Federal Aviation 

Administration

Small Airplane Directorate 

Small Airplane Risk Analysis 

 (SARA) 

Handbook 
 

Table of Contents 

Section PAGE 

1. Purpose.............................................................................. 1 

2. Related Publications ...................................................... 1 

3. Superseded Documents ...................................................... 1 

4. Definitions ........................................................................ 1 

CHAPTER 1. INTRODUCTION ...................................................... 4 

1-1 Replacing the Airworthiness Concerns Process Risk Assessment ......... 4 

1-2 Use of Risk Methods ...................................................... 5 

1-3 SARA Process ............................................................... 5 

1-4 SAD Product Range ...................................................... 8 

1-5 SAD COS Website ...................................................... 9 

1-6 Small Airplane Fleet Demographics .................................... 9 

1-7 Airworthiness Concerns Sheet ............................................. 9 

CHAPTER 2. SARA PROCESS FOR AVIONICS AND AIRPLANE 

SYSTEMS AND EQUIPMENT ...................................................... 10 

2-1 Description of Included Systems ............................................. 10 

2-2 Definition of Hazard Levels for Avionics and Airplane Systems and 

 Equipment Installations ...................................................... 10 

2-3 SARA Overview for Avionics and Airplane Systems and 

 Equipment ........................................................................ 13 

2-4 Example Problem ............................................................... 24 

2-5 The Large Fleet Problem ...................................................... 29 

CHAPTER 3. SARA PROCESS FOR POWERPLANT, PROPELLER, 

AND APU INSTALLATIONS ...................................................... 31 

3-1 Description of Included Systems ............................................. 31 

3-2 Evaluation Methods ............................................................... 31 

3-3 Working with the Engine and Propeller Directorate .................. 32 

3-4 Hazard Ratios and Risk Guidelines .................................... 32 

Small Airplane Risk Analysis (SARA) Handbook Revision: Original 

 Date: September 30, 2010 
 

Table of Contents (continued) 

Section PAGE 

CHAPTER 4. SARA PROCESS FOR AIRFRAME AND OCCUPANT 

PROTECTION SYSTEMS ...................................................... 35 

4-1 Airframe Risk Analysis ...................................................... 35 

4-2 Hazard Level Definitions for Airframe – Primary Structure .................. 35 

4-3 Investigation of Airworthiness Issue .................................... 36 

4-4 Quantitative Analysis ...................................................... 36 

4-5 Quality Escapes in Primary Structure .................................... 37 

4-6 Corrosion in Primary Structure ............................................. 39 

4-7 Metal Fatigue in Primary Structure .................................... 41 

4-8 Composite Materials – Primary Structure .................................... 49 

4-9 Other Structure – Control Surfaces, Tabs, and High Lift Devices ......... 50 

4-10 Other Structure – Secondary Structure .................................... 50 

4-11 Other Structure – Landing Gear ............................................. 50 

4-12 Other Structure – Occupant Protection .................................... 51 

APPENDIX 1. WORKSHEET FOR AVIONICS, SYSTEMS, AND 

POWERPLANT INSTALLATIONS ............................................. A1-1 

APPENDIX 2. WORKSHEET FOR AIRFRAME AND OCCUPANT 

PROTECTION ........................................................................ A2-1 

APPENDIX 3. AIRWORTHINESS CONCERNS SHEET .................. A3-1 

Small Airplane Risk Analysis (SARA) Handbook Revision: Original 

 Date: September 30, 2010 
 

List of Acronyms 

Acronym Definition 

ACO Aircraft Certification Office 

ACP Airworthiness Concerns Process 

ACS Airworthiness Concern Sheet 

 AD Airworthiness Directive 

 AIR Aircraft Certification Service 

 AMC Acceptable Means of Compliance 

 AOPA Airplane Owners and Pilots Association 

 APU Auxiliary Power Unit 

 ASE Aircraft Safety Engineer 

 BVID Barely Visible Impact Damage 

 CARB Corrective Action review Board 

 COS Continued Operational Safety 

 EAA Experimental Aircraft Association 

 ECS Environmental Control Systems 

 EPD Engine and Propeller Directorate 

 FMP Fatigue Management Plan 

 GM Guidance Material 

 IAR Immediately Adopted Rule 

 IDG Integrated Drive Generator 

 MSAD Monitor Safety Analyze Safety 

 NPRM Notice of Proposed Rule Making 

 NTSB National Transportation Safety Board 

 RAS Risk Analysis Specification 

 SAD Small Airplane Directorate 

 SAIB Special Airworthiness Information Bulletin 

 SARA Small Airplane Risk Analysis 

 SDR Service Difficulty Report 

 SMS Safety Management System 

Small Airplane Risk Analysis (SARA) Handbook Revision: Original 

 Date: September 30, 2010 
 

List of Acronyms, continued 

Acronym Definition 

 

STC Supplemental Type Certificate 

 TIS Time in Service 

Small Airplane Risk Analysis (SARA) Handbook Revision: Original 

 Date: September 30, 2010 
 

List of Figures 

Figure Number Title 

1 Overview of the Small Airplane Risk Analysis (SARA) 

Process 

2 Event Guidelines for Class I Airplanes and Other Aircraft 

3 Event Guidelines for Class II Airplanes 

4 Event Guidelines for Class III Airplanes 

5 Event Guidelines for Class IV Airplanes 

6 Example Problem for Avionics and Airplane Systems and 

Equipment 

7 Effect of Fleet Size on Expected Number of Events 

8 Example Quality Escape Scenario 

9 Life Analysis Example 

10 Life Analysis Flowchart 

11 Control Program Based on Component Replacement or 

Modification 

12 Control Programs Based on Damage Tolerance Inspections 

Small Airplane Risk Analysis (SARA) Handbook Revision: Original 

 Date: September 30, 2010 
 

Small Airplane Risk Analysis (SARA) Handbook Revision: Original 

 Date: September 30, 2010 

List of Tables 

Table Number Title 

1 Aircraft Class Definitions 

2 Required Data for Analysis of Avionics and Airplane 

Systems and Equipment 

3 Risk Calculations 

4 Recommended Avionics and Airplane Systems and 

Equipment Hazard Ratios 

5 Estimating Number of Fatal Accidents for Avionics and 

Airplane Systems and Equipment 

6 Estimated Number of Fatal Accidents for Example Problem 

7 Effect of Fleet Size on Expected Number of Events 

8 Recommended Hazard Ratios for Single-Engine 

Powerplant, Propeller, and Auxiliary Power Unit 

Installations 

9 Recommended Hazard Ratios for Multi-Engine 

Powerplant, Propeller, and Auxiliary Power Unit 

Installations 

10 Structural Hazard Level Classifications 

11 Qualitative Hazard Level Descriptions for Corrosion 

12 Qualitative Hazard Level Descriptions for Fatigue 

13 Adjustments to Time-in-Service for Reported Crack Size
 1 

1. Purpose 

The Small Airplane Directorate’s (SAD’s) Small Airplane Risk Analysis (SARA) process 

provides Aviation Safety Engineers (ASEs) with guidance for estimating the risk 

associated with airworthiness concerns. SARA also provides guidance on how ASEs can 

use estimated risk as a consideration in making unsafe condition determinations and in 

evaluating corrective actions. 

2. Related Publications 

The following publications provide the ASE with additional information on the subject of 

risk analysis. 

a) FAA Order 8110.107 Monitor Safety/Analyze Data, March 12, 2010. 

b) FAA IR-M-8040.1C Airworthiness Directives Manual, May 17, 2010. 

c) Risk Analysis Specification, October 11, 2006. (FAA Document) 

d) Engine and Propeller Directorate Continued Airworthiness Assessment Process 

Handbook, Draft. 

e) AC 39-8 Continued Airworthiness Assessments of Powerplant and Auxiliary Power 

Unit Installations of Transport Category Airplanes, September 8, 2003. 

f) Transport Airplane Directorate Risk Assessment Methodology (TAD RAM) 

Handbook, Draft. 

g) Rotorcraft Risk Analysis Handbook, Draft. 

h) European Aviation Safety Agency (EASA) Part 21 Acceptable Means of Compliance 

(AMC) and Guidance Material (GM), October 17, 2003. 

i) AC 91-82 Fatigue Management Programs for Airplanes with Demonstrated Risk of 

Catastrophic Failure Due to Fatigue. 

j) AC 23-1309-1D System Safety Analysis and Assessment for Part 23 Airplanes. 

k) AC 43-16A General Aviation Maintenance Alerts 

3. Superseded Documents 

The Small Airplane Directorate’s Airworthiness Concerns Process (ACP) Guide is 

superseded by the FAA Order 8110.107 and this handbook. 

4. Definitions 

The following definitions apply to the information provided in this handbook. Do not 

assume these definitions should apply to the same or similar terms used in other federal 

documents, regulations or ACs. 

a) CARB. Corrective Action Review Board (see FAA Order 8110.107). 

Small Airplane Risk Analysis (SARA) Handbook Revision: Original 

 Date: September 30, 2010 
 2 

b) Compliance schedule. A timetable for performing specified corrective actions (e.g., 

maintenance, inspections, part replacements, alterations, etc.) to alleviate an identified 

unsafe condition. 

c) Continued airworthiness. The ongoing activities associated with ensuring a product 

remains in compliance with the intent of the applicable Product Design Standards. 

d) Control program. The combination of compliance schedule and corrective actions 

needed to alleviate an identified unsafe condition. Note that the condition is no longer 

considered to be unsafe while it is being addressed by a control program. 

e) Event. The occurrence of a failure or other condition. Events typically trigger 

investigations that seek causes of a safety issue. The safety issue (or condition) is then 

evaluated for safety implications. 

f) Fatal Accident. An occurrence associated with the operation of an aircraft which 

takes place between the time any person boards the aircraft with the intention of flight 

and until such time as all such persons have disembarked, and in which any person 

(including those on the ground injured as a result of the essential operation of the 

flight) suffers a fatal injury. This definition excludes maintenance, ramp positioning 

and ground personnel movement, unless injuries are a direct result of the aircraft’s 

action or malfunction. 

g) Fatal accident ratio. The conditional probability that an outcome of a specific 

severity level will result in a fatal accident. 

h) Fatal injury. An injury that results in death within 30 days of the accident. 

i) Fleet Risk. A quantitative assessment output equal to the average number of future 

events expected to occur within a given time. Fleet risk can be differentiated into two 

types (see below), and typically cover the time required for problem resolution. 

However, in the case of uncorrected fleet risk and control program fleet risk for 

control programs that do not incorporate final corrective actions (e.g., recurring 

inspections), fleet risk usually cover a 20-year period or shorter interval 

corresponding to the expected life of the fleet. 

1) Uncorrected fleet risk. The forecasted number of future events expected to occur 

in the fleet (or, if applicable, the relevant affected subfleet) if no corrective 

actions are incorporated. 

2) Control program fleet risk. The forecasted number of future events expected to 

occur in the fleet (or, if applicable, the relevant affected subfleet) during the 

control program. 

j) Hazard level. Level of event outcome, as defined by its effect on the aircraft, 

passengers, and crew. 

k) Hazard ratio. The conditional probability that a particular failure mode will result in 

an event of a specific hazard level. 

l) Individual Risk. This is the risk per flight-hour or per flight cycle. The per flighthour (or per flight cycle) guidelines apply to the average of the fleet or subfleet 

suspected of having the unsafe condition. The terminology of individual risk is not 

Small Airplane Risk Analysis (SARA) Handbook Revision: Original 

 Date: September 30, 2010 
 3 

Small Airplane Risk Analysis (SARA) Handbook Revision: Original 

 Date: September 30, 2010 

meant to imply that the risk to an individual person is calculated. Rather, individual 

risk is normally calculated by dividing the fleet risk by the total number of flighthours (or flight cycles) within the assumed exposure period. 

1) Uncorrected individual risk. The forecasted number of future events per flighthour (or per flight cycle) expected to occur in the fleet (or, if applicable, the 

relevant affected subfleet) if no corrective actions are incorporated. 

2) Control program individual risk. The forecasted number of future events per 

flight-hour (or per flight cycle) expected to occur in the fleet (or, if applicable, the 

relevant affected subfleet) during the control program. 

m) MSAD. Monitor Safety/Analyze Data (see FAA Order 8110.107). 

n) Safety Issue. Cause(s), contributing factor(s), or finding(s) that led to, or could lead 

to, an unsafe outcome. Safety decisions are rendered on issues/causes, not events. For 

example, investigation of an uncommanded flight control surface movement--an 

event--might reveal that the cause was a circuit failure in the autopilot’s computer. 

Circuit failure is the safety issue/cause to evaluate for safety implications, and to take 

corrective action against.
 4 

Chapter 1. Introduction 

1-1 Replacing the Airworthiness Concerns Process Risk Assessment 

The Aircraft Certification Service (AIR) developed a Risk Analysis Specification (RAS) 

as part of the ongoing development of a Safety Management System (SMS). The RAS 

requires risk analysis to be data driven, objective, and comparable across AIR’s product 

range. The RAS clarifies these requirements as follows: 

 Be quantitative (statistical); e.g., have quantified values for probability and 

severity. 

 Recognize and address ‘conditional probabilities’ in quantitative terms. 

 Define and use a standardized safety-related severity, and relate it to ‘fatal 

accident(s)’. 

 Provide means for ongoing data collection and analysis to support 

quantitative risk analysis. 

Aviation Safety Engineers (ASEs) have used the method described in the Small Airplane 

Directorate’s (SAD’s) Airworthiness Concerns Process (ACP) Guide to complete risk 

assessments of airworthiness concerns on SAD products. The ACP risk assessment relied 

heavily on the ASE’s qualitative assessment of the severity of the airworthiness concern. 

The ACP method placed less emphasis on the frequency of failures or defects and how 

often these failures or defects actually resulted in outcomes of a given severity. The 

potential existed in the ACP risk assessment that failures or defects that rarely result in 

catastrophic outcomes (for example) could be rated as highly as failures that more 

frequently result in a catastrophic outcome. 

To address the potential shortcomings in the ACP risk assessment and to comply with the 

RAS, SAD has developed the Small Airplane Risk Analysis (SARA) process. SARA uses 

quantitative risk measures including the frequency and expected number of events that 

result in a given outcome severity. The SARA process is similar to the risk analysis 

methods described in AC 39-8, Engine and Propeller Directorate Continued 

Airworthiness Assessment Process Handbook, and EASA’s Part 21 Acceptable Means of 

Compliance (AMC) and Guidance Material (GM). 

To avoid confusion with the traditional severity terms used in type certification 

(catastrophic, hazardous, etc), SARA defines severity using ‘Levels’. SARA makes 

continued airworthiness recommendations based on the frequency and number of events 

expected to result in Level 5 (the most severe), Level 4, and Level 3 outcomes. Other, 

lower hazard levels exist, specifically Levels 0, 1, and 2. These hazard levels correspond 

to hazard descriptions used during type certification, including ‘no safety effect’ and 

‘minor safety effect’. We will not manage continued airworthiness based on severity 

levels below Level 3. Levels 3, 4, and 5 are defined in appropriate sections of this 

document. 

Consistent with the well known ‘Swiss cheese’ analogy to risk management, using three 

separate levels of severity provides us with multiple opportunities to correct 

Small Airplane Risk Analysis (SARA) Handbook Revision: Original 

 Date: September 30, 2010 
 5 

airworthiness issues before they can result in the most severe outcome. By basing 

decisions on three different severity levels, we can minimize the impact on the risk 

analysis accuracy of uncertainties in the input data, including the hazard ratios and the 

frequency of the underlying defect or failure. 

1-2 Use of Risk Methods 

We have historically used probabilistic methods in type certification to define levels of

safety for systems and avionics design (see AC 23.1309-1D). It is a natural extension to 

apply a similar approach to the continued operational safety for systems and avionics. We 

can also apply these methods to powerplant, propeller, and APU installations (see AC 39-

8 and Engine and Propeller Directorate Continued Airworthiness Assessment Process 

Handbook, Draft). 

A probabilistic approach is not always appropriate for making decisions on whether 

airworthiness action is necessary. For example, the majority of primary structure in small 

airplanes is single-load path structure designed without the benefit of fail-safe or damage 

tolerance principles and maintained without the benefit of directed inspection programs. 

