Distribution: Electronic Initiated By: AIR-150 10/1/2012

SUBJ: Monitor Safety/Analyze Data

This order contains the Monito r Safety/Analyze Data (MSAD) pr ocess, designed to promote an improved continued operational safety (COS) me thodology by incorporating a data-driven, riskbased approach for safety assurance and safe ty risk management. MSAD supports aviation products throughout their life cycle.

This order describes how the Aviation Safety organization (AVS) staff uses MSAD within the Aircraft Certification Service’s (AIR) Safety Ma nagement System (SMS) to identify and manage risk in aviation products.

MSAD uses product defined hazard criteria to surface potential hazards from aviation safety data. MSAD uses a standard taxonomy for organizing COS data and promotes quick identification of emerging safety trends.

In addition, MSAD establishes a causal analysis approach. This approach may identify underlying contributing factors, su ch as process breakdowns, whic h we then communicate to the appropriate AVS oversight business process owner.

The MSAD process is heavily based on existing i ndustry best practices. MSAD builds a safety risk management model that sets the example fo r how we expect industry to evolve, in taking responsibility for the safety of their aviation products.

Susan J. M. Cabler Acting Manager, Aircraft Engineering Division Aircraft Certification Service 

### ORDER 8110.107A National Policy10/01/2012 8110.107A

ii REVISION HISTORY

Rev Description of Change Effective Date

0 Original 3/12/2010

1 Major Changes:

 Page 1, Para 1-2: Clarified that references to “ACO” may apply to other offi ces in AIR when those offices have responsibility for co ntinued operational safety oversight

 Page 1, Para 1-3: Changed al l references of AIR-140 to AIR150, the new business process owner

 Page 4, Fig. 2: Revised MSAD proce ss flow to enhance readability and reflec t changes to process

 Page 6, Para 2-6: Mo re guidance for marking events as “false positives”

 Page 7, Para 2-7: Added guidance fo r minimizing single point safety decisions during the preliminar y risk assessment

 Page 8, Para 2-9: Clarified responsibilities fo r TSO articles and standard parts installed on multiple product types that span purview of more than one directorate

 Page 9, Para 2-9a: Adde d information encouraging involvement of AEG

 Page 10, Para 2-9c: Added a third risk value, “Time until control program risk guideline is reached,” which must be calculated as part of the risk analysis

 Page 12, Fig. 4: Added a di agram outlining the corrective action timeline

 Page 13, Para 2-10: Moved CARB section (previously para 2-15) for improved r eadability and added responsibility for CARB when dealing with MCAIs

 Page 15, Para 2-11: Clarified wh en a “structured” root causal analysis must be performed

 Page 17, Para 2-15b: Added guidance for determining the appropriate corrective action

 Page 26, Chapter 4: Added chapter on appl ying the MSAD process to foreign products

 Page 33, Chapter 7: Added chap ter detailing situations where exceptions may be made to the MSAD process 10/1/201210/01/2012 8110.107A

iii Table of Contents

Paragraph Page

Chapter 1. Gene ral Informa tion................................................................................... 1 1-1. Purpose of this Order. .................................................................................................. .........1 1-2. Audience................................................................................................................ ................1 1-3. Certificate Holder Engagement. .......................................................................................... .1 1-4. Where to Find This Order................................................................................................ .....1

Chapter 2. MSAD Process Over view .......................................................................... 2 2-1. Purpose of the MSAD Process. ........................................................................................... 2 2-2. Range of the MSAD Process.............................................................................................. .2 2-3. MSAD Overview. ......................................................................................................... .......2 2-4. The MSAD Process Flow................................................................................................... ..3 2-5. Acquire Data (Step 1.0). ................................................................................................ .......6 2-6. Hazard Criteria Analysis (Step 2.0)..................................................................................... .6 2-7. Perform Preliminary Ri sk Assessment (Step 3.0). ..............................................................7 2-8. Initiate Im mediate Corrective Ac tion (Step 4.0)..................................................................8 2-9. Record Risk Analys is Results (Step 5.0). ............................................................................8 2-10. CARB. .................................................................................................................. .............13 2-11. Safety Issue Cause(s) (Step 6.0)....................................................................................... 15 2-12. Perform Causal An alysis (Step 7.0). ................................................................................16 2-13. Document the Cause(s) (Step 8.0)....................................................................................16 2-14. Identifying Causes and Contributing Factors. .................................................................16 2-15. Evaluate and Select Corrective Action for a Fl eet Issue (Step 9.0)................................17 2-16. Submit to Process Owner for Further Analysis (Step 10.0)............................................21 2-17. Submit Cause to Certificat e Oversight Proce ss (Step 11.0)............................................22 2-18. Document and Subm it Issue to External Or ganization (Step 12.0)................................22 2-19. Initiate AD, SAIB or other Corrective Acti on Process (S tep 13.0)................................22 2-20. Prepare Internal Fee dback to MSAD Process Owner (Optional) (Step 14.0). ..............22 2-21. Prepare Lessons Learned (Step 15.0)...............................................................................22

Chapter 3. Follow On and Tr ending .......................................................................... 23 3-1. Monito r and Validate. .................................................................................................. ......23 3-2. Trending............................................................................................................... ...............23

Chapter 4. Applying MS AD to Foreign Products ..................................................... 26 4-1. Introduction. .......................................................................................................... .............26 4-2. Addressing MCAI........................................................................................................ ......26 4-3. Addre ssing Events...................................................................................................... ........27

Chapter 5. Roles a nd Responsibil ities ..................................................................... 29 5-1. Process Owner Responsibilities......................................................................................... 29 5-2. AIR-110 Responsibilities............................................................................................... ....2910/01/2012 8110.107A

iv Table of Contents (Continued)

5-3. AIR-120 and AI R-130 Responsibilities............................................................................29 5-4. Directorat e Responsibilities........................................................................................... ....29 5-5. Responsi bilities of offices responsible for COS oversight...............................................30

Chapter 6. Backgr ound.............................................................................................. 31 6-1. AIR SMS. ............................................................................................................... ............31 6-2. Industry Interface and A pplicability..................................................................................3 1 6-3. Benefits of the MSAD Process..........................................................................................3 2 6-4. MSAD Tool Support...................................................................................................... ....32

Chapter 7. Excepti ons................................................................................................ 33 7-1. Exceptions to Some Requirements of this Order..............................................................33

Appendix A. Definiti ons and Acronyms................................................................. A-1

Appendix B. Administ rative Informa tion............................................................... B-1

Appendix C. Directive Feedback Info rmation ........................................................ C-110/01/2012 8110.107A

1 Chapter 1. General Information

1-1. Purpose of this Order. This order explains how you will use the MSAD process to analyze COS data and monitor safety in aircraft fleet s. In this order, we describe the steps of the process, the tasks within those steps, and the responsibilities in cumbent on all process users for all product types.

1-2. Audience. We, the FAA, wrote this order for aviation safety engineers (ASE), aviation safety inspectors (ASI), aircraft certification o ffices (ACO*) staffs, dire ctorate standards staffs, and all Aircraft Certification Service (AIR) and Flight Standards Se rvice (AFS) personnel responsible for monitoring and a ddressing product safety risks.

*Note: For the purposes of this order, the term “ACO” is used as defined in FAA Order 8100.5, Aircra ft Certification Service, paragraph 1-8(c). The term “A CO” also applies to an FAA office responsible for COS oversight.

1-3. Certificate Holder Engagement. Compatible certificate holder processes that are acceptable to the FAA ACO can be used in lieu of functions identified for FAA personnel throughout this order. The ACO, Safety Mana gement Design and Analysis Branch (AIR-150) and the appropriate directorates should coordinate to ensure these proce sses provide an adequate oversight role for the ACO in ensuring that the objectives of this order are met.

1-4. Where to Find This Order. You can find this order on the MyFAA Employee website at https://employees.faa.gov/tool s_resources/orders_notices/ or the FAA’s Regulatory and Guidance Library (RGL) website at http://rgl.faa.gov

.10/01/2012 8110.107A

2 Chapter 2. MSAD Process Overview

2-1. Purpose of the MSAD Process. We designed the MSAD pro cess to filter, review, analyze and trend aviation safety data. The MSAD process helps us identify safety issues in the in-service aircraft fleets, and identify corrective actions to mitigate safety risks across the fleet. The process also identifies othe r causes of safety issues that cannot be addressed by fleet (product/part) corrective actions. MSAD users s hould submit these causes to the appropriate organization and/or process owne r (whether inside or outside AIR) for further analysis and action.

