# AC 39-8A: Continued Airworthiness Assessments of Powerplant and Auxiliary Power Unit Installations of Transport Category Airplanes - Type: Advisory circular (guidance, not mandatory unless a rule or AD requires it) - Status: Current - Approved: October 1, 2026 - Family: AC 39-8 - Pages: 76 - FAA DRS: https://drs.faa.gov/browse/excelExternalWindow/DRSDOCID111169565820261002111748.0001 - Page: https://openairdocs.org/ac/39-8 ## Versions - AC 39-8A (Current), approved Oct 1, 2026 - AC 39-8 (Historical), approved Sep 8, 2003 ## ADs that cite it (10) - [AD 2020-12-07](https://openairdocs.org/ad/2020-12-07) (historical): Propeller Blade Section · Hamilton Sundstrand 54H. Effective Jul 20, 2020 - [AD 2020-07-02](https://openairdocs.org/ad/2020-07-02) (historical): Turbine Engine Compressor Section · Pratt & Whitney PW1519G, PW1521G, PW1521G-3 and 5 more. Effective Apr 15, 2020 - [AD 2019-21-11](https://openairdocs.org/ad/2019-21-11) (historical): Turbine Engine Compressor Section · Pratt & Whitney PW1519G, PW1521G, PW1521G-3 and 10 more. Effective Oct 29, 2019 - [AD 2019-19-11](https://openairdocs.org/ad/2019-19-11) (historical): Turbine Engine Compressor Section · Pratt & Whitney PW1519G, PW1521G, PW1521G-3 and 10 more. Effective Sep 26, 2019 - [AD 2018-02-14](https://openairdocs.org/ad/2018-02-14) (historical): Turbine Engine Combustion Section · Honeywell International TPE331-1, TPE331-10, TPE331-10AV and 38 more. Effective Feb 28, 2018 - [AD 2017-05-05](https://openairdocs.org/ad/2017-05-05): Failure of the HPT 1st stage hub · Pratt & Whitney Division PW4074, PW4074D, PW4077 and 4 more. Effective Apr 13, 2017 - [AD 2013-26-06](https://openairdocs.org/ad/2013-26-06): High-pressure turbine (HPT) stage 2 wheels · Rolls-Royce AE 3007A, AE 3007A1, AE 3007A1/1 and 5 more. Effective Feb 7, 2014 - [AD 2012-18-18](https://openairdocs.org/ad/2012-18-18): Gas generator (GG) turbine blade · Turbomeca Arriel 2B, Arriel 2B1, Arriel 2C2 and 1 more. Effective Oct 24, 2012 - [AD 2010-16-03](https://openairdocs.org/ad/2010-16-03): Ice and rain protection · Boeing MD-11 and MD-11F. Effective Sep 9, 2010 - [AD 2008-21-11](https://openairdocs.org/ad/2008-21-11): Low-pressure turbine (LPT) cases · General Electric CF6-80C2A1, CF6-80C2A2, CF6-80C2A3 and 25 more. Effective Nov 28, 2008 ## Text ### Page 1 U.S. Department of Transportation Federal Aviation Administration Advisory Circular Subject: Continued Airworthiness Assessment Methodologies of Powerplant and Auxiliary Power Unit Installations on Transport Category Airplanes Date: AC No: 39-8A Initiated By: AIR-630 This advisory circular (AC) describes continued airworthiness assessment methodologies (CAAM) that may be applied to the products associated with the powerplant or auxiliary power unit (APU) installations on transport category airplanes. It provides information and guidance on how to estimate the risks associated with identified unsafe conditions. The methodologies described in this AC are derived from the criteria developed by the FAA and industry. It represents a means for risk assessment. With an updated subject title emphasizing methodologies, and emphasis on usage of the latest data, this new AC supersedes its predecessor AC 39-8 Continued Airworthiness Assessments of Powerplant and Auxiliary Power Unit Installations of Transport Category Airplanes. If you have suggestions for improving this AC, you may use the form at the end of this AC. James D. Foltz Aviation Safety Acting Director, Policy and Standards Division, Aircraft Certification Service ### Page 2 AC 39-8A Table of Contents Paragraph Page CHAPTER 1. GENERAL INFORMATION … 1-1 1.1 Purpose … 1-1 1.2 Applicability. … 1-1 1.3 Cancellation. … 1-2 1.4 Related Reading Material. … 1-2 1.5 Definitions … 1-3 1.6 Principal Revisions. … 1-6 1.7 Background. … 1-7 1.8 CAAM Publications … 1-7 CHAPTER 2. IDENTIFYING UNSAFE CONDITIONS … 2-1 2.1 Identifying Unsafe Conditions … 2-1 2.2 Root Cause Analysis and/or Contributing Factors … 2-1 2.3 Hazard Ratio of Prior Events. … 2-1 2.4 Probability of Future Events. … 2-1 2.5 Immediate Action is Warranted. … 2-1 2.6 Responses to Unsafe Conditions … 2-2 2.7 Risk to Persons Outside the Airplane. … 2-2 CHAPTER 3. RISK ASSESSMENT … 3-1 3.1 Risk Assessment. … 3-1 3.2 Assumptions … 3-1 3.3 Probability of Event Prediction … 3-1 3.4 Mitigating and Corrective Actions … 3-3 3.5 Assessment Model Considerations. … 3-6 **CHAPTER 4. RISK FACTOR GUIDELINES AND PRIORITIZATION BASED ON RISK** . … 4-1 4.1 Hazard Level 3 and Level 4 Risk Guidelines. … 4-1 4.2 Risk Guidelines for In-Flight Shutdown (IFSD) Rate Concerns. … 4-2 4.3 Risk Guidelines for Immediate Action. … 4-2 4.4 Prioritization Based on Risk. … 4-2 ii ### Page 3 AC 39-8A Table of Contents Paragraph Page CHAPTER 5. MISCELLANEOUS CONDISDERATIONS … 5-1 5.1 Corrected Risk. … 5-1 5.2 Cumulative Risk … 5-1 5.3 Lessons Learned … 5-2 5.4 Alternative Methods of Compliance (AMOC). … 5-2 5.5 Airplane and Engine Stakeholder Coordination. … 5-2 APPENDIX A. POTENTIAL UNSAFE CONDITIONS … A-1 A.1 Purpose … A-1 A.2 Identification of Potential Unsafe Conditions … A-1 A.3 Categories of Failures Leading to Potential Unsafe Conditions … A-2 APPENDIX B. HAZARD LEVEL DEFINITIONS … B-1 B.1 Purpose … B-1 B.2 Hazard Level Classification … B-1 B.3 Hazard Level 3 – Serious Consequences. … B-1 B.4 Hazard Level 4 – Severe Consequences. … B-3 B.5 Hazard Level 5 – Catastrophic Consequences … B-3 B.6 General Notes Applicable to all Event Hazard Levels. … B-4 B.7 Historical Comparison of Hazard Level Descriptions. … B-4 APPENDIX C. HAZARD RATIO DEVELOPMENT … C-1 C.1 Purpose … C-1 C.2 Applying the Hazard Ratio. … C-1 C.3 Hazard Ratio Development … C-1 C.4 Notes on Hazard Ratio Development. … C-3 APPENDIX D. HISTORICALLY POTENTIAL UNSAFE CONDITIONS … D-1 D.1 Purpose … D-1 D.2 CAAM Database … D-1 D.3 Hazard Ratio Calculation … D-1 D.4 Failure Condition: Uncontained … D-2 D.5 Failure Condition: Fire Zone Fire. … D-10 D.6 Failure Condition: Tailpipe Fire. … D-12 iii ### Page 4 AC 39-8A Table of Contents Paragraph Page D.7 Failure Condition: Case Rupture. … D-13 D.8 Failure Condition: Case Burnthrough … D-14 D.9 Failure Condition: