 The intent of these assessments is to determine whether an unsafe condition exists (that is, whether th e potential unsafe condition has a reasonable expectation of resulting in injury) and to ensure that an unsafe condition that represents the great er risk receives higher levels of attention and resources for its tim ely resolution than does one that represents a lower risk. 7.1.4 There are a range of powerplant in stallations of small airplane and rotorcraft, including high performa nce twin turbine engine-powered aircraft to single reci procating engine-powered aircraft. We have defined different risk guideline ca tegories based on the engine or propeller malfunction, the engine type , and the aircraft type. These different categories recognize the different levels of safety permitted during the certification of aircraft engines, propellers, and small airplanes and rotorcraft. 7.1.5 Risk analysis results, including a ll supporting data (e.g., Weibull, risk analysis spreadsheet, hazard ratios, and histograms) and assumptions used in the uncorrected risk and cont rol program risk calculations must be forwarded to the E&PDSS. This information is necessary to support collection of risk analysis “libra ry data” as described in the MSAD Order.

7.1.5.1 If the E&PD COS focal is aske d to attend the CARB meeting, the risk analysis data must be forwarded to the E&PD COS focal prior to the meeting. Otherwise, the risk analysis data may be shared with the E&PDSS after the CARB meeting 7.1.5.2 Updates to the risk analysis should be forwarded to the E&PDSS. 7.1.5.3 If the control program incl udes inspections, the predicted inspection findings should be documented and monitored as described in this handbook. 7.1.6 The risk analyses described in th is handbook can be performed using the WinSmith Weibull (WSW) software with or without one of the risk analysis spreadsheets developed by th e E&PD. The E&PD risk analysis9/23/10 rev. 0

11 spreadsheets require the Weibull para meters (e.g., data from WSW), but offer more options for control progr ams. Other approaches may be used, such as the methodology of Policy PS-ANE100-1999-00006 , but should be coordinated with the E& PDSS. The E&PD risk analysis spreadsheets are available in the folder titled “Risk Analysis Tools” on the ANE-110 SharePoint site ( https://avssharepoint.faa.gov/ai r/EPD/ANE110/COS/default.aspx )

. 7.2 Estimate the Number of Airplanes Exposed

. Determine the number of airplanes for which the unsafe condition ma y exist or be expected to develop if no corrective action is taken. For example, airplanes w ith engine parts within a certain serial number range or airplanes with installed engines below a certain total cycles or total hours. Note th at exposure means the possibility of occurrence, not the certainty of it. 7.2.1 If the engine, propeller, or APU expos ed to the potential safety issue is installed in airplanes from multiple risk guideline categories (see Table 1 or 2) and the risk guidelines or haza rd ratios are different, determine the number of airplanes expo sed in each category. 7.2.2 Data sources for information necessary to conduct a risk analysis include the manufacturer, aircraft bluebook, Airclaims, FAA websites, and the FAA registry. 7.2.2.1 Small airplane demographic information (number of airplanes and utilization data) is available on the Small Airplane Directorate COS website. We recommend that the ASE work closely with the installing ACO in performing their COS duties. 7.2.2.2 Rotorcraft demographic informa tion (number of rotorcraft and utilization data) is on the Rotorcra ft Directorate SharePoint site ( https://avssharepoint.faa.gov/air/ RCD/rotocraftriskanalysisdata/ default.aspx ) 7.2.3 See the reference in paragraph 2.3 on techniques for using secondary data to estimate the fleet demographic information.

7.3 Create Risk Model. 7.3.1 See the reference in paragraph 2.6 for information on Weibull analysis, failure distributions, and failure forecasting. This includes the definitions for the Weibull and failure forecasting terminology used in this handbook. 7.3.2 The meaning of failure must be cl early defined in the analysis. For example, failure may mean part crac king, part fracture, fire, or engine shutdown. 7.3.3 The ages (e.g., cycles or hours) of failures and suspensions (unfailed parts) of the suspect fleet are ente red into Weibull software such as9/23/10 rev. 0

12 WSW. This software will determine the Weibull 2-parameter Beta and Eta Parameters and pve%.

7.3.4 If the data includes more than 21 failures, use WSW to perform a distribution analysis. The distribu tion with the highest pve% should be used for the analysis. 7.4 Calibrate the Risk Model to Current Experience.

7.4.1 Calibrate the risk model to what ha s already happened (i.e., calibrate to the present risk). There will be a nu mber of irrefutable facts within a problem. For instance, these fact s may include the number of parts failed; the number of parts found cr acked; and the number of parts found not cracked. If the model does not calibrate, the team should review further to determine which model assumptions may be in error. The model will not predict future risk reliably if it cannot calibrate to actual experience to date. 7.4.1.1 If the calculated Present Risk Qu antity is much larger than the observed number of failures, the Weibull analysis may not apply to the entire population (i.e., a batch problem). 7.4.1.2 If you have a batch problem, you may have the wrong data set and the first priority is to id entify the units in the batch. 7.4.1.3 Once the suspect population is id entified, the risk model is generally calibrated by adjusting the Weibull characteristic life or slope to match the experien ce to date. You should perform sensitivity studies to understand the impact this adjustment has on the risk analysis results.
7.4.2 If no failures have occurred, the m odel can be conserva tively calibrated to one failure. For example, if multiple parts have been found cracked, but not fractured, then calibrate the model to the number of cracks found and to one fracture.

7.4.3 Present Risk Calculation Methods. 7.4.3.1 The “Abernethy Risk – Quantity Expected” option in the WSW program can be used to calculat e the present risk number of failures. 7.4.3.2 The E&PDSS has developed a risk analysis spreadsheet that can be used to calculate present risk.

7.5 Estimate the Uncorrected Fleet Risk Factor and Uncorrected Individual Risk. 7.5.1 Use analytical techniques to estimate the uncorrected fleet risk factor— the expected number of events if no action is taken to address the condition. This step takes the e xposed population and estimates the number that are expected to experien ce the event. Fleet risk factors for9/23/10 rev. 0

13 other hazard levels are also calcula ted to allow for comparison to the risk guidelines in tables 1-2. Fleet risk factor s for higher-level events are obtained by multiplying the event risk factor by the applicable hazard ratio. (See appendix 4 for guidance on estimating the hazard ratio.) In AC 39-8, the uncorrected ri sk guideline is called the long-term risk guideline. 7.5.2 Failure rate data is often provide d in failures per flight hour (flighthour), even though the failure rate itse lf is not directly a function of flight-hours. Therefore, ensure th e event predictions take into account the frequency with which the actual st resses that cause failure will occur within the total exposu re period. For example, a component failure mode may be predominantly a function of the number of times electrical power is applied to it. If so, the average power applications per flight hour should be the same between the s ource of the failure rate data and the subject application of that data , or an appropriate correction should be applied.
7.5.3 For uncorrected fleet risk factor, a 20 -year fleet life per aircraft may be assumed or another reasonable estimate of the actual fleet life may be used. Additionally, the fleet risk fact or should be converted to risk per flight-hour to facilitate compari ng risks on a common exposure basis. This is normally done by dividing th e fleet risk factor by the total number of flight-hrs within the assumed exposure period. Compare the uncorrected individual risk to the uncorrected risk guidelines of the appropriate category listed in tables 1-2 to help establish the relative threat posed by the unsafe condition. 7.5.4 The uncorrected fleet risk calculations may take credit for mandatory actions already in place that reduce the risk of the unsafe condition. For example, the risk reduction of manda tory inspections already published in the Airworthiness Limitations Section (ALS) of the Instructions for Continued Airworthiness (ICA) may be included in the uncorrected risk calculations. This may require more complex calculations, such as a simulation, to quantitatively predic t the risk reduction of part inspections.