2-2. Range of the MSAD Process.

a. We intend the MSAD process to analyze in -service data to determine corrective action for COS issues. The MSAD process covers everything from receiving data to determining fleet corrective action. Issu ing the corrective action, incl uding the notice of proposed rulemaking (NPRM) process, is outside MSAD. It is part of the airworthiness directive (AD), special airworthiness information bulletin (SAIB), and/or other FAA actions or recommendations processes.

b. Certain certificate holders ha ve their own processes to filter, review, analyze and trend aviation safety data on their products. We expect the ACOs will continue to foster cooperative COS agreements which integrate th e certificate holders’ pr ocesses with the MSAD process in a manner that is compatible with this order. In those instan ces, the certificate holder will accomplish many of the steps defined in this order to address the safety of their products with the ACO ASE performing an oversight role.

c. MSAD may also interface w ith other AIR processes, non-AIR FAA processes, and industry, to help identify non-fleet -based problems. For exampl e, ASEs and ASIs who oversee the certificate holder may analyze product de sign, production, operations, and maintenance process data to identify certificate holder risks and correctiv e actions that shoul d reduce aircraft fleet risks.

2-3. MSAD Overview. As an ASE following the MSAD process, you perform both a risk analysis of the potential safety issue and a causal analysis. Following the MSAD process, you initiate the AD or SAIB (or other corrective ac tions or recommendations) as required. When you complete the process, you store event data, safe ty issues, risk analysis, causal analysis and corrective action data for future use. Figure 1 is a high-level view of the entire process. Although we display and describe the component s sequentially, you may encounter situations where portions of the process are worked concurrently or out of sequence.10/01/2012 8110.107A

3 Figure 1. High-L evel View of MSAD

2-4. The MSAD Process Flow. In figure 2, the entire MSAD proce ss is given in fifteen steps. Subsequent paragraphs explain every step. We will expand some steps, like risk analysis, into more detail as we discuss them.

Aviation data, in a standard taxonomy, is collected by automation, provided by certificate holders or captured by other methods. Aviation data is filtered, using automation and/or manually, to identify event data likely to identify safety issues. Senior COS ASE(s) conducts qualitative assessment to filter the data or issues quick disposition (Emergency ADs, Final rule; request for comments andobvious nonissues). ASE evaluates certificate holder risk analysis or performs quantitative risk analysis to identify safety issues for corrective action. Risk is reduced

Acquire

data Conduct hazard criteria analysis Perform preliminary risk assessment Aviation

data triggers

MSAD

Perform risk analysis

ASE identifies causes that contributed to the event. ASE identifies candidate product/part solutions andsubmits nonproduct/part cause information to applicable parties. Identify

causes

ASE works with other AIR and AVS experts to identify and evaluate candidate corrective actions to reduce risk. May lead to the initiation of anAD or nonmandatory corrective action. Select corrective

action

Monitor and validate corrective actions10/01/2012 8110.107A

4 Figure 2. MSAD Pro cess Flow Page 1

Note: See Chapter 3 for details on link C. See figure 3 for details on step 5.0.10/01/2012 8110.107A

5 Figure 2. MSAD Pro cess Flow - Page 2

External (non-AIR)

issues documentation AD, SAIB

or other optional corrective

action information ASE Initiate AD, SAIB* or other corrective action
process 7.0 8.0 ASE

Perform causal analysis

ASE
Evaluate & select corrective action for a fleet issue (CARB Decision) ASE

Submit cause to certificate

oversight
process Cause/effect chart

AD, SAIB

or other optional corrective

action decision 6.0

12.0

14.0 13.0

15.0 ASE

Prepare internal

feedback to MSAD process

owner (optional) Feedback

ASE

Prepare COS lesson learned,

as necessary Lessons learned END ASE
Submit to
process owner for further

analysis 9.0 Is the safety issue cause(s) unclear?

People/ process issue documentation Process issue documentation 11.0 10.0 Product/part

cause? Internal AIR process or people cause? Yes

Yes Design or Production Certificate holder cause?

Yes Maintenance or operations cause?

Yes

Cause(s) ASE

Document the cause(s) Link A MSAD (figure 2, page 1)

Link B Monitor & validate (paragraph 3-1) ASE
Document & submit issue

to external (non-AIR) organization Was previous corrective action

ineffective? Does CARB recommend RCA? No No

Yes Yes Yes No10/01/2012 8110.107A

6 2-5. Acquire Data (Step 1.0). Data is acquired from FAA databases using an automated batch process. Acquired data can also be manually i nput, such as a report satisfying the requirement found in Title 14 of the Code of Federal Regu lations (14 CFR) 21.3 and 183.63. In both cases, the data goes to an electronic form called the MS AD record. Not all event data will be analyzed through the MSAD process. Hazard cr iteria (described in paragraph 2-6) are used to filter out the events that do not present potential safety issu es. However, the events that are filtered out can still be used for trending purposes.

a. Responsible Office. MSAD software sends event data to the responsible office for the applicable product-t ype. When event data applies to more than one product-type, MSAD software sends it to all responsible offices based on the make and model. If all offices indicate they are not responsible for the event data, the software will send the event data to AIR-150 for resolution. When the event data does not contain a ny product-type data that is directly traceable to an aircraft, engine, or propell er, such as an appliance, the software sends it to all offices to determine whether the part/appliance is installed on any of the aircraft for which the office has type certificate (TC)/supplemental type certific ate (STC) oversight. An MSAD record will not show that it is fully “closed” until all offices involved have completed their review and taken appropriate action to close the record. Sometimes more than one office may need to remedy safety issues related to a single event.

b. Taxonomy. MSAD taxonomy is aligned with the FAA’s Commercial Aviation Safety Team (CAST) and International Civi l Aviation Organization (ICAO) common taxonomy team (CICTT). MSAD taxonomy is more in-dep th and detailed than CICTT because CICTT terms are currently top-level event descriptor s only. MSAD supplements CICTT taxonomy with lower-level event descriptions, part name, and ot her details. CICTT taxono my is still evolving. New terms and changes in hierarchy may or ma y not fit the MSAD application. However, we intend to keep MSAD aligned with CICTT taxonomy as it matures.

c. Event Data Sources. Sources of safety data include FAA databases focusing on event information. We expect indu stry sources to increase as coope rative data sharin g increases. ASEs can manually create an event record from any data source. The ACO COS focal can import event data from external sources via th e data portal. Automation will pull data from certain databases and submit those as event reco rds to the cognizant ACOs and directorates based on the make and model. ACO and director ate personnel can manually enter event records from any data source. Manufacturing inspecti on district office (MIDO) personnel can manually enter event records associated with quality es capes. We anticipate that automation will be modified to add additional data sources.

2-6. Hazard Criteria Analysis (Step 2.0). Hazard criteria are used to automatically or manually filter event data. Filtering reduces the number of events that the senior COS ASE(s) must review for potential safety issues duri ng the preliminary risk assessment. Automatic filtering is based on keyword, key-phrase matches, or other data mining techniques of the event data for the product type. For example, a filt er might be one that sends forward any event description that includes the word “fire.” Even t data that does not meet the hazard criteria is retained and can be used for trending. If seni or COS ASE(s) determine that the event should not10/01/2012 8110.107A

7 have passed the hazard filtering crit eria, then the event should be ma rked as a “false positive” to assist directorates in re fining the hazard criteria.

Note: Automation will not filter § 21.3 reports or other safety data submitted under negotiated agreements since the agreement will typically in clude the hazard criteria.

a. Product Type Hazard Criteria. Each directorate standard s staff must develop and maintain their own hazard criteria to f ilter event data about their product type.

b. Manual Sampling. Automated hazard criteria should c ontinue to mature over time. The criteria list will be a living document. Di rectorate-assigned COS representatives must review, at least annually, samplings of events f iltered by the hazard criteria to ensure that the criteria stay valid. The rate and frequency of events they sample may vary, based on process maturity and directorate/ACO needs.

2-7. Perform Preliminary Risk Assessment (Step 3.0). The purpose of the preliminary risk assessment is to quickly identify any safety issues needing an emer gency AD or immediately adopted rule (IAR) (issued as a “final rule; request for comment”). It also determines whether an event indicates a potential safety issue requiring more investigation through the MSAD process. The assessment should take advantage of whatever da ta is immediately availa ble. It is preferred to minimize single point safety decisions by doi ng multi-discipline assessments when manpower permits. This assessment can be performed by a group of senior COS ASEs, however any actual data analysis is usually performed by a si ngle person. If a group assessment is performed, a cognizant senior ASE for the engine ering discipline most affected by the event must participate.

a. Review by Other Offices. Here, or at any other point in the MSAD process, the senior COS ASE(s) or assigned ASE may decide th at there is a cross-product issue, and that other offices need to review the information. The senior COS ASE(s) or assigned ASE must enter the rationale in the MSAD record a nd submit it to the appropriate office(s).

b. Questions for the Senior COS ASE(s). As the senior COS ASE(s), you must review the event to answer two key questions:

(1) Is this a potential safety issue?