Multiple-Engine Events … D-15 D.10 Failure Condition: Engine/Pylon Separations … D-4 D.11 Failure Condition: Cowl Separation. … D-5 D.12 Failure Condition: Asymmetric Thrust Reverser Deployment/Inflight Beta. … D-6 D.13 Failure Condition: Fuel Leak. … D-7 D.14 Failure Condition: Propeller System Events … D-8 D.15 Failure Condition: APU System Event. … D-10 D.16 Failure Condition: Propulsion System malfunction Recognition and Response (PSMRR) … D-12 D.17 Failure Condition: Crew Error. … D-13 D.18 Previously Reported Hazards Not Included … D-14 APPENDIX E. RISK ASSESSMENT EXAMPLE … E-1 E.1 Purpose … E-1 E.2 Example – Compressor Disk Fracture. … E-1 iv ### Page 5 AC 39-8A FIGURES Number Page Figure 1a. Airplane Threat Comparison (Hazard Level 3) … 4-4 Figure 1b. Airplane Threat Comparison (Hazard Level 4) … 4-4 Figure 2. Event Probability vs. Event Forecast (Risk Factor) … 5-1 TABLES Number Page Table 1. Risk Guidelines … 4-1 Table D-1 - Uncontained Disk Hazard Ratios of Fan and Low-Pressure Compressor (LPC) … D-2 Table D-2 - Uncontained Disk Hazard Ratios of High-Pressure Compressor (HPC), Intermediate Pressure Compressor (IPC), High-Pressure Turbine (HPT) and Intermediate Pressure Turbine (IPT) … D-3 Table D-3 - Uncontained Disk Hazard Ratios of Low-Pressure Turbine (LPT) … D-4 Table D-4 - Uncontained Blade Hazard Ratios (Fan and Platforms) … D-5 Table D-5 - Uncontained Blade Hazard Ratios (LPC and HPC) … D-6 Table D-6 - Uncontained Blade Hazard Ratios (HPT/IPT and LPT) … D-7 Table D-7 - Uncontained "Other" Hazard Ratios (Fan and HPC) … D-8 Table D-8 - Uncontained "Other" Hazard Ratios (HPT and LPT/PT) … D-9 Table D-9a - Fire Zone Fire Data … D-11 Table D-9b - Fire Zone Fire Data … D-11 Table D-10 - Tailpipe Fire Data … D-12 Table D-11 - Case Rupture Hazard Ratios … D-13 Table D-12 - Case Burnthrough Hazard Ratios … D-14 Table D-13 - Multiple-Engine Event (Fuel Related) Hazard Ratios … D-1 Table D-14 - Multiple-Engine Event (Non-Fuel) Hazard Ratios … D-2 Table D-15 - Engine/Pylon Separations … D-4 Table D-16 - Cowl Separation Hazard Ratios … D-5 Table D-17 - Thrust Reverser Deploy - Inflight Hazard Ratios … D-6 v ### Page 6 AC 39-8A Table D-18 - Fuel Leak Data … D-7 Table D-19 - Propeller System Hazard Ratios … D-9 Table D-20 - APU Data … D-11 Table D-21 - Propulsion System Malfunction Recognition and Response Data … D-12 Table D-22 - Crew Error Data … D-13 vi ### Page 7 **AC 39-8A CHAPTER 1. GENERAL INFORMATION** 1.1 Purpose. 1.1.1 This advisory circular (AC) describes continued airworthiness assessment methodologies (CAAM) that may be used for products associated with the powerplant or auxiliary power unit (APU) installations on transport category airplanes. It provides guidance for estimating the risks associated with identified unsafe conditions, for defining, prioritizing, and selecting suitable corrective actions for all identified unsafe conditions, and for verifying that the corrective actions are effective. 1.1.2 The Federal Aviation Administration (FAA) may use these CAAM to identify unsafe conditions and make decisions concerning the priority in which unsafe conditions should be addressed. Continued airworthiness requires that safety concerns within the existing fleet are addressed and the knowledge gained is applied for the benefit of future fleets. 1.1.3 This AC describes the CAAM processes that may be used to identify unsafe conditions and determine when an unsafe condition is likely to exist or develop in other products of the same type design in accordance with 14 CFR part 39. 1.2 Applicability. 1.2.1 The guidance provided in this AC is for airplane engine manufacturers, modifiers, foreign authorities, FAA engine type certification engineers, FAA inspectors, and FAA designees, which are collectively referred to as stakeholders in this AC. 1.2.2 This is a guidance document. Its content is not legally binding in its own right and will not be relied upon by the Department as a separate basis for affirmative enforcement action or other administrative penalty. Conformity with the guidance document is voluntary only. Nonconformity will not affect rights and obligations under existing statutes and regulations. The FAA will consider other methods of demonstrating compliance that an applicant may elect to present. Terms such as “should,” “may,” and “must” are used only in the sense of ensuring applicability of this particular method of compliance when the acceptable method of compliance in this document is used. If the FAA becomes aware of circumstances in which following this AC would not result in compliance with the applicable regulations, the FAA may require additional substantiation as the basis for finding compliance. 1.2.3 This material does not change or create any additional regulatory requirements or authorize changes in or permit deviations from existing regulatory requirements. 1-1 ### Page 8 AC 39-8A 1.3 Cancellation. This AC cancels AC 39-8, Continued Airworthiness Assessments of Powerplant and Auxiliary Power Unit Installations on Transport Category Airplanes, dated September 8, 2003. 1.4 Related Reading Material. For all references throughout the document, use the latest revision unless otherwise discussed with the FAA. 1.4.1 14 CFR Regulations. The following 14 CFR regulations are related to this AC. You can download the full text of these regulations from the Federal Register website at www.ecfr.gov. • Part 25, Airworthiness standards: Transport category airplanes. • Part 33, Airworthiness standards: Aircraft engines. • Part 35, Airworthiness standards: Propellers. • Part 39, Airworthiness directives. • Part 121, Operating requirements: Domestic, flag, and supplemental operations. • Part 125, Certification and operations: Aircraft having a seating capacity of 20 or more passengers or a maximum payload capacity of 6,000 pounds or more; and rules governing persons on board such aircraft. • Part 135, Operating Requirements: Commuter and on demand operations and rules governing persons on board such aircraft. 