7.5.5 Uncorrected Risk Calculation Methods. 7.5.5.1 The “Abernethy Risk – Quantity Expected” option in the WSW program can be used to calculate the uncorrected risk (number of failures if no action is taken). 7.5.5.2 The E&PDSS developed risk analys is spreadsheet can be used to calculate the uncorrected risk. 7.5.5.3 Refer to appendix 5 of AC 39-8 for additional approaches to estimate the uncorrected risk factor.9/23/10 rev. 0

14 7.5.5.4 A simulation is necessary to quantify the risk when mandatory inspections are included in the unc orrected risk calculation. The E&PDSS can perform this calcul ation on behalf of the ACO. 7.6 Compare the Uncorrected Risks to Risk Guidelines. 7.6.1 If the probability of future level 3, 4, and 5 events per flight-hour are all below the uncorrected individual ri sk guidelines of the appropriate category listed in tables 1-2 of th is handbook, consider an SAIB or other optional corrective action. 7.6.2 If the probability of future level 3, 4, or 5 events per flight-hour is above the uncorrected individual risk gui delines of the appropriate category listed in tables 1-2 of this handbook, the condition is unsafe and corrective action must be taken. 7.7 Identify Options for Mitigating Action. 7.7.1 Responses to identified safety i ssues can vary from an immediate mitigating reaction to an extensivel y considered final response. The control programs for most unsafe conditions may incl ude initial, interim, and final actions. This handbook assi sts ASE’s with the evaluation of those actions and helps to verify th at the actions are appropriate and timely to mitigate the unsafe condition. 7.7.2 Some actions that have proven to be both practical and beneficial for immediate responses are inspections, placards, revisions or supplements to the Aircraft Flight Manual (AFM), staggering engines to obtain mixedlife engines on a given airplane (for infant-mortality problems) and preflight checks. These actions are appropriate for follow-on actions, along with repair or replacement of the suspect components.

7.8 Estimate the Effects of Candidate Actions.

7.8.1 Evaluate candidate actions considered after an unsafe condition has been identified with the appropriate ma nufacturer, designer, or operators. This is to consider thei r capacity to reduce the future risk to acceptable levels. See tables 1-2 for control program risk guidelines (In AC 39-8, the control program risk guideline is referred to as short-term acceptable risk). From a technical perspectiv e, several candidate actions may be available. The selected action(s) should consider issues such as confidence in the effectiveness of th e corrective action; availability of the resources necessary to support th e corrective action; and the ability of the operators to expediently a nd properly incorporate the corrective action.

7.9 Estimate Potential Risk Reduction . Once the candidate actions have been identified, estimate the fleet risk factor and risk per flight-hour for the proposed mitigation program. This process should be performed for all actions under consideration, thereby allowing the e ffects of different programs to be9/23/10 rev. 0

15 compared. The objective is to keep the risks to the affected fleet below the applicable guidelines until final action can be incorporated to bring the product back to the level of safety intended by the product's original basis of certification. If none of the candidate immediate corrective action programs can achieve the needed risk reductions, cons ider more aggressive action, including grounding. 7.9.1 Control Program Risk Calculation Methods. 7.9.1.1 The type of analysis required to quantitatively evaluate the risk reduction varies from problem to problem. In some cases, a closed form risk calculation is possible. In other cases, a simulation may be necessary to assess the risk of the control
program. 7.9.1.2The WSW “Abernethy Risk – Quantity Expected” option can be used to calculate the control pr ogram risk for simple control programs, such as removal of all parts by a specific cycles-sincenew (CSN) count or after a specific number of additional cyclesin-service (CIS). 7.9.1.3 The E&PDSS developed risk analys is spreadsheet can be used to calculate the control program ri sk. The spreadsheet provides additional options for control programs compared to WSW. 7.9.1.4 A simulation is necessary to quant ify the risk of certain control programs (e.g., when inspections or shop visit rate distributions are included in control program). Contact the E&PDSS to perform this calculation. 7.9.2 Note that the control program risk calculation is required to quantify the risk reduction of the corrective act ions being evaluated. It is not sufficient to state that the control program risk is below the control program risk guidelines .

7.10 Implement and Monitor the Impact of the Corrective Actions.

7.10.1 An airworthiness directive can be us ed to ensure all operators comply with the corrective actions de fined in the control program.
7.10.2 When feasible, track the rate of inco rporation of the corrective action(s) to verify that the action is being implemented in a timely manner. If the action includes inspection, analyze in spection results to help quantify incipient failures and aid assessment of the extent of the problem. Track service experience to ensure that th e rate of occurrence is being reduced; however, rate of occurrence may not be applicable in cases of rare events or small exposures. Serv ice experience and inspection results should also be evaluated against exp ectations developed as a result of any quantitative or qualitative analysis performed as part of the action.9/23/10 rev. 0

16 7.10.3 Note that no method exis ts to ensure complete re porting to all interested parties. The inclusion of reporting requirements within the body of the AD itself will ensure that the operators report inspection findings to the FAA or design approval holder—co nsider this for those unsafe conditions of high risk where the in spection findings are necessary to evaluate the adequacy of actions . Although manufacturers will not automatically receive these findings, unless required by an AD, they may receive responses to reporting requests within a manufacturer's service bulletin. For more general reporting (e.g., dete rmination of the effectiveness of a new repair pro cedure or whether new problems are being introduced due to the corrective action), the principal inspectors at affected airlines (for the FAA), or the manufacturer’s Field Service Representatives can provide direct in sights into the effects of mandated corrective actions.

7.11 Verify Corrective Actions Were Effective

. 7.11.1 Any experience that deviates signi ficantly from expectations or assumptions is grounds to revise th e assessment. Since an initial reaction may not be the complete response to the unsafe condition, a complete validation of the effectiveness of any initial corrective action may not be feasible prior to taking additional action. Continue to monitor field experience and inspection results to ensure that any interim action (i.e., inspection) continue s to validate assumptions and predictions, or to alleviate any cons equence of any extra conservatism built into an initial assessment. Final action (part modification or replacement) carries with it an assu mption that the causal factors have been effectively eliminated or mitigat ed with regard to their ability to result in an unsafe condition. Track field experience s to validate this assumption. Take care to ensure that any unforeseen adverse impacts of corrective actions are id entified and evaluated. 7.12 Follow-on Assessments and Responses. 7.12.1 In many circumstances, the initial ac tions taken in response to an unsafe condition may be insufficient to effectively mitigate the risk to acceptable levels. Therefore, follow-on responses and actions may be required. The risk assessment pr ocess described above should be applied to the decisions involved in th e use of actions, whether initial or follow-on. A more complete und erstanding of the problems and contributing factors to the unsafe condition at later points will most likely be available. Initial re sponses may be based upon limited or partial data, and later steps are usua lly based upon information that is more complete. 7.12.2 The FAA response to an unsafe condition should be based on a technical understanding of the problem and should require an appropriate implementation schedule that is cons istent with the risk assessment.9/23/10 rev. 0

17 When performing a follow-on assessme nt, the fact that exposure time has elapsed between the initial and follow-on assessments should not be used to justify unduly extending the duration of the control program. The exposure time for evaluating the risk for follow-on actions is the amount of time required to complete the entire correction program (i.e., any initial, interim and final actio ns). The objective throughout the entire correction program is to k eep the risks below the applicable guidelines until the product is brought back to the level of safety intended by the product’s or iginal basis of certif ication. Establish the schedule for follow-on actions such that these applicable guidelines will be met. 