(2) Does an urgent unsafe condition exist that requires immediate corrective action?

c. Preliminary Risk Assessment Answers. The answers to those two questions determine the remaining steps in the process.

(1) If you, the senior COS ASE(s), determine th at there is a potential safety issue, you must define it and submit the resultant action to the assigned ASE to proceed with the risk analysis step (investigati on may determine that there is negligible risk and that calculation of the risk is not required). If you ar e the cognizant engineer for this product, you can assign this potential safety issue to yourself.10/01/2012 8110.107A

8 (2) If you, the senior COS ASE(s), identify an urgent unsafe condition that requires immediate corrective action, you must define the safe ty issue and assign it to an ASE to initiate either an emergency AD or IAR (per step 4.0). The assigned ASE can delay the comprehensive risk analysis and causal analys is until after starting the emergency AD or IAR. Once the emergency AD or IAR starts, the assigned ASE mustcontinue analyzing the safety issue in the risk analysis step. You or the assigned ASE may determine that an emergency AD or IAR is necessary later in the MSAD process as new data becomes available.

Note: An emergency AD or IAR can be started based on an FAA estimate that the time in which the action is required is too short to allo w the time necessary for public comment. (Reference FAA Manual FAA-IR-M 8040.1, Airworthiness Directives Manual. )

(3) If you, the senior COS ASE(s), determine that no further action is necessary, you must document that determination. The ev ent does not move any further in the event evaluation portion of the MSAD pro cess, but is retained for tre nding. Prior to closing the MSAD event, you should ensure that MSAD events discovere d to be false positives are marked, and that the MSAD record is routed to appropriate offices, as necessary.

2-8. Initiate Immediate Corrective Action (Step 4.0). If a safety issue is urgent, you, the assigned ASE, must start either an emergency AD or IAR per FAA Order 8040.1, Airworthiness Directives; FAA Manual FAA-IR-M 8040.1; and any dire ctorate-specific procedures. This ensures that the risk is mitigated in a timel y fashion, without waiting for the remaining MSAD process steps.

2-9. Record Risk Analysis Results (Step 5.0). MSAD risk analysis objectively characterizes hazards for probability and severity, and determin es the risk posed by each hazard associated with a given safety issue. Each di rectorate may have particular risk measures based on their product type. If you are an assi gned ASE, you are responsible for the risk analysis, and you must record the total uncorrected fleet risk and the unco rrected individual risk (perflight or per flighthour) and compare them to directorate-defined risk guidelines , as applicable

, for issuing ADs or other mandatory corrective actions for the product type. If the safe ty issue is associated with an appliance, technical standard or der (TSO) article or standard part, the sa fety issue could be associated with multiple product types and the assigned ASE should obtain any available information from the manufacturer to determ ine product applicability to support the risk assessment. In certain cases where the safety e ffect is different depending on the installation or when the appliance, TSO article or standard pa rt is installed on multiple product types that use different directorate-defined ri sk guidelines, the ASE should assign the MSAD records to the cognizant TC or STC oversight office to perform the risk analysis and subsequent follow-on actions. The risk guidelines for AD or other mandatory corrective action assist the CARB in determining if mandatory correctiv e action is warranted. The risk analysis process (step 5.0) is defined in the next paragraphs, and is illustrated in figure 3.10/01/2012 8110.107A

9 Figure 3. Record Risk Analys is Results Flow Diagram

a. Identify ASI Support. If you, the assigned ASE, need manufacturing, maintenance or operations ASI support, you should cont act an ASI responsib le for the product and ask for information to support the risk analysis. Those ASIs may come from an aircraft evaluation group (AEG), flight standards district office (FSDO), certific ate management office (CMO), MIDO and/or manufacturing in spection office (MIO).

Note: When ASEs solicit information from flight standards ASIs in the field (i.e., FSDO or CMO), ASEs should either obtain the information through the cognizant AEG or notify the AEG that information is requested directly from the field.

b. Identify Potential Outcomes. You, the assigned ASE, must identify and document all important potential outcomes for the potential safety issue you are studying for further risk analysis. If you determine that th e risk of an outcome is obviously negligible, there is no need to calculate or document it.10/01/2012 8110.107A

10 c. Calculate the Risk Value of Each Outcome. You, the assigned ASE, must use the directorate-specified product-specif ic risk analysis method (resulti ng in units convertible to fatal accidents) to calculate the quantitative probabili ty, severity, and risk value for each important outcome. Calculate and reco rd these risk values:

(1) Total uncorrected fleet risk;

(2) Uncorrected individual risk (per flight or per fl ight hour); and

(3) Time until control program risk guideline is reached (Not required if (1) and (2) are both below directorate risk guidelines).

d. See table 1 for detailed descriptions of ri sk values. You, the assigned ASE, must attach the documents produced th at support probabilities, severitie s and risk values for total uncorrected fleet risk and uncorrect ed individual risk (p er flight or per fl ight hour) to the MSAD record containing the event information.

Table 1 – Risk Value Definition, Purpose, and Mathematical Basis

Risk Value Definition Purpose Mathematical Basis

Total uncorrected fleet risk Predicted risk expected, over remaining life of affected fleet, if no corrective action is taken. Provides future risk if no corrective action is taken. Helps determine if an unsafe condition may exist in future. Used to guide decisions for corrective action. Computed as the product of the average severity and average per-flight (or flight-hour) probability of occurrence, multiplied by the exposure (flights or flight-hours) remaining in affected fleet life. If known voluntary compliance to an existing service document is supported by data, then you can account for the existing control actions by adjusting the affected fleet numbers.10/01/2012 8110.107A

11 Risk Value Definition Purpose Mathematical Basis

Uncorrected individual risk Predicted risk perflight or per flighthour. Needed for cases of low fleet exposure that result in the total uncorrected fleet risk, as defined above, to be acceptable while the risk to an individual aircraft or person is unacceptable. Helps determine if an unsafe condition may exist in future. Used to guide the decision for corrective action. If only a subset of the fleet is subject to the risk, include only that portion in the analysis. Evaluate significant variations between identifiable subsets of the fleet (different models, different usages, etc.) as separate populations for the individual risk. Typically based on averages that apply to the fleet. However, there may be circumstances where you can calculate individual risk including risk values for special conditions and combinations of conditions, or for subsets of the fleet, for example by model or usage.

Time until control program risk guideline is reached Amount of time from when the need for corrective action is determined by the CARB to the time when the fleet would exceed the control program risk guideline if no action was taken. With the agreement of the corrective action review board (CARB), this guideline may be exceeded in cases of

severe resource availability or service disruption and there is no practical interim measures to reduce risk. Provides information to assist in risk management planning, i.e., how much time is available to determine root cause, develop service information, coordinate and process corrective action, and incorporate the corrective action in the fleet while staying within the risk guideline. See Figure 4 On occasion the plan to issue corrective action material by a date that meets this guideline may fail to be achieved (e.g., the planned modification was discovered late in the process to not work). In those cases do not shorten compliance times to completely make up for the lost time; it is acceptable to recalculate the time until the program risk guideline is reached and start anew. However, give the issue extra supervision and emphasis to avoid a repeat and work to issue the corrective action material before the new date by as much as can be reasonably accomplished. The time period when risk accumulates in the fleet to a value that equals the control program risk guideline (Note: Control program risk guideline is discussed further in section 2-15.c.).10/01/2012 8110.107A

12 Figure 4. Corrective Action Timeline

Time Until Control Program Risk Guideline is Reached Safety Determination Date Fleet Corrected Date

Safety determination and Control program incorporation time accepted at CARB Root causes determined, all service information developed and AD worksheet submitted AD Published Control Program Risk Guideline is reached

Corrective action buffer time

e. Risk Analysis Requirements. You, the assigned ASE, must calculate the safety issue’s risk values as specified in table 1 for each outcome in measures defined by the product directorate and record them in the MSAD r ecord. Additionally, when calculating total uncorrected fleet and uncorrected individual risk, the units must be convertible to the number of fatal accidents for comparative purposes, whether or not an uncorrected risk guideline exists. You must calculate the time until control program risk guideline is reached if either conditions (1) or (2) from paragraph 2-9c are above directorate risk guidelines.

(1) To calculate the risk values of the issue, you must:

 Evaluate the risk based on the dir ectorate’s methods and guidance for the particular product type;

 Document the assumptions, method s and other supporting information describing how the probability and severity were determined;

 Work with the applicable product directorate to gain conditional probability data that the director ate may compile as risk analysis “library data” for its products (e.g., hazard ratios and injury ratios).