1.4.2 FAA Policy Statements. The following policy statements are related to the guidance in this AC. The latest version of each policy statement referenced in this document is available on the https://drs.faa.gov/browse. • FAA Policy PS-ANE-2011-33-1, Engine Reliability in Extended Operations (ETOPS) – Continued Operational Safety (COS) Assessments. • FAA Policy PS-ANM-25-05, Risk Assessment Methodology for Transport Category Airplanes. 1.4.3 FAA Order. FAA Order 8110.107, Monitor Safety/Analyze Data, is related to the guidance in this AC. The latest version of each order referenced in this document is available on DRS at https://drs.faa.gov/browse. 1-2 ### Page 9 AC 39-8A 1.4.4 FAA Manual. FAA Manual FAA-IR-M-8040.1, Airworthiness Directives Manual, is related to the guidance in this AC. The latest version of this FAA Manual referenced in this document is available on the https://employees.faa.gov/tools_resources/orders_notices/. 1.4.5 Industry Publications. The following publications from the Air Force Wright Aeronautical Laboratories (AFWAL), Aerospace Industries Association (AIA), and SAE International provide additional guidance. The Air Force Wright Aeronautical Laboratories (AFWAL) was merged into the Air Force Research Laboratory. • AFWAL-TR-83-2079, Weibull Analysis Handbook. • AIA PC-342, Initial Report on Propulsion System and APU Related Aircraft Safety Hazards. • AIA and AECMA (Association Européenne des Constructeurs de Matériel Aérospatial/European Association of Aerospace Industries) Project Report on Propulsion System Malfunction plus Inappropriate Crew Response (PSM+ICR). • AIA PC-342-1, Supplemental Report on Turbine Engine Rotor Uncontained Events. • SAE ARP 4754, Guidelines for Development of Civil Aircraft and Systems. • SAE ARP 4761, Guidelines and Methods for Conducting the Safety Assessment Process on Civil Airborne Systems and Equipment. • SAE ARP5120, Aircraft Gas Turbine Engine Health Management System Development and Integration Guide. • SAE ARP 5150, Safety Assessment of Transport Airplanes in Commercial Service. • Technical Reports on Propulsion System and Auxiliary Power Unit (APU) Related Aircraft Safety Hazards (CAAM 1, CAAM 2, and CAAM 3 Reports), and the subsequent CAAM reports posted on the website Engines and Propellers - Data and Reports | Federal Aviation Administration. 1.4.6 Technical Publications. • E. Lloyd and W. Tye, Systematic Safety: Safety Assessment of Aircraft Systems, London: Taylor Young Limited, 1982. • Averill M. Law and W. David Kelton, Simulation Modeling and Analysis - 2nd Edition, McGraw-Hill Publishing Company, 1991. 1.5 Definitions. 1.5.1 APU Installation. Any gas turbine-powered unit delivering rotating shaft power, compressor air, or both, which is not intended for direct propulsion of an airplane. Typically, the APU 1-3 ### Page 10 AC 39-8A installation includes the following components: • APU gas turbine unit; • APU accessories; • APU inlet and exhaust systems; • APU control systems; • APU indicating systems; • APU fire protection systems; and • APU bleed air systems. 1.5.2 Continued Airworthiness. The ongoing activities associated with ensuring a product remains in conformity with its type design and is in a condition for safe operation. 1.5.3 Control Program. The combination of corrective actions and timetable for their completion needed to address an identified unsafe condition. 1.5.4 Event. Any individual occurrence involving an aircraft or its components. Described in terms of what is observed (the symptoms) or recorded during the occurrence. Events typically trigger investigations that seek causes of a hazard. The hazard (or condition) is then evaluated for safety implications. 1.5.5 Hazard Level (HL). Level of event outcome, as defined by its effect on the aircraft, passengers, and crew (see appendix B, Hazard Level Definitions). 1.5.6 Hazard Ratio (HR). The conditional probability that a particular powerplant installation failure mode will result in an event of a specific HL. 1.5.7 Malfunction. A single initiating cause of a failure, defect, or other abnormal condition on a type design that can affect one or more parts. One specific cause (such as a melt-related defect leading to fracture) that affects several different parts (5th stage disks and 6th stage disks, for example) within an engine type design is considered a single malfunction type. However, multiple initiating causes for a single part (e.g., meltrelated defect, high-cycle fatigue, corrosion, etc., for 5th stage disks) represent multiple malfunction types. Note that the use of the term “malfunction” attempts to cover the traditional definition referring to systems or components not functioning properly along with hardware-induced failures. 1-4 ### Page 11 AC 39-8A 1.5.8 Powerplant Installation. Each component that is necessary for propulsion, affects the control of the major propulsive units, or affects the safety of the major propulsive units between normal inspections or overhauls. Typically, the powerplant installation includes the following components: • Main engines and propellers; • Engine and propeller accessories including engine oil systems, engine bleed systems, gearboxes; • Engine and propeller controls and indicating systems; • Engine and propeller protection systems, including engine fire protection systems, engine overspeed protection systems, engine icing protection systems; • Engine nacelles and cowling, including inlets, exhaust nozzles, core cowls, fan cowls, thrust reversers; • Engine struts and pylons; and • Fuel systems, including fuel feed systems, refuel and defuel systems, fuel transfer systems, fuel system controls and indications. 1.5.9 Product Design Standards. The requirements delineated within the airworthiness standards (for the purposes of this AC, 14 CFR parts 25, 33, and 35) and operating rules (for the purposes of this AC, 14 CFR parts 91, 121, 125, and 135) that regulate the physical and functional characteristics of airplanes, engines, propellers, and components. For the purposes of this AC, these are sometimes referred to as “certification standards” or “design standards.” 