Also, airplane components intended to provide occupant protection must function as 

intended in a survivable incident or accident. Using a probabilistic approach in these 

types of situations is not appropriate for making decisions on whether airworthiness 

action is necessary. However, probabilistic methods can help us determine how quickly 

we should take an airworthiness action and how effective a proposed airworthiness action 

may be in reducing the risk associated with an airworthiness concern. 

SARA recognizes the inherent differences in achieving the required level of safety for 

each engineering discipline. SARA provides risk guidelines for systems, avionics, and 

powerplant installations in terms of the frequency of events of different severity levels. 

SARA uses an additional measure, the expected number of events over a one year period, 

as a risk guideline for whether ASEs should consider immediate action. 

For airframe and occupant protection, SARA provides risk guidelines in terms of the 

severity a defect or failure will have on the airframe or occupant protection component. 

ASEs should consider airworthiness action in these cases if investigation reveals that the 

defect or failure may occur in other products of the same type design. 

1-3 SARA Process 

The flowchart in Figure 1 provides an overview of the SARA process. Figure 1 shows a 

clear delineation between the avionics, systems and propulsion philosophy and the 

airframe and occupant protection approach. We anticipate airworthiness concerns that 

may not fall within the scope of avionics, systems, and propulsion installations or 

airframe and occupant protection. Some airworthiness concerns may also overlap more 

than one engineering discipline. In these cases, ASEs should contact SAD to determine 

which risk analysis method is most appropriate for their situation. 

a. Avionics, Airplane Systems and Equipment. In the avionics and airplane 

systems and equipment approach, ASEs will need to determine the hazard ratios 

appropriate for their airworthiness concern. Hazard ratios are ‘conditional probabilities’ 

Small Airplane Risk Analysis (SARA) Handbook Revision: Original 

 Date: September 30, 2010 
 6 

that transform the frequency of defects or failures into the frequency of outcomes of 

different severities, Level 3, 4, or 5. 

ASEs determine the hazard ratios from service history if adequate service history is 

available for a specific safety concern on a specific make/model or group of airplanes. 

Collaboration with subject matter experts, flight test pilots, and human factors specialists 

is critical to developing appropriate hazard ratios. As a process check, ASEs should 

compare calculated hazard ratios against the hazard ratios provided in Chapter 2 of this 

handbook. ASEs include the hazard ratios in their presentation to the CARB and provide 

SAD with descriptions of how the hazard ratios were developed and any unique 

characteristics of the installation. 

In situations where insufficient service history is available, ASEs should use the hazard 

ratios provided in Chapter 2 of this handbook. ASEs may adjust these hazard ratios based 

on specifics of a particular installation and on engineering judgment. 

ASEs use the hazard ratios to determine the uncorrected individual risk, expressed as the 

frequency of outcomes of a given severity level. ASEs will also determine the 

uncorrected fleet risk, the total number of expected outcomes of a given severity level 

over a fixed period of time. These risk values represent an estimate of future outcomes if 

no corrective actions are taken. ASEs will determine the uncorrected fleet risk for two 

time periods, ‘long-term’ exposure (used to determine whether mandatory action is 

needed) and ‘short-term’ exposure (used to determine whether immediate action is 

needed). ASEs will make recommendations for airworthiness actions by comparing these 

risk values against the risk guidelines provided in Chapter 2 of this handbook. 

If mandatory action is considered, ASEs should work with the design approval holder or 

type club to develop candidate control programs. ASEs should evaluate the effectiveness 

of the candidate programs by evaluating the ability of the control programs to reduce the 

individual and fleet risk to acceptable levels. We do not necessarily require the most 

effective control program, but any control program should reduce the individual and fleet 

risk to acceptable levels. 

b. Propeller, Powerplant, and APU Installations. The SARA process for 

propeller, powerplant, and APU installations is the same process used for avionics and 

airplane systems and equipment. However, the hazard ratios presented in Chapter 3 of 

this handbook take into account the significant differences in outcomes resulting from 

powerplant failures in single-engine and multi-engine airplanes. Coordination with other 

Directorates, especially the Engine and Propeller Directorate, may be helpful in resolving 

propeller, powerplant, and APU installation airworthiness concerns. 

c. Airframe and Occupant Protection. In the airframe approach, ASEs first make 

a determination of whether the defect or failure may occur on other products of the same 

type design. AC 91-82 describes how ASEs can make these determinations for instances 

of fatigue cracking. If the defect or failure may occur again in the fleet, ASEs make 

airworthiness recommendations based on the effect on the airframe’s strength, fatigue 

characteristics, or stiffness. If an ASE determines that airworthiness action is necessary, 

the ASE works with the DAH and type club to develop candidate control programs. 

Small Airplane Risk Analysis (SARA) Handbook Revision: Original 

 Date: September 30, 2010 
 7 

Figure 1: Overview of the Small Airplane Risk Analysis (SARA) Process 

Small Airplane Risk Analysis (SARA) Handbook Revision: Original 

 Date: September 30, 2010 
 8 

d. Fatal Accidents. ASEs will need to determine the number of fatal accidents that 

may result if no corrective action is taken. The number of fatal accidents is not used to 

make recommendations on airworthiness action but may be used by management to 

prioritize resources. 

e. Worksheets. SAD has developed worksheets for the avionics, systems, and 

powerplant installations approach and the airframe and occupant protection approach to 

assist ASEs in completing the risk analysis. These worksheets are included in Appendix 1 

and 2 and are also available in electronic format on SAD’s COS website. 

f. Voluntary Actions. ASEs should consider taking voluntary actions, including 

SAIBs, service information, or an article in AC 43-16A General Aviation Maintenance 

Alerts when mandatory action is not appropriate. 

1-4 SAD Product Range 

SAD’s range of products is unique, including manned free balloons, airships, sailplanes, 

single-engine and twin-engine airplanes, business jets, and airplanes used in scheduled 

commuter service. We have applied different expectations for levels of safety to each of 

these products in both type certification (see AC 23.1309-1D) and continued 

airworthiness. We will continue to recognize the need for different levels of safety for 

different SAD products by adjusting the risk guidelines for each type of product. SARA 

provides separate guidelines for each class of aircraft defined in Table 1. These aircraft 

classes are similar to those used in AC 23.1309-1D. 

Table 1: Aircraft Class Definitions 

Class Description 

Single Reciprocating Engine Airplanes < 6,000 lbs. 

Restricted Category Agricultural Airplanes 

Sailplanes 

Normal Category Airships 

Class I 

Manned Free Balloons 

Multiple Reciprocating Engine Airplanes < 6,000 lbs. 

Single Turbine Engine Airplanes < 6,000 lbs. 

Class II 

Multiple Turbine Engine Airplanes < 6,000 lbs. 

Single Reciprocating Engine Airplanes > 6,000 lbs. 

Multiple Reciprocating Engine Airplanes > 6,000 lbs. 

Single Turbine Engine Airplanes > 6,000 lbs. 

Class III 

Multiple Turbine Engine Airplanes > 6,000 lbs. 

Class IV Commuter Category Airplanes 

Note: Restricted category airplanes, other than agricultural 

airplanes, should be evaluated using the class definition 

most appropriate for their engine configuration and 

maximum weight. 

Small Airplane Risk Analysis (SARA) Handbook Revision: Original 

 Date: September 30, 2010 
 9 

Small Airplane Risk Analysis (SARA) Handbook Revision: Original 

 Date: September 30, 2010 

1-5 SAD COS Website 

We recognize the need to provide ASEs with a library of reference materials to facilitate 

risk analysis. ASEs will need access to the latest revision to this document, a catalog of 

risk analysis examples, hazard ratios, computational tools, and fleet demographic 

information. The Directorate has established a continued operational safety (COS) 

website to provide ASEs access to this information. ASEs can access the website at the 

following address: 

https://intranet.faa.gov/FAAEmployees/org/linebusiness/avs/offices/air/div_dir/ace/cosm/ 

1-6 Small Airplane Fleet Demographics 

Each risk analysis will require information on the total number of airplanes in the 

affected fleet and the number of hours on these airplanes. To assist ASEs, the Directorate 

will develop a ‘fleet demographics snapshot’ for each type certificated airplane. The 

snapshot will include the number of airplanes of a specific model, their year of 

manufacture, average hours per year on a specific model, an estimate of the total fleet 

hours, and how many airplanes of a specific model are used in commercial service. We 

will provide this data as a ‘snapshot’ for a specific point in time. We will then update the 

snapshot on a periodic basis. If a snapshot is not available for your airplane, you can 

request SAD to develop one for you. 

1-7 Airworthiness Concerns Sheet 

The SARA process retains the Airworthiness Concerns Sheet (ACS) as a means of 

soliciting information from the aviation community. The ACS is not part of any 

rulemaking activity; its purpose is to solicit technical and economic input. If one year or 

more passes between when the ACS was transmitted and an action (a Notice of Proposed 

Rulemaking (NPRM), for example) is considered, the ASE should evaluate the need for 

seeking the aviation communities’ input again with a new ACS. 

The ACS is used in the same way the ACS was used in the ACP. An ACS should be 

transmitted to the aviation community and feedback received before an airworthiness 

action is initiated. 

ASEs should complete an ACS for Emergency Airworthiness Directive (AD) and 

Immediately Adopted Rule (IAR) actions. However, unlike the routine NPRM process, 

the ACS is developed concurrently with the Emergency AD or IAR. In these cases, ASEs 

should complete and transmit the ACS at the same time they initiate the AD worksheet. 

The response time for this type of ACS should be consistent with the urgency of the 

concern, typically 10 days or less. It may be necessary for the ASE to communicate 

directly with user groups to ensure responses are collected in time to support the urgency 

of the action. The Emergency AD or IAR action will be prepared as the ACS is processed 

by the user groups. This enhances the decision making process by helping gather all 

available service information prior to issuing the Emergency AD or Adopted Rule AD. 

Later, if new information becomes available, the ASE working with the Small Airplane 

Directorate AD group may initiate further rulemaking to adjust the regulatory impact as 

appropriate (increase or decrease the AD requirements, for instance). 
 10 

Chapter 2. SARA Process for Avionics and Airplane Systems and Equipment 

2-1 Description of Included Systems 

This section describes the SARA process for airplane avionics and systems and 

equipment typically certificated under part 23 subpart F (or predecessor regulations). 

ASEs should use the SARA process for avionics and airplane systems and equipment, 

including, but not limited to, the following airplane components. 

 pneumatic systems, 

 fluid systems (excluding fuel and engine oil systems), 

 flight control systems, 

 electrical and electronic systems, 

 avionics systems, and 

 mechanical systems and equipment. 

2-2 Definition of Hazard Levels for Avionics and Airplane Systems and 

Equipment 

ASEs should use the following definitions of hazard level when completing the SARA 

process on avionics and airplane systems and equipment. These definitions are similar to 

those in AC 39-8 with some changes to better reflect small airplane design and operating 

environment. 

a. Level 5 Event: Defect or failure conditions that are expected to result in:

 Occupant fatalities or incapacitation or fatal injury to the pilot(s), 

normally with the loss of the airplane. These events typically involve 

loss of survivable cabin volume or environment and uncontrolled or 

high speed, high angle impacts with terrain. 

 Notes: 

o Fatal Injury. The NTSB defines “fatal injury” as an injury that 

results in death within 30 days of the accident. 

b. Level 4 Event: Defect or failure conditions that are expected to result in: 

 Serious injuries including life-threatening injuries. Some fatalities may 

occur in these events even though survivable cabin volume or 

environment is usually maintained. These events may involve high 

speed, low angle impacts or low speed impacts. These events may also 

result in hull loss. 

Small Airplane Risk Analysis (SARA) Handbook Revision: Original 

 Date: September 30, 2010 
 11 

 Notes: 

o Serious Injuries. The NTSB definition of "serious injury" 

means any injury that: 

 Requires hospitalization for more than 48 hours, 

commencing within seven days from the date the injury 

was received, 

 results in the fracture of any bone (except simple fractures 

of fingers, toes or nose), 

 involves lacerations that cause severe hemorrhages, nerve, 

muscle or tendon damage, 

 involves injury to any internal organ, or 

 involves second or third degree burns or any burns 

affecting more than five percent of the body surface. 

o Forced landing. For Class IV airplanes (typically commuter 

category airplanes), ASEs should consider any forced landing 

as a Level 4 event. Forced landing is defined as the inability to 

continue flight due to the consequences of damage, 

uncontrolled fire or thrust loss where imminent landing is 

obvious but aircraft controllability is not necessarily lost (i.e., 

total power loss due to fuel exhaustion will result in a "forced 

landing”). The term "emergency landing" may also be used to 

mean a forced landing if there is an urgent requirement to land, 

but declaration of an emergency does not necessarily imply 

that a forced landing is imminent. An air turn back or diversion 

due to a malfunction is not a forced landing, since there is a 

lack of urgency and the crew has the ability to select where 

they will perform the landing. However, off-airport landings 

are almost always forced landings. 

o Uncontained (uncontrolled) fires in a typical single-engine 

airplane configuration. ASEs should consider fires or smoke 

that impinge on or enter the airplane cabin as Level 4 events. 

c. Level 3 Event: Defect or failure conditions that are expected to result in: 

 Substantial damage to the aircraft or second unrelated system. Non-life 

threatening serious injuries (for example, simple fractures). 

 Notes: 

o Substantial damage to the aircraft or second unrelated 

system. "Substantial damage" means damage or structural 

failure that adversely affects the limit loads capability of a 

Primary Structural Element or the performance or flight 

Small Airplane Risk Analysis (SARA) Handbook Revision: Original 

 Date: September 30, 2010 
 12 

characteristics of the aircraft, and that would normally require 

major repair or replacement of the affected components. 

Typically not considered “substantial damage” (because they 

do not generally result in the effects delineated above) are: 

o engine failure damage limited to the engine or its 

mounts, 

o bent fairings or cowlings, 

o dented skin, 

o small puncture holes in the skin or fabric, 

o damage to landing gear associated with runway 

departures, 

o wheel, tires, 

o flaps, 

o engine accessories on failed engine, 

o brakes or 

o wing tips. 

Damage to a second unrelated system must impact the ability 

to continue safe flight and landing. Coordination and 

agreement between the engine/propeller/APU manufacturer 

and the airframe manufacturer may be required to properly 

categorize events related to second system damage. In general, 

aircraft are designed to be dispatched with one part of a 

redundant system inoperative with no effect on flight safety. 

Therefore, an uncontained rotor event which severed an 

unrelated hydraulic system line without significantly degrading 

the ability to continue safe flight should not be considered a 

level 3 event. 

o Small penetrations of aircraft fuel lines or aircraft fuel tanks 

that lead to fuel exhaustion are a level 3 classification. 

Assistance of the airframe manufacturer should be sought when 

questions arise. 

o Damage to a second engine that results in a significant loss of 

thrust or an operational problem requiring pilot action to 

reduce power is a level 3 event. Minor damage which was not 

observed by the crew during flight and which did not affect the 

ability of the engine to continue safe operation for the rest of 

the flight is should not be considered a level 3 event. 

o Uncontained (uncontrolled) fires that do not result in a Level 4 

event. The concern is impinging flames onto the wing/fuselage 

or acting as an ignition source for flammable material 

Small Airplane Risk Analysis (SARA) Handbook Revision: Original 

 Date: September 30, 2010 
 13 

anticipated to be present. Localized fires with very limited fuel 

sources (such as gearbox and IDG fires) may exit the fire zone 

in locations remote from the wing, fuselage and airplane 

structure or flammable material anticipated to be present and 

thus not be deemed level 3 since they do not present the above 

concern. Fires inside the fire zone are not level 3 unless they 

escape. 

o Rapid depressurization of the cabin is a level 3 event. 

o For multi-engine airplanes, permanent loss of thrust or power 

greater than one propulsion system (inflight) is a level 3 event. 

o Temporary or permanent inability to climb and fly 1000 feet 

above terrain (increased threat from terrain, inclement weather, 

etc.) along the intended route that results in restricted capability 

(i.e., multiple propulsion system malfunctions or single 

propulsion system malfunctions and/or other aircraft system 

malfunction or crew error.) is a level 3 event. 

o Any temporary or permanent impairment of aircraft 

controllability caused by, for instance, propulsion system 

malfunction, thrust reverser inflight deployment, propeller 

control malfunction, or propulsion system malfunction coupled 

with aircraft control system malfunction, abnormal aircraft 

vibration, or crew error is a level 3 event. 

o Malfunctions or failures resulting in smoke or other fumes 

delivered through the ECS system causing serious impairment 

is a level 3 event. Serious impairment includes the loss of 

crew’s ability to see flight deck instrumentation or perform 

expected flight duties. Purely psychological aspects of the 

concern of odors, etc., are not to be included, nor are concerns 

about long-term exposure. 