(2) Some ACOs have negotiated agreements with certain certificate holders such that the certificate holder performs the risk analysis on behalf of the FAA. In those cases, you10/01/2012 8110.107A

13 may review the certificate holder risk analysis per the negotiated agreement to verify that the risk analysis meets the objec tives of this section.

f. Determine Necessary Action. To assist the CARB in determining the type and/or need for corrective action (mandatory, non-ma ndatory or no action), you, the assigned ASE, must compare the risk values calculated for the safety issue against the product directorate’s risk guideline(s) for ADs or other mandatory corr ective action. (The directorate’s minimum requirement is to provide an uncorrected individu al risk guideline). See figure 5, Risk Guideline Diagram.

Figure 5. Risk Guideline Diagram

Optional Corrective Action

Negligible Benefit as a Result of Action Safety Improvement Range(SAIB or Other Nonmandatory Optional Corrective Action)

AD Range

Possible Risk Values Risk Guideline Airworthiness Directive

2/3 Guideline CARB Required

2-10. CARB.

a. You, the assigned ASE, must present you r recommended action, al ong with your risk analysis, causal analysis and quantitative evalua tion of the risk re duction of correcti ve actions to the CARB for concurrence. In some cases, a safety issue may go to the CARB several times before a final corrective action is selected. For example, the assigned ASE can elect to bring a given safety issue to the CARB prior to completing all analyses to provide awareness and obtain preliminary feedback. The goal of the CARB is to improve sa fety through better decision making. This is achieved by:

(1) Improving robustness by reducing the numbe r of single thread safety decisions.

(2) Providing for cross-functional review, a llowing others to raise concerns and contribute knowledge about a safety issue and proposed corrective action plan.10/01/2012 8110.107A

14 (3) Facilitating real-time, open exchange of safety issues across the key lifecycle disciplines among ACO, MIDO and AEG staff.

(4) Providing a forum for the review of the pr eliminary risk analysis, risk analysis, causal analysis and corrective acti on(s) for a product type, leadi ng to acceptance, rejection or revision of the proposed corrective action.

(5) Increasing knowledge and experi ence in the AVS community.

Note: CARBs are designed to precede the AD process, not replace it. CARB actions ensure a complete data package is submitted to the AD process.

b. CARB Applicability. All safety issues with a risk above two-thirds of the risk guidelines for AD or other mandatory corrective action must be reviewed by the CARB. All ADs or other mandatory corrective actions must be reviewed by the CARB regardless of risk. Any unilateral corrective action considered on fo reign products and technical no action required (NAR) decisions involving mandatory continui ng airworthiness info rmation (MCAI) must always be reviewed by the CARB. Emergenc y ADs and IARs can in itially bypass a CARB review. However, after immediat e actions are taken, the safety i ssue must go through the rest of the MSAD process, including the CARB. In ra re cases where a CARB wo uld be significantly delayed by lack of me mbers and alternates, and where we must issue an AD, SAIB or other corrective action without further delay, the appl icable ACO may allow a temporary bypass of the CARB. The CARB must review the corrective action during the next meeting. The CARB meeting minutes must be documented, and includ e attendees, subjects discussed, and decisions made.

c. ACOs Select CARB Participants. The ACO manager is res ponsible for selecting and assigning representatives to CARBs, and for designating alternates for unavailable representatives. The ACO manager should c oordinate with MIDO and AEG management to facilitate MIDO and AEG representation. The CARB should consist of the following personnel:

(1) ACO or responsible office manager.

(2) ASE or pilot assigned and presenting the safety issue.

(3) At least three other ASEs, one with experi ence in the safety is sue and two others that support CARB technical discip line diversity. This can be sa tisfied using program or branch managers with the appropriate experience.

(4) Representation from the AEG and MIDO/CMO.

(5) Other optional FAA representatives (such as standards staff, chief scientist and technical advisor, etc.) for a range of i nputs to the safety i ssue corrective action.

d. CARB Attributes. The CARB should:10/01/2012 8110.107A

15 (1) Permit open discussion and not suppre ss dissenting technical opinions;

(2) Convene regularly as determined by the ACO manager (or delegate) to ensure timely review of safety issues a nd enable participants to attend;

(3) If necessary, share resources ac ross organizations and offices;

(4) If necessary, use Web cast conference s and teleconferences to support the proper mix of expertise; and

(5) If possible, reach consensus on a safety decision. In cases where consensus cannot be reached, the ACO or responsible o ffice manager has final decision authority.

e. Factors Not Related to Risk Analysis. In rare situations , the ASE or FAA management may, based on factors unrelated to the risk analysis, make recommendations not consistent with risk guidelines for ADs or othe r mandatory corrective act ions. The decision to accept or reject these recommendations is made during the CARB. When this happens, the assigned ASE documents final decisions in the MSAD record. Factors not related to risk analysis must not be used to influence the objectiv ity of risk analyses as the risk analysis is intended as objective input into the decision.

2-11. Safety Issue Cause(s) (Step 6.0). As shown in figure 2, the MSAD process identifies and mitigates product risk from safety issues. The goal is to determine the product-related cause(s) for the safety issue. If the causes are unclear, you, the assigned ASE, must conduct a structured causal analysis.

a. A “structured” causal analysis uses a tool such as Apollo Root Cause AnalysisTM and the companion RealityCharting® Software.”

b. A structured causal analysis is not required for issues w ith obvious causes and clearly identifiable fleet solution(s) unl ess directed by the CARB, or in cases where previous corrective action(s) were not effective. Fleet solutions include inspections, re-designs, limitations and/or other product/part co rrective actions.

c. If the causes are obvious to you based on engineering expertise and judgment, you must still document the causes based on your non-st ructured approach. Documenting all of the causes is an important step to support future trending activity and quick identification of systemic problems when causes reoccur.

d. In addition, consider doing a st ructured causal analysis in all cases for complex and/or high-profile safety issues. The structured a pproach supports your assu mptions and conclusions during the process, and guides the documentati on of the cause(s), eff ect(s) and the causal analysis report.10/01/2012 8110.107A

16 2-12. Perform Causal Analysis (Step 7.0). Safety issues where cause s are not obvious and/or product/part corrective actions are not easily identifiable require a structured method to identify causes. The MSAD process prescribes this st ructured causal analysis approach. When you perform a structured causal analys is, you trace the chain of events , identify contributing factors and develop a list of candidate solutions.

a. Focus on identifying the part or product cause s that can be addressed using a “fleet” corrective action (AD, SAIB or ot her optional corrective action).

b. You may also identify other causes that cont ributed to the event. These “contributing factors” may include design, manufacturing, operat ions and maintenance failures and may have surfaced from “people” and/or “process” issues in a manufacturer, designer or operator’s organization. Causes may also include FAA pro cess shortfalls. You should submit the causes to the appropriate organization for their review and corrective action. You should contact the cognizant ASI when manufacturing, maintenance or ope rations issues are identified in the causal analysis.

c. Some ACOs have negotiated agreements with certain certificate holders such that the certificate holder performs the causal analysis on behalf of the FAA. In those cases, you must selectively review the causal analysis per the negotiated agreement to verify that it meets the objectives of this section.

2-13. Document the Cause(s) (Step 8.0). Document the causes in the MSAD record using the causal taxonomy. MSAD requires y ou to document the output of a causal analysis, including at least:

a. A problem statement (may be simila r to the defined safety issue);

b. Product/part causes;

c. People/process causes, also called “cont ributing factors,” if applicable; and

d. A causal analysis report (for structured causa l analysis only), which is typically a document produced by a causal analysis tool in a standard format.

2-14. Identifying Causes and Contributing Factors.

a. Causal analyses may identify contributing factors that can influence a part- or system-level failure. Since contributing factors are not always addressed by ADs or SAIBs, you, the assigned ASE, should submit these factors to the appropriate organization for analysis and possible action.

b. If you, the assigned ASE, identify that outsi de MSAD, an operational, maintenance or manufacturing process is cont ributing to a safety issue, you should send your analysis results and safety issue information to the appropriate organization for review and action (e.g., AEG,10/01/2012 8110.107A

17 MIO, MIDO, etc). You should follow-up to ensu re that the organization understands and has sufficient information to address the safety issue.