1.5.10 Risk Factor. A quantitative assessment output equal to the average number of future events expected to occur within a given time. Risk factors can be differentiated into three types; uncorrected, control program, and corrected. Typically, they cover the time required for problem resolution. However, in the case of uncorrected and control program risk factors, control programs that do not incorporate final corrective actions, such as recurring inspections, usually cover a period of 20 years or shorter that correspond to the expected life of the fleet. • Uncorrected Risk Factor. The forecasted number of future events expected to occur in the entire worldwide fleet of transport category airplanes installed with the model of engine being analyzed, or, if applicable, the relevant affected subfleet if no corrective actions are incorporated. Fleet actions that were in place (if any) prior to the start of the Uncorrected Risk period or any mandated mitigations (such as FAA ADs or part life limits) that may place restrictions on the duration of operation should be considered for inclusion in the Uncorrected Risk Factor. • Control Program Risk Factor. The forecasted number of future events expected to occur in the entire worldwide fleet of transport category airplanes installed with the 1-5 ### Page 12 AC 39-8A model of engine being analyzed, or, if applicable, the relevant affected subfleet during the control program. • Corrected Risk Factor. The forecasted number of future events expected to occur after the entire affected population incorporates the final corrective actions. The affected population may be the entire worldwide fleet of transport category airplanes installed with the model of engine being analyzed or relevant affected subfleet, depending on the issue. Note that this number should be consistent with the long-term acceptable risk guidelines listed in table 1 of this AC. 1.5.11 Unsafe Condition. A condition, which, if not corrected, is reasonably expected to result in one or more serious or fatal injuries. • Is Reasonably Expected. Has a probability of occurrence that is not acceptable to the long-term risk guidelines listed in table 1 of this AC and the intent of the applicable product design standards. • Fatal Injury. As defined by the National Transportation Safety Board (NTSB)10F , any injury that results in death within 30 days of the accident. • Serious Injury. As defined by the NTSB, any injury that: 1. Requires hospitalization for more than 48 hours, commencing within 7 days from the date the injury was received; 2. Results in the fracture of any bone (except simple fractures of fingers, toes, or nose); 3. Causes severe hemorrhages, nerve, muscle or tendon damage; 4. Involves injury to any internal organ; or 5. Involves second- or third-degree burns, or any burns affecting more than 5 percent of the body surface. 1.6 Principal Revisions. This AC revision makes the hazard level (HL) and failure condition definitions consistent with the CAAM reports by referencing the web location of the latest CAAM data. This AC also updates the hazard ratio data in appendix D with a new format and additional data based on the CAAM 3 and later reports. Guidance has been added on calculating a Level 4 hazard ratio when there have not been any L4 events. The term “excessive” has been replaced with “elevated” when referring to increasing levels of risk. References in the document were updated and outdated information was removed, including several appendices. The document was also reformatted. **1 49 CFR 830.2 1-6** ### Page 13 AC 39-8A 1.7 Background. 1.7.1 In 1991, the AIA tasked a working group called “the CAAM committee” (here after referred to “the CAAM”) with developing effective methods for identifying, prioritizing, and resolving safety-related problems occurring on commercial airplane engines. The CAAM analyzed 10 years of engine, propeller, and APU events and developed an event characterization system. The CAAM then grouped the events by the observed outcome (non-containment, fire, etc.) and assigned an HL. 1.7.2 For each observed outcome, the CAAM calculated the historical conditional probabilities of the most serious events, HLs 3 and 4, using a methodology to estimate the risks of safety-related problems occurring on airplane engines, propellers, and APUs. In 1994, the CAAM first published these results in the AIA PC-342 and AIA PC-342-1. 1.7.3 Since then, the CAAM has updated the database of the safety-significant propulsion system and APU historical malfunctions for 1992 through 2000 and 2001 through 2012 and published all three sets of results in reports in 1999, 2005, and 2017 (“CAAM 1,” “CAAM 2,” and “CAAM 3” reports).2 1F The FAA has used the information in these reports to help identify and prioritize responses to potential engine, propeller, and APU unsafe conditions. 1.8 CAAM Publications. CAAM will be continually engaged in the collection, evaluation, and publication of data and guidance material. The future CAAM publications will be posted on the website Engines and Propellers - Data and Reports | Federal Aviation Administration. Due to the evolution and revision of definitions and other factors, various datasets should only be used with the guidance established for that dataset. The following further elaborates on the relationship of current CAAM work to, and applicability of, prior published data. Consistent with historic CAAM practices, the current CAAM effort is not intended to supersede or invalidate prior work, but rather to build upon, supplement, and advance what has come before. No single CAAM report or activity can be taken in isolation. The published CAAM reports provide a valuable history and will remain an integral part of current and contemplated committee work for the foreseeable future. As new datasets are developed, published, and updated the companion background and guidance material will, as applicable, indicate what prior work it may replace or make obsolete (if that is the case). While some data/information may be supplanted, familiarity with topic evolution through prior work will still have relevance and value. The FAA encourages users of any CAAM data to become familiar with the entire body of work as the current effort is inextricably tied and related to previous work. As the application of the datasets in CAAM reports and this AC and how to best interpret the data for the purpose of numerical assessments should be based on the definitions, nomenclatures and guidance 2 These reports are available at https://www.faa.gov/aircraft/air_cert/design_approvals/engine_prop/engine_sp_topics 1-7 ### Page 14 AC 39-8A specified in respective datasets. The material in these datasets is general in nature and should only be utilized in conjunction with a thorough assessment of the individual situation to which it is applied. 