## 8. RISK GUIDELINES.

8.1 General.

8.1.1 There are uncorrected and control program guidelines for fleet risk factor and individual ri sk. These guidelines he lp establish whether a condition is unsafe and if immediat e action is necessary. They also establish acceptable risk for contro l programs. There are guidelines for level 3, 4, and 5 events. Note that the level 3 guideline covers events predicted to be at least level 3 (i.e., levels 3, 4 and 5 events). The level 4 guideline covers events predicted to be at least level 4 (i.e., levels 4 and 5 events). This is necessary to assess the true risk exposure. 8.1.2 The per flight-hour guidelines appl y to the average of the fleet or subfleet suspected of having the unsafe condition. The fleet risk factor guidelines apply to the aggregate flee t or subfleet suspected of having the unsafe condition. 8.1.3 Control programs should be acceptabl e to all the applicable control program risk guidelines. For large fleet sizes, the fleet risk factor guideline will likely be the limiting valu e. For small fleets, it is likely that the risk per flight-hour guide line will be the limiting value. 8.1.4 These guidelines should not be regard ed as targets or typical values. The control program values shoul d usually be lower than these guidelines unless a lower value would result in extreme resource availability difficulties. Any reasonable action which reduces the risk should be included as part of the control program (keeping in mind the principles of prioritizat ion of resources). 8.2 Risk guidelines fo r Immediate Action.

8.2.1 If the uncorrected fleet risk factor for the affected fleet would exceed the applicable control program fleet risk factor with in 60 days, or the risk per flight-hour to which airplanes would be exposed during that same 60-day period would exceed the applicable hazard level guideline, consider immediate action. The immedi acy of this action may vary from9/23/10 rev. 0

18 before the next flight to within 60 days depending on the nature and level of risk. If a quantitative assess ment of the risk is unavailable, the decision as to the necessity of i mmediate action should be made based on objective judgment and expert opini on. This initial analysis is not meant to take the place of the comple te and in-depth analysis typically performed during the continuing asse ssment of the risk posed by the identified unsafe condition. It is m eant to give a best-estimate relative ranking compared to the overall cont ributions of all unsafe conditions, and to indicate whether conti nued operation without immediate corrective action is acceptable.

Table 1. Risk Guidelines for Engines, Propellers, and APUs installed on Small Airplanes (e.g., Part 23)

Fleet Risk Factor Individual Risk (Per flight-hr) Fleet Risk Factor Individual Risk (Per flight-hr) Fleet Risk Factor Individual Risk (Per flight-hr) Turbine engines, propellers, APUs installed on multi-turbine engine powered small airplanes
Uncorrected Risk Guideline

-- 1.E-07

-- 1.E-08

-- 1.E-09 Control Program Risk Guideline 1.0 4.E-04 1.0 4.E-05 0.1 4.E-06 Turbine engines, propellers installed on single turbine engine powered small airplanes(1) Uncorrected Risk Guideline

-- 5.E-07

-- 1.E-07

-- 1.E-08 Control Program Risk Guideline 6.0 8.E-04 3.0 4.E-04 0.3 4.E-05 Recip engines, propellers installed on multi-recip engine powered small airplanes Uncorrected Risk Guideline

-- 5.E-06

-- 1.E-06

-- 1.E-07 Control Program Risk Guideline 10.0 8.E-04 5.0 4.E-04 0.5 4.E-04 Recip engines, proepllers installed on single recip engine powered small airplanes (2) Uncorrected Risk Guideline

-- 5.E-05

-- 1.E-05

-- 1.E-06 Control Program Risk Guideline 14.0 8.E-04 7.0 4.E-04 0.7 4.E-04

(1) Excludes IFSD and Loss of Power Event. IFSD and Powerloss Event rate > 0.1/1000 hrs. should be investigated and corrective action implemented to maintain safe operation

(2) Excludes IFSD and Loss of Power Event. IFSD and Powerloss Event rate > 1/1000 hrs. should be investigated and corrective action implemented to maintain safe operation Category Level 3 Guidelines Level 4 Guidelines Level 5 Guidelines

Table 2. Risk Guidelines for Engines and APUs in stalled in Rotorcraft (e.g., Part 27, 29)

Fleet Risk Factor Individual Risk (Per flight-hr) Fleet Risk Factor Individual Risk (Per flight-hr) Fleet Risk Factor Individual Risk (Per flight-hr)Turboshaft engines, APUs installed on multiturbine engine powered Rotorcraft Uncorrected Risk Guideline

-- 1.E-07

-- 1.E-08

-- 1.E-09 Control Program Risk Guideline 1.0 4.E-04 1.0 4.E-05 0.1 4.E-06 Turboshaft engines installed on single engine powered Rotorcraft (1) Uncorrected Risk Guideline

-- 5.E-07

-- 1.E-07

-- 1.E-08 Control Program Risk Guideline 6.0 8.E-04 3.0 4.E-04 0.3 4.E-05 Recip Engines installed on Rotorcraft (2) Uncorrected Risk Guideline

-- 5.E-05

-- 1.E-05

-- 1.E-06 Control Program Risk Guideline 14.0 8.E-04 7.0 4.E-04 0.7 4.E-04

(1) Excludes IFSD and Loss of Power Event. IFSD and Powerloss Event rate > 0.1/1000 hrs. should be investigated and corrective action implemented to maintain safe operation

(2) Excludes IFSD and Loss of Power Event. IFSD and Powerloss Event rate > 1/1000 hrs. should be investigated and corrective action implemented to maintain safe operation Category Level 3 Guidelines Level 4 Guidelines Level 5 Guidelines9/23/10 rev. 0

19 

## 9. Prioritization Based on Risk
9.1 Figure 1 provides a useful means to graphically compare unsafe conditions based on risk calculations and the risk guide lines, helping to establish priorities. The descriptions of this section use the risk guidelines for turbine engines, and propellers installed on multi -turbine engine small ai rplanes (see Table 1), but the concepts apply to all the risk guide lines. Figure 1 uses the level 4 risk guidelines for turbine engine, propellers, and APUs installed in multi-engine small airplanes; a similar graph for ot her risk guidelines can be prepared.

9.2 High Risk . A level 4 event is a likely occurren ce when its risk plots in the area to the right of the sloped line in Figure 1 (i.e., greater than 1.0 predicted events, or fleet risk factor). Furthermore, th e malfunction is beginn ing to contribute more risk than the aggregate risk from all other causes, including contributions from the crew, when it plots in the area a bove the top horizontal line in Figure 1 (i.e., above 4E-5 per flight -hour). In these instan ces, immediate actions, as described in this handbook, may be necessary. Similar values can be established for level 5 events, an order of magnitude below the associated level 4 values; i.e., the high-risk area for level 5 events is greater than 0.1 predicted events, or above 4E-6 per flight-hour. These values equate to the control program acceptable risk guidelines.

9.3 Excessive Risk . Exposure within the enclosed envelope in Figure 1 (i.e., to the left of the sloped line an d above the bottom horizontal line) imposes sufficient risk to warrant concern and mandatory action.

9.4 Reasonable Risk . Risk factors of 1.0 level 4 events in 100 million aircraft flight-hrs (1E-8) meet the uncorrected i ndividual risk guideli nes. (This assumes no other aspects of the origin al basis of certification ha ve been violated.) The equivalent value for level 5 events is 1 in a billion flight-hrs (1E-9). Note that the uncorrected risk guideline for type certification may sometimes appear less restrictive. However, as noted earlie r, comparing certification and continued airworthiness assessments a nd guidelines can be confus ing and misleading. For example, the additional accuracy potentia lly afforded to continued airworthiness assessments over certification assessments must be compensated for within the guidelines.9/23/10 rev. 0

20 FIGURE 1. Aircraft Threat Comparison


## 10. Corrected Risk
10.1 The final goal in resolving an uns afe condition is the development and implementation of corrective actions th at, when fully incorporated, minimize the probability of future events to less than the uncorrect ed individual risk guidelines. Interim measur es, such as recurring insp ections, are often effective in providing immediate risk reduction to a high-risk problem. However, do not rely on recurring inspections to serve as a final corrective action unless there is no practicable alternative. If the inte rim measures minimize the probability of additional events to below the uncorrected individual risk guidelines, the incorporation of the final corrective actions can be delayed to minimize resource impact. The completion of a ll actions to correct the unsafe condition should be done as soon as feasible and in accordance with the risk guidelines and principles. The actions shall return the product to the level of safety intended by that product's original basis of certification, unless an exemption from that basis is found to be in the public interest. 1.0E-10 1.0E-09 1.0E-08 1.0E-07 1.0E-06 1.0E-05 1.0E-04 1.0E-031.0E+031.0E+041.0E+051.0E+061.0E+071.0E+081.0E+09

Number of Aircraft Flights (exposure)Level 4 Occurrence Rate (events per flight hr.)