2-3 SARA Overview for Avionics and Airplane Systems and Equipment. 

ASEs should perform the steps outlines in Figure 1 when completing the SARA process 

for defects and failures related to avionics and airplane systems and equipment. A 

description of these steps is provided in the following paragraphs. 

a. Collecting Data for Avionics and Airplane Systems and Equipment. To 

complete the SARA process for avionics and airplane systems and equipment, an ASE 

will need to collect the data summarized in Table 2.

b. Risk Parameter Calculation. After collecting the data in Table 2, the ASE will 

perform the calculations summarized in Table 3.

c. Frequency of Failures and Defects. ASEs should select service data over an 

appropriate historical time frame to determine the frequency of failures and defects. In 

some cases, service difficulty reports may extend over several years. In other case, 

Small Airplane Risk Analysis (SARA) Handbook Revision: Original 

 Date: September 30, 2010 
 14 

reports may have only been received over the past few years. For example, if ten reports 

have been received over the past five years, and eleven reports over the past ten years, a 

frequency based on the last five years of data may give a better estimation of future 

events. (In some instances, ASEs should consider using life analysis methods similar to 

the methods used for airframe fatigue, as described in Chapter 4.) 

ASEs should use caution when evaluating service reports for a safety issue on which we 

have previously taken action. Partially effective mitigation actions may result in a low 

frequency of recent past events and may bias the decision process towards a nonconservative action to address future events. 

Table 2: Required Data for Analysis of Avionics and Airplane Systems and Equipment 

Input Data Source 

Number of Airplanes Demographic snapshot on SAD COS 

website, FAA Registry, Manufacturer’s 

records. (Note: If more than one suspect 

component is installed in an airplane, 

then risk calculations should consider 

the number of installed components.) 

Flight cycles per year per airplane, Flight 

hours per year per airplane 

Demographic snapshot on SAD COS 

website, Aircraft Bluebook. 

Long-term Exposure Assume 20 years for risk calculations 

Short-term Exposure Assume 1 year for risk calculations 

Frequency of failure or defect Service history in MSAD, 

Manufacturer’s data 

Hazard Ratios ASEs should determine hazard ratios 

from service history if adequate service 

history is available for a specific safety 

concern on a specific make/model or 

group of airplanes. Calculated hazard 

ratios can be compared against the 

values in Table 4 as a check. 

In situations where insufficient service 

history is available, ASEs should use the 

recommended hazard ratios in Table 4 

and adjust these hazard ratios based on 

specifics of a particular installation and 

on engineering judgment. 

Small Airplane Risk Analysis (SARA) Handbook Revision: Original 

 Date: September 30, 2010 
 15 

Table 3: Risk Calculations 

Risk Parameter Equation 

Frequency of Failure or 

Defect (per hour or per 

flight cycle) 

Total Number of Defects or Failures / 

Affected Fleet Hours or Flight Cycles 

(Calculation based on in-service data) 

Level 3, 4, and 5 

Hazard Ratios 

Fraction of defects or failures resulting in Level 3, 

4, and 5 events. 

(Note: Level 3 events include Level 4 and Level 5 

events. Similarly Level 4 events include Level 5 

events.) 

See Table 4. 

Uncorrected Individual 

Risk, Frequency of 

Level 3, 4, and 5 Events 

(per hour or per flight 

cycle) 

Frequency of Defect or Failure x Level 3, 4, and 5 

Hazard Ratios 

Long-Term Exposure 

(hours or flight cycles) 

Number of Airplanes x Average Flight Hours 

(Flight Cycles) per year per airplane x Remaining 

Service Life of Fleet (20 years default) 

Short-Term Exposure 

(hours or flight cycles) 

Number of Airplanes x Average Flight Hours 

(Flight Cycles) per year per airplane x 1 year 

Uncorrected Fleet Risk, 

Short-Term Expected 

Number of Level 3, 4, 

and 5 Events 

Frequency of Level 3, 4, and 5 Events x Short 

Term Exposure 

Uncorrected Fleet Risk, 

Long-Term Expected 

Number of Level 3, 4, 

and 5 Events 

Frequency of Level 3, 4, and 5 Events x LongTerm Exposure 

Control Program Risk Frequency of Level 3, 4, and 5 Events x Control 

Program Exposure 

d. Random and Wearout Failures. We have traditionally treated failures in 

avionics and airplane systems and equipment as random failures, with a constant rate of 

failure over time. The rate of failure may actually increase over time for many failure 

scenarios. These types of failures are called wearout failures. Wearout is a common 

failure mode in airframe failures, particularly in metal fatigue. 

ASEs should consider the possibility of wearout failure when evaluating airworthiness 

concerns in avionics and airplane systems and equipment. ASEs should suspect wearout 

failures when the number of failure reports appears to increase over time. A typical 

example would be five SDRs over the last three years, two SDRs in the three to six year 

time frame, and no SDRs older than six years. ASEs should review the guidance on life 

analysis in paragraph 4-6 for methods of evaluating wearout failures. 

Small Airplane Risk Analysis (SARA) Handbook Revision: Original 

 Date: September 30, 2010 
 16 

e. Hazard Ratios for Avionics and Airplane Systems and Equipment. ASEs 

should determine hazard ratios from service history if adequate service history is 

available for a specific safety concern on a specific make/model or group of airplanes. 

ASEs should calculate the data described in Table 2 and determine the hazard ratios as 

described in Table 3. ASEs should collaborate with subject matter experts, flight test 

pilots, and human factors specialists when developing hazard ratios. ASEs should 

compare calculated hazard ratios against the values in Table 4 as a process check. ASEs 

should include the hazard ratios in their presentation to the CARB and provide SAD with 

descriptions of how the hazard ratios were developed and any unique characteristics of 

the installation. 

In developing hazard ratios based on service history, ASEs should assume that the next 

failure or defect will result in the lowest severity with no reported outcomes. For 

example, an airworthiness concern has resulted in 10 Level 3 outcomes and no Level 4 or 

Level 5 outcomes. In computing the hazard ratios, ASEs should assume that the next 

event will result in a Level 4 outcome. In this case, an ASE would calculate the hazard 

ratios based on 11 Level 3 events, 1 Level 4 event, and no Level 5 events. This approach 

will result in a reasonably conservative interpretation of service history. 

In situations where insufficient service history is available, ASEs should use the 

recommended hazard ratios in Table 4. SAD has developed the hazard ratios in Table 4 

for a number of common defects and failures in avionics and airplane systems and 

equipment. ASEs may adjust these hazard ratios based on specifics of a particular 

installation and on engineering judgment. If ASEs adjust these hazard ratios, ASEs 

should include the hazard ratios in their presentation to the CARB and provide SAD with 

descriptions of how the hazard ratios were adjusted and any unique characteristics of the 

installation. 

We recognize that these hazard ratios may not cover every defect or failure an ASE will 

encounter. SAD is developing methods to evaluate failures in avionics, airplane systems, 

and powerplant installations that may be modeled using methods similar to the life 

analysis used for fatigue in metal structures. 

f. Risk Guidelines for Avionics, Airplane Systems and Equipment. Once the 

ASE has calculated the risk parameters in Table 3, the ASE then compares the risk 

parameters against the recommended risk guidelines included in Figures 2, 3, 4, and 5 to 

make recommendations on airworthiness actions. The risk guidelines are presented for 

the four classes of aircraft described in Table 1. ASEs should consider airworthiness 

action if any if the risk values exceed the risk guidelines.

 High Risk. If the risk parameters fall within an area of the guidelines labeled 

‘High Risk’, ASEs should consider taking immediate action (Immediately 

Adopted Rule or Emergency AD). The goal of the immediate action is to 

reduce the risk to at least the level of ‘Excessive Risk’. If the immediate 

action reduces risk only to the level of ‘Excessive Risk’ ASEs should consider 

additional action to further reduce the risk. The additional action would 

typically be an NPRM. 

Small Airplane Risk Analysis (SARA) Handbook Revision: Original 

 Date: September 30, 2010 
 17 

 Excessive Risk. If the risk parameters fall within an area of the guidelines 

labeled ‘Excessive Risk’, ASEs should consider developing a routine NPRM 

action. 

 Reasonable Risk. Mandatory airworthiness action is not generally indicated if 

the risk parameters fall into an area of the guidelines labeled ‘Reasonable 

Risk’. In these cases, ASEs may consider voluntary actions including SAIBs 

and service information. 

g. Fatal Accidents. If the ASE determines that mandatory action is necessary, the 

ASE should estimate the number of fatal accidents that may result if no corrective action 

is taken. Table 5 provides ASEs with the calculations necessary to estimate the number of 

fatal accidents. ASEs may adjust the recommended fatal accident ratios as necessary 

based on the circumstances of the airworthiness concern and service history. 

h. Control Programs. If an ASE determines that mandatory action is necessary, the 

ASE should work with the type design holder to develop a control program. Acceptable 

control programs must reduce the long term individual risk for Level 3, 4, and 5 events 

below the long term individual risk guideline, into the area labeled ‘Reasonable Risk’ in 

Figures 2, 3, 4, and 5. 

Control programs must also reduce the risk while the control program is implemented. 

The control program risk must be within the area on the risk guidelines corresponding to 

‘excessive risk’ or ‘reasonable risk’. The control program risk ensures that the 

compliance timing in control programs provides an acceptable level of safety. 

ASEs should evaluate the control program fleet risk over the entire period of time 

allowed for compliance. For example, if a control program requires replacing a specific 

component within the next three years, ASEs would estimate how many airplanes comply 

over each of the next three years and the number of airplanes not yet in compliance in 

each of the next three years. 

Small Airplane Risk Analysis (SARA) Handbook Revision: Original 

 Date: September 30, 2010 
 18 

Table 4: Recommended Avionics and Airplane Systems and Equipment Hazard Ratios 

Failure Condition Hazard Ratios 

Level 5 Level 4 Level 3 

Flight Control System Failure .15 .3 1.0 

FC_LOSSOFCONTROL 

SMA_MISRIGGED 

SMA_FAILURE_CONTROL-CABLE 

Flight Controls (un-commanded movement) .05 .1 1.0 

FC_UNCOMMANDEDMANUVEUR 

FC_UNCOMMANDEDPITCH 

FC_HARDOVER 

Brake System Failure (loss of braking) .1 .3 1.0 

MS_BRAKE_FAILURE 

FC_LOST_BRAKES 

Hydraulic System Failure (multiple systems) .05 .25 .7 

MS_MULTIPLE_HYDRAULIC_FAILURE 

Oxygen system Failure .1 .3 1.0 

MS_OXYGEN_SYSTEM_FAILURE 

Environmental Control Failures .1 .3 1.0 

EC_LOSS_CABIN_PRESSURE 

SMA_FAILURE_PRESSURIZATION 

EC_ICE_PROTECTION 

Cabin Safety, Smoke and Fire .3 .7 1.0 

CS_SMOKE_AND_FIRE 

CS_SMOKE_AND_FIRE_CABIN 

CS_SMOKE_AND_FIRE_CARGO 

Landing Gear System Failure 0 0 .5 

SMA_FAILURE_LDNG_GEAR_EXTEND 

Crew Seat failure .05 .25 .8 

CS_CREW_SEAT_SLIPPED 

Avionics and Navigation Failure .1 .3 1.0 

AV_LOSS_OF_AIRSPEED 

AV_MISLEADING_AIRSPEED 

AV_LOST_DISPLAYS 

AV_MISLEADING_ALTITUDE 

AV_MISLEADING_ATTITUDE 

AV_STALL_WARNING 

Electrical Power Distribution Failure .2 .5 1.0 

PD_BAD_WIRE_SMOKE_FIRE 

PD_LOST_ELECTRIC_POWER 

Small Airplane Risk Analysis (SARA) Handbook Revision: Original 

 Date: September 30, 2010 
 19 

Table 5: Estimating Number of Fatal Accidents for Avionics and Airplane Systems and 

Equipment 

Hazard 

Level 

Historical 

Fatal Accident Ratio

Estimated Number of Fatal Accidents 

Level 5 1.00 Level 5 Fatal Accidents = 

Level 5 Fatal Accident Ratio x 

20 Year Fleet Risk for Level 5 Outcomes 

Level 4 0.10 Level 4 Fatal Accidents = 

Level 4 Fatal Accident Ratio x 

( 20 Year Fleet Risk for Level 4 Outcomes – 

20 Year Fleet Risk for Level 5 Outcomes ) 

Level 3 0.00 Level 3 Fatal Accidents = 

Level 3 Fatal Accident Ratio x 

( 20 Year Fleet Risk for Level 3 Outcomes – 

20 Year Fleet Risk for Level 4 Outcomes – 

20 Year Fleet Risk for Level 5 Outcomes ) 

Total Estimated Fatal Accidents Level 5 + Level 4 + Level 3 Fatal Accidents 

Small Airplane Risk Analysis (SARA) Handbook Revision: Original 

 Date: September 30, 2010 
 20 

Figure 2: Event Guidelines for Class I Airplanes and Other Aircraft 

0.7 Outcomes

7.0 Outcomes

 70 Outcomes

Small Airplane Risk Analysis (SARA) Handbook Revision: Original 

 Date: September 30, 2010 
 21 

Figure 3: Event Guidelines for Class II Airplanes Uncorrected Individual Risk Of Level 5 Outcomes (Frequency of Level 5 Outcomes) Number of Outcomes per Hour(per Flight)

Event Guidelines for AC 23.1309-1D Class II Airplanes

(Multi-Engine Reciprocating, Single-Engine Turbine, 

or Multi-engine Turbine Airplanes < 6,000 lbs.)