1-8 ### Page 15 **AC 39-8A CHAPTER 2. IDENTIFYING UNSAFE CONDITIONS** 2.1 Identifying Unsafe Conditions. When a potential unsafe condition is identified by the stakeholder, the stakeholder should conduct a quantitative or qualitative assessment for the actual risk of the event of interest. See chapter 3 for further guidance on performing the assessment. 2.2 Root Cause Analysis and/or Contributing Factors. The preliminary information received by the stakeholder regarding the potential unsafe condition may be insufficient to determine the appropriate corrective action. Therefore, it is often necessary to seek additional information to determine the root causes and contributing factors to the potential unsafe condition. Unsafe conditions may be caused either in combination or separately by improper design, manufacture, maintenance, or operation. The contribution of these individual elements should be evaluated by the stakeholder in order to ascertain the probability of future occurrences as well as the effectiveness of candidate corrective actions. Unsafe conditions that are not mitigated by conditional factors may require expeditious action unless the root causes, failure distribution, and risk factor can be established and determined to be non-urgent by the stakeholder. Note: Root cause problem assessments may identify concerns in other products of the same or similar type design or usage. In these cases, consideration of corrective action beyond the initially identified population may be necessary. 2.3 Hazard Ratio of Prior Events. The stakeholder(s) should review the prior examples of similar occurrences of the potential unsafe condition and their associated airplane-level effects to help with the determinations described in all aspects of the CAAM processes. The CAAM reports are one source that provides information on previous occurrences of a variety of propulsion system and APU events. This information is especially helpful in estimating the hazard ratio. See appendices C and D for additional guidance. 2.4 Probability of Future Events. The stakeholder(s) should compare the probability of HL 3 and higher events occurring in the future to the long-term acceptable risk guidelines outlined in table 1 of this AC, as well as the applicable design standards to determine whether an unsafe condition exists. An unsafe condition exists if the probability of occurrence does not meet both of these guidelines and design standards. 2.5 Immediate Action is Warranted. When the stakeholder identifies an unsafe condition, the FAA should decide if immediate action is warranted following the guidelines detailed in paragraph 4.3. If 2-1 ### Page 16 AC 39-8A immediate action is warranted, such action should reflect the severity of the condition and the likelihood of additional events occurring before the implementation of a longterm solution. 2.5.1 It is possible that the likelihood of a recurrence of an unsafe condition cannot be adequately estimated immediately following a potentially severe event. If it is possible to take immediate and practical action which the FAA has a basis to believe will address that safety risk, while the agency’s initial assessment to fully determine the cause and likelihood of recurrence is being made, the FAA should consider that action. For example, an accident caused by an inflight thrust reverser deployment resulted in the pilot losing control of the airplane. Neither the cause of failures, which led to the thrust reverser deploying inflight, nor the reasons why the inflight deployment resulted in the pilot losing control of the airplane, could be readily determined with certainty. However, it was possible to take reasonable immediate action by “locking-out” the thrust reversers. The FAA would allow the thrust reversers to be “unlocked” when it could assure system integrity by requiring periodic checks of the entire thrust reverser system, including its fault indication features. The final corrective action was to incorporate system modifications to ensure that subsequent inflight deployments are not anticipated to occur within the fleet life of the airplane type. 2.5.2 If no practical or readily implemented corrective action is possible to ensure continued operational safety, or if such action is not known to be sufficient in and of itself, then every effort should be made to objectively evaluate the appropriate level of response to the identified unsafe condition. When factual data is sparse, this review should be based on sound engineering judgment. The intent in either situation is for consistent and objective responses to unsafe conditions. 2.6 Responses to Unsafe Conditions. Responses to identified unsafe conditions can vary from an immediate mitigating reaction to an extensively considered final response. The control programs for most unsafe conditions may include initial, interim, and final actions. The CAAM processes assist with the evaluation of those actions and help to verify that the actions are appropriate and timely to mitigate the unsafe condition. 