AC 39-8A

U.S. Department of Transportation Federal Aviation Administration Advisory Circular Subject: Continued Airworthiness Assessment Methodologies of Powerplant and Auxiliary Power Unit Installations on Transport Category Airplanes Date: AC No: 39-8A Initiated By: AIR-630 This advisory circular (AC) describes continued airworthiness assessment methodologies (CAAM) that may be applied to the products associated with the powerplant or auxiliary power unit (APU) installations on transport category airplanes. It provides information and guidance on how to estimate the risks associated with identified unsafe conditions.

The methodologies described in this AC are derived from the criteria developed by the FAA and industry. It represents a means for risk assessment. With an updated subject title emphasizing methodologies, and emphasis on usage of the latest data, this new AC supersedes its predecessor AC 39-8 Continued Airworthiness Assessments of Powerplant and Auxiliary Power Unit Installations of Transport Category Airplanes.

If you have suggestions for improving this AC, you may use the form at the end of this AC.

James D. Foltz Aviation Safety Acting Director, Policy and Standards Division, Aircraft Certification Service

AC 39-8A Table of Contents Paragraph Page

CHAPTER 1. GENERAL INFORMATION1-1

1.1 Purpose1-1

1.2 Applicability.1-1

1.3 Cancellation.1-2

1.4 Related Reading Material.1-2

1.5 Definitions1-3

1.6 Principal Revisions.1-6

1.7 Background.1-7

1.8 CAAM Publications1-7

CHAPTER 2. IDENTIFYING UNSAFE CONDITIONS2-1

2.1 Identifying Unsafe Conditions2-1

2.2 Root Cause Analysis and/or Contributing Factors2-1

2.3 Hazard Ratio of Prior Events.2-1

2.4 Probability of Future Events.2-1

2.5 Immediate Action is Warranted.2-1

2.6 Responses to Unsafe Conditions2-2

2.7 Risk to Persons Outside the Airplane.2-2

CHAPTER 3. RISK ASSESSMENT3-1

3.1 Risk Assessment.3-1

3.2 Assumptions3-1

3.3 Probability of Event Prediction3-1

3.4 Mitigating and Corrective Actions3-3

3.5 Assessment Model Considerations.3-6

CHAPTER 4. RISK FACTOR GUIDELINES AND PRIORITIZATION BASED ON RISK

.4-1

4.1 Hazard Level 3 and Level 4 Risk Guidelines.4-1

4.2 Risk Guidelines for In-Flight Shutdown (IFSD) Rate Concerns.4-2

4.3 Risk Guidelines for Immediate Action.4-2

4.4 Prioritization Based on Risk.4-2

ii

AC 39-8A Table of Contents Paragraph Page

CHAPTER 5. MISCELLANEOUS CONDISDERATIONS5-1

5.1 Corrected Risk.5-1

5.2 Cumulative Risk5-1

5.3 Lessons Learned5-2

5.4 Alternative Methods of Compliance (AMOC).5-2

5.5 Airplane and Engine Stakeholder Coordination.5-2

APPENDIX A. POTENTIAL UNSAFE CONDITIONSA-1

A.1 PurposeA-1

A.2 Identification of Potential Unsafe ConditionsA-1

A.3 Categories of Failures Leading to Potential Unsafe ConditionsA-2

APPENDIX B. HAZARD LEVEL DEFINITIONSB-1

B.1 PurposeB-1

B.2 Hazard Level ClassificationB-1

B.3 Hazard Level 3 – Serious Consequences.B-1

B.4 Hazard Level 4 – Severe Consequences.B-3

B.5 Hazard Level 5 – Catastrophic ConsequencesB-3

B.6 General Notes Applicable to all Event Hazard Levels.B-4

B.7 Historical Comparison of Hazard Level Descriptions.B-4

APPENDIX C. HAZARD RATIO DEVELOPMENTC-1

C.1 PurposeC-1

C.2 Applying the Hazard Ratio.C-1

C.3 Hazard Ratio DevelopmentC-1

C.4 Notes on Hazard Ratio Development.C-3

APPENDIX D. HISTORICALLY POTENTIAL UNSAFE CONDITIONSD-1

D.1 PurposeD-1

D.2 CAAM DatabaseD-1

D.3 Hazard Ratio CalculationD-1

D.4 Failure Condition: UncontainedD-2

D.5 Failure Condition: Fire Zone Fire.D-10

D.6 Failure Condition: Tailpipe Fire.D-12

iii

AC 39-8A Table of Contents Paragraph Page

D.7 Failure Condition: Case Rupture.D-13

D.8 Failure Condition: Case BurnthroughD-14

D.9 Failure Condition: Multiple-Engine EventsD-15

D.10 Failure Condition: Engine/Pylon SeparationsD-4

D.11 Failure Condition: Cowl Separation.D-5

D.12 Failure Condition: Asymmetric Thrust Reverser Deployment/Inflight Beta.D-6

D.13 Failure Condition: Fuel Leak.D-7

D.14 Failure Condition: Propeller System EventsD-8

D.15 Failure Condition: APU System Event.D-10

D.16 Failure Condition: Propulsion System malfunction Recognition and Response

(PSMRR)D-12

D.17 Failure Condition: Crew Error.D-13

D.18 Previously Reported Hazards Not IncludedD-14

APPENDIX E. RISK ASSESSMENT EXAMPLEE-1

E.1 PurposeE-1

E.2 Example – Compressor Disk Fracture.E-1

iv

AC 39-8A

FIGURES Number Page

Figure 1a. Airplane Threat Comparison (Hazard Level 3)4-4

Figure 1b. Airplane Threat Comparison (Hazard Level 4)4-4

Figure 2. Event Probability vs. Event Forecast (Risk Factor)5-1

TABLES Number Page

Table 1. Risk Guidelines4-1

Table D-1 - Uncontained Disk Hazard Ratios of Fan and Low-Pressure

Compressor (LPC)D-2

Table D-2 - Uncontained Disk Hazard Ratios of High-Pressure Compressor (HPC), Intermediate Pressure Compressor (IPC), High-Pressure Turbine (HPT) and

Intermediate Pressure Turbine (IPT)D-3

Table D-3 - Uncontained Disk Hazard Ratios of Low-Pressure Turbine (LPT)D-4

Table D-4 - Uncontained Blade Hazard Ratios (Fan and Platforms)D-5

Table D-5 - Uncontained Blade Hazard Ratios (LPC and HPC)D-6

Table D-6 - Uncontained Blade Hazard Ratios (HPT/IPT and LPT)D-7

Table D-7 - Uncontained "Other" Hazard Ratios (Fan and HPC)D-8

Table D-8 - Uncontained "Other" Hazard Ratios (HPT and LPT/PT)D-9

Table D-9a - Fire Zone Fire DataD-11

Table D-9b - Fire Zone Fire DataD-11

Table D-10 - Tailpipe Fire DataD-12

Table D-11 - Case Rupture Hazard RatiosD-13

Table D-12 - Case Burnthrough Hazard RatiosD-14

Table D-13 - Multiple-Engine Event (Fuel Related) Hazard RatiosD-1

Table D-14 - Multiple-Engine Event (Non-Fuel) Hazard RatiosD-2

Table D-15 - Engine/Pylon SeparationsD-4

Table D-16 - Cowl Separation Hazard RatiosD-5

Table D-17 - Thrust Reverser Deploy - Inflight Hazard RatiosD-6

v

AC 39-8A

Table D-18 - Fuel Leak DataD-7

Table D-19 - Propeller System Hazard RatiosD-9

Table D-20 - APU DataD-11

Table D-21 - Propulsion System Malfunction Recognition and Response DataD-12

Table D-22 - Crew Error DataD-13

vi

AC 39-8A CHAPTER 1. GENERAL INFORMATION

1.1 Purpose.

1.1.1 This advisory circular (AC) describes continued airworthiness assessment methodologies (CAAM) that may be used for products associated with the powerplant or auxiliary power unit (APU) installations on transport category airplanes. It provides guidance for estimating the risks associated with identified unsafe conditions, for defining, prioritizing, and selecting suitable corrective actions for all identified unsafe conditions, and for verifying that the corrective actions are effective.

1.1.2 The Federal Aviation Administration (FAA) may use these CAAM to identify unsafe conditions and make decisions concerning the priority in which unsafe conditions should be addressed. Continued airworthiness requires that safety concerns within the existing fleet are addressed and the knowledge gained is applied for the benefit of future fleets.

1.1.3 This AC describes the CAAM processes that may be used to identify unsafe conditions and determine when an unsafe condition is likely to exist or develop in other products of the same type design in accordance with 14 CFR part 39.

1.2 Applicability.

1.2.1 The guidance provided in this AC is for airplane engine manufacturers, modifiers, foreign authorities, FAA engine type certification engineers, FAA inspectors, and FAA designees, which are collectively referred to as stakeholders in this AC.

1.2.2 This is a guidance document. Its content is not legally binding in its own right and will not be relied upon by the Department as a separate basis for affirmative enforcement action or other administrative penalty. Conformity with the guidance document is voluntary only. Nonconformity will not affect rights and obligations under existing statutes and regulations. The FAA will consider other methods of demonstrating compliance that an applicant may elect to present. Terms such as “should,” “may,” and “must” are used only in the sense of ensuring applicability of this particular method of compliance when the acceptable method of compliance in this document is used. If the FAA becomes aware of circumstances in which following this AC would not result in compliance with the applicable regulations, the FAA may require additional substantiation as the basis for finding compliance.

1.2.3 This material does not change or create any additional regulatory requirements or authorize changes in or permit deviations from existing regulatory requirements.

1-1

AC 39-8A

1.3 Cancellation.

This AC cancels AC 39-8, Continued Airworthiness Assessments of Powerplant and Auxiliary Power Unit Installations on Transport Category Airplanes, dated September 8, 2003.

1.4 Related Reading Material.

For all references throughout the document, use the latest revision unless otherwise discussed with the FAA.

1.4.1 14 CFR Regulations.

The following 14 CFR regulations are related to this AC. You can download the full text of these regulations from the Federal Register website at www.ecfr.gov.

• Part 25, Airworthiness standards: Transport category airplanes.

• Part 33, Airworthiness standards: Aircraft engines.

• Part 35, Airworthiness standards: Propellers.

• Part 39, Airworthiness directives.

• Part 121, Operating requirements: Domestic, flag, and supplemental operations.

• Part 125, Certification and operations: Aircraft having a seating capacity of 20 or more passengers or a maximum payload capacity of 6,000 pounds or more; and rules governing persons on board such aircraft.

• Part 135, Operating Requirements: Commuter and on demand operations and rules governing persons on board such aircraft.

1.4.2 FAA Policy Statements.

The following policy statements are related to the guidance in this AC. The latest version of each policy statement referenced in this document is available on the https://drs.faa.gov/browse.

• FAA Policy PS-ANE-2011-33-1, Engine Reliability in Extended Operations (ETOPS) – Continued Operational Safety (COS) Assessments.

• FAA Policy PS-ANM-25-05, Risk Assessment Methodology for Transport Category Airplanes.

1.4.3 FAA Order.

FAA Order 8110.107, Monitor Safety/Analyze Data, is related to the guidance in this AC. The latest version of each order referenced in this document is available on DRS at https://drs.faa.gov/browse.

1-2

AC 39-8A

1.4.4 FAA Manual.

FAA Manual FAA-IR-M-8040.1, Airworthiness Directives Manual, is related to the guidance in this AC. The latest version of this FAA Manual referenced in this document is available on the https://employees.faa.gov/tools_resources/orders_notices/.

1.4.5 Industry Publications.

The following publications from the Air Force Wright Aeronautical Laboratories (AFWAL), Aerospace Industries Association (AIA), and SAE International provide additional guidance. The Air Force Wright Aeronautical Laboratories (AFWAL) was merged into the Air Force Research Laboratory.

• AFWAL-TR-83-2079, Weibull Analysis Handbook.

• AIA PC-342, Initial Report on Propulsion System and APU Related Aircraft Safety Hazards.

• AIA and AECMA (Association Européenne des Constructeurs de Matériel Aérospatial/European Association of Aerospace Industries) Project Report on Propulsion System Malfunction plus Inappropriate Crew Response (PSM+ICR).

• AIA PC-342-1, Supplemental Report on Turbine Engine Rotor Uncontained Events.

• SAE ARP 4754, Guidelines for Development of Civil Aircraft and Systems.

• SAE ARP 4761, Guidelines and Methods for Conducting the Safety Assessment Process on Civil Airborne Systems and Equipment.

• SAE ARP5120, Aircraft Gas Turbine Engine Health Management System Development and Integration Guide.

• SAE ARP 5150, Safety Assessment of Transport Airplanes in Commercial Service.

• Technical Reports on Propulsion System and Auxiliary Power Unit (APU) Related Aircraft Safety Hazards (CAAM 1, CAAM 2, and CAAM 3 Reports), and the subsequent CAAM reports posted on the website Engines and Propellers - Data and Reports | Federal Aviation Administration.

1.4.6 Technical Publications.

• E. Lloyd and W. Tye, Systematic Safety: Safety Assessment of Aircraft Systems, London: Taylor Young Limited, 1982.

• Averill M. Law and W. David Kelton, Simulation Modeling and Analysis - 2nd Edition, McGraw-Hill Publishing Company, 1991.

1.5 Definitions.

1.5.1 APU Installation.

Any gas turbine-powered unit delivering rotating shaft power, compressor air, or both, which is not intended for direct propulsion of an airplane. Typically, the APU 1-3

AC 39-8A installation includes the following components:

• APU gas turbine unit;

• APU accessories;

• APU inlet and exhaust systems;

• APU control systems;

• APU indicating systems;

• APU fire protection systems; and

• APU bleed air systems.

1.5.2 Continued Airworthiness.

The ongoing activities associated with ensuring a product remains in conformity with its type design and is in a condition for safe operation.

1.5.3 Control Program.

The combination of corrective actions and timetable for their completion needed to address an identified unsafe condition.

1.5.4 Event.

Any individual occurrence involving an aircraft or its components. Described in terms of what is observed (the symptoms) or recorded during the occurrence. Events typically trigger investigations that seek causes of a hazard. The hazard (or condition) is then evaluated for safety implications.

1.5.5 Hazard Level (HL).

Level of event outcome, as defined by its effect on the aircraft, passengers, and crew (see appendix B, Hazard Level Definitions).

1.5.6 Hazard Ratio (HR).

The conditional probability that a particular powerplant installation failure mode will result in an event of a specific HL.

1.5.7 Malfunction.

A single initiating cause of a failure, defect, or other abnormal condition on a type design that can affect one or more parts. One specific cause (such as a melt-related defect leading to fracture) that affects several different parts (5th stage disks and 6th stage disks, for example) within an engine type design is considered a single malfunction type. However, multiple initiating causes for a single part (e.g., meltrelated defect, high-cycle fatigue, corrosion, etc., for 5th stage disks) represent multiple malfunction types. Note that the use of the term “malfunction” attempts to cover the traditional definition referring to systems or components not functioning properly along with hardware-induced failures.

1-4

AC 39-8A

1.5.8 Powerplant Installation.

Each component that is necessary for propulsion, affects the control of the major propulsive units, or affects the safety of the major propulsive units between normal inspections or overhauls. Typically, the powerplant installation includes the following components:

• Main engines and propellers;

• Engine and propeller accessories including engine oil systems, engine bleed systems, gearboxes;

• Engine and propeller controls and indicating systems;

• Engine and propeller protection systems, including engine fire protection systems, engine overspeed protection systems, engine icing protection systems;

• Engine nacelles and cowling, including inlets, exhaust nozzles, core cowls, fan cowls, thrust reversers;

• Engine struts and pylons; and

• Fuel systems, including fuel feed systems, refuel and defuel systems, fuel transfer systems, fuel system controls and indications.

1.5.9 Product Design Standards.

The requirements delineated within the airworthiness standards (for the purposes of this AC, 14 CFR parts 25, 33, and 35) and operating rules (for the purposes of this AC, 14 CFR parts 91, 121, 125, and 135) that regulate the physical and functional characteristics of airplanes, engines, propellers, and components. For the purposes of this AC, these are sometimes referred to as “certification standards” or “design standards.”

1.5.10 Risk Factor.

A quantitative assessment output equal to the average number of future events expected to occur within a given time. Risk factors can be differentiated into three types;

uncorrected, control program, and corrected. Typically, they cover the time required for problem resolution. However, in the case of uncorrected and control program risk factors, control programs that do not incorporate final corrective actions, such as recurring inspections, usually cover a period of 20 years or shorter that correspond to the expected life of the fleet.

• Uncorrected Risk Factor. The forecasted number of future events expected to occur in the entire worldwide fleet of transport category airplanes installed with the model of engine being analyzed, or, if applicable, the relevant affected subfleet if no corrective actions are incorporated. Fleet actions that were in place (if any) prior to the start of the Uncorrected Risk period or any mandated mitigations (such as FAA ADs or part life limits) that may place restrictions on the duration of operation should be considered for inclusion in the Uncorrected Risk Factor.

• Control Program Risk Factor. The forecasted number of future events expected to occur in the entire worldwide fleet of transport category airplanes installed with the 1-5

AC 39-8A model of engine being analyzed, or, if applicable, the relevant affected subfleet during the control program.

• Corrected Risk Factor. The forecasted number of future events expected to occur after the entire affected population incorporates the final corrective actions. The affected population may be the entire worldwide fleet of transport category airplanes installed with the model of engine being analyzed or relevant affected subfleet, depending on the issue. Note that this number should be consistent with the long-term acceptable risk guidelines listed in table 1 of this AC.

1.5.11 Unsafe Condition.

A condition, which, if not corrected, is reasonably expected to result in one or more serious or fatal injuries.

• Is Reasonably Expected. Has a probability of occurrence that is not acceptable to the long-term risk guidelines listed in table 1 of this AC and the intent of the applicable product design standards.

• Fatal Injury. As defined by the National Transportation Safety Board (NTSB)10F , any injury that results in death within 30 days of the accident.

• Serious Injury. As defined by the NTSB, any injury that:

1. Requires hospitalization for more than 48 hours, commencing within 7 days from the date the injury was received;

2. Results in the fracture of any bone (except simple fractures of fingers, toes, or nose);

3. Causes severe hemorrhages, nerve, muscle or tendon damage;

4. Involves injury to any internal organ; or

5. Involves second- or third-degree burns, or any burns affecting more than 5 percent of the body surface.

1.6 Principal Revisions.

This AC revision makes the hazard level (HL) and failure condition definitions consistent with the CAAM reports by referencing the web location of the latest CAAM data. This AC also updates the hazard ratio data in appendix D with a new format and additional data based on the CAAM 3 and later reports. Guidance has been added on calculating a Level 4 hazard ratio when there have not been any L4 events. The term “excessive” has been replaced with “elevated” when referring to increasing levels of risk. References in the document were updated and outdated information was removed, including several appendices. The document was also reformatted.

1 49 CFR 830.2 1-6