100 104 103 102 101 108 107 106 105

Exposure, Fleet Hours(Cycles)

10-3

10-7

10-6

10-5

10-4

10-8

0.5 Outcomes

High Risk

Reasonable Risk

Excessive Risk

High Risk

(if more than 0.5 outcomes 

expected in next 1 year period)

Uncorrected Individual Risk

Of Level 4 Outcomes

(Frequency of Level 4 Outcomes)

Number of Outcomes per Hour(per Flight)

100 104 103 102 101 108 107 106 105

10-2

10-6

10-5

10-4

10-3

10-7

5.0 Outcomes

High Risk

Reasonable Risk

Excessive Risk

High Risk

(if more than 5.0 outcomes 

expected in next 1 year period)

Exposure, Fleet Hours(Cycles)

Uncorrected Individual Risk

Of Level 3 Outcomes

(Frequency of Level 3 Outcomes)

Number of Outcomes per Hour(per Flight)

100 104 103 102 101 108 107 106 105

10-1

10-5

10-4

10-3

10-2

10-6

 50 Outcomes

High Risk

Reasonable Risk

Excessive Risk

High Risk

(if more than 50 outcomes 

expected in next 1 year period)

Exposure, Fleet Hours(Cycles)

Small Airplane Risk Analysis (SARA) Handbook Revision: Original 

 Date: September 30, 2010 
 22 

Figure 4: Event Guidelines for Class III Airplanes Uncorrected Individual Risk Of Level 5 Outcomes (Frequency of Level 5 Outcomes) Number of Outcomes per Hour(per Flight)

Event Guidelines for AC 23.1309-1D Class III Airplanes

(Single-Engine Reciprocating, Multi-Engine Reciprocating, 

Single-Engine Turbine, or Multi-Engine Turbine Airplanes > 6,000 lbs)

100 104 103 102 101 108 107 106 105

Exposure, Fleet Hours(Cycles)

10-4

10-8

10-7

10-6

10-5

10-9

0.3 Outcomes

High Risk

Reasonable Risk

Excessive Risk

High Risk

(if more than 0.3 outcomes 

expected in next 1 year period)

Uncorrected Individual Risk

Of Level 4 Outcomes

(Frequency of Level 4 Outcomes)

Number of Outcomes per Hour(per Flight)

100 104 103 102 101 108 107 106 105

10-3

10-7

10-6

10-5

10-4

10-8

3.0 Outcomes

High Risk

Reasonable Risk

Excessive Risk

High Risk

(if more than 3.0 outcomes 

expected in next 1 year period)

Exposure, Fleet Hours(Cycles)

Uncorrected Individual Risk

Of Level 3 Outcomes

(Frequency of Level 3 Outcomes)

Number of Outcomes per Hour(per Flight)

100 104 103 102 101 108 107 106 105

10-1

10-5

10-4

10-3

10-2

10-6

30 Outcomes

High Risk

Reasonable Risk

Excessive Risk

High Risk

(if more than 30 outcomes 

expected in next 1 year period)

Exposure, Fleet Hours(Cycles)

Small Airplane Risk Analysis (SARA) Handbook Revision: Original 

 Date: September 30, 2010 
 23 

Figure 5: Event Guidelines for Class IV Airplanes 

0.1 Outcomes

1.0 Outcomes

10 Outcomes

Small Airplane Risk Analysis (SARA) Handbook Revision: Original 

 Date: September 30, 2010 
 24 

2-4 Example Problem 

a. Data Collection. You receive reports of complete loss of braking in Model X 

airplanes due to ruptured brake lines in the wheel well. A check of MSAD safety 

information database shows that over the last 20 years there are 255 reports of the same 

or similar failures resulting in loss of braking in Model X airplanes. The aircraft registry 

lists approximately 820 active Model X airplanes. Historical data indicates that the 

majority of these aircraft have been active over the last 20 years. Since the Model X is a 

single engine general aviation aircraft under 6000 pounds MTOW (Class I), it is assumed 

to have an average of 125 flight hours per year, and each flight cycle lasts 0.61 hours. 

b. Failure Mode. In this example, we have assumed that the reported failures occur 

randomly over the past 20 years. ASEs should evaluate the available failure data for 

evidence of a wearout failure mode. 

c. Worksheet. ASEs should use the worksheet included in Appendix 1 to complete 

the following calculations. 

d. Hazard Ratios. Review of the 255 reported failures resulted in the following 

assignments of severity to each of the reported failures. These assignments were made 

using engineering judgment and by collaborating with subject matter experts, flight test 

pilots, and human factors specialists. 

 25 of the failures resulted in Level 5 outcomes. 

 76 of the failures resulted in Level 4 outcomes. (Note: Level 4 outcomes 

include those failures that resulted in Level 5 outcomes.) 

 255 of the failures resulted in Level 3 outcomes. (Note: Level 3 outcomes 

include those failures that resulted in Level 4 outcomes.) 

 Level 5 Hazard Ratio = Number of failures resulting in Level 5 outcomes / 

Total number of failures = 25 / 255 = 0.098  0.1 

 Level 4 Hazard Ratio = 76 / 255 = 0.298  0.3 

 Level 3 Hazard Ratio = 255 / 255 = 1.0 

These calculated hazard ratios correspond to the recommended hazard ratios for loss of 

braking included in Table 4. 

e. Uncorrected Individual Risk. Failures in the braking system, and, more 

importantly, the hazardous outcomes due to failures in the braking system, are 

independent of the length of flight or total flight hours and are a function of when the 

brakes are used in landing (and to a lesser extent taxi and takeoff). In this case, the 

frequency of the brake system failure should be on a per flight cycle basis and not a per 

flight hour basis. 

 Frequency of braking system failure = 

 ( 255 reported failures / ( 820 airplanes x 20 years ) ) x 

 ( 1 year / 125 hours per airplane ) x 

 ( 0.61 hours / flight ) = 

 7.59 x 10-5 per flight cycle 

Small Airplane Risk Analysis (SARA) Handbook Revision: Original 

 Date: September 30, 2010 
 25 

 Frequency of Level 5 outcomes = 

 0.10 x 7.59 x 10-5 per flight = 

 7.59 x 10-6 per flight cycle 

 Frequency of Level 4 outcomes = 

 0.30 x 7.59 x 10-5 per flight = 

 2.28 x 10-5 per flight cycle 

 Frequency of Level 3 outcomes = 

 1.00 x 7.59 x 10-5 per flight = 

 7.59 x 10-5 per flight cycle 

f. Uncorrected Fleet Risk. 

 Short-term Exposure = 

 1 year x 820 airplanes x 125 hours per airplane per year x 

 1 flight / 0.61 hours = 

 1.68 x 105

 flight cycles 

 Short-term Level 5 Outcomes = 

 = 7.59 x 10-6 x 1.68 x 105 = 1.28 Level 5 outcomes 

 Short-term Level 4 Outcomes = 

 = 2.28 x 10-5 x 1.68 x 105 = 3.83 Level 4 outcomes 

 Short-term Level 3 Outcomes = 

 = 7.59 x 10-5 x 1.68 x 105 = 12.75 Level 3 outcomes 

 Long-term Exposure = 

 20 x Short-term Exposure = 

 3.36 x 106

 flight cycles 

 Long-term Level 5 Outcomes = 

 = 7.59 x 10-6 x 3.36 x 106 = 25.5 Level 5 outcomes 

 Long-term Level 4 Outcomes = 

 = 2.28 x 10-5 x 3.36 x 106 = 76.6 Level 4 outcomes 

 Long-term Level 3 Outcomes = 

 = 7.59 x 10-5 x 3.36 x 106

 = 255 Level 3 outcomes 

g. Risk Guidelines. We have plotted the uncorrected individual risk and fleet risk in 

Figure 6. 

 For Level 5 outcomes: 

o The uncorrected individual risk is above the risk guideline for 

mandatory airworthiness action (NPRM) (7.59 x 10-6 > 1 x 10-6) but 

below the risk guideline for immediate action (7.59 x 10-6 < 5 x 10-4). 

o The short-term fleet risk is above the risk guideline for recommending 

immediate action (1.28 > 0.7). 

 For Level 4 outcomes: 

Small Airplane Risk Analysis (SARA) Handbook Revision: Original 

 Date: September 30, 2010 
 26 

o The uncorrected individual risk is above the risk guideline for 

mandatory airworthiness action (NPRM) (2.28 x 10-5 > 1 x 10-5) but 

below the risk guideline for immediate action (2.28 x 10-5 < 5 x 10-3). 

o The short-term fleet risk is just below the risk guideline for immediate 

action (3.83 < 7.0). 

 For Level 3 outcomes: 

o The uncorrected individual risk is just below the risk guideline for 

recommending an NPRM (7.59 x 10-5 < 1 x 10-4). (Note that FAA 

Order 8110.107 directs ASEs to present findings to the CARB if the 

uncorrected individual risk is within two-thirds of the risk guideline.) 

o The short-term fleet risk below the risk guideline for immediate action. 

(12.75 < 70.0). 

An ASE should consider mandatory airworthiness action if any of the risk values at any 

severity level exceeds the risk guidelines. In this example, the risk values for Level 4 and 

Level 5 result in a recommendation for at least an NPRM. The short-term fleet risk for 

Level 5 results in a recommendation for immediate action. 

h. Fatal Accidents. Table 6 provides an estimate of the number of fatal accidents 

that might occur if this airworthiness concern is left uncorrected. (See Table 5 for 

description of method.) Again, ASEs will not use these values for making 

recommendations for airworthiness action. Management may use these values for 

resource allocation.

Table 6: Estimated Number of Fatal Accidents for Example Problem 

Hazard 

Level 

Recommended 

Fatal Accident Ratio

Estimated Number of Fatal Accidents 

Level 5 1.00 Level 5 Fatal Accidents = 

1.00 x 25.5 = 25.5 

Level 4 0.10 Level 4 Fatal Accidents = 

0.10 x ( 76.6 – 25.5 ) = 5.1 

Level 3 0.00 Level 3 Fatal Accidents = 

0.00 x ( 255 – 76.6 – 25.5 ) = 0.0 

Total Estimated Fatal Accidents 30.6 

i. Control Program Risk. Any control program in this example must be capable of 

reducing the individual risk below the long-term individual risk guidelines shown in 

Figure 6. Because of the high level of the fleet risk for Level 5 events (1.28 Level 5 

events over the next year) any control program must also consider the control program 

fleet risk guideline for Level 5 events, no more than 0.7 Level 5 events while the control 

Small Airplane Risk Analysis (SARA) Handbook Revision: Original 

 Date: September 30, 2010 
 27 

program is implemented across the fleet. If we expect 1.28 events to occur in just one 

year, any control program in this example would have to quickly remove and replace the 

affected components across the fleet.

 Candidate Control Program: Fleetwide replacement of affected component 

within a six month period. 

o Control program fleet risk (Level 5) = 7.59 x 10-6 per flight cycle x 

0.5 year x 820 airplanes x 125 hours per airplane per year x 

 1 flight / 0.61 hours = 0.64 Level 5 Events 

o The control program fleet risk is below the control program risk 

guideline ( 0.64 Level 5 Events < 0.70 Level 5 Events) 

Small Airplane Risk Analysis (SARA) Handbook Revision: Original 

 Date: September 30, 2010 
 28 

Figure 6: Example Problem for Avionics, Airplane Systems and Equipment, and 

Powerplant, Propeller and APU Installations Uncorrected Individual Risk Of Level 5 Outcomes (Frequency of Level 5 Outcomes) Number of Outcomes per Hour(per Flight)

Event Guidelines for AC 23.1309-1D Class I Airplanes

(Single Reciprocating Engine Airplanes < 6,000 lbs. 

Use also for Restricted Category Agricultural Airplanes, 

Normal Category Airships, and Sailplanes)

100 104 103 102 101 108 107 106 105

Exposure, Fleet Hours(Cycles)

10-2

10-6

10-5

10-4

10-3

10-7

0.7 Outcomes

High Risk

Reasonable Risk

Excessive Risk

High Risk

(if more than 0.7 outcomes 

expected in next 1 year period)

Uncorrected Individual Risk

Of Level 4 Outcomes

(Frequency of Level 4 Outcomes)

Number of Outcomes per Hour(per Flight)

100 104 103 102 101 108 107 106 105

10-1

10-5

10-4

10-3

10-2

10-6

7.0 Outcomes

High Risk

Reasonable Risk

Excessive Risk High Risk

(if more than 7.0 outcomes 

expected in next 1 year period)

Exposure, Fleet Hours(Cycles)

Uncorrected Individual Risk

Of Level 3 Outcomes

(Frequency of Level 3 Outcomes)

Number of Outcomes per Hour(per Flight)

100 104 103 102 101 108 107 106 105

100

10-4

10-3

10-2

10-1

10-5

 70 Outcomes

High Risk

Reasonable Risk

Excessive Risk

High Risk

(if more than 70 outcomes 

expected in next 1 year period)

Exposure, Fleet Hours(Cycles)

X X

Uncorrected Individual Risk

Short-Term Exposure

Long-Term Exposure

Short-Term Uncorrected Fleet Risk

Long-Term Uncorrected Fleet Risk

X X Uncorrected Individual Risk

X X

Small Airplane Risk Analysis (SARA) Handbook Revision: Original 

 Date: September 30, 2010 
 29 

2-5 The Large Fleet Problem 

a. Problem Statement. One consequence of relatively low values for the acceptable 

uncorrected risk guidelines for Class I airplanes is that a particular failure and outcome 

can occur at a rate below the uncorrected individual risk guideline but still have relatively 

high uncorrected fleet risk. A failure can occur in a large fleet of airplanes at a rate 

acceptable to the individual risk guidelines (and to type certification requirements) but we 

expect a substantial number of Level 5 or Level 4 outcomes to occur. 

b. Example. 

 Fleet size: 25,000 airplanes (Cessna 172s currently on the FAA registry) 

 Long-term (20 years) Exposure: 

 25,000 airplanes x 125 hours/year/airplane x 20 years = 

 6.25 x 107

 fleet flight hours. 

 Uncorrected Individual Risk for Level 5 outcomes: 

 1 x 10-7 Level 5 outcomes per flight hour (for example) 

 Uncorrected Long-term Fleet Risk: 

 6.25 x 107

 fleet flight hours x 1 x 10-7 Level 5 events / flight hour = 

 6.25 Level 5 events 

In this example, the uncorrected individual risk is below the risk guidelines for Level 5 

outcomes in Class I airplanes. However, because of the large fleet size, we expect a 

significant number of Level 5 events over the next 20 years. 

c. Fleet Size. We have depicted this result on the Level 5 risk guideline shown in 

Figure 7 along with the expected number of Level 5 events for a range of fleet sizes. We 

have also summarized the Figure 7 data in the following table. 

Table 7: Effect of Fleet Size on Expected Number of Events 

Affected 

Fleet Size 

Hours 

per year 

per 

airplane 

20-Year 

Fleet Exposure

(hours) 

Uncorrected 

Individual Risk 

(Level 5 outcomes 

per flight hour) 

Uncorrected 

Fleet Risk 

(Level 5 outcomes)

1,000 125 2.50 x 106 1 x 10-7 0.25 

4,000 125 1.00 x 107 1 x 10-7 1.00 

25,000 125 6.25 x 107 1 x 10-7 6.25 

d. Level of Safety Provided by Type Certification. In general, we cannot require a 

higher level of safety for continued operational safety than we require for type 

certification. The corresponding certification requirement 14 CFR § 23.1309 (and AC 

23.1309-1D) was written with the intent of reducing the acceptable level of certitude for 

complex systems that provide an overall increase in the level of safety by improving pilot 

situational awareness. However, many simple systems in small airplanes were type 

certificated without consideration of their failure rates. In cases of simple systems or 

systems with a long history of satisfactory service history in other airplanes, we may 

require higher levels of safety (acceptable uncorrected individual risk) than AC 23.1309-

1D recommends. 

Small Airplane Risk Analysis (SARA) Handbook Revision: Original 

 Date: September 30, 2010 
 30 

Small Airplane Risk Analysis (SARA) Handbook Revision: Original 

 Date: September 30, 2010 

e. Recommendations. In situations where the uncorrected individual risk guideline 

is not exceeded, the ASE and CARB should still consider airworthiness action if we 

expect one or more Level 5 events or 10 or more Level 4 events over a 20 year period. 

The ASE and the CARB should consider: 

 The number of outcomes expected over 20 years (long-term fleet risk). 

 How close the uncorrected individual risk is to the risk guidelines. 

 How much confidence we have in the uncorrected individual risk including 

hazard ratios and the frequency of the failure or defect. 

 The reliability of similar systems installed on other airplanes. 

 Input from the design approval holder, industry associations, and type clubs. 

Figure 7: Effect of Fleet Size on Expected Number of Events Uncorrected Individual Risk Of Level 5 Outcomes (Frequency of Level 5 Outcomes) Number of Outcomes per Hour(per Flight)

0.7 Outcomes

1,000

4,000

25,000
 31 

Chapter 3. SARA Process for Powerplant, Propeller, and APU Installations 

3-1 Description of Included Systems 

This section describes the SARA process for powerplant, propeller, and APU 

installations typically certificated under part 23 subpart E (or predecessor regulations). 

ASEs should use the SARA process for powerplant, propeller, and APU installations, 

including, but not limited to, the following airplane components. 

a. The airplane powerplant installation, including: 

 Main engines and propellers, 

 Engine and propeller accessories including engine oil systems, engine 

bleed systems, gear boxes, etc., 

 Engine and propeller controls and indications, 

 Engine and propeller protection systems, including engine fire 

protection systems, engine over-speed protection systems, engine icing 

protection systems, etc., 

 Engine nacelles and cowling, including inlets, exhaust nozzles, core 

cowls, fan cowls, thrust reversers, etc., 

 Engine struts and pylons, and 

 Fuel systems, including fuel feed systems, refuel and de-fuel systems, 

fuel transfer systems, fuel system controls and indications, etc. 

b. The auxiliary power unit (if installed), including: 

 The APU, 

 APU accessories, 

 APU inlet and exhaust systems, 

 APU control systems, 

 APU indicating systems, 

 APU fire protection systems, and 

 APU bleed air systems, etc. 