2.7 Risk to Persons Outside the Airplane. Throughout the CAAM risk assessment processes, the stakeholders should consider the threat to persons both inside and outside the airplane when determining how to mitigate the unsafe condition. However, certain causes of serious injury to persons outside the airplane, such as those caused by human negligence or recklessness, cannot be wholly prevented by practicable changes to the type design. Examples of this include personnel that have walked into turning propellers or been ingested into engines due to a disregard for cautions, warning markings, or manual instructions. Many other risks to persons outside the airplane, such as the shedding of small components from the airplane or engine were statistically insignificant from the perspective of CAAM risk assessment, in comparison with the airplane-level risk, due to the low probability of persons being 2-2 ### Page 17 AC 39-8A injured. Thus, if the threat to persons outside the airplane is insignificant compared to the threat to persons inside the airplane, or to the applicable risk guidelines, then the stakeholder does not need to consider the marginal additional risk to persons outside the airplane when developing corrective action. 2-3 ### Page 18 **AC 39-8A CHAPTER 3. RISK ASSESSMENT** 3.1 Risk Assessment. It may be necessary for the FAA to work closely with the design approval holder and, if appropriate, the operators to complete the steps outlined within the CAAM risk assessment process. This cooperative effort may take the form of the FAA engineer overseeing the work of the manufacturer or designer, the FAA engineer and manufacturer working in concert, or the FAA engineer performing the analysis with input from the manufacturer. 3.2 Assumptions. Any risk analysis, whether qualitative or quantitative, is only as accurate as the assumptions, data, and analytical techniques used. Therefore, all assumptions should be justified to ensure that the conclusions of the analysis are valid. The justification of the assumptions should be an integral part of the analysis. Assumptions can be validated by using experience with identical or similar systems or components, with due allowance made for differences of design, duty cycle, and environment. When it is not possible to adequately justify the critical elements of the analysis, conservatism should be built into the initial assumptions. However, it is important to maintain consistency with the observed physics of the event and failure mode when adding conservatism. Alternatively, the uncertainty in the data and assumptions should be evaluated to the degree necessary to demonstrate that the conclusions are relatively insensitive to that uncertainty. If a quantitative method is used, it is essential that the analysis calibrates with the experience to date. A quantitative risk analysis cannot be expected to credibly predict into the future if it does not calibrate to actual experience. 3.3 Probability of Event Prediction. There are various methods used to classify the severity and predict the probability of event occurrence. The intent, in any case, is to perform a realistic structured assessment to determine whether an unsafe condition exists. This ensures that an unsafe condition with a greater risk of occurrence receives a higher level of attention and resources for its resolution than does one that represents a lower risk. The actual process used may vary depending on the nature of the potentially unsafe condition, the level of experience with similar unsafe conditions, the level of risk assessment, and prioritization of information needed to support effective decision-making. However, the stakeholder should perform a process equivalent to that described in this AC as fully as possible. The steps outlined in paragraphs 3.3.1 – 3.3.12 may be performed using either quantitative or qualitative methods, or both. 3.3.1 Estimate the Number of Airplanes Exposed. Determine the number of airplanes for which the unsafe condition may exist, or be expected to develop, if no corrective action is taken. For example, estimate the number of airplanes with engine parts that fall within a certain serial number range or airplanes with installed engines with a certain total cycles or total hours. A failure condition may 3-1 ### Page 19 AC 39-8A apply to the fleet of airplanes installed with the affected engines, or it may be limited to a particular, identifiable subpopulation. Alternatively, the full fleet may consist of many subpopulations that are all at risk of the failure condition, but at different rates or probabilities. Subpopulations may include different engine models, operators, types of operations, location of operations, manufacturing heats, production lots, or serial number ranges. To divide the full fleet and separately assess the risk of subpopulations, the individual components, engines, or airplanes should be able to be identified as belonging to the at-risk subpopulation(s). For example, if the model of each engine is known, the heat of material or serial number for each part is known, or the type of operation for flights can be identified. 3.3.2 Estimate the Uncorrected Risk Factor. 3.3.2.1 Use analytical techniques to estimate the uncorrected risk factor. This step estimates how many events will occur within the exposed population. While the event of interest is usually the occurrence of the identified unsafe condition, events of lesser or greater severity may also be analyzed. Risk factors for HLs 3, 4, and 5 are also calculated to allow for comparison to the risk guidelines outlined in table 1 of this AC. Risk factors for higher-level events are obtained by multiplying the event risk factor by the applicable hazard ratio. 3.3.2.2 Failure of components is most often a function of component cycles, airplane flights, or hours of operation. However, it may be a function of calendar time or other parameters. Failure rate data expressed as failures per flight hour, cycle, or flight may also be dependent on the frequency with which the actual stresses that cause failure to occur within the exposure period. For example, a component failure mode may be predominantly a function of the number of times electrical power is applied to it. If so, the average power applications per flight hour should be the same between the source of the failure rate data and the subject application of that data, or an appropriate correction should be applied. Note: Exposure means the possibility of occurrence, not the certainty of it. If multiple airplane types are exposed to the same unsafe condition, then the estimate should include all affected airplanes rather than assessing the risk to each airplane type separately. 