Reasonable Risk High Risk

Excessive Risk9/23/10 rev. 0

21 

## 11. Cumulative Risk

11.1 If there are several unsafe conditions be ing resolved concur rently on the same powerplant installation, the combined ri sk of those various conditions may represent an unacceptable risk level for th at airplane type, even if each taken individually does not. Furthermore, repe ated exposure to risk levels acceptable against any single unsafe condition could be reasonably expected to result in an unacceptable risk of serious injury somewh ere in the life of the worldwide fleet with its various unsafe conditions. Th e Poisson distribution explains the statistical variation associated with aver age prediction for rare events (see figure 2 below). A 0.1 fleet risk factor guidelin e equates to a 9.5 per cent probability of one or more events. If, during the lif e of a fleet, there are seven different malfunctions which are each managed to a risk factor of 0.1 events (i.e., cumulative forecast of 0.7 events), then it is likely that a event will occur at some point due to one of these malfunctions. Additionally, for an event forecast of 0.7, there is a 16 percent probability of two or more events and a three percent probability of three or more events.

0 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9

1

0 0.1 0.2 0.3 0.4 0.5 0.6 0.7 0.8 0.9 1 Expected Number of Failures (Event Forecast) Zero Events

One or More Events

T wo or More Events T hree or More Events

FIGURE 2 . Event Probability vs. Event Forecast (Fleet Risk Factor)

11.2 It is neither expected nor required to calculate cumula tive risk nor track cumulative risk across the life of the fleet. The intent of this section is to recognize that acceptable risk levels should be regarded as upper limits, to be allowed only when reducing the risk furt her would result in undue burden. The goal of risk analysis is not to find th e most lenient program possible within9/23/10 rev. 0

22 acceptable risk levels. Si nce no guidelines have been developed on cumulative risk, the guidelines published in th is handbook apply to individual unsafe conditions being addressed by a contro l program (although the individual unsafe condition may apply to several products). 

## 12. Alternative Methods of Compliance (AMOC)
12.1 The objective of an AMOC is to allo w an operator or manufacturer to propose an alternative corrective acti on to that prescribed in an AD. The intent of the AMOC is to enable approval of options that were not necessarily conceived of at the time of AD issuance, but which provi de an equivalent level of safety to that afforded by the AD. The risk assessment process described in this handbook can be used to help determin e if a proposed AMOC affords an equivalent level of safety. AMOCs should not result in an increase of the total risk assessed against the unsafe condition.


## 13. Inter-Directorate Coordination
13.1 Different risk management objectives may lead to differences of opinions between directorates as to the appropriat e actions to address identified unsafe conditions, or to the timing of those ac tions. Because of the inter-involvement of both directorates with most unsafe c onditions, especially th ose that are highly installation-dependent, we recommend cl ose coordination to resolve these differences. However, if differences pe rsist after inter-directorate coordination and discussion of the assumptions, ava ilable data and objectives, the final control program decisions rest with th e directorate with the most relevant specialized technical expertise. This means that the E&PD is responsible for making the final control program deci sions for unsafe conditions caused primarily by shortcomings within the engine type design. When significant installation-dependency of an engine-related unsafe condition exists , the E&PD should address any installation concerns raised by the cognizant airplane or rotorcraft directorate. For unsafe co nditions caused primarily by shortcomings in the airplane type desi gn, exclusive of the engine type design, the cognizant airplane or rotorcraft di rectorate is responsible fo r making the final control program decisions. The primary resp onsibility must be respected by both directorates. Direct orates should avoid a writi ng competing ADs against the same unsafe condition.9/23/10 rev. 0

23 APPENDIX 1. POTENTIAL UNSAFE CONDITIONS

1. Purpose . This appendix provides the user with an overview of potentially unsafe conditions. Issuance of an AD, in accordan ce with Part 39, requires that an unsafe condition exist in a product and the condition is likely to exist or develop in other products of the same type design. This append ix presents material that can be used in reviewing actual or potential problems to determ ine if they should be identified as unsafe conditions. Unsafe conditions may result from design, manufacturing, operational or maintenance deficiencies as well as unfore seen changes in opera tions or the operating environment.

2. Identification of Potential Unsafe Conditions

2.1 At least three areas of information can be used as a guide in identifying potential unsafe conditions. The first, and most visible, includes conditions which alone or in combination with ot her contributing factors have led to accidents. Such conditions or combinations have clearly been demonstrated to be unsafe. The second includes conditions that have significantly increased the probability of, but not directly caused, se rious injuries. If such “contributing conditions” occur frequently enough, th is too is an unsafe condition. The majority of ADs are intended to correct this type of unsafe condition. The third area of information involves hazards id entified as part of the product’s certification program. 2.2 Given the size and complexity of today’ s worldwide air transportation system, it would be unusual for an identified unsafe condition to be limited to a single airplane or engine. Examples of singul ar events where AD action would not be expected are those caused by gross ne gligence or a rare meteorological phenomenon. 2.3 Conditions specified as potentially unsafe. The FAA has defined certain specific conditions as potentially unsafe based upon previous service experience and relevant certification assessments:

2.3.1 Potential unsafe conditions identifi ed during certification assessments. Certification assessments often identify and classify failure and operating conditions according to the se verity of the impacts they are expected to have on the continued op erational safety of the airplane. Very severe conditions ar e assigned to categories such as “catastrophic,” “preventing continued safe flight an d landing,” or “critical” because of their potential to directly cause se rious injuries to multiple persons. Severe conditions are assigned to cat egories such as “emergency” or “hazardous” because of their potential to either directly cause serious injuries to a limited number of person s or to impair the ability of the flightcrew to perform their tasks. Therefore, the occurrence of any of these conditions in service is by definition a potentia lly unsafe condition regardless of the actual outcome. More moderate conditions are9/23/10 rev. 0

24 assigned to categories such as “abno rmal” or “major.” The occurrence of any moderate conditions in se rvice at a high frequency may be considered a potentially unsafe condi tion if a reasonabl e potential exists for it to contribute to a more serious event. 2.3.2 Historical potentially unsafe c onditions. Appendix 6 of this handbook lists conditions considered to be potentially unsafe for engines and propellers installed in multi-turbine engine-powered small airplanes.9/23/10 rev. 0

25 APPENDIX 2

EVENT HAZARD LEVELS AND DEFINI TIONS FOR ENGINE, PROPELLER, AND APUs INSTALLED IN SMALL AIRPLANES

1. Purpose 1.1 This appendix outlines the defini tions of propulsion system and APU malfunctions or related incidents, in cer tain cases coupled with crew error or other aircraft system malfunctions, resu lting in the following consequences to the aircraft or its passengers/crew. 1.2 It is important to emphasize that a ll event classification is based on what actually occurred rather than what might have occurred. Do not inflate the hazard level for an event in the name of c onservatism; this is likely to lead to confusion and dissension and a reduction in the ability to differentiate between the risks posed by different unsafe conditions.

2. Hazard Levels

2.1 Level 5. An occurrence resulting in fatalities, usually with the loss of the airplane.

2.2 Level 4. 2.2.1 Forced landing of a multi-engine in stallation. Forced landing of a multiturbine engine installation is defined as the inability to continue flight where imminent landing is obvious, but aircraft controllability is not necessarily lost (e.g., total power loss due to fuel exhaustion will result in a "forced landing”). An air tu rn back or diversion due to a malfunction is not a forced landing, sin ce there is a lack of urgency and the crew has the ability to select where they will perform the landing. 1 However, off-airport landings are almost always forced landings. 2.2.2 Actual loss (hull loss) of aircra ft (as opposed to economic) while occupants were on board. 2.2.3 Serious injuries including life threatening injuries.