2-15. Evaluate and Select Corrective Action for a Fleet Issue (Step 9.0). You, the assigned ASE, based on the cause(s) identified in step 7.0 , must identify candidate corrective action(s) and select the appropriate one(s) to reduce the fleet risk presented by the safety issue.

a. Identify Candidate Corrective Actions (CCAs). Actions can range from initial mitigating to extensive final and terminating. You, the assigned ASE, must evaluate each CCA for its appropriateness and timeliness to mitigate th e safety risk. Corrective actions typically are developed by certificate holders. Certificate holders typically submit these to the FAA and the FAA has the option of accepting, rejecting or deve loping alternative correc tive action(s). When a certificate holder does not subm it corrective action(s) for a c oncern, the FAA must develop necessary corrective action(s) to mitigate the ri sk to an acceptable level. CCAs can include:

(1) Inspections;

(2) Part repairs or replacements;

(3) Modification/kit installations;

(4) Limitations;

(5) Rework; and

(6) Process/procedure changes.

b. Determine the Corrective Action Vehicle.

(1) You, the assigned ASE, must calcula te CCA control program fleet and individual risk as defined in table 2 using paragraph 2-9.e.(1).

(2) If new information becomes available la te in the control program development that shows that the risk was much greater than first calculated, or if there was a significant delay in issuing the control program due to some un foreseen issue, you ma y find that the intended control program will now exceed the guidelines. In that case, the control program risk may be evaluated using the exposure from the current point in time (inst ead of since when the need for the control program was identified in paragraph 2-9 f., as described in table 2 on the next page). Care should be taken to avoid ge tting into these situations. It should be the norm to use the exposure since the need for the control program wa s identified in paragraph 2-9 f., and resetting the clock should be an exception.

(3) If you decide not to follow the recommended corrective action, you must document your decision and what you based it on. Attach supporting documentation to the MSAD record.10/01/2012 8110.107A

18 c. Initiate Correc tive Action. AD, SAIB and other correc tive action processes are outside MSAD. They are defined in appropriate orders and the quality management system (QMS) process. Once the AD or SAIB is issued, the assigned ASE or othe r administrative personnel enters the corrective action information ( AD number, SAIB number or other a pplicable information) into the MSAD record.10/01/2012 8110.107A

19 Table 2 – Control Program Risk Value De finition, Purpose, and Mathematical Basis

Risk Value Definition Purpose Mathematical Basis
Control program fleet risk Risk within affected fleet while corrective action is taken (plus any residual risk not remedied by corrective action). Helps risk managers evaluate candidate corrective actions against a maximum allowable risk value with respect to effectiveness and timeliness. Computed as the product of the average severity and average per flight or per flight-hour probability of the occurrence, multiplied by the control program exposure (predicted number of flights (or flight-hours) for the fleet during the time taken to accomplish the corrective actions). The start of the control program is normally considered to be when the need for the control program was identified in paragraph 2-9 f., i.e., the risk typically includes the exposure since that time—it includes corrective action preparation time and AD flow time, as applicable. If actual corrective action incorporation rate is unknown, estimatecorrective action flights or flighthours by using estimated time for AD issuance plus half the AD compliance time.
Control program individual risk Predicted risk per flight or per flight-hour during the control program. Needed for cases of low fleet exposure that result in the control program fleet risk, as defined above, to be acceptable while the risk to an individual aircraft or person during the control program is unacceptable. Helps risk managers evaluate candidate corrective actions against a maximum allowable risk value with respect to effectiveness and timeliness. If only a subset of the fleet is subject to the risk, include only that portion in the analysis. Evaluate significant variations between identifiable subsets of the fleet (different models, different usages, etc.) as separate populations for the individual risk. Typically based on averages that apply to the fleet during the control program. However, there may be circumstances where you can calculate individual risk including risk values for special conditions and combinations of conditions, or for subsets of the fleet, for example by model or usage.10/01/2012 8110.107A

20 Figure 6. Evaluate and Select Correct ive Action(s) Flow Diagram (expanded illustration of step 9.0 in figure 2)

c. Evaluate AD CCAs using the Contro l Program Fleet Risk and Control Program Individual Risk Guidelines (CPRGs). This applies to AD CCAs only. Skip this task if you are proposing non-ma ndatory corrective action. You, the assigned ASE, should ensure that the CCA (or combination of corrective actions) cal culated control program risk is at or below both the fleet and individual CPRG.

(1) During this analysis, consider combined actions of a “bundle” of CCAs as a whole, for example interim action such as a repetitive inspection followed by a final action, such as a part replacement. Evaluate the correctiv e action plan for the to tal effect on the risk.

(2) If the risk of a CCA exceeds either fleet or individual CPRG, consider eliminating or revising the candi date by either accelerating the implementation (e.g., replacing at ‘B’ check rather than at ‘C’ check, or “inspect at 100-hr vs . 200-hr intervals”) and/or adding/modifying corrective actions. Use the dire ctorate-established CPRG analysis method to10/01/2012 8110.107A

21 determine the action’s acceptability and timing by comparing it to the control program fleet and control program individual risk guidelines.

Note: When considering compliance times for mandatory corrective action, do not unnecessarily extend the compliance time even if doing so would keep the control program fleet or control progr am individual risk below the CPRG. Work within existing maintenance schedules.

d. CCA Evaluation. You, the assigned ASE, must evaluate each ca ndidate corrective action. Ideal candidates are in expensive, easy to perform, implemented quickly, 100 percent effective at reducing risk and do not introduce subs titute risk (risk of unintended consequences). Most situations do not meet these ideals. Th erefore, you must conduct a short evaluation of candidate action(s) using effectiveness, cost, timeliness of implementation and complexity.

e. Select Preferred Corrective Action. Once you, the assigned ASE, have evaluated all candidate corrective actions against the attributes in pa ragraph 2-14.d., select the most appropriate one(s), balancing the attri butes. You must document and submit your recommendation with all supporting doc umentation for review by the CARB.

f. Interim Corrective Action. When issuing interim corrective action, you must add a date and associated comment field to the MSAD reco rd. This date will act as a reminder that the final action still needs to be issued in time to meet the control program risk guideline.

g. Terminating Corrective Action. When the terminating action is defined, you must calculate the control program fleet and control program individual risk to ensure it meets the fleet and individual CPRGs. Proceed through the corrective action selection process as defined in paragraph 2-14.e. The CARB must review term inating actions not previously discussed in the initial CARB.

Note: For some safety issues th e time needed to implement the initially proposed cont rol program may exceed the control program incorporation time. This could occur due to the proposed control program requiring unusually extensive engineering and/or testing, unusually long time to produce parts, or unusual shop capacity constraints in installing the proposed correc tive action. To effectively manage risk in those cases, an interim action should be taken prior to the initially pr oposed corrective action (final action). The control program risk of the combination of the interim action and the final action should be within the control program risk guideline.

2-16. Submit to Process Owner fo r Further Analysis (Step 10.0). As described in figure 2, assigned ASEs discovering causes identified in ot her AIR business processe s (like certification and rulemaking) should communicate those ca uses to process owners for action.10/01/2012 8110.107A

22 2-17. Submit Cause to Certificate Oversight Process (Step 11.0). Assigned ASEs who identify causes in the certific ate oversight process, like desi gn and production escapes, should communicate them to the certificate overs ight representative for action.

2-18. Document and Submit Issue to External Organization (Step 12.0). AFS, air traffic and other non-AIR FAA staffs may receive causal information from the MSAD process that identifies a specific condition in their business pr ocess or the certificate holders they oversee. The condition may warrant corrective action, as determined by their business process.

Note: When assigned ASEs submit information to flight standards ASIs in the field (i.e., FSDO/CMO), the assigned ASEs should either submit the information through the cognizant AEG or, at a minimum, notify the AEG that information has been submitted directly to the field.

2-19. Initiate AD, SAIB or other Corrective Action Process (Step 13.0).

a. The CARB should use the risk analysis outpu ts to guide its decision whether or not to choose an AD, SAIB or other corrective action. If the CARB se lects any of these options, the assigned ASE starts the corrective action process.

b. Developing and issuing corrective actions ma y require exchange of information and further MSAD process analysis. You must us e the MSAD process to track changes to the technical decision-making.

2-20. Prepare Internal Feedback to MS AD Process Owner (Optional) (Step 14.0). MSAD is part of the AIR QMS process. AVS MSAD users can submit feedback to the MSAD QMS procedure and associated work instructions by submitting a corrective action request (CAR), preventive action request (PAR) or nonc onformance record (NCR) through AVS QMS Information Technology Support ( QMITS) system.

2-21. Prepare Lessons Learned (Step 15.0). Either a senior COS ASE or assigned ASE should consider all safety issues to determine if the events, safety issues, risk analyses or corrective action selections are valuable teach ing cases. If so, use the “Lessons Learned Nominations” function in the MSAD tool to capture the lessons.10/01/2012 8110.107A

23 Chapter 3. Follow On and Trending

3-1. Monitor and Validate. The cognizant ASE must monitor and validate the effects of corrective action in the fleet by monitoring in-ser vice data to ensure th at the risk has been properly mitigated (see link B, figure 2). You can do this by identifying repeat and similar events using the MSAD record database. You must also watch for introduction of substitute risk due to unintended consequences of mitigating action.

3-2. Trending.

a. Data trending is defined as collecting and monito ring existing data to identify items that meet specific criteria or exceed establishe d guidelines. Trending da ta is important because it:

(1) Enables tracking known safety issues to en sure that their rate of occurrence does not cause risk to exceed established guidelines, and is consistent with the intent of the certification assumptions and analyses.

(2) Allows the monitoring of the results of implemented corrective actions. We do this to verify that the implementation and resu lts are as presumed, and that new problems were not introduced by the actions.

(3) Identifies emerging safety issues, whic h are challenging to implement. Items may appear to be an issue, but very few woul d likely result in an acc ident if uncorrected. Therefore, you have to carefully deci de on which data to trend and act.

b. Conducting Trending. Trend analysis can be conducted by all AIR personnel responsible for monitoring and addressing produ ct safety risks, as needed. Although MSAD trending is primarily based on fleet level events , it does not prevent us from trending at the certificate management level, looking for trends in people/process causes. MSAD event records can initiate trending, or manageme nt can assign it periodically. If the assigned ASE identifies a potential safety issue (see link C, figure 2), th e ASE must perform a risk analysis per paragraph 2-9. If an ASI identifies a potential safety i ssue, the ASI must submit that information to the cognizant ASE, who will assess the fleet risk and take appropriate corrective action, as
necessary.

c. Identifying Trends. Trending activities can include:

(1) Identifying items to trend (par ts, products, failures, etc.);

(2) Analyzing cross-product trends;

(3) Tracking trends and items of significant interest;

(4) Tracking repeat events – similar failur es that have occurred on multiple occasions, including:10/01/2012 8110.107A

24  Repeat part failures (within makes, models and series or across them);

 High part replacement rates (within ma kes, models and series or across them); and

 Repeat safety issues (within makes, models and series or across them).

(5) Identifying causes (during MSAD process);

(6) Identifying most common part ca tegory or system failures; and

(7) Identifying patterns or potential correlati ons (for example, wh en part A fails and part B fails, then event C occurs).

Note: Not all events necessita te a trend analysis. You should focus on anticipated concerns.

d. Figure 7 illustrates the trending process.10/01/2012 8110.107A

25 Figure 7. Data Trendi ng Process Flow Diagram10/01/2012 8110.107A

26 Chapter 4. Applying MS AD to Foreign Products

4-1. Introduction. This chapter describes how MSAD applies to safety issues on products designed and manufactured outside the United St ates. It covers how to handle events on th ese products, as well as how to review and disposition MCAI.

4-2. Addressing MCAI. MCAI are documents issued by other State of De sign Authorities (SoDA), following ICAO Annex 8, regarding un safe conditions on pr oducts designed or manufactured in other countries. FAA Order 8040.5, Airworthiness Directive Proc ess for Mandatory Continuing Airworthiness Information , offers general guidance on MCAI.

a. If you are responsible for addr essing the MCAI, foll ow the process in Order 8040.5 for all MCAI received. If you determine that unila teral action, as define d by Order 8040.5, may be necessary, enter the information into the MSAD data base, creating an initial MSAD record. You then apply the MSAD process step s, beginning with risk analysis per paragraph 2-9. When requesting more technical information from the SoDA, specifically request in formation needed to perform the MSAD risk analysis step. This al so applies when you believe that an MCAI does not represent a safety issue and a corresponding AD need not be issued. This does not apply when no AD required (non-technical NAR) decisions are ma de for administrative reasons. Typical administrative reasons may include instances when the SoDA has issued a revised or supersed ing MCAI and the FAA decides no AD is required for the initial or preceding MCAI, an d instead writes an AD for the later MCAI.

b. For an illustrated versi on of how to apply MSAD to MCAIs, see figure 8.10/01/2012 8110.107A

27 Figure 8. MSAD Process for MCAI

4-3. Addressing Events. Some events on forei gn products will pass th rough the MSAD hazard criteria filter for a product type, and will need to be re viewed by the re sponsible FAA office. If you are responsible for a foreign produc t, review and disposit ion all events associat ed with that product using the MSAD process for foreign product data described in this se ction. Coordinate with the SoDA as needed, ensuring they are aware of a ny safety issues in or der to address them.

a. Hazard Criteria Analysis . Foreign product data will be automatically filtered per paragraph 2-6.

b. Perform Preliminary Risk Assessment. If you have identified a safety issue requiring emergency corrective action or a potential safety issue, coordinate the MSAD event record information, along with the results of the prelimin ary risk assessment, with the SoDA to determine whether they intend to address the safety issue wi th an MCAI, are in the process of preparing an MCAI, or have already issued an MCAI. If an FAA AD exists that adequately addresses the safety issue, link the MSAD record item for the even t to the FAA AD and reference it for future management of the issue. If you determine that no further ac tion is necessar y, close the MSAD record. No further action is requ ired in the MSAD process, but the record is retain ed for trending. Prior to closing th e MSAD event, you should ensure that MSAD events discovered to be false positives are marked. For cases when immediate action is warrante d, after you notify the SoDA, you10/01/2012 8110.107A

28 should initiate FAA correc tive action without waiti ng for the SoDA to take ac tion or for the eventual MCAI.

c. If the SoDA notifies us that they are taki ng no action or you de termine that the SoDA action is not adequate, you will need to continue th rough the MSAD process fr om “Perform Risk Analysis,” per paragraph 2-9, to determine what furthe r action, if any, is necess ary. You may need to take unilateral action following the process described in Order 8040.5.

d. Figure 9 is a depicti on of the MSAD process flow chart including other SoDAs.

Figure 9. MSAD Process fo r Foreign Product Data

Proceed to perform risk analysis (figure 2, page 1, step 5.0) START

Automation/ manual entry
Acquire data Hazard Criteria

ASE

Inform SoDA (that corrective action

may be warranted)

Is SoDA

action adequate? Yes Yes

No Automation

Conduct hazard criteria analysis

Senior COS ASE
Perform preliminary

risk assessment Potential safety issue? Does an FAA AD address this issue? No

END END END

No Yes10/01/2012 8110.107A

Chapter 5. Roles and Responsibilities

5-1. Process Owner Responsibilities. AIR-150 will organize inter-directorate meetings at least annually to review and discuss MSAD info rmation and lessons learned. The agenda may include MSAD process support--make/model lists, h azard criteria, risk analyses methods and risk guidelines--which the direct orates are responsible to devel op and maintain. The agenda may also include any cross-product issu es identified as part of the MSAD process. These meetings can be combined with other meetings, and must be documented in meeting minutes.

5-2. AIR-110 Re sponsibilities. The Engineering Procedures O ffice (AIR-110) develops and standardizes regulations, national directives, policy, procedures, and advisory material for COS. AIR-110 will work with AIR-150 to ensure MS AD supports the COS activities in AIR.

5-3. AIR-120 and AI R-130 Responsibilities. The Technical Programs and Continued Airworthiness Branch (AIR-120) and the Avionic Systems Branch (AIR-130) will have access to the MSAD data to determine if the TSO process or specific TSOs need changes to address emerging safety issues in the aviation fleet. Bo th branches will also participate in the interdirectorate meetings descri bed in paragraph 5-1.

5-4. Directorat e Responsibilities. Each directorate is responsible for developing and maintaining the supporting MSAD pr ocesses for their product type.

a. Develop Hazard Criteria. Directorates will develop a list of hazard criteria by product type and perform samp ling per paragraph 2-6.b.

b. Develop Risk Measures and Risk Guidelines. Directorates will develop risk measures, risk guidelines and sp ecify risk analysis me thods.

c. Establish Condi tional Probabilities. Directorates will esta blish for their product type (with assistance from ACOs) conditi onal probabilities of aircraft-lev el outcomes give n a base event

occurrence.

d. MSAD Process Maintenance.

(1) Directorates must support th e inter-directorate meetings described in paragraph 5-1.

(2) Directorate COS representatives must re view hazard criteria samples (at least annually) and update hazard criteri a as needed for their product type concerns. The results of this review should be recorded.

(3) Each directorate, coordinating with in dustry, may adapt thei r risk analysis methods and risk guidelines, as needed.

(4) Directorates must determine how often their conditional probability data is reviewed and revised.10/01/2012 8110.107A

30 5-5. Responsibilities of offi ces responsible for COS oversight. These offices must:

a. Perform or oversee, per ACO/certificat e holder agreement, the MSAD process consistent with the product type.

b. Develop and maintain fleet size and age esti mates (cycles or hours) for each model, or review and accept estimates supplie d by the cognizant certificate holder.

c. Develop and maintain model utilization ra tes, or review and accept estimates supplied by the cognizan t certificate holder.

d. Develop or review other basic da ta needed for risk analysis.

e. Support the directorates as necessary in accomplishing their responsibilities.10/01/2012 8110.107A

31 Chapter 6. Background

6-1. AIR SMS. The AIR SMS vision states, “AIR mana ges safety through a comprehensive systems safety approach, maximizing our value to aviation safety through influence and response to the changing aviation environment.”

a. AIR SMS supports and aligns with AVS SMS requirements in VS 8000.367, Aviation Safety (AVS) Safety Management System Requirements , by establishing the MSAD process, which provides a safety risk management and safety assurance approach to AIR's COS mission. To achieve the AVS SMS vision and su pporting goals, AIR decision-making processes need to evolve into an approach th at is both quantitative and risk-based.

b. A mature AIR SMS will give AIR a holistic approach using risk-based processes to support an enhanced focus on safety. SMS re presents the first time AVS and AIR have attempted to manage risk thr oughout the product life cycle. Before this, much of FAA risk analysis had been an isolated qualitative activity, l acking standard methods for analyzing and managing risk over time.

c. FAA Order 8040.4, Safety Risk Management Policy

, establishes our safety risk management policy and requires all FAA lines of business to establish and implement a formal risk management program consistent with their role in the FAA. The order states: “The FAA shall use a formal, disciplined, and documented d ecision-making process to address safety risks in relation to high-consequence decisions affecting the complete life cycle.”

d. AIR SMS addresses the requirements in Order 8040.4. After setting up an FAA SMS that uses risk-based decision making tools and processes, we expect that industry will develop or coordinate a corres ponding SMS compatible with our model and tailored to each company’s needs.

6-2. Industry Interface and Applicability. MSAD effectiveness relies heavily on in-service data from operators, manufacturers and other certif icate holders. This da ta sharing approach is risk-based, reflecting the SMS principle of bei ng proactive by using data-driven analysis.

a. Accordingly, we have to develop MSAD inte rfaces with industry to foster data sharing. We expect that AIR offices, includ ing headquarters, direct orates and ACOs, will promote good working relationships with th eir respective industry stakeholders.

b. In addition, since certifi cate holders are routinely responsible for developing corrective actions for product or part hazards in the fleet, we should harmonize industry and FAA processes as much as we can. Harmoni zed processes promote common understanding of the fundamentals of COS: data analysis, hazard iden tification, risk analysis methods, risk guidelines, causal analysis and appropriate co rrective actions. MSAD is defined so that MSAD process steps, except the decision and issuance of an AD or SAIB, could be performed for us by industry when potential future SM S regulations that are applicable to certificate holders are in place. Some ACOs are working towards, or have in place, negotiated agreements with their certificate holders in which the certificate holder goes beyond statutory requirements and performs data analysis, hazard identification, risk analysis, causal analysis and corrective action10/01/2012 8110.107A

32 development in accordance with the product dire ctorate’s MSAD objectives. In these cases, the FAA plays a critical oversight sa fety assurance role, as opposed to a safety risk management role.

6-3. Benefits of the MSAD Process. MSAD and its supporting tool s and methods allow the current AIR COS process to evolve into a more risk-based, systemic, decision-making system. MSAD:

a. Identifies safety issues and related caus es that determine product-related corrective actions.

b. Submits underlying process and people safe ty issues to certificate management, rulemaking and other business processes to enab le a more complete aircraft life-cycle COS environment.

c. Enables consistent standardized measur able risk-based decision making for COS across AIR.

d. Quickly identifies safety trends using analysis of depende nt variables (MSAD database).

e. Builds a COS model that exemplifies what the FAA would like to see from industry in the future.

6-4. MSAD Tool Support.

a. This order defined MSAD minimum process requirements, not tool requirements. The MSAD database, however, is a tool used to store event data according to MSAD-required taxonomy. An assigned ASE conducts the MSAD pr ocess using the database and other support tools to:

(1) Access, collect and store safety information;

(2) Guide users through the process;

(3) Track completion of the process steps; and

(4) Support risk, causal and corre ctive action analyses.

b. The database is intended to store all information input by the user, including calculations, analyses performed and techni cal decisions made for the MSAD record.10/01/2012 8110.107A

33 Chapter 7. Exceptions

7-1. Exceptions to Some Requirements of this Order. This chapter defines some specific situations where exceptions to some of the re quirements of this order are authorized, and the extent of those exceptions.

a. When certain higher-level polic ies require that an AD be written, do not use MSAD risk analysis results in making the decision to write the AD. The policy decision to write ADs in those cases was made during the course of rulemaking or other policy deliberations, and overrides the MSAD risk guidelines. The following are the lim ited authorized cases ofan overriding higherlevel policy:

(1) ADs for mandatory modifications requi red by the widespread-fatigue-damage rule (75 FR 69746, November 15, 2010, or later revision).

(2) ADs to mandate the incorporation in the airworthiness limitati ons section of the maintenance manual new or revised damage tolera nce inspections or safe -life limits required for § 23.571, 25.571, 27.571, 29.571, 33.14, and 33.70 compliance.

(3) ADs that are needed for Special Fe deral Aviation Regulation (SFAR) 88 compliance.

(4) ADs required by the aging aircraft program (69 FR 45936, July 30, 2004 and 70 FR 5518, February 2, 2005, or later revisions ) for changes to supplemental structural inspection programs and corrosion preven tion and control pr ograms (CPCP).

b. ADs are issued to correct an unsafe conditi on in an aircraft, en gine, propeller or appliance (products), and have a defined applicability at the ti me of issuance. On occasion, after AD issuance, the FAA may discover that the appl icability did not incl ude all the affected products, and the AD is superseded to increase th e applicability. When the FAA supersedes an AD solely for this reason, do not use MSAD risk an alysis results in making the decision to issue a supersedure, as the supersedure will be issu ed regardless of the risk result to meet ICAO obligations or as general policy.

c. For the situations defined in paragraphs 7-1 a. and 7-1 b., the following exceptions to the requirements of the followi ng paragraphs ar e authorized:

(1) Paragraph 2-9, Record Risk Analysis Results (Step 5.0).

(2) Paragraph 2-11, Perform Causal Analysis (Step 7.0).

(3) Paragraph 2-12, Document the Causes (Step 8.0).

(4) Paragraph 2-13, Identify Cause and Contributing Factors.10/01/2012 8110.107A

34 (5) Paragraph 2-14, Evaluate a nd Select Corrective Action for a Fleet Issue (Step 9.0). (6) Some of the requirements defined in paragraph 2-15 a., CARB. See paragraph 7-1 d. for requirements that remain in effect.

d. When exceptions are made in accordance with this chapter, the following limitations and requirements remain in effect:

(1) The issue and recommended corrective act ion must be presented to the CARB for concurrence per paragraph 2-15 a.

(2) The CARB decision of the issue must be documented in the CARB meeting minutes per paragraph 2-15 b.

(3) The exception of paragraph 7-1 b. may not be exercised if the unsafe condition of the superseding AD in any way differs fr om the superseded AD unsafe condition (the supersedure must be solely to add applicability).10/01/2012 8110.107A Appendix A

Appendix A. Definitions and Acronyms (Continued)

A-1 Appendix A. Definitions and Acronyms

14 CFR Title 14 of the Code of Federal Regulations

ACO Aircraft certification office. The aircraft certifica tion directorate’s engineering operational element. Th is office administers and secures compliance with agency regulations, pr ograms, standards, and procedures governing the type design of aircraft, aircraft engine s, or propellers. It offers certification expertise on i nvestigating and reporting aircraft accidents, incidents, and service difficu lties. The term “ACO” refers to the Engine Certification Office (ECO), the Rotorcraft Certification Office (RCO), the Special Certification Offi ce (SCO), Military Certificate Office (MCO) and all other ACOs.

AD Airworthiness directive

AEG Aircraft evaluation group

AFS Flight Standards Service

AIR Aircraft Certification Service

ASE Aviation safety engineer

ASI Aviation safety inspector

Assigned ASE Directorate or ACO ASE with COS responsibilities for a specific aircraft or product safety issue

AVS Aviation Safety Organization

CAR Corrective action request

CARB Corrective Action Review Board

CAST Commercial Aviation Safety Team

Causes Underlying circumstances, occurrences, and/or failures that contribute, or could contribute, directly or indirectly, to an event.

CCA Candidate corrective action

CICTT CAST/ICAO Common Taxonomy Team

CMO Certificate management office

Condition See “Safety Issue”10/01/2012 8110.107A Appendix A

Appendix A. Definitions and Acronyms (Continued)

A-2 CPRG Control program risk guideline. The upper limit of acceptable risk which assists the ASE in determining the adequacy, in terms of risk reduction, of a proposed candidate corrective action. These guidelines are characterized in terms of both fleet risk and individual risk.

Corrected risk Residual risk that remains after corrective action is taken. When highly effective corrective action is taken, resi dual risk is considered to be zero. See also “Uncorrected Risk.”

Corrective action Any action to mitigate a safety issue. Includes mandatory actions like ADs and rule changes, to correct an uns afe condition. Includes non-mandatory actions and recommendations like SAIBs and Aviation Alerts. Includes actions that either directly corrects the safety problem and/or mitigates risk with operational limitations or rest rictions, like grounding a product from further flight.

COS Continued operational safety

CPCP Corrosion prevention an d control program

Cross-product Can be across product lines within a manufacturer, across products from various manufacturers, and/or across pr oduct-types, if parts, components or processes are common to other aircraft or engines.

DAB Daily alert bulletin

Event Any individual occurrence involving an aircraft or its components. Described in terms of what is observe d (the symptoms) or recorded during the occurrence. Events typically trigge r investigations that seek causes of a safety issue. The safety issue (or co ndition) is then evaluated for safety implications.

FAA Federal Aviation Administration

Fleet Aircraft, engine or propel ler products of a type curr ently in service affected by a certain safety issue.

FSDO Flight standards district office

Hazard Any existing or potential condi tion that can lead to inju ry, illness or death to people; damage to or loss of a system , equipment or property or damage to the environment. A hazard is a co ndition that is a prerequisite to an accident or incident.

IAR Immediately adopted rule10/01/2012 8110.107A Appendix A

Appendix A. Definitions and Acronyms (Continued)

A-3 ICAO International Civil Aviation Organization

MCAI Mandatory continuing airworthiness information

MIDO Manufacturing inspectio n district office

MIO Manufacturing inspection office

MSAD Monitor Safety/Analyze Data

NAR No action required

NCR Nonconformance record

NPRM Notice of proposed rulemaking

Outcome Result of an event, condition, or failure at aircraft level.

PAR Preventive action request

Preliminary risk
assessment An initial assessment of the risk posed by a safety issue, often performed with limited data or qualitative inform ation. This assessment is meant to quickly determine an issue’s potential risk and urgency, and is followed by comprehensive and quantitative analysis as data and circumstances permit, unless the issue is deemed to entail very little risk.

Probability Ratio of the number of actual occu rrences to the number of possible occurrences. For example, 1 in 1 million flight hours. Probability is often expressed with the denominator normali zed to a single unit; therefore, 1x10 -6 per flight hour. Probability can also be evaluated against total exposure of the fleet (or other relevant parameter); as in "40% probability that a failure will occur”, or “an expected number of events, if the hazard is not addressed”.

QMITS Quality Management Information Technology Support

QMS Quality management system

RCA Root cause analysis

RGL Regulatory Guidance Library

Risk analysis Process whereby hazards are objectively characterized for their severity and probability. The process can be ei ther qualitative or quantitative.

Risk guideline The upper limit of acceptable risk which assists the ASE in determining the10/01/2012 8110.107A Appendix A

Appendix A. Definitions and Acronyms (Continued)

A-4 need for AD or other mandatory corr ective actions and the adequacy, in terms of risk exposure, of a pr oposed candidate corrective action.

Risk Expression of the severity and probabili ty of an undesired event. See also "corrected risk” and “uncorrected risk."

Safety issue Cause(s), contributing factor(s ), or finding(s) that led to, or could lead to, an unsafe outcome. Safety decisions are re ndered on issues/causes, not events. For example, investigation of an uncommanded flight control surface movement--an event--might reveal that the cause was a circuit failure in the autopilot’s computer. Circuit failure is the safety issue/cause to evaluate for safety implications, and to ta ke corrective action against.

SAIB Special airworthiness information bulletin

Senior COS ASE The assigned ASE who performs the prel iminary risk assessment which has experience in COS duties. This person is not equivalent to senior engineers that exist in the ACOs. However, se nior engineers may be qualified as senior COS ASEs.

Service bulletin (SB) One type of "service document" (see be low). In this order, the terms are
synonymous.

Service documents Publications by a type certificate holder, a ppliance or component manufacturer that offer informa tion on safety, product improvement, economics and operational and/or main tenance practices. Publications include service bulletins, all-operato rs' letters, service newsletters and service digests or magazines. Not in cluded are flight manuals and certain maintenance manuals required for F AA type certification or approval. (Source: AC 20-114, Manufactur ers Service Documents)

Severity The consequence or impact of a hazard in terms of degree or loss or harm.

SMS Safety management system

SoDA State of design authority

STC Supplemental type certificate

Substitute Risk Risk of unintended consequences from implementing corrective action

Taxonomy For the purposes of MSAD, a standa rd industry language and set of definitions that improve the quality of information and communication within the aviation community.

TC Type certificate10/01/2012 8110.107A Appendix A

Appendix A. Definitions and Acronyms (Continued)

A-5 TSO Technical standard order

Uncorrected risk Risk that accumulates over time in th e affected fleet if no corrective action is taken for a certain safety issue. See also "corrected risk."10/01/2012 8110.107A Appendix B

B-1 Appendix B. Admini strative Information

1. Distribution. Distribute this order to the Washington he adquarters division a nd branch levels of the Aircraft Certification Service and Flight Stan dards Service, to the he adquarters division and regional divisions of the Flight Standards Service, to aircraft evaluation groups, to all Aircraft Certification Service Directorates and certification offices and branch es. Distribute to manufacturing inspection offices (MIO), manufacturing inspection di strict offices (MIDO), manufacturing inspection satellite offices (MISO), all flight standards dist rict offices (FSDO), airc raft certification and airworthiness branches of the FAA Academy, a nd the International Policy Office, AIR-40.

2. Authority to Change This Order. The issuance, revision, or cancel lation of the material in this order is the responsibili ty of the AIR Safety Management Desi gn and Analysis Branch (AIR–150). This branch will accomplish all changes, as require d, to carry out the FAA’s re sponsibility to provide guidance for the Monitor Safety/Analyze Data (MSAD) process.

3. Suggestions for Improvement. If you find deficiencies, need clar ification or want to suggest improvements to this order, send FAA Form 1320-19, Directive Feedba ck Information, (written or electronically) to the Aircraft Certification Servic e, Administrative Serv ices Branch, AIR-510, Attention: Directives Management Officer. You can also send a c opy to the Aircra ft Engineering Division, AIR-100, Attention: Comments to Order 8110.107A. If you urgently need an interpretation, contact Safety Ma nagement Design and Analysis Branch, AIR–150, at 202-267-8588. Always use Form 1320-19, in appendix C, to follow up each verbal conversation.

4. Records Management. Refer to Orders 0000.1, FAA Standa rd Subject Classification System; 1350.14, Records Management; and 1350.15, Records, Organization, Transfer, and Destruction Standards; or your office Record s Management Officer or Direc tives Management Officer for guidance regarding retention or dispositio n of records.

5. Related Federal Regu lations and Publications.

 14 CFR Part 39.

 FAA-IR-M 8040.1, Airworthiness Directives Manual.

 FAA Order 8040.1, Airworthiness Directives.

 FAA Order 8040.4, Safety Risk Management.

 FAA Order 8040.5, Airworthiness Directive Process for Mandatory Continuing Airworthiness Information.

 FAA Order 8110.100, Special Airworthiness Information Bulletin.10/01/2012 8110.107A Appendix C

C-1 U.S. Department of Transportation

Federal Aviation Administration

Appendix C. Directive Feedback Information

Please submit any written comments or recommendations for improving this directive, or suggest new items or subjects to be added to it. Also if you find an error, please tell us about it.

Subject: Order 8110.107A

To: Directive Management Office, AIR-510

(Please check all appropriate line items)

 An error (procedural or typographical) has been noted in paragraph ______ on page_____

 Recommend paragraph _____ on page _____ be changed as follows: (attach separate sheet if necessary)

 In a future change to this directive, please include coverage on the following subject: (briefly describe what you want added) :

 Other comments:

 I would like to discuss th e above. Please contact me.

Submitted by: ____________________________ Date: __________________

Telephone Number: __________________________ Routing symbol: _________

FAA Form 1320-19 (10-98)