3.3.2.3 For uncorrected risk factor, a 20-year fleet life may be assumed, or another reasonable estimate of the actual fleet life may be used. The fleet life should be converted to flights or flight hours, as appropriate, per airplane. Additionally, the risk factor should be converted to risk per flight or flight hour, if applicable, to facilitate comparing risks on a common exposure basis. Converting the risk per flight or flight hour is done by dividing the risk factor by the total number of flights or flight hours within the assumed exposure period. Whatever exposure basis is used, flights or flight hours, it should be used consistently to allow the various risks being managed simultaneously to be readily compared to each other and the risk 3-2 ### Page 20 AC 39-8A guidelines. The uncorrected risk factor(s) should be compared to the risk guidelines outlined in table 1 of this AC to help establish the relative threat posed by the unsafe condition. 3.4 Mitigating and Corrective Actions. 3.4.1 Identify Options for Mitigating Action. Some types of actions that have proven to be both practical and beneficial for immediate responses are inspections, placards, revisions, supplements to the airplane flight manual, staggering engines to obtain mixed life engines on a given airplane (for infant-mortality problems), and pre-flight checks. These same actions are appropriate for follow-on actions, along with repair or replacement of the suspect components. 3.4.2 Estimate the Effects of Candidate Actions. The stakeholder should evaluate candidate actions considered after identification of an unsafe condition with the appropriate manufacturer, designer, or operators. This evaluation considers the action’s capacity to reduce the future risk to acceptable levels. From a technical perspective, several candidate actions may be available. The selected action(s) should consider such issues as confidence in the effectiveness of the corrective action, availability of the resources necessary to support the corrective action, the ability of operators to incorporate the corrective action expediently and adequately, and potential implementation risk for operators to rework a particular design. For acceptable short-term risk, see the risk guidelines outlined in table 1 of this AC. 3.4.3 Estimate Potential Risk Reduction. Once the candidate actions have been identified, the risk factor for the proposed control program should be estimated using the process described above. This process should be performed for all candidate actions under consideration, thereby allowing the effects of different programs to be compared. The objective is to keep the risks to the affected fleet below the applicable guidelines until final action can be taken to bring the product back to the level of safety intended by the product's original basis of certification. If none of the immediate corrective action programs can achieve the needed risk reductions, more aggressive action, including grounding, should be considered. Note: Aircraft operation with an unsafe condition may be acceptable, provided short term guidelines in table 1 are met during the corrective action. 3.4.4 Estimate Impact on Resources. Resources are generally considered to be time, material (parts and inspection equipment), and labor. However, there may be additional considerations such as shop capacity, parts distribution, and operational disruptions. The extent of these resources should be estimated to quantify the impact of the AD or other corrective action, allow for timely provisioning, and aid in the determination of desirable tradeoffs between resources and risk. Depending on the analysis that has been performed, the number of replacement parts, shop visits, inspections, etc., may be available as output parameters. However, the results from the steps used to establish the risk factor could likewise be 3-3 ### Page 21 AC 39-8A used to estimate an impact on resources. Data from the manufacturer(s), operators, or both will often be used in this process. 3.4.5 Rank Practical Candidate Actions. Given that several candidate actions provide an equivalent reduction in risk, they can be ranked regarding the impact on resources. Small increases in risk may be acceptable when a candidate action with lower risk is of much greater difficulty to effectively implement or is much more burdensome than a slightly riskier option. Each candidate action should be evaluated against its effectiveness (meaning its relative reduction of risk), availability of resources (such as shop visit capacity, material availability, personnel, etc.), and how quickly the candidate action can be implemented, how easy it is to implement, and its relative cost. Candidate actions include such items as: • Manufacturing, maintenance, or operational procedural changes; • On-wing or in-shop inspections; • Limitations on time-limited dispatch (TLD); and • Part repairs, replacement, or modifications. The number of cycles or hours between initial and repetitive actions should also be evaluated. The ideal action would be inexpensive, easy to perform, possible to begin immediately, and completely effective. The real situation often requires trading off these characteristics. For example, developing an accurate inspection tool and method that can be used for engines on-wing may mean inspection does not begin immediately. 3.4.6 Develop and Implement Appropriate Responses. The objective of all continued operational safety decisions is to maintain an acceptable level of safety by reducing the risks posed by future events. Selection of actions, including taking no specific action, should be based on the specific circumstances and an assessment of the risk of future occurrences of the unsafe condition. Prohibition of engine operation based on an observed unsafe condition, pending determination of the root causes and appropriate corrective action, should be reserved for situations where immediate action is necessary, and no other option would be effective in addressing the unsafe condition. See paragraph 4.3 for risk guidelines for immediate action. Note: If the FAA decides not to implement a particular candidate corrective action, the decision and its justification must be filed by the involved stakeholders in the project folder for future reference, following FAA policies related to office retention length. Closure documentation should include justification and reasons for the determination of non-implementation of the corrective action. 