3-2 Evaluation Methods 

The risk evaluation for powerplant, propeller, and APU installations is the same as that 

described in Chapter 2 for avionics and airplane systems and equipment. ASEs should 

use the SARA process when the airworthiness concern involves issues associated with 

the airplane design. For issues concerning the powerplant, propeller, or APU design, 

Small Airplane Risk Analysis (SARA) Handbook Revision: Original 

 Date: September 30, 2010 
 32 

ASEs should refer to the Engine and Propeller Directorate Continued Airworthiness 

Assessment Process Handbook for powerplant design issues. 

3-3 Working With the Engine and Propeller Directorate 

Safety concerns involving powerplant, propeller, or APU installations in small airplanes 

will often require close coordination between the ACO, SAD, and E&PD. For safety 

concerns resulting from shortcomings in the airplane design, exclusive of the engine 

(propeller or APU) design, SAD will be responsible for making control program 

decisions. Similarly, for safety concerns caused primarily by shortcomings within the 

engine type design, the E&PD is responsible for making control program decisions. 

Different risk management objectives may lead to differences between Directorates on 

the appropriate actions necessary to address identified unsafe conditions, or on the timing 

of those actions. Due to the inter-involvement of the Directorates with propulsion related 

safety issues, especially those that are installation dependent, close coordination is 

recommended. However, if differences persist after coordination and discussion of the 

assumptions, available data, and objectives, the final control program decision will rest 

with the Directorate having airworthiness responsibility for the associated product. 

The E&PD has developed the Engine and Propeller Directorate Continued Airworthiness 

Assessment Process Handbook (Draft) to provide ASEs with guidance specific to 

evaluating safety concerns resulting primarily from the powerplant design. ASEs should 

refer to the E&PD guidance for powerplant design issues. 

3-4 Hazard Ratios and Risk Guidelines 

The risk analysis for safety concerns resulting primarily from shortcomings in the 

airplane design uses the same SARA methods described in Chapter 2 for avionics and 

airplane systems and equipment. ASEs should refer to the guidance and methods 

included in Chapter 2 of this handbook when evaluating safety concerns involving 

powerplant, propeller, or APU installations in small airplanes. 

a. Hazard ratios. ASEs may use the recommended hazard ratios in Table 8 and 

Table 9 when evaluating safety concerns resulting primarily from shortcomings in the 

airplane design. If the safety concern results from the engine design, ASEs should use the 

guidance provided in the Engine and Propeller Directorate Continued Airworthiness 

Assessment Process Handbook. 

b. Risk guidelines. ASEs should use the risk guidelines in Figures 2, 3, 4, and 5 

when evaluating safety concerns involving powerplant, propeller, or APU installations in 

small airplanes in which the design of the airplane is the primary shortcoming. 

Otherwise, ASEs should use the guidance provided in the Engine and Propeller 

Directorate Continued Airworthiness Assessment Process Handbook. 

Small Airplane Risk Analysis (SARA) Handbook Revision: Original 

 Date: September 30, 2010 
 33 

Table 8: Recommended Hazard Ratios for Single-Engine Powerplant, Propeller, and 

Auxiliary Power Unit Installations (Use only when the safety concern involves 

shortcomings in the airplane design. Otherwise, refer to the Engine and Propeller 

Directorate Continued Airworthiness Assessment Process Handbook) 

Failure Condition Hazard Ratios 

Level 5 Level 4 Level 3 

Propeller Separation .05 .12 1.0 

PROP_FAILURE 

PROP_SEPARATION 

PROP_HUB 

PROP_TIP_SEPARATION 

Propeller Debris .01 .02 .05 

PROP_COUNTERWEIGHT 

PROP_EROSION_STRIP_SEPARATION 

Control System .01 .03 1.0 

PROP_ENG_OVERSPEED 

PROP_FLAT_PITCH 

PROP_GOVERNOR 

PROP_LOW_PITCH 

PROP_RUNAWAY 

PROP_NOT_FEATHER 

Engine Shutdown .01 .1 1.0 

ENGINE_SHUTDOWN 

Engine Fire (reference AC 39-8)

ENGINE_FIRE_IN_ENGINE 

ENGINE_APU_FIRE 

Engine Uncontained (reference AC39-8)

ENGINE_UNCONTAINED_FAILURE 

ENGINE_APU_UNCONTAINED 

Small Airplane Risk Analysis (SARA) Handbook Revision: Original 

 Date: September 30, 2010 
 34 

Small Airplane Risk Analysis (SARA) Handbook Revision: Original 

 Date: September 30, 2010 

Table 9: Recommended Hazard Ratios for Multi-Engine Powerplant, Propeller, and 

Auxiliary Power Unit Installations (Use only when the safety concern involves 

shortcomings in the airplane design. Otherwise, refer to the Engine and Propeller 

Directorate Continued Airworthiness Assessment Process Handbook) 

Failure Condition Hazard Ratios 

Level 5 Level 4 Level 3 

Propeller Separation .3 .45 1.0 

PROP_FAILURE 

PROP_SEPARATION 

PROP_HUB 

PROP_TIP_SEPARATION 

Propeller Debris .2 .2 1.0 

PROP_COUNTERWEIGHT 

PROP_EROSION_STRIP_SEPARATION 

Control System .01 .03 1.0 

PROP_ENG_OVERSPEED 

PROP_FLAT_PITCH 

PROP_GOVERNOR 

PROP_LOW_PITCH 

PROP_RUNAWAY 

PROP_NOT_FEATHER 

Engine Shutdown .01 .1 1.0 

ENGINE_SHUTDOWN 

Engine Fire (reference AC 39-8)

ENGINE_FIRE_IN_ENGINE 

ENGINE_APU_FIRE 

Engine Uncontained (reference AC39 -8)

ENGINE_UNCONTAINED_FAILURE 

ENGINE_APU_UNCONTAINED 
 35 

Chapter 4. SARA Process for Airframe and Occupant Protection 

4-1 Airframe Risk Analysis 

Approximately seventy percent of all airframe airworthiness directives address metal 

fatigue and twenty-five percent address corrosion. A quantitative, probabilistic risk 

analysis capable of predicting when a structural component would fail and cause an 

accident requires a probabilistic damage tolerance analysis. 

The vast majority of the small airplane fleet received type certification prior to the 

regulations that required fatigue evaluation. Only a small percentage of the small airplane 

fleet has damage tolerance information readily available. It is impractical to expect type 

certificate holders to develop the required information in a timely manner to support COS 

investigations. 

The SARA process therefore bases COS decisions on whether fatigue cracks or corrosion 

are likely to occur on other airplanes in the fleet and whether these cracks or corrosion 

will reduce the strength of the structure to below certification basis levels. 

4-2 Hazard Level Definitions for Airframe – Primary Structure 

A defect or failure in primary structure that reduces margins of safety below that required 

by the type design certification basis should be considered for airworthiness action. An 

ASE can assign a hazard level to these defects or failures following the guidance in Table 

10. 

Table 10: Structural Hazard Level Classifications 

Hazard Level Residual Strength Residual Stiffness 

(Flutter Speed) 

Level 5 ≤ 100% Limit Load ≤ 1.0 VD

Level 4 ≤ 130% Limit Load ≤ 1.1 VD

Level 3 < 150% Limit Load < 1.2 VD

Examples of such defects or failures include, but are not limited to: 

 Fatigue cracks and stress corrosion cracking in metallic structure, 

 Corrosion in metallic structure that reduces the strength of the structure by 

reducing effective net section or that causes corrosion pitting and cracking, 

 Quality control escapes in metallic structure resulting in under-strength parts 

or components. Examples would include incorrect alloy, incorrect heat 

treatment, missing or incorrect fasteners, inadequate edge margins, or 

misdrilled holes. 

Small Airplane Risk Analysis (SARA) Handbook Revision: Original 

 Date: September 30, 2010 
 36 

 Delaminations, disbonds, or susceptibility to barely visible impact damage 

(BVID) in composite structure. 

 Quality control escapes in composite structure including incomplete bonding, 

voids, foreign material inclusion, process errors, missing or incorrect 

fasteners, inadequate edge margins, or misdrilled holes. 

 Defects or failures that alter the stiffness or mass distribution of the structure 

resulting in a reduction in the flutter margins below that required by the type 

design certification basis. Stiffness may be affected by the same defects or 

failures as strength, including fatigue cracks, stress corrosion cracking, 

corrosion, delaminations and disbonds, and quality control escapes. The mass 

distribution of the structure could be effected by conditions such as moisture 

ingress in honeycomb or composite structures. 

 Defects or failures that reduce the fatigue life of life limited components, 

reduce the inspection threshold or inspection interval of damage tolerant 

components (reduced residual strength capability), or that require more 

effective inspection methods of damage tolerant components. These defects or 

failures could include quality control escapes resulting in use of material with 

inferior fatigue, crack growth, or fracture properties. 

4-3 Investigation of Airworthiness Issue 

ASEs should investigate the cause of an airworthiness concern to determine whether the 

defect or failure may occur on other products of the same type design. Airworthiness 

concerns that are not expected to occur elsewhere in the fleet, for example, corrosion 

caused by accidental spillage of a corrosive fluid, are generally not candidates for 

mandatory airworthiness action. AC 91-82 provides a discussion of investigating 

instances of fatigue cracking. If the ASE’s investigation shows that the airworthiness 

concern may occur on other products of the same type design, the ASE should make 

recommendations on airworthiness action based on the defect’s or failure’s effect on the 

structure as defined in Table 10. 

4-4 Quantitative Analysis 

ASEs should make airworthiness recommendations based on the results of their 

investigation of the airworthiness issue and their quantitative assessment of the hazard 

level of the airworthiness concern. ASEs do not need to complete a probabilistic analysis 

to determine whether an airworthiness concern is an unsafe condition. The majority of 

primary structure in small airplanes is single-load path structure designed without the 

benefit of fail-safe or damage tolerance principles and maintained without the benefit of 

directed inspection programs. A probabilistic approach for these structures is not 

appropriate for making decisions on whether airworthiness action is necessary. 

However, an ASE should complete a quantitative risk analysis to determine the 

effectiveness of candidate control programs. To complete this analysis, the ASE needs to 

determine the expected number of airplanes or components with the defect or failure and 

Small Airplane Risk Analysis (SARA) Handbook Revision: Original 

 Date: September 30, 2010 
 37 

the effectiveness of the candidate control programs. We discuss the usual types of defects 

or failures affecting primary structure, the control programs we typically use to address 

these issues, and how to evaluate candidate control programs in the following paragraphs. 

We have developed the worksheets provided in Appendix 2 to assist ASEs in evaluating 

airframe concerns. These worksheets are available on the Directorate’s COS website. 

4-5 Quality Escapes in Primary Structure (Fixed Number of Affected 

Components) 

a. Need for Corrective Action. An ASE should base a recommendation on 

corrective action largely on the quality escape’s hazard level, as defined in Table 10. 

Quality escapes may include engineering errors, manufacturing and assembly errors, or 

inspection errors. 

b. Uncorrected Individual and Fleet Risk. In a quality escape situation, the 

uncorrected fleet risk (both short-term and long-term) is equal to the number of airplanes 

manufactured with the quality escape. The uncorrected individual risk for level 3 

outcomes is 1.0 per flight or per hour. This value for uncorrected individual risk is above 

the risk guidelines used in the avionics, airplane systems and equipment, and powerplant, 

propeller and APU installation approach for taking immediate action. 

c. Immediate Action. We typically address quality escapes in primary structure 

using a two step approach. The first is to take immediate action (Emergency AD or IAR) 

placing temporary operating limitations on the affected airplanes. For example, quality 

escapes that reduce the structure’s static strength can be mitigated in the short-term by 

reducing the airplane’s maximum weight, limit load factor, and operating airspeeds. 

Other immediate actions may include inspection of the airplane to determine if the 

quality escape exists on the airplane 

d. Control Programs. The immediate action described above may be able to 

mitigate the risk associated with continued operation of quality escapes. However, we do 

not allow continued reliance on operating limitations as a permanent fix for a defect in 

primary structure when modifications or repairs can eliminate the cause of the unsafe 

condition. (See FAA IR-M-8040.1C Airworthiness Directives Manual.) We therefore 

follow the immediate action with an NPRM to require repair, modification, or 

replacement of the affected components. 

A typical quality escape scenario is depicted in Figure 8. We know, from the 

manufacturer, that a small number of airplanes were manufactured with the defect, 17 

airplanes in this example. If we did not intervene with a control program, the 17 airplanes 

would continue to operate with the defect. (Of course, the company would issue service 

information and some owners might voluntarily comply with the service information. 

However, we would not accept voluntary compliance as an acceptable control program 

for Level 3 or higher defects in primary structure.) 

The short-term control program mitigates the risk until we can implement the long-term 

control program. The elapsed calendar time (and fleet exposure) to implement the longterm program is depicted in Figure 8. This delay corresponds to the time to complete the 

NPRM process and the compliance time allowed in the final rule. The long-term plan 

Small Airplane Risk Analysis (SARA) Handbook Revision: Original 

 Date: September 30, 2010 
 38 

replaces, modifies, or repairs as quickly as possible. The long-term control program 

should be capable of replacing or modifying all of the quality escape components in a 

reasonable period of time. Factors ASEs should consider in determining a compliance 

schedule include the availability of replacement components, maintenance resources, and 

the hazard level (Level 3/4/5) of the quality escape. 

e. Control Program Risk. The short-term control program should reduce the future 

risk of components with below required strength to zero so that the control program risk 

is zero. It is possible that operating restrictions may not be 100% effective in reducing the 

risk. A pilot may intentionally or inadvertently exceed the reduced limitations. An ASE 

may consider the possibility of airplanes exceeding the reduced limitations in 

determining the control program risk. This may be an important consideration in 

instances of large affected fleet sizes or the types of operation. The long-term control 

program should be capable of replacing or modifying all of the quality escape 

components in a reasonable period of time. 

f. Fatal Accidents. ASEs should use the values in Table 5 for estimating the 

number of fatal accidents resulting from long-term fleet exposure. ASEs should consider 

adjusting the fatal accident ratio for Level 5 outcomes when the structure’s strength is 

reduced below limit load or the flutter speed is reduced to within the normal operating 

envelope. For example, if the structure is only capable of 2g, we would expect nearly 

100% of the quality control defects to result in fatal accidents. 

Figure 8: Example Quality Escape Scenario 

Small Airplane Risk Analysis (SARA) Handbook Revision: Original 

 Date: September 30, 2010 
 39 

4-6 Corrosion in Primary Structure (Constant Defect or Failure Rate) 

a. Need for Corrective Action. An ASE should base a corrective action 

recommendation on the corrosion hazard level, defined in Table 10, and the root cause of 

the corrosion finding. In making a recommendation on the need for corrective action, an 

ASE should understand that, left uncorrected, an instance of corrosion with Level 3 

effects may progress in hazard level to Level 4 and Level 5. An ASE should consider not 

only the current hazard level of a corrosion finding, but the potential for the finding to 

progress in hazard level. 

An ASE may not always have adequate data from the corrosion finding or from the 

manufacturer to make a quantitative determination of hazard level. In these cases, an 

ASE should use engineering judgment to make a qualitative determination of hazard 

level. Table 11 provides guidance an ASE should consider in making a qualitative 

determination of hazard level. 

Table 11: Qualitative Hazard Level Descriptions for Corrosion (Use only if residual 

strength and stiffness data is not available.) 

Hazard Level Description of Corrosion 

Corrosion through 25% or more of the component cross 

sectional area. 

Level 5 

Corrosion that is a potentially urgent airworthiness 

concern requiring immediate action. 

Level 4 Corrosion through up to 25% of the component cross 

sectional area. 

Corrosion that requires rework / blend-out that exceeds 

allowable limits, requiring a repair or complete or partial 

replacement of a principal structural element (PSE) as 

defined by the original equipment manufacturer’s 

structural repair manual. 

Corrosion that is widespread and requires blend-out 

approaching allowable rework limits. 

Level 3 

Corrosion through up to 10% of the component thickness. 

b. Uncorrected Individual and Fleet Risk. Estimating the uncorrected individual 

and fleet risk for corrosion issues has to consider that instances of corrosion that start 

with Level 3 consequences will likely progress in hazard level to Level 4 and Level 5 

consequences. Estimating when corrosion reaches Level 4 or Level 5 would require 

knowledge of the rate at which the structural component is corroded away. In general, we 

do not have data or a statistical model that provides us with this knowledge. However, we 

do know that we expect all instances of Level 3 corrosion to progress to Level 4 and then 

Level 5 with an associated time lag between the different hazard levels. In estimating the 

uncorrected risk, it is sufficient to set the risk of Level 4 and Level 5 outcomes to the 

same value as for Level 3, recognizing that each level is reached at a different point in 

Small Airplane Risk Analysis (SARA) Handbook Revision: Original 

 Date: September 30, 2010 
 40 

time. In estimating the uncorrected individual risk and fleet risk, ASEs should consider 

that corrosion may be significantly under-reported in the service history. ASEs may 

increase the number of corrosion findings used in the risk analysis to account for the 

effect of under-reporting. 

c. Immediate Action. Immediate action is sometimes necessary in addressing 

corrosion issues. An ASE should consider immediate action in the following situations: 

 The airworthiness concern is the result of finding Level 4 or Level 5 

corrosion in a Class IV airplane. 

 The airworthiness concern is the result of finding Level 5 corrosion in a 

Class I, II, or III airplane. 

 An inspection program required by an existing AD was not adequate to 

detect corrosion before it reached Level 5 consequences. 

d. Control Programs. We typically address unsafe conditions due to corrosion with 

inspections and on-condition repairs, part replacement, or modifications. Some corrosion 

airworthiness actions require application of corrosion prevention treatments. 

Airworthiness actions should correct root causes of corrosion, for example, plugged drain 

holes, when possible. 

An ASE may predict the expected number of future corrosion events (with at least Level 

3 effects) assuming a constant defect or failure rate, based on service history. An ASE 

may adjust the estimated failure rate to account for under-reporting of corrosion. 

Instances of minor corrosion, including Level 3 corrosion, may especially be underreported in the available databases. ASEs should consider alternate measures of exposure, 

such as calendar years rather than the usual measure of flight cycles or flight hours. 

(More advanced statistical methods for predicting the expected number of corrosion 

events often do not give more accurate or reliable predictions due to the variables that 

effect corrosion initiation.) 

ASEs do not need to make separate predictions of the expected number of Level 4 or 

Level 5 events. Making these detailed predictions would require data on how fast 

corrosion progresses through a structural component. 

e. Control Program Risk. In the absence of terminating action or addressing the 

cause of the corrosion, we expect instances of corrosion to continue to occur and progress 

in hazard level throughout the fleet. In these cases, a corrosion control program should be 

capable of detecting corrosion before the hazard level progresses beyond Level 3. The 

control program risk for Level 3 outcomes may therefore remain relatively high. 

However, the control program risk for Level 4 or Level 5 outcomes should be zero. 

ASEs should monitor the in-service performance of the control program. Mandatory 

inspection finding reports included in the airworthiness action can assist ASEs in 

collecting data on the control program effectiveness. ASEs should consider more frequent 

inspections or additional actions, including application of corrosion prevention 

treatments, for any control program that does not detect corrosion before it progresses in 

hazard level to Level 4 or Level 5. 

Small Airplane Risk Analysis (SARA) Handbook Revision: Original 

 Date: September 30, 2010 
 41 

f. Fatal Accidents. A review of past airworthiness action suggests that about 1 in 20 

corrosion ADs is a direct result of a fatal accident. The remaining ADs are the result of 

corrosion findings that were externally visible or detectable (fuel leak or wavy or bubbled 

skin) or found at annual inspection. Based on this data, an estimate of the number of fatal 

accidents would be five percent of all occurrences of corrosion. 

4-7 Metal Fatigue in Primary Structure 

a. Need for Corrective Action. Metal fatigue is of particular concern as an 

airworthiness issue. We expect the number of cracks in the fleet to increase exponentially 

as the fleet ages, with a significant percentage, if not the entire fleet, eventually 

experiencing the same fatigue cracking scenario. We also expect a crack with Level 3 

consequences to grow in size and progress in hazard level to Level 4 and Level 5 

consequences. An ASE should recommend corrective action for reports of fatigue 

cracking that result or will result in at least Level 3 consequences. 

An ASE may not always have adequate data from the fatigue crack finding or from the 

manufacturer to make a quantitative determination of the hazard level. In these cases, an 

ASE should use engineering judgment to make a qualitative determination of the hazard 

level. Table 12 provides guidance an ASE should consider in making qualitative 

determinations. 

Table 12: Qualitative Hazard Level Descriptions for Fatigue Cracks (Use only if residual 

strength and residual stiffness data is not available.) 

Hazard Level Description of Fatigue Crack 

Level 5 Fatigue crack through 25% of the cross sectional area 

up to and including total component failure. 

Level 4 Fatigue crack at least 0.10 inch in maximum dimension 

up to 25% of the cross sectional area. 

Level 3 Fatigue crack less than 0.10 inch in maximum 

dimension. 

b. Uncorrected Individual and Fleet Risk. Metal fatigue usually presents itself as 

cracks found in service. Other scenarios may include data provided by the type certificate 

holder showing that cracks are likely to form or that existing life limits should be 

shortened. In each of these scenarios ASEs should estimate the uncorrected individual 

and fleet risk by estimating the number of cracks currently present in the fleet and the 

number of cracks likely to develop in the future. ASEs can determine these values using 

the life analysis methods described below. 

Estimating the uncorrected individual and fleet risk for fatigue issues is similar to 

corrosion in that fatigue that starts with Level 3 consequences will likely progress in 

Hazard level to Level 4 and Level 5 consequences. Estimating when a fatigue crack 

reaches Level 4 or Level 5 would require knowledge of the crack growth rate. This data 

is not available for the majority of the small airplane fleet. However, we do know that we 

expect all instances of Level 3 fatigue cracking to progress to Level 4 and then Level 5 

with an associated time lag between the different hazard levels. In estimating the 

uncorrected risk, it is sufficient to set the risk of Level 4 and Level 5 outcomes to the 

Small Airplane Risk Analysis (SARA) Handbook Revision: Original 

 Date: September 30, 2010 
 42 

same value as for Level 3, recognizing that each level is reached at a different point in 

time. 

c. Immediate Action. Immediate airworthiness action is sometimes necessary in 

addressing fatigue issues. An ASE should consider immediate action in the following 

situations: 

 The airworthiness concern is the result of finding a Level 4 or Level 5 fatigue 

crack in a Class IV airplane. 

 The airworthiness concern is the result of finding a Level 5 fatigue crack in a 

Class I, II, or III airplane. 

 An inspection program required by an existing AD was not adequate to detect 

a Level 5 crack. 

d. Control Programs. AC 91-82 describes how an applicant can develop a control 

program based on inspections or component replacement/modification to address fatigue 

cracking. We expect control programs based on replacement/modification to provide a 

higher degree of risk mitigation than control programs based on inspections alone. 

Removing the source of the unsafe condition with a design change clearly reduces the 

risk to the least practical amount. 

Control programs based on damage tolerance-based inspections with on-condition repair 

or modification may be capable of managing the risk associated with fatigue cracking. 

Without changes to the design, we expect fatigue cracks to continue to initiate throughout 

the fleet and any cracks will progress in hazard level. Any inspection-based control 

program should be capable of detecting instances of fatigue cracking before they progress 

in hazard level beyond Level 3. An ASE should consider a fatigue crack finding with 

Level 4 or Level 5 consequences during a repetitive inspection as evidence that the 

control program is not capable of adequately mitigating the risk. In these cases, the FAA 

may require a control program based on fleet-wide component replacement/modification. 

In evaluating control programs for fatigue, ASEs will need to complete a life analysis to 

determine: 

 The time-in-service (TIS) corresponding to a cumulative probability of 1-in1,000 (1/1,000) of a crack initiating in a component. (For the purposes of life 

analysis, ‘crack initiation’ corresponds to the existence of a ‘small’ fatigue 

crack. This may be the smallest, reliably detectable crack size or a crack 

approximately 0.10 inches in maximum dimension.) Components at or above 

this TIS require a control program. Components below this TIS can continue 

to operate without restrictions. 

 The number of cracked components we expect at any point in the service life 

of the fleet. This information, combined with crack growth data, allows us to 

estimate the number of Level 3, Level 4, and Level 5 cracking events at any 

point in the fleet’s service life. 

e. Life Analysis. A life analysis uses statistical distributions (typically a two 

parameter Weibull distribution) to estimate the fleet-wide distribution of time-in-service 

(TIS) to the initiation of fatigue cracking. Figure 9 presents a typical life analysis using 

Small Airplane Risk Analysis (SARA) Handbook Revision: Original 

 Date: September 30, 2010 
 43 

Figure 9: Life Analysis Example 

The Directorate encourages ASEs to become familiar with life analysis methods. We 

realize that many ASEs may have infrequent opportunities to complete a life analysis and 

use available software tools. In these circumstances, the Directorate will assist the ASE in 

completing the analysis. The Directorate’s COS SharePoint site provides points of 

contact for assistance in life analysis. 

ASEs completing a life analysis should use the following standard methodology: 

 Time-in-Service (TIS): ASEs should determine the TIS for crack findings and 

negative inspection results (suspensions) from the TIS included in inspection 

reports. If this data is not available, an ASE can estimate the TIS based on 

fleet demographic snapshots provided on the SAD COS SharePoint site. 

 Suspensions: Suspensions should be included in the analysis to account for 

the remainder of the fleet without known crack detections. Suspensions are 

usually components known not to be cracked after a directed inspection. We 

will assume that components that have not yet been inspected are also 

suspensions. 

 Components per Airplane: ASEs should be careful to properly count the 

number of components in the fleet. For example, an airplane will have 

Small Airplane Risk Analysis (SARA) Handbook Revision: Original 

 Date: September 30, 2010 
 44 

identical wing-to-fuselage attachment joints on both sides of the airplane. One 

airplane will thus have two components. Both or neither components could be 

cracked, or one could be cracked and the other not cracked. ASEs should base 

the life analysis on the number of components in the fleet, not the number of 

airplanes. 

 Reported Crack Size: Reported fatigue cracks may include cracks ranging in 

size from small cracks to cracks that have grown to the point of component 

failure (complete element fracture). The TIS for larger cracks will include a 

significant portion of time spent growing the crack after crack initiation. The 

discrepancy between the TIS reported for small cracks and large cracks can 

significantly change the results of the life analysis, since we are trying to 

estimate the TIS to crack initiation (assumed to be the presence of a ‘small’ 

crack). An ASE can adjust the TIS for a crack of a given size to the TIS 

corresponding to crack initiation using crack growth data supplied by the 

manufacturer. If this data is not available, an ASE can adjust the TIS based on 

the ‘2/3’ rule of thumb. (If the TIS at component failure due to fatigue was 

15,000 hours, the TIS at crack initiation was approximately 10,000 hours.) If 

crack growth data is not available, an ASE may use the guidance in Table 13 

to adjust the TIS for various crack sizes. 

Table 13: Adjustments to Time-in-Service for Reported Crack Size (Use only if crack 

growth data is not available.) 

Reported Crack Size Approximate TIS at Crack Initiation 

Crack through entire 

cross section, component 

failure 

= Reported TIS / 1.5 

Crack 25% through the 

part thickness 

= Reported TIS / 1.3 

Small crack 

(approximately 0.10 

inches) 

= Reported TIS / 1.0 

 If the life analysis is based on only one reported fatigue crack, the WeiBayes 

distribution (WinSmith/SuperSmith) is the preferred distribution. The Weibull 

slope parameter, β, should be set to 4.5 for aluminum wing and empennage 

structures and to 3.8 for steel wing structures. 

 If the life analysis is based on fewer than 21 reported cracks, the ASE should 

complete both a WeiBayes analysis and a two-parameter Weibull distribution 

using rank regression (this is the default analysis method in 

WinSmith/SuperSmith). The ASE should then use engineering judgment to 

decide which analysis appears to better fit the reported crack findings. An 

ASE should use caution when five or fewer reported cracks are included in the 

analysis. Justifying use of a distribution other than a WeiBayes may be 

difficult in these circumstances. 

Small Airplane Risk Analysis (SARA) Handbook Revision: Original 

 Date: September 30, 2010 
 45 

Figure 10: Life Analysis Flowchart 

Small Airplane Risk Analysis (SARA) Handbook Revision: Original 

 Date: September 30, 2010 
 46 

 If the life analysis is based on 21 or more reported cracks, the ASE should use 

the two-parameter Weibull distribution using rank regression. 

ASEs can use other distributions, including the three-parameter Weibull and log-normal 

distributions, if these distributions provide a significantly better fit to the data. ASEs 

should be careful if confronted with reported cracks that appear to fit a three-parameter or 

‘curved’ Weibull distributions. These cracking scenarios may actually be a mixture of 

more than one underlying distribution representing different cracking scenarios, including 

severe usage and manufacturing issues. ASEs should consult with the Directorate 

whenever the data appears to ‘curve’ or if the ASE uses a distribution other than the twoparameter Weibull distribution in the analysis. 

Life analysis software packages, including WinSmith/SuperSmith, are capable of 

producing many of the risk analysis values we need, including the TIS corresponding to a 

cumulative probability of 1/1,000 and the expected number of cracks at any point in the 

service life of the fleet. ASEs conducting a life analysis can use the software’s 

capabilities to compute these numbers or they can use a spreadsheet developed by the 

Directorate to compute these numbers. The spreadsheet, called FatigueLife, is available 

on the Directorate’s COS SharePoint site. An ASE may also develop their own 

spreadsheet or software code for computing these numbers, using for example, the 

methods in The New Weibull Handook, 4th Edition by Dr. Robert B. Abernethy. 

Figure 10 provides a flowchart of the life analysis process. The flowchart incorporates the 

standard methodology outlined above and is based on many of the best practices 

recommended The New Weibull Handook. 

f. Time-in-Service for Control Program. The Directorate requires a control 

program to address fatigue cracking when a component reaches the TIS corresponding to 

a 1-in-1,000 (1/1,000) cumulative probability of fatigue crack initiation. An ASE can use 

the WinSmith/SuperSmith software or the FatigueLife spreadsheet to determine the B.1 

life (1/1,000). Once a component (airplane) reaches the B.1 life, the component must 

have a fatigue management program (FMP). AC 91-82 provides additional information 

on FMPs.

g. Expected Number of Cracks. An ASE can use the WinSmith/SuperSmith 

software or the FatigueLife spreadsheet to determine the expected number of cracks in 

the fleet. At a minimum, ASEs should determine the expected number of cracks at the 

present time and at one, three, five, ten, and twenty years in the future. ASEs use this 

information to determine the expediency required for control programs relying on 

component replacement or modification and to evaluate the effectiveness of inspectionbased control programs.

h. Calibrating Life Analysis to Reported Crack Findings. ASEs should calibrate 

the life analysis against the number of cracks reported from the field. ASEs should 

complete this analysis only after the majority (if not all) of the components in the fleet 

have been inspected. It is possible, even after updating with the most recent inspection 

results, that the life analysis will over-predict or under-predict the number of cracks in the 

fleet. 

Small Airplane Risk Analysis (SARA) Handbook Revision: Original 

 Date: September 30, 2010 
 47 

ASEs should compare the expected number of cracks at the present time against the 

number of cracks reported in the field. If the life analysis over-predicts the number of 

cracks, the Weibull characteristic life parameter, η, needs to be adjusted to a higher value. 

Conversely, if the life analysis under-predicts the number of cracks, the value of η needs 

to be adjusted to a lower value. 

ASEs should use judgment when making these adjustments. For example, if the life 

analysis predicts 20 cracks and the field reports 19, no adjustment to the analysis is 

necessary. However, ASEs should adjust the analysis if 20 cracks are predicted and only 

15 are reported in the field. ASEs can use the FatigueLife spreadsheet to adjust the value 

of η until there is a reasonable agreement between the analysis and inspection results. 

i. Control Programs Based on Component Replacement or Modification. A 

control program based on component replacement or modification is similar to the ‘safelife’ approach used in type certification. Components above the TIS at which we require 

a control program must be removed from service, replaced, or modified. Components 

with less than the TIS requiring a control program can continue to operate without 

restriction until they reach the TIS. 

The difficulty with the ‘safe-life’ approach in continued operational safety is that several 

in-service components will likely be well above the TIS required for a control program. 

The options available for these components include immediately removing them from 

service (including potential grounding of the airplane) or immediately replacing or 

modifying the component. In many cases, replacement or modification parts may not be 

available or maintenance resources may have limited availability. 

In these cases, the Directorate and the responsible ACO have worked with the design 

approval holder, STC applicants, and airplane owners to develop a staged compliance 

schedule that maintains an acceptable level of safety, maximizes use of available 

replacement or modification hardware and maintenance resources, and minimizes the 

effect on airplane owners. These compliance schedules require those components with 

the highest risk of developing a fatigue crack (high time components) to be replaced or 

modified first, followed by components with lower TIS. 

A control program based on component replacement or modification is depicted in Figure 

11. Control program 1 requires fleet-wide replacement of the affected component over a 

two year compliance time. This control program reduces the expected number of cracks 

in the fleet to the least amount. However, this control program may have the unintended 

consequence of grounding airplanes if sufficient hardware or maintenance resources are 

not available. Control program 2 includes a staged compliance schedule over a four year 

period that addresses high time components first followed by components with lower 

TIS. Control program 2, although resulting in more cracks in the fleet, may provide an 

acceptable level of safety when combined with additional inspections for components 

waiting for replacement or modification. 

Marv Nuss presented a conference paper on a staged compliance program developed for 

the Cessna 402. A copy of his paper and presentation are available on the Directorate’s 

COS website. 

Small Airplane Risk Analysis (SARA) Handbook Revision: Original 

 Date: September 30, 2010 
 48 

Figure 11: Control Program Based on Component Replacement or Modification 

j. Control Programs Based on Damage Tolerance-Based Inspections. Control 

programs based on damage tolerance-based inspections with on-condition repair or 

modification may be capable of managing the risk associated with fatigue cracking. 

These control programs may be capable of maintaining an acceptable level of safety if 

they detect all incidences of fatigue cracking before the crack reaches Level 4 or Level 5.

Figure 12 depicts the effectiveness of a control program based on damage tolerance 

inspections. An effective inspection-based control program should be capable of 

detecting instances of fatigue cracking before they progress in hazard level beyond Level 

3. An ASE should consider a fatigue crack finding with Level 4 or Level 5 consequences 

during a repetitive inspection as evidence that the control program is not capable of 

adequately mitigating the risk. In these cases, the FAA may require a control program 

based on fleet-wide component replacement/modification. 

Inspection programs in which the detectable crack size results in Level 4 or Level 5 

hazards are not acceptable for a long-term control program. In these cases, the FAA will 

require a control program based on fleet-wide component replacement modification. 

These inspections can be used as short-term measures to mitigate the risk associated with 

continued operation until part replacement or modification can occur. 

Small Airplane Risk Analysis (SARA) Handbook Revision: Original 

 Date: September 30, 2010 
 49 

Figure 12: Control Programs Based on Damage Tolerance Inspections 

k. Control Program Risk. Control programs based on fleet-wide component 

replacement or modification should be capable of replacing or modifying all components 

in a reasonable period of time. Factors ASEs should consider in determining a 

compliance schedule include the fleet-wide distribution of TIS and the risk associated 

with continued operation, availability of replacement components, and availability of 

maintenance resources. 

Control programs based on inspections should be capable of detecting fatigue cracks 

before they progress to Level 4 or Level 5 hazards. Mandatory reporting requirements 

included in the airworthiness action can provide ASEs with the data necessary to monitor 

the effectiveness of the inspection program. ASEs should consider more frequent 

inspections or terminating actions if service history shows the inspection program is not 

capable of preventing Level 4 or Level 5 fatigue cracks. 

l. Fatal Accidents. A review of past airworthiness action suggests that about 1 in 20 

fatigue ADs is a direct result of a fatal accident. The remaining ADs are the result of 

findings that were easily detectable (fuel leaks) or found at annual inspection. Based on 

this data, an estimate of the number of fatal accidents would be five percent of all 

occurrences of fatigue. 

4-8 Composite Materials – Primary Structure 

For composite primary structure, ASEs should use the most appropriate method presented 

for metallic primary structure to determine hazard level and the expected number of 

future events. For defects or failures that would be obvious and would be repaired before 

further flight, the residual strength and residual stiffness capability of the structure does 

Small Airplane Risk Analysis (SARA) Handbook Revision: Original 

 Date: September 30, 2010 
 50 

not need to account for environmental factors. If the defect or failure would not be 

detected and repaired before further flight, the residual strength and residual stiffness 

must be calculated using appropriate environmental factors. 

4-9 Other Structure - Control Surfaces, Tabs, and High Lift Devices 

a. Flutter. An ASE should base a recommendation on airworthiness action using the 

methods described for primary structure if the defect or failure in the control surface can 

reduce the flutter margins below that required by the type certification basis. 

b. Separation of Control Surface. An ASE should base a recommendation on 

airworthiness action using the methods described for primary structure if the defect or 

failure may cause the control surface to separate from the airplane and damage vital parts 

of the airplane or cause serious or fatal injuries to persons on the ground. 

c. Reduced Controllability. An ASE should base a recommendation on 

airworthiness action using the methods described for mechanical system risk analysis if 

the defect or failure may reduce the controllability of the airplane in any axis or reduce 

the effectiveness of high lift devices. 

4-10 Other Structure - Secondary Structure 

a. Separation of Secondary Structure. An ASE should base a recommendation on 

airworthiness action using the methods described for primary structure if the defect or 

failure may cause the secondary structure to separate from the airplane and damage vital 

parts of the airplane or cause serious or fatal injuries to persons on the ground, 

b. Reduced Controllability. An ASE should base a recommendation on 

airworthiness action using the methods described for system risk analysis if the defect or 

failure may reduce the controllability of the airplane in any axis or reduce the 

effectiveness of high lift devices. 

4-11 Other Structure - Landing Gear 

Landing gear collapse and failure of the pilot to lower the landing gear are common 

occurrences in small airplanes. The Directorate completed a detailed study (available on 

the SAD COS website) of gear up and collapsed gear incidents in Class I airplanes 

(single reciprocating engine, less than 6,000 lbs). The study showed that no serious or 

fatal injuries have occurred as a result of these incidents. In fact, the highest hazard level 

resulting from these incidents was Level 3, which occurred about 50% of the time. At this 

time, the Directorate believes that ASEs should recommend only voluntary action in 

Class I airplanes to address defects or failures in the landing gear that will result only in 

gear collapse. ASEs may consider mandatory action for airplanes in other classes, due to 

the higher landing speeds and potential for the airplane to be used for hire or in 

commercial operations. 

Small Airplane Risk Analysis (SARA) Handbook Revision: Original 

 Date: September 30, 2010 
 51 

Small Airplane Risk Analysis (SARA) Handbook Revision: Original 

 Date: September 30, 2010 

4-12 Other Structure – Occupant Protection 

An ASE should consider corrective action for any defect or failure in a design feature 

intended to improve survivability in accidents. Examples would include defects or 

failures in safety equipment, including seats, seat belts, shoulder harnesses, or inflatable 

restraints, that lower the strength of the safety equipment below that required by static or 

dynamic occupant protection requirements. Additional examples include interior 

structure intended to retain items of mass or to separate cargo space from the passenger 

compartment. 
Appendix 1 A1-1 

Small Airplane Risk Analysis (SARA) Page 1 of 7 

Avionics, Airplane Systems and Equipment, and 

Powerplant, Propeller and APU Installations 

Worksheet 

Make: 

Model/Series: 

Serial Numbers: 

Date: 

ASE: 

Office: 

Telephone: 

Electronic Mail: Reason for Airworthiness Concern: 

 

 Frequency of Failure (Random or Constant Failure Rate) 

 Service history, total number of failures during selected service history time frame: (input) 

 Fleet exposure, selected service history time frame, years: (input) 

 Fleet exposure, fleet size during selected service history time frame: (input) 

 Fleet exposure, average annual usage, 

 flight hours per airplane per year or flights per airplane per year: (input) 

 Frequency of failure = total number of failures during selected time frame 

 = (calculated) 

selected time frame x fleet size x average annual usage 

 Hazard Ratios 

 Service history, number of failures during selected service history time frame 

 that resulted in Level 5 outcomes: (input) 

 Service history, number of failures during selected service history time frame 

 that resulted in Level 4 outcomes: (includes Level 4 and Level 5 outcomes) (input) 

Service history, number of failures during selected service history time frame 

 that resulted in Level 3 outcomes: (includes Level 3, 4, and 5 outcomes) (input) 

 

 Hazard Ratio, Level 5 = Number of failures that resulted in Level 5 outcomes 

 = (calculated) 

Total number of failures during selected time frame 

Hazard Ratio, Level 4 = Number of failures that resulted in Level 4 outcomes 

 = (calculated) 

Total number of failures during selected time frame 

Hazard Ratio, Level 3 = Number of failures that resulted in Level 3 outcomes 

 = (calculated) 

Total number of failures during selected time frame 

Small Airplane Risk Analysis (SARA) Handbook Revision: Original 

 Date: September 30, 2010 
Appendix 1 A1-2 

Small Airplane Risk Analysis (SARA) Page 2 of 7 

Avionics, Airplane Systems and Equipment, and 

Powerplant, Propeller and APU Installations 

Worksheet 

 

Uncorrected Fleet Risk - Long-term Fleet Risk: 

Number of Level 5 Outcomes = Frequency of Level 5 Outcomes x Long-term Exposure: 

 (calculated) 

 Number of Level 4 Outcomes = Frequency of Level 4 Outcomes x Long-term Exposure: 

 (calculated) 

 

 Number of Level 3 Outcomes = Frequency of Level 3 Outcomes x Long-term Exposure: 

 (calculated) 

 Uncorrected Individual Risk 

 Frequency of Level 5 Outcomes = Frequency of Failure x Level 5 Hazard Ratio: (calculated) 

 Frequency of Level 4 Outcomes = Frequency of Failure x Level 4 Hazard Ratio: (calculated) 

 

 Frequency of Level 3 Outcomes = Frequency of Failure x Level 3 Hazard Ratio: (calculated) 

 Fleet Exposure (Future) 

 Short-term Exposure, expected number of airplanes in fleet over 

the next one year period: (input) 

 Short-term Exposure, average annual usage 

 Flight hours per year per airplane or flights per year per airplane: (input) 

 

 Short-term Exposure = expected number of airplanes in fleet over next one year period x 

Average annual usage x 1 year: (calculated) 

Long-term Exposure, expected number of airplanes in fleet over 

the next 20 year period: (input) 

 Long-term Exposure, average annual usage 

 Flight hours per year per airplane or flights per year per airplane: (input) 

 

 Long-term Exposure = expected number of airplanes in fleet over next 20 year period x 

Average annual usage x 20 years: (calculated) 

 Uncorrected Fleet Risk - Short-term Fleet Risk: 

Number of Level 5 Outcomes = Frequency of Level 5 Outcomes x Short-term Exposure: 

 (calculated) 

 Number of Level 4 Outcomes = Frequency of Level 4 Outcomes x Short-term Exposure: 

 (calculated) 

 

 Number of Level 3 Outcomes = Frequency of Level 3 Outcomes x Short-term Exposure: 

 (calculated) 

Small Airplane Risk Analysis (SARA) Handbook Revision: Original 

 Date: September 30, 2010 
Appendix 1 A1-3 

Small Airplane Risk Analysis (SARA) Page 3 of 7 

Avionics, Airplane Systems and Equipment, and 

Powerplant, Propeller and APU Installations 

Worksheet 

 Plot uncorrected individual risk against short-term and long-term exposure on the appropriate 

risk guidelines given on pages 4, 5, 6, and 7 of this worksheet. 

 The plotted information provides the ASE with a recommendation for appropriate airworthiness action. 

 Comments: (input) 

Small Airplane Risk Analysis (SARA) Handbook Revision: Original 

 Date: September 30, 2010 
Appendix 1 A1-4 

Small Airplane Risk Analysis (SARA) Page 4 of 7 

Avionics, Airplane Systems and Equipment, and 

Powerplant, Propeller and APU Installations 

Worksheet 

0.7 Outcomes

7.0 Outcomes

 70 Outcomes

Small Airplane Risk Analysis (SARA) Handbook Revision: Original 

 Date: September 30, 2010 
Appendix 1 A1-5 

Small Airplane Risk Analysis (SARA) Page 5 of 7 

Avionics, Airplane Systems and Equipment, and 

Powerplant, Propeller and APU Installations 

Worksheet 

Uncorrected Individual Risk

Of Level 5 Outcomes

(Frequency of Level 5 Outcomes)

Number of Outcomes per Hour(per Flight)

Event Guidelines for AC 23.1309-1D Class II Airplanes

(Multi-Engine Reciprocating, Single-Engine Turbine, 

or Multi-engine Turbine Airplanes < 6,000 lbs.)

100 104 103 102 101 108 107 106 105

Exposure, Fleet Hours(Cycles)

10-3

10-7

10-6

10-5

10-4

10-8

0.5 Outcomes

High Risk

Reasonable Risk

Excessive Risk

High Risk

(if more than 0.5 outcomes 

expected in next 1 year period)

Uncorrected Individual Risk

Of Level 4 Outcomes

(Frequency of Level 4 Outcomes)

Number of Outcomes per Hour(per Flight)

100 104 103 102 101 108 107 106 105

10-2

10-6

10-5

10-4

10-3

10-7

5.0 Outcomes

High Risk

Reasonable Risk

Excessive Risk

High Risk

(if more than 5.0 outcomes 

expected in next 1 year period)

Exposure, Fleet Hours(Cycles)

Uncorrected Individual Risk

Of Level 3 Outcomes

(Frequency of Level 3 Outcomes)

Number of Outcomes per Hour(per Flight)

100 104 103 102 101 108 107 106 105

10-1

10-5

10-4

10-3

10-2

10-6

 50 Outcomes

High Risk

Reasonable Risk

Excessive Risk

High Risk

(if more than 50 outcomes 

expected in next 1 year period)

Exposure, Fleet Hours(Cycles)

Small Airplane Risk Analysis (SARA) Handbook Revision: Original 

 Date: September 30, 2010 
Appendix 1 A1-6 

Small Airplane Risk Analysis (SARA) Page 6 of 7 

Avionics, Airplane Systems and Equipment, and 

Powerplant, Propeller and APU Installations 

Worksheet 

Uncorrected Individual Risk

Of Level 5 Outcomes

(Frequency of Level 5 Outcomes)

Number of Outcomes per Hour(per Flight)

Event Guidelines for AC 23.1309-1D Class III Airplanes

(Single-Engine Reciprocating, Multi-Engine Reciprocating, 

Single-Engine Turbine, or Multi-Engine Turbine Airplanes > 6,000 lbs)

100 104 103 102 101 108 107 106 105

Exposure, Fleet Hours(Cycles)

10-4

10-8

10-7

10-6

10-5

10-9

0.3 Outcomes

High Risk

Reasonable Risk

Excessive Risk

High Risk

(if more than 0.3 outcomes 

expected in next 1 year period)

Uncorrected Individual Risk

Of Level 4 Outcomes

(Frequency of Level 4 Outcomes)

Number of Outcomes per Hour(per Flight)

100 104 103 102 101 108 107 106 105

10-3

10-7

10-6

10-5

10-4

10-8

3.0 Outcomes

High Risk

Reasonable Risk

Excessive Risk

High Risk

(if more than 3.0 outcomes 

expected in next 1 year period)

Exposure, Fleet Hours(Cycles)

Uncorrected Individual Risk

Of Level 3 Outcomes

(Frequency of Level 3 Outcomes)

Number of Outcomes per Hour(per Flight)

100 104 103 102 101 108 107 106 105

10-1

10-5

10-4

10-3

10-2

10-6

30 Outcomes

High Risk

Reasonable Risk

Excessive Risk

High Risk

(if more than 30 outcomes 

expected in next 1 year period)

Exposure, Fleet Hours(Cycles)

Small Airplane Risk Analysis (SARA) Handbook Revision: Original 

 Date: September 30, 2010 
Appendix 1 A1-7 

Small Airplane Risk Analysis (SARA) Handbook Revision: Original 

 Date: September 30, 2010 

Small Airplane Risk Analysis (SARA) Page 7 of 7 

Avionics, Airplane Systems and Equipment, and 

Powerplant, Propeller and APU Installations 

Worksheet 

0.1 Outcomes

1.0 Outcomes

 10 Outcomes
Appendix 2 A2-1 

Small Airplane Risk Analysis (SARA) Page 1 of 4 

Airframe and Occupant Protection 

Worksheet

Date: 

ASE: 

Office: 

Telephone: 

Electronic Mail: 

Make: 

Model/Series: 

Serial Numbers: 

Reason for Airworthiness Concern: 

 

Primary Structure – Fatigue (Wearout Failure Rate) 

Material

 Aluminum 

 Steel 

 Other: (Input) 

Component

 Wing 

 Pressurized Fuselage 

 Empennage 

 Other: (Input) 

Analysis Type

 Weibayes 

 Two-Parameter Weibull 

 Other: (Input) 

TIS Adjusted for Crack Size

 Yes 

 No 

Crack Reports

Total Number of Suspensions 

 (Input) 

Total Number of Reported Cracks 

 (Input) 

Number of Level 5 cracks 

 (Input) 

Number of Level 4 cracks 

 (Input) 

Number of Level 3 cracks 

 (Input) 

Analysis Parameters

 Hours 

 Flights 

η = (Input) 

β = (Input) 

B.1 Life = (Input) 

Expected Number of Cracks (Calculated)

(Example Values)

Fleet Hours Expected Number of Cracks 

0 5 

62500 7 

187500 11 

312500 15 

625000 30 

1250000 70 

Expected Number of Cracks

0

20

40

60

80

0 500000 1000000 1500000

Num ber of Cracks

Fleet Hours

Small Airplane Risk Analysis (SARA) Handbook Revision: Original 

 Date: September 30, 2010 
Appendix 2 A2-2 

Small Airplane Risk Analysis (SARA) Page 2 of 4 

Airframe and Occupant Protection 

Worksheet 

Primary Structure – Corrosion (Random or Constant Failure Rate) 

Component Corrosion Reports

 Wing, Outboard Time Period of Findings, years: (Input) 

 Wing, Center Section 

 Fuselage Total Number of Corrosion Findings: (Input) 

 Pressurized Fuselage 

 Empennage Total Number of Level 5 Findings: (Input) 

 Engine Compartment 

 Other: (Input) Total Number of Level 4 Findings: (Input) 

Total Number of Level 3 Findings: (Input) 

Estimated Rate of Under-reporting: (Input) 

Rate of Corrosion (Calculated) (Example Values)

4

1.8

2.2

3

6.7

Year

0

20 48.4

12.0

145.3

Expected Number

of Corrosion Events

Underreported Events

4.0

Underreported Rate of Corrosion, Events per year

Expected Number

of Corrosion Events

Reported Events

Number of Corrosion Reports

Time Frame, Years

Rate of Corrosion, Events per year

Underreporting Factor

Expected Number of Corrosion Events

0.0

20.0

40.0

60.0

80.0

100.0

120.0

140.0

160.0

0 5 10 15 20

Years

Corrosion Events

Reported

Underreported

Small Airplane Risk Analysis (SARA) Handbook Revision: Original 

 Date: September 30, 2010 
Appendix 2 A2-3 

Small Airplane Risk Analysis (SARA) Page 3 of 4 

Airframe and Occupant Protection 

Worksheet 

Primary Structure – Quality Escape (Fixed Number of Defects or Failures 

Number of Effected Components: (Input) 

Number of Effected Airplanes: (Input) 

Severity

 Level 3 

 Level 4 

 Level 5 (Example Values) 

18

9

0 18 9

20 18 9

Number of Effected Components

Number of Effected Airplanes

Number of Quality Escapes

0

5

10

15

20

0 5 10 15 20

Years

Number of Escapes

Comonents

Airplanes

Primary Structure – Composites: Risk analysis for composite structures will most likely follow a 

constant failure rate similar to the analysis for corrosion in metals. ASEs should consult the SARA 

Handbook for information on risk analysis of composite primary structure.

Other Structure – Control Surfaces, Tabs, High Lift Devices, and Secondary Structure: If the 

hazards involved in the airworthiness concern are flutter or separation of a surface which may damage 

vital parts of the airplane or cause serious or fatal injuries to persons on the ground, ASEs should select 

the most appropriate primary structure risk analysis method. If reduced controllability is the hazard, 

ASEs should use the SARA process for avionics, airplane systems and equipment, and powerplant, 

propeller, and APU installations. 

Occupant Protection: ASEs should select the most appropriate primary structure risk analysis method 

for any components intended to provide occupant protection. These components include seats, seat belts, 

shoulder harnesses, and interior structure intended to retain items of mass or to separate cargo space from 

the passenger compartment. 

Small Airplane Risk Analysis (SARA) Handbook Revision: Original 

 Date: September 30, 2010 
Appendix 2 A2-4 

Small Airplane Risk Analysis (SARA) Handbook Revision: Original 

 Date: September 30, 2010 

Small Airplane Risk Analysis (SARA) Page 4 of 4 

Airframe and Occupant Protection 

Worksheet

Comments: (Input)
Appendix 3 A3-1 

ACS Completion Instructions 

The Small Airplane Directorate has developed a template for the ACS. A representation 

of the template is given on the following page. The format of the template is fixed, with 

the user able to input information in the grey blocks. The user can move from block to 

block using either the computer mouse to click on each block, the ‘Tab’ key, or the arrow 

keys on the computer keyboard. 

Block 1: Date: (Number of characters allowed: 20) 

Input into Block 1 the date you complete the ACS. The block length provides sufficient 

space to spell out the month, for example: ‘September 28, 2007’. 

Block 2: Name: (Number of characters allowed: 35) 

Title: (Number of characters allowed: 35), (e.g., Aerospace Engineer, 

Program Manager, etc.) 

 Office: (Number of characters allowed: 35), (e.g.,Atlanta ACO) 

 Department: (Number of characters allowed: 35), (e.g., ACE-118W) 

 Street Address: (Number of characters allowed: 35) 

 City, State, ZIP: (Number of characters allowed: 35) 

 Telephone: (Number of characters allowed: 35) 

 Electronic Mail: (Number of characters allowed: 35) 

Complete Block 2 with your contact information. 

Block 3: Make: (Number of characters allowed: 40), (e.g., Cessna) 

Model / Series: (Number of characters allowed: 40), (e.g., 172 Series, 

 or 402C ) 

 Serial Numbers: (Number of characters allowed: 100) 

Complete Block 3 with as much airplane make, model, series, and serial number 

information as possible. The ASE should use the information provided on the Type 

Certificate Data Sheet to ensure accurate and consistent identification of the make, 

model, series, and serial number information. A complete description of the make, 

model, and serial numbers is often needed to determine the scope of the airworthiness 

concern. If available, the manufacturers’ Service Bulletin(s) usually contain this 

information. If the series or serial number range is unclear or unknown, then this should 

be explained and requested as part of the information the owners / operators may be 

able to provide. (This information is required on AD worksheets, so it will be needed in 

the event the airworthiness concern evolves into a proposed AD action.) 

Block 4: Reason for Airworthiness Concern: 

 (Number of characters allowed: 220) 

Complete Block 4 with a short synopsis of the airworthiness concern. For example: 

Small Airplane Risk Analysis (SARA) Handbook Revision: Original 

 Date: September 30, 2010 
Appendix 3 A3-2 

U.S. Department 

Of Transportation 

Federal Aviation 

Administration 

Airworthiness 

Concern Sheet 

Small Airplane Risk Analysis (SARA) Handbook Revision: Original 

 Date: September 30, 2010 

Date: (Block 1) 

Reply to: Make: 

Name: Model / Series: (Block 3) 

Title: Serial Numbers: 

Office: 

Department: (Block 2) Reason for Airworthiness Concern: (Block 4)

Street Address: 

City, State, ZIP: 

Telephone: 

Electronic Mail: 

Federal Aviation Administration (FAA) Description of Airworthiness Concern 

 

(Block 5) 

Request for Information (For example: Proposed alternate inspection or repair procedures, cost impact, etc. Your comments 

or replies to the FAA need to be as specific as possible. Please provide specific examples to illustrate your comments or concerns.) 

(Block 6) 

This Airworthiness Concern Sheet (ACS) is intended as a means for FAA Aviation Safety Engineers to coordinate airworthiness 

concerns with aircraft owners/operators through associations and type clubs. At this time, the FAA has not made a determination on 

what type of corrective action (if any) should be taken. The resolution of this airworthiness concern could involve Airworthiness 

Directive (AD) action or a Special Airworthiness Information Bulletin (SAIB), or the FAA could determine that no action is needed at 

this time. The FAA’s final determination will depend in part on the information received in response to this ACS. 

The FAA endorses dissemination of this technical information to all manufacturers and requests association and type club comments. 

Attachments: (Block 7) Transmittal: (Block 8) Response Requested 

Service Difficulty Report by: (Block 9) 

 Accident/Incident Data System Federal Aviation Administration 

 Service Letter / Bulletin Airplane Owners and Pilots Date: 

 Special Airworthiness Information Association 

 Bulletin Experimental Aircraft Emergency 

 Federal Aviation Administration or Association (10 days) 

 National Transportation Safety Board Type Club Alert 

 Safety Recommendation Type Certificate Holder (30 days) 

 Airworthiness Directive Other: Information 

 Alternate Means of Compliance (90 days) 

 Other: 
Appendix 3 A3-3 

‘There have been several cases of main wheel bearing failures reported to the FAA 

within the past six months. These failures have resulted in wheel loss during takeoff.’ 

‘In the past year, the FAA has received 33 Service Difficulty Reports (SDRs) of 

cracks and corrosion in Cessna 190/195 magnesium aileron hinge brackets, P/N 

0322709-1.’ 

Block 5: Federal Aviation Administration (FAA) Description of Airworthiness 

Concern: (Number of characters allowed: 1,200) 

Complete Block 5 with a succinct, complete description of the airworthiness concern. 

Under no circumstances should your description of the airworthiness concern (or 

any other part of the ACS) state that the FAA ‘proposes to mandate’, ‘is considering 

an AD’, or otherwise suggest that rulemaking is imminent. The purpose of an ACS is 

to collect information from the aviation community prior to making a decision on an 

appropriate couse of action to resolve an airworthiness concern. The ACS must be kept 

separate from the rulemaking process, and must not violate ‘Ex Parte’ requirements. 

Examples: 

‘On January 1, 2001, the manufacturer published service bulletin SB01-01. The 

service bulletin recommended eddy current inspections for fatigue cracks in the lower 

caps of the wing main spars. The manufacturer has received service bulletin inspection 

reports of five instances of either cracked or failed spars on in-service airplanes. 

Fortunately, the inspections found the cracked spars before a wing separation 

occurred. 

The manufacturer has recently completed an engineering evaluation that shows that 

the eddy current inspection procedure may not be able to always detect cracks before 

the cracks reach the critical crack length. The engineering evaluation also shows that 

the wing structure does not have fail-safe capability. 

The manufacturer has developed a new service bulletin, SB07-01, and a service kit, 

K07-01, that define a strap modification to the wing. The manufacturer believes that 

the strap modification is needed to assure continued airworthiness. The manufacturer 

estimates that 500 man-hours would be required to install the modification. The cost 

of service kit, K07-01, is $2,662.’ 

And, 

‘The manufacturer has notified the FAA that defective bushings have been installed on 

four models of airplanes. The defective bushings are installed on the horizontal 

stabilizer hinge on the vertical fin. The defective bushings did not receive a required 

thermal process during manufacture of the bushings. The manufacturer’s service 

bulletin, SB 04-03, provides instructions on replacement of the defective bushings. 

Small Airplane Risk Analysis (SARA) Handbook Revision: Original 

 Date: September 30, 2010 
Appendix 3 A3-4 

The affected airplane serial numbers are given in the ‘Make/Model Series/ Serial 

Number’ block above.’ 

Block 6: Request for Information: (Number of characters allowed: 300) 

Complete Block 6 with a request for information from the aviation community. The 

purpose of the request is to gather information that could provide additional insight or 

otherwise help resolve the airworthiness concern. 

Examples: 

‘The FAA requests information regarding this airworthiness concern. In particular, the 

FAA requests information and supporting data regarding an NDI procedure that can 

detect the described cracks before they reach their critical length, alternate 

modification designs, and cost information.’ 

‘The FAA requests your comments on the maintenance history of the parts involved. 

Proposals for inspection or repair procedures should include the estimated costs of the 

procedure. Also give any other comments that you feel are necessary.’ 

Block 7: Attachments

Use the computer mouse to ‘check’ or ‘un-check’ the appropriate boxes in Block 7. 

 Never include or attach proprietary data. 

 Do not include the risk analysis. The risk analysis may suggest to the aviation 

community that FAA action is imminent, regardless of the ACS process. 

 FAA Safety Recommendations are for FAA internal use only. However, after 

consultation with the Office of Accident Investigation, AAI-200, you may 

share selected information with the public. NTSB Safety Recommendations 

are a matter of public record and you may share them with the public in their 

entirety. 

Block 8: Notification

Use the computer mouse to ‘check’ or ‘un-check’ the appropriate boxes in Block 8. We 

have provided an ‘Other’ check box in Block 8 that allows you to input (up to 80 

characters) a list of other organizations you have transmitted the ACS to. 

 Always notify the FAA’s Small Airplane Directorate Continued Operational 

Safety Branch, ACE-113. 

 Always notify the type certificate holder. 

 Always notify the Airplane Owners and Pilots Association (AOPA). AOPA is 

responsible for disseminating the information to the appropriate user groups. 

 Notify the Experimental Aircraft Association (EAA), if the concern involves 

an experimental or amateur built airplane. 

Small Airplane Risk Analysis (SARA) Handbook Revision: Original 

 Date: September 30, 2010 
Appendix 3 A3-5 

Small Airplane Risk Analysis (SARA) Handbook Revision: Original 

 Date: September 30, 2010 

The Aircraft Owners and Pilots Association (AOPA) has agreed to forward the ACS to 

the appropriate type clubs or organizations. Therefore, the ASE will send AOPA the 

completed ACS. ASEs should send the document to AOPA electronically, providing 

AOPA with the most efficient means for forwarding the document to type clubs and 

expediting the data gathering. The type clubs will respond to AOPA with technical and 

economic information pertinent to the airworthiness concern. AOPA will consolidate the 

feedback into one response. 

Although AOPA is the primary conduit to the type clubs, this should not preclude 

sending the ACS directly to type clubs. If communication between the FAA and a type 

club are strong, notifying the type club directly, in addition to AOPA, can expedite the 

data gathering process. 

Block 9: Response Requested by: (Number of characters allowed: 20) 

Complete Block 9 by inputting a date (based on calendar days from the date shown in 

Block 1 of the ACS) by which responses to the ACS should be received. Based on the 

initial risk analysis, your choices of ‘Response Requested by’ dates include: 

 ‘Emergency (10 days or less)’. Use of this date indicates an urgent safety 

concern. The airworthiness concern involves potential catastrophic failure / loss 

of life. Expect minimal owner / operator response by the requested date. 

 ‘Alert (30 days)’. Use of this date indicates a high level of concern. Encourage 

associations and type clubs to use electronic and facsimile media to expedite the 

response process. Expect fewer owner / operator responses by the requested 

date. 

 ‘Information (90 days)’. Use of this date indicates a ‘non-emergency’ concern. 

This date allows associations and type clubs time to utilize print media, mass 

mailings, etc, maximizing the number and quality of owner / operator 

comments.