2.3 Level 3. 2.3.1 Substantial damage to the airc raft or second unrelated system. 2.3.1.1 "Substantial damage" in this cont ext means damage or structural failure that adversely affects the limit loads capability of a primary structural element, the performance or flight characteristics of the aircraft, and that would normally require major repair or replacement of the affected components.

1 Where it is unclear whether the landing was forced, it may be helpful to consider whether the pilot had any alternative to landing at the closest airport .9/23/10 rev. 0

26 (Typically not considered “substantial damage” are engine failure damage limited to the e ngine or mount system, bent fairings or cowlings, dented sk in, small puncture holes in the skin or fabric, or damage to land ing gear associated with runway departures, wheel, tires, flaps, engine accessories on the failed engine, brakes or wing tips). 2.3.1.2 Damage to a second unrelated syst em must impact the ability to continue safe flight and landi ng. Coordination and agreement between the engine/propelle r/APU manufacturer and the airframe manufacturer may be required to properly categorize events related to second system damage. 2.3.1.3 Small penetrations of aircraft fu el lines or aircraft fuel tanks, where the combined penetration areas exceed two square inches. The concern is exhaustion of fuel reserves. Assistance of the airframe manufacturer should be sought when questions arise. 2.3.1.4 Damage to a second engine (cross-engine debris) which results in a significant loss of thrust or an operational problem requiring pilot action to reduce power. Minor damage which was not observed by the crew during flight and which did not affect the ability of the engine to continue safe operation for the rest of the flight is excluded, being cons idered a level 2 event.

2.3.2 Uncontrolled fires – which escape the fire zone and impinge flames onto the wing or fuselage, or act as ignition sources for flammable material anticipated to be present outside the fire zone

. 2.3.3 Rapid depressurization of the cabin. 2.3.4 Permanent loss of thrust or power greater than one propulsion system. 2.3.5 Temporary or permanent inability to climb and fly 1000 feet above terrain (increased threat from terrain, inclement weather, etc.) along the intended route that results in re stricted capability (i.e., multiple propulsion system malfunctions or single propulsion system malfunctions). 2.3.6 Any temporary or permanent impair ment of aircraft controllability caused by propulsion system malfuncti on, thrust reverser in-flight deployment, propeller control ma lfunction, or propulsion system malfunction coupled with aircraft co ntrol system malfunction, abnormal aircraft vibration, or crew error.

2.3.7 Malfunctions or failures that result in smoke or other fumes on the flight deck that result in a serious impa irment. Serious impairment includes the loss of crew’s ability to see flig ht deck instrumentation or perform expected flight duties. Purely ps ychological aspects of the concern of9/23/10 rev. 0

27 odors, etc., are not to be included; nor are concerns about long-term
exposure.
3. General Notes Applicable to All Event Hazard Levels.

3.1 The severity of aircraft damage is based on the consequences and damage that actually occurred.

3.2 Injuries resulting from an emergency evacuation rather than from the event that caused the evacuation are not c onsidered in evaluating the severity of the event. It is recognized that emergency evacuations by means of the slides can result in injuries, w ithout regard to the kind of event precipitating the evacuation.9/23/10 rev. 0

28 APPENDIX 3

EVENT HAZARD LEVELS AND DEFINITIONS FOR ENGINE AND APUs INSTALLED IN ROTORCRAFT

1. Level 5.

1.1 Fatal accident

2. Level 4. 2.1 Serious injuries 2.2 Rotorcraft destroyed

3. Level 3. 3.1 Substantial damage to rotorcraft.

4



### . General Notes Applicable to All Event Hazard Levels. 3.1 NTSB definitions for serious injuries, destroyed, and substantial damage are used. 3.2 Injuries resulting from an emergency evacuation rather than from the event that caused the evacuation are not considered in evaluating the severity of the event. It is recognized that emergency evacuati ons by means of the slides can result in injuries, without regard to the kind of event precipitati ng the evacuation.9/23/10 rev. 0

29 APPENDIX 4

HAZARD RATIO DEVELOPMENT

1. Purpose. This appendix describes methodologies to estimate the hazard ratio for use in risk assessments.

2. General.

2.1 The hazard ratio converts the basic event fl eet risk factor to a fleet risk factor for a specific hazard level (e.g., Level 4 ev ent). It does this by estimating the conditional probability of a specific hazar d level event given the occurrence of the basic event. Developing a hazard ra tio will require considerable engineering judgment. The hazard ratio strongly influences the quantitative assessment results and, therefore, should have a suffi cient validation basis or be assessed conservatively. Hazard ratios are used fo r hazard levels 3, 4 and/or 5, as is appropriate, to establish the appropriate comparison of the risk of the unsafe condition to the risk guidelines shown in tables 1 and 2 in the body of this handbook. 2.2 ASEs should use hazard ratios appropri ate for their airworthiness concern. The ASE should determine the hazard ratios from service history if adequate service history is available on the specific or similar engine make/model and installation (single or multi-engine inst allation). Collaboration with the TC holder, subject matter experts, incl uding the installing product ACO or directorate, is critical to developing appropriate h azard ratios. As a process check, ASEs should compare calculated hazard ratios agains t the hazard ratios provided in the folder titled, “MSAD – Risk Analysis Supporting Data” on the ANE-110 COS SharePoint site. Consider the SharePoint site haza rd ratio data as a general guide not a replacement for more specific guidance and assessments for a particular aircraft type, e nvironment, or operating condition. 2.2.1 Under-reporting of Failures and De fects. Service difficulty reporting (SDR) is not mandatory for the type s of operations typical of small airplanes and rotorcraft. We e xpect significant u nder-reporting of failures and defects in most situatio ns. This under-reporting may have a direct impact on the hazard ratios—w e expect that most Level 3, Level 4 and Level 5 outcomes will be reported, however, outcomes below Level 3 may be under-reported. ASEs shoul d use experience and engineering judgment to make adjustments to account for under-reporting. 2.3 When insufficient service history is ava ilable, ASEs should use the hazard ratios provided in the ANE-110 SharePoint site . These hazard ratios may not cover every defect or failure an ASE will encounter. In this situation, the ASE should use the best available information to es timate the hazard ratios. When working with the SharePoint site hazard rati os, the ASE must understand whether the hazard ratio is from the base event or fr om an accident. If the hazard ratio is9/23/10 rev. 0

30 based on the assumption that an accident has occurred, the ASE must adjust the hazard ratio to account for the ratio of base events that lead to accidents. The TC holder may be able to provide data to support the hazard ratio adjustment.

3. Hazard Ratio Development. 3.1 The following methods should be employe d to establish the hazard ratio for a given hazard level (X):

3.1.1 At least one level X or hi gher event has occurred. 3.1.1.1 Data. Use the value obtained by dividing the number of level X or higher events by the to tal number of events. 3.1.1.2 Analysis. If analysis suggests the true hazard ratio, that ratio may be used. For example, for a particular airplane, a propeller blade will pass through the fuselage if it is released within a 90° arc. The hazard ratio (assuming level 4 for serious injury to passengers seated in the plane of the propeller) would then be 90°/360°=0.25 level 4 events given a blade release. This method has particular value where little data exists. Note that when the hazard ratio obtained by analysis di ffers significantly from what would be calculated from the obs erved data, we strongly suggest using observed data to esta blish the hazard ratio. 3.1.2 No level X or higher events have occurred. 3.1.2.1 Next event assumption. When no industry-wide data are available or suitable, a cons ervative hazard ratio may be established by assuming the next event would be level X or higher (e.g., 0:4 becomes 1:5). There may be cases where this method is overly conservative. 3.1.2.2 Analysis. Engineering analysis may allow for accurate estimation of the hazard ratio.

4. Notes on Hazard Ratio Development. 4.1 Communication between the engine/pr opeller/APU manufacturer, installer, operators and the FAA is often necessary, especially if no appr opriate historical hazard ratio is available. Additionally, it may be necessary to use engineering judgment to assess the impact of unique features of a specific powerplant or APU installation. 4.1.1 Hazard ratios for use in engine inst allations in rotorcraft have been developed. NTSB accident data reviewed covered the 10 year time period of October 1996 – September 2005.

5. Use of the Hazard Ratio. Use of the hazard ratio allo ws the conversion of the base level event to an event of a specific hazard level. For example, if, using the methods outlined above, the level 4 hazard ratio is estima ted at 2/6 (.33), the fleet risk factor for9/23/10 rev. 0

31 the base event can be converted to a fleet ri sk factor for level 4 events by multiplying the base event fleet risk factor by the hazard ratio.9/23/10 rev. 0

32 APPENDIX 5

ASSESSMENT EXAMPLES

1. Purpose

. 1.1 This appendix provides step-by-step ex amples of the risk assessment process detailed in this handbook, taking the read er through several typical fictitious service problem scenarios from identification to resolution. 1.2 The examples shown below are from AC 39-8 appendix 7. Accordingly, CAAM hazard ratios and CAAM risk guide lines are used in the examples. The general methodology for risk assessment is the same for all E&PD products, regardless of the installati on. For engines, propellers , or APUs installed in small airplanes and rotorcraft, use powerplant or APU hazard ratios and risk guidelines specific to category of airpla ne/rotorcraft installation instead of transport airplane installation hazard ratios/risk guidelines

. 1.3 Additional examples are available in th e folder titled “Risk Analysis Training” on the ANE-110 SharePoint site ( https://avssharepoint.faa.gov/ai r/EPD/ANE110/COS/default.aspx )

. 2. Example 1: Compressor Disk Fracture. 2.1 An 8th stage compressor disk installed in a low-bypass turbofan engine fractures during takeoff roll. The fracture occurs prior to V1, and the takeoff is safely aborted. The fractured disk has 12,508 cycles part life. The fracture is uncontained, but does not cause any damage to the aircraft, or injury to any passenger or crew. Control is maintained at all times, and th e aircraft stops on the runway. Failure investig ation reveals the disk fract ured in low-cycle fatigue due to corrosion. The investigation fu rther indicates the corrosion occurred because the failed part had not been pr operly coated during manufacture. The problem is identified and corrected in production; however, the risk posed by other improperly-coated parts in service must be assessed. 2.2 Estimate the number of aircraft exposed. Initial evaluation of the extent of the problem detects no known manufacturing process changes that might have accounted for the coating problem. However, this part number disk is processed at a dedicated coating facility (i.e., th e facility produces onl y this part), and while all disks of this part number are potentially at risk, the problem is not considered to extend to other part numb ers (no evidence of any problems with the parts produced by other facilities). Four hundred and thirty-three (433) disks (including spares) of the suspect pa rt number are currently in service and are considered to be at risk of a repeat event. 2.3 The engine manufacturer immediately performs a Weibull analysis using a typical fatigue wearout slope against th e population of current disks. This analysis gives a material property life di stribution to input into a Monte Carlo simulation. The simulation runs a computer model of the fleet forward in time.9/23/10 rev. 0

33 This model predicts 1.3 additional disk fr actures if all current parts are allowed to remain in service unt il their certified retireme nt life (15,000 cycles). Calibration of this risk model (by backing up the simulation to the start of service and running the fleet model to the present) gives a prediction of 0.95 events to date (versus 1 occurred), whic h is judged to be indicative of a valid model. 2.4 Estimate the uncorrected risk and risk per flight. While this event did not result in serious injury or other CAAM level 4 or 5 event, historical data available at the time on similar disk fractures over the previous 15 years (see the CAAM report referenced in AC 39-8 paragra ph 2b(1)) indicate a record of sevenCAAM level 3 and 4 events out of a total of 10 uncontainments due to lowbypass ratio turbofan high-pressure compre ssor fractures. Four of those events (40 percent) resulted in hull loss or fatality (CAAM level 4) due to on-ground fire; one (10 percent) was also CAAM level 5 (hull loss/multiple fatalities). Structural review by the e ngine manufacturer predicts that fracture of this 8th stage disk would be expected to result in uncontainment 100 percent of the time. Coordination with the aircraft ma nufacturer, validated by the Transport Airplane Directorate, indicates that, for this installation (wing-mounted engine), 50 percent of the uncontainments would be at least CAAM level 3, and 80 percent of the level 3 events would be hull loss/injury events (level 4). The assumption is made that 40 percent of the events (0.50 level 3 x 0.80 level 4 given level 3 = 0.40) would be expected to result in serious injury or other CAAM level 4 event. 10 percent of a ll events are assumed to be level 5 (0.40 level 4 x 0.25 level 5 given level 4 = 0.10) . Since 1.3 events are predicted, and 40 percent of those would be expected to result in a CAAM level 4 event, 0.52 level 4 events would be expected if no action is taken (1.3 x 0.40 = 0.52), and 0.13 level 5 events. There are two at-risk engines per aircraft, and the 433 disks have an average of 5000 cycles remaini ng until retirement. Therefore, the average per-flight risk of a CAAM level 4 (or higher) event if no action is taken is 4.8E-7 [0.52 / (433 disks x 5000 cycles/dis k / 2 cycles/flight) = 4.8E-7]. Note that the spare disks are included in the analysis. While these level 4 risks are clearly in the region where ac tion must be taken, the per- flight risk is below the guideline for immediate action (4E-6 per-f light for CAAM level 4 events), so the disks are allowed to remain in serv ice while an inspection and replacement plan is developed. CAAM level 3 events are also calculated: there are 0.65 level 3 (or higher) events predicted (1.3 events x 0.50 at leas t level 3 = 0.65), with a per-flight risk of 6.0E-7 [0.65 / (433 disks x 5000 cycles/disk / 2 cycles/flight) = 6.0E-7].

2.5 Estimate effects of candidate actions. Ov er the next few weeks, while a plan is being developed, a number of retired disk s are located and inspected, along with several disks in engines curre ntly undergoing scheduled shop visits. One disk is found to have a crack resulting from a co rrosion pit. These inspection findings, along with structural modeling by the e ngine manufacturer, allow for a more refined quantitative analysis, including in itiation and propagati on distributions.9/23/10 rev. 0

34 The Monte Carlo simulation is revise d and performed against a number of inspection and replacement scenarios to find one that acceptably mitigates the risk of serious injury. The engine ma nufacturer submits a plan to the E&PD which calls for replacement of the disks at next shop visit, with engines above 10,000 cycles part life to be removed no la ter than within th e next 2,000 cycles. The simulation predicts that this plan would result in 0.18 uncontainments, of which 0.09 would be at least level 3 (0.50 level 3 x 0.18 = 0.09), 0.07 would be level 4 (0.40 level 4 x 0.18 events = 0.07) , and .02 would be level 5 (0.10 level 5 x 0.18 events = 0.02). Both the level 3 and level 4 predictions are below the risk guidelines (see table 1, paragraph 9 in AC 39-8); the level 5 risk is well controlled within the level 4 exposure. This plan calls for an aggressive production schedule of replacement disks. Shop visit capacity will also be strained but is expected to be capab le of meeting the increase in inducted engines with only minor schedule disrupti ons. The engine manufacturer issues a Service Bulletin recommending disk replacement to the above schedule. 2.6 Implement and monitor corrective act ion plan. The E&PD reviews the assumptions and results of the risk an alysis. Though the E&PD would like to further reduce the risk of this event, it agrees that a more aggressive schedule would result in significant service disr uptions. The E&PD issues an NPRM, followed by an AD, to mandate the engi ne manufacturer’s Service Bulletin. Disks are inspected as they are replaced, with the results compared at regular intervals to the month-by-month predicte d crack findings from the Monte Carlo simulation. Subsequent inspection findings indicate the initial risk analysis is somewhat conservative. However, both the engine manufacturer and the E&PD believe that no alleviation of the disk replacement schedule should be pursued due to the potential seriousness of anothe r event. After nine months, the E&PD also requests a comparison of the actual shop visit (disk replacement) rate with the predictions from the risk analysis. The actual is found to be within two percent of the predicted, so no additiona l action is taken. After four and onehalf years, the last of the suspect disks is replaced. No additional events have occurred during that period.

3. Example 2: Boost Pump Wiring Chafing. 3.1 Inspection of a fuel leak problem on a tr ansport aircraft revealed that the leak was the result of a conduit bur n through caused by an el ectrical arc between the conduit and a boost pump wire inside the conduit that had chafed completely through the insulation. The penetrated conduit lies within th e fuel tank, thus raising a concern about a possible fuel ta nk ignition. A differe nt airplane type had experienced an unexplained catastr ophic fuel tank ignition eight years earlier. 3.2 Estimate the number of aircraft exposed. The boost pump wiring on this airplane type is common to all models. The worldwide fleet includes about 3000 airplanes with two engine models a nd a variety of derivatives. Since the vibration characteristics for the different engine types which might affect9/23/10 rev. 0

35 chafing is not known, it must be assumed th at all airplanes in the fleet could be affected. The analyst has a total of three inspection records. Two of the inspections had been performed prio r to the one that indicated conduit penetration. A Weibull analysis of the data indicates a strong wearout mode (i.e., the likelihood of chafing increases with the age of th e wiring). The Weibull analysis predicts 0.92 burned-th rough conduits should have occurred to date, which calibrates with the actual expe rience. The analysis as applied to the fleet indicates that airplanes with more than 30,000 hours contribute significantly to the overall risk of a bare wire event. Although only one airplane has been found with a burned-through condu it, the analysis indicates that there may be 76 airplanes still flying with unde tected exposed wires. The analyst concludes that the entire fleet should be included in the actions to control the situation.

3.3 Since there is no life limit on the fuel tank wiring, the statistical analysis described in (a) predicts that 76 bare wire events are already latent in the fleet and many more will occur in the remaini ng life of the fleet. Information gained in investigation of a similar situation in a different airplane type shows that the wing tanks on the airplane type wher e the bare wire was found are in a flammable condition for three percent of each flight. The center tanks are flammable for 30 percent of each flight.

3.4 Estimate the uncorrected risk factor and risk per flight. There is no known experience of a bare wire event causing an ignition event; therefore, the analyst must estimate the hazard ratio—the cond itional probability of an ignition event given that a bare wire event has occu rred. This is conservatively accomplished by assuming that an ignition event in one of the predicted 76 airplanes flying with bare wires is imminent. The hazar d ratio, which can also be expressed as the conditional probability (CP) of an i gnition event, is estimated by using the model developed by the analysis to co mpute how long each airplane predicted to have a bare wire has been flying after the event occurred. The analyst determines that the total after-event flight hours accumulated by the 76 airplanes predicted by the model to have bare wires is 624,217 hours. Thus, CP is estimated to be 1/624,217  1.6E-6. This is a conservative approach, but the only objective estimate of CP available to the analyst. The only actual fuel tank ignition event on this airplane type resu lted in a level 5 event. Although the airplane was on the ground at the time of the ignition, a number of passengers were killed and the airplane was dest royed. No cause for the accident was recorded. Therefore, the analyst concl udes that any ignition source in a fuel tank will have level 5 potential. From this information, the risk can be now be calculated for any length of time, incl uding the next 60 days to determine if immediate action is warranted. (The gui deline for immediate action, as defined in paragraph 9g of the main body, applies to a 60-day period.) This airplane accumulates, on average, 341 hours in a 60-day period. The Weibull analysis estimates that 6 additional bare wires will develop over the next 60 days.

76 latent bare wires in the fleet plus 6 more in 341 fleet hours = 829/23/10 rev. 0

36 1.6E-6 per-hour probability of ignition event given bare wire 341 hours operation

= 82 x 1.6E-6 x 341 = 0.045 level 5 events in the next 60 days of US fleet-wide operation.

The risk does not exceed the short- term acceptable level 4 risk guideline (remember, level 5 risk must at least meet level 4 guidelines) within the next 60 days. However, since the event in qu estion has a high injury forecast, the analyst concludes that immediate m itigating action is necessary.

3.5 Estimate effects of candidate actions . The analyst uses the information generated above to establish an inspection and repair plan that will meet the risk guidelines. The analyst determines that if all airplanes ol der than 65,000 flight hours (126 airplanes) are inspected and repa ired within 20 days, the risk factor is decreased more than 40 percent. A dditional inspections are also proposed: Airplanes with 55,000 but <65,000 flight hours (152 airplanes) should be inspected within 45 days. Airpla nes with 45,000 but <55,000 flights (116 airplanes) should be inspected with in 90 days. Airplanes with 38,000 but <45,000 flights (154 airplanes) should be inspected within 180 days. Airplanes with 30,000 but <38,000 flights (283 airplane s) should be inspected within one year. Airplanes with 1 but <30,000 flight s (2062 airplanes) sh ould be inspected by the time the airplane reaches 30,000 f lights. There are 0.09 level 5 events expected in the fleet within the full inspection period. Because this is a conservative analysis (no events to date, but one assumed, among other conservatism), this prediction is judged to be acceptable for a level 5 risk
exposure. 3.6 Implement and monitor corrective action plan. A telegraphic AD is issued to implement the proposed inspection plan. An updated analysis made from the information obtained from the inspections indicates that the safety objectives will not be met without adjustments to the inspection schedule. The original AD is amended to show the following: All airplanes older than 65,000 flight hours to be inspected and repaired w ithin 20 days. Airplanes with 55,000 but <65,000 flight hours should be inspected within 40 days. Airplanes with 45,000 but <55,000 flights should be inspected w ithin 60 days. Airplanes with 38,000 but <45,000 flights should be inspected w ithin 90 days. Airplanes with 25,000 but <38,000 flights should be inspected w ithin 180 days. Airplanes with 1 but <25,000 flights should be inspected by th e time the airplane reaches 25,000 flights. This new inspection schedule br ings the safety objective back to the original expectation of 0.09 level 5 events within the inspection period.

3.7 The corrective action taken to eliminat e the wearout problem consists of a Teflon sleeve over the original wire bundl e. Since there has been no time to prove that the corrective action will be e ffective in the long term, the fleet will require inspections to ensure that the safety objectives are maintained in the future. Therefore, the AD is further amended to require that the conduits and9/23/10 rev. 0

37 wiring be inspected at 3 0,000 flights since new or last replacement of the wiring.9/23/10 rev. 0

38 APPENDIX 6

HISTORICALLY POTENTIALLY UN SAFE CONDITIONS FOR TURBINE ENGINES, PROPELLERS, AND APUs INSTALLED IN SMALL AIRPLANES

1. Purpose. 1.1 This appendix outlines the major propul sion system malfunction definitions as developed by the Aerospace Industries Association (AIA) Committee on Continued Airworthiness Assessment Methodologies (CAAM), PC342. These definitions were developed for transport airplane propulsion systems. However, these definitions also apply to turbine engines, propellers, and APUs installed on small airplanes. This appendix is inte nded to provide examples not to be an inclusive or prescriptive checklist; it may not include all the information relevant to the failure conditions of a sp ecific airplane with its various functions and its intended use.

2. Single Propulsion System Event. 2.1 Uncontained. A significant safety ev ent that initiates from an uncontained release of debris from a rotating co mponent malfunction (e.g., blade, disk, spacer, impeller, or drum/spool). To be categorized as uncontained, the debris must pass completely through the nacelle envelope. Parts that puncture the nacelle skin but do not escape or pass completely through are considered contained. Fragments that pass out of the inlet or exhaust opening without passing through any structure are not judged to be "unc ontained.” Starter and gearbox uncontainments are excluded. 2.2 Engine overspeed. Engine acceleration to a rotor speed above that sanctioned in the type certificate datasheet. 2.3 Case rupture. A significant safety even t that initiates from a sudden rupture of a high-pressure vessel or case with the re sultant release of high-pressure gases into the under-cowl cavity. Case ruptures resulting from uncontained release of debris from a rotating component malf unction are excluded. Case ruptures include those events that propagate from fatigue-type cracks as well as ruptures related to secondary malf unctions (e.g., flame impingement). See paragraph 2.4 below. 2.4 Case burnthrough. Case burnthrough is defi ned as a local case penetration that initiates from local overtemperature of the case external wall due to an internal engine malfunction (e.g., fuel nozzle l eakage, internal bearing compartment fires, titanium fires). Burnthroughs are distinguishe d from ruptures by their lack of an explosive rel ease of high-pressure gas. A common cause of case burnthrough is localized penetration due to fuel nozzle malfunction. Events involving accessory component cases also contribute to this category; for example, sump fires that propagate in ternally and result in burnthrough of piping or that initiate gear box fires. The key aspect, whether in the primary gas9/23/10 rev. 0

39 path or accessories, is that fire init iates from an internal malfunction and proceeds to burn through a case, tube or gearbox to reach external regions. 2.5 Under-cowl fire. A safety-significan t propulsion system fire-related event involving combustion external to the engine casings. Under-cowl fires are those that occur within the nacelle and on the e ngine side of the strut or installation fire barrier/wall. Internal pylon fires, including even ts where fuel leaks from the pylon and initiates a fi re under the cowl, are excluded. Under-cowl may be within fire zones or flammable fluid z ones. Tailpipe fires, and hot air leaks resulting in fire warnings, without co mbustion, are excluded from the definition and documented separately. Fires that rema in internal to the engine casing are excluded.
2.6 Flammable fluid leak. Leak of fuel, o il or hydraulic fluid into the pylon or dry bay, or under the engine cowls, which c ould credibly lead to a fire. Leaks collected from shrouds and components and drained directly overboard by a dedicated drain are excluded due to the l ack of fire safety concern. Drips and seeps are also excluded. In-tank leakage is excluded. 2.7 Compartment overheat/air leak. High-pre ssure or temperatur e air leaks due to casing or high-pressure/temperature ai r duct system malfunctions within the nacelle or in the pylon. 2.8 Engine separation. Separation of the e ngine, with or without the strut/pylon. Events resulting from gr ound contact are excluded. 2.9 Cowl separation. Separation of nacelle components, such as inlets, cowls, thrust reversers, exhaust nozzles, or ta il plugs. Separation of relatively small sections of skin, blow-out panels or other small pieces that are unlikely to hazard continued safe flight and landi ng are excluded. Events resulting from ground contact are excluded. 2.10 Propulsion system malfunction and inappr opriate crew response (PSM+ICR). A significant safety event initia ting from a single propulsion system malfunction (excluding propeller system), which, by itself, does not hazard the aircraft, but is compounded by inappropria te crew response (i.e., crew did not execute checklist/normal flying duties). A typical example of PSM+ICR is an IFSD followed by inappropriate crew respons e that caused the aircraft to crash. Not counted are cases of gr oss error negligence (such as deciding to take off with an engine known to be inoperative ). See the AIA/AECMA Project Report on PSM+ICR (November, 1998) for additional examples. 2.11 Crew error. A significant safety event caused by a propulsion system malfunction or improper operation that was caused by an inappropriate crew action, excluding sabotage, gross neglig ence and suicide. Not counted are events where inappropriate crew acti on causes a propulsion system malfunction through very indirect means such as flying the airplane into the ground or running the airplane into equipment on the taxiway/runway.9/23/10 rev. 0

40 2.12 Reverser/beta malfunction – in-flight deploy. A significant safety event wherein a thrust reverser deploys in-flight, or a propeller enters beta mode inflight (exclusive of design intent).

2.13 Reverser/beta malfunction – failure to deploy. A significant safety event resulting from the failure of a thrust re verser to deploy or a propeller to enter beta mode when commanded. 2.14 Tailpipe fire. Fire within the tailpipe, where visibl e sustained flames exit the tailpipe. Engine surge/stall and hot starts resulting in a “glow” are excluded, as are events resulting from deicing fluid ingestion. 2.15 False/misleading indication. Indication that was appreciabl y different from reality, to the point where an indicati on difference was noticed by the pilot or subsequent investigation. This includ ed parameters that were higher than actuality, lower than actualit y or completely absent, and also discrete warnings or alerts that were falsely present or absent. Individual EICAS messages were excluded since these were very type-specific and numerous.

3. Multiple-Engine Powerloss Event. 3.1 Environmental. A significant safe ty event initiating from essentially simultaneous power loss from multiple propulsion systems for an environmental cause (e.g., bird, ice, rain, hail, or volcanic ash ingestion). 3.2 Maintenance. A significant safety ev ent initiating from multiple propulsion system powerloss from clearly improper ma intenance (e.g., failure to restore oil system integrity after inspection). 3.3 Other/unknown. A significant safety ev ent initiating from multiple propulsion system powerloss for reasons other than those characterized elsewhere, or where the initiating event( s) are unknown. This incl udes unrelated events of engine powerloss within the same flight.

4. APU System Event. 4.1 A significant APU-related safety event as follows:

4.1.1 Uncontained. An uncontained ro tating component malfunction that allows debris to exit thro ugh the APU containment casings. 4.1.2 Axial uncontained. Major rotati ng components that exit the APU containment casings in an axial dir ection (i.e., without penetrating the case). 4.1.3 Overspeed. Acceleration of a roto r beyond the speed sanctioned in the Type Certificate Data Sheet.

4.1.4 Fire. Combustion external to the APU casings. Tailpipe fire data and hot air leaks resulting in fire warnings, without combustion, are excluded from the definition and documented separately.9/23/10 rev. 0

41 4.1.5 Tailpipe fire. Fires within the ta ilpipe and exiting th e tailpipe, where flames are visible. Hot starts resulting in a “glow” are excluded. 4.1.6 Compartment overheat. High-temper ature air leaks due to casing highpressure/temperature air duct syst em malfunctions within the APU.

5. Propeller System Event.

5.1 An event that initiates from a malfuncti on or misuse of the propeller system as follows: 5.1.1 Propeller separation/debris release. Separation of single or multiple blades, or large piece thereof, due to blade or hub malfunction. Note that events occurri ng after groundstrike are included for their information on their threat to th e aircraft or its occupants. 5.1.2 Autofeather/pitch lock. Propeller system malfunc tion leading to inability to control the propeller. Control hunting is excluded as a normal product behavior. 5.1.3 Propeller system malfunction pl us inappropriate crew response (Propeller PSM+ICR). A significan t safety event initiating from a propeller system malfunction whic h, by itself, does not hazard the aircraft, passengers, or crew, but is compounded by inappropriate crew
response. 5.1.4 Crew error. A significant safety event caused by a propeller system malfunction or improper operation that was caused by an inappropriate crew action, excluding sabotage, gr oss negligence and suicide (e.g., operation in beta mode in violati on of operating instructions). Not included are events where inappropri ate crew action causes a propeller system malfunction through very indirect means such as flying the airplane into the ground or running the airplane into equipment on the taxiway/runway.

6. Propulsion System Fume Event



### . Significant smoke and/or fu mes on the flight deck or cabin that are generate d by the propulsion system.