3.4.7 Verify Results of Corrective Actions. Initial corrective actions, whether immediate reactions or responses initially considered (e.g., the issuance of an immediately adopted AD), may not represent the final action needed to address the unsafe condition. To that end, service experience and any other data gathered during the action implementation should be carefully reviewed to validate the analytical process and the estimated risks. 3-4 ### Page 22 AC 39-8A 3.4.8 Monitor Implementation and Impacts of the Corrective Actions Taken. When feasible, the rate of incorporation of the corrective action(s) should be tracked by all involved stakeholders to verify that the action is being implemented within the timeline prescribed by the AD. If the action includes inspection, the stakeholder(s) should analyze the inspection results to help quantify incipient failures and aid assessment of the extent of the problem. Service experience should be tracked to ensure that the rate of occurrence of the referenced event is reduced. However, a rate of occurrence may not be applicable in cases of rare events or small exposures. The stakeholder(s) should evaluate the service experience and inspection results against expectations developed because of any quantitative or qualitative analysis performed as part of the action. The inclusion of reporting requirements within the body of the AD will ensure that the operators report inspection findings. This inclusion should be considered for those high risk (as defined in paragraph 4.4.1) unsafe conditions where the inspection findings are necessary to evaluate the adequacy of actions. FAA principal aviation safety inspectors or the manufacturer’s field service representatives can also provide direct insights into the impact of mandated corrective actions independent of any reporting requirements. 3.4.9 Verify Corrective Actions Were Effective. Any experience that deviates significantly from expectations or assumptions is grounds to revise the risk assessment. Continue monitoring field experience and inspection results to ensure that any interim action continues to validate the assumptions and predictions of the risk assessment. Final action carries with it an assumption that the causal factors, which lead to an unsafe condition, have been effectively eliminated or mitigated. The stakeholder should track the field experience to validate this assumption. Care should be taken to ensure that any unforeseen adverse impacts of corrective actions taken are identified and evaluated. 3.4.10 Follow-On Assessments and Responses. The initial actions taken in response to an unsafe condition may be insufficient to mitigate the risk to acceptable levels. A complete understanding of the problems and contributing factors to the unsafe condition will most likely be available at a later point. Therefore, the stakeholder(s) should consider follow-on responses and actions. The stakeholder(s) should apply the risk assessment process described in this paragraph to the decisions involved in the use of actions, whether initial or follow-on. The FAA response to an unsafe condition should be based on a technical understanding of the problem and should require an appropriate implementation schedule that is consistent with the risk assessment. When performing a follow-on assessment, the fact that exposure time has elapsed between the initial and follow-on assessments should not be used to justify extending the duration of the control program. The exposure time for evaluating the risk for follow-on actions is the amount of time needed to complete the entire corrective action program, such as any initial, interim, and final actions. The objective is to keep the risks below the applicable guidelines until the product is brought back to the level of safety intended by the product’s original basis of certification. 3-5 ### Page 23 AC 39-8A 3.5 Assessment Model Considerations. As mentioned above, quantitative assessments of potential unsafe conditions are the preferred method since they provide measurements that enhance the oversight and viability of potential corrective actions and prioritization. Often, the need to reduce the risk of an unsafe condition may not be supported by an adequate quantitative assessment. However, manufacturers should be able to acquire or develop data by experience, test, and analysis as needed for quantitative assessments. The stakeholders can use these assessments to judge the adequacy of control programs and validate that immediate or initial corrective actions provide sufficient risk reduction. Quantitative assessments, therefore, should be a goal for assessing any potential unsafe condition. A structured approach in performing quantitative assessments is essential for ensuring credible results. Important controls include anchoring the model to known facts, reviewing the input data, assumptions and judgment, calibrating the model to actual experience, reviewing all critical elements, establishing a consistent set of ground rules, and utilizing engineering judgment. Note: The utilized safety and risk assessment methods are different for certification and continued airworthiness. Consequently, to avoid confusion, this AC does not focus on certification classifications and should not be used to support product certification. 3.5.1 Anchoring Model to Known Facts. There will be many irrefutable facts within a problem. A problem can refer to an abnormality that might lead to an unsafe condition. For instance, these facts may include the number of parts failed, found cracked, and not cracked. The assessment model should not contradict any known information. 3.5.2 Reviewing Input Data, Assumptions, and Judgment. All critical elements, input data, assumptions, and judgment require careful review and validation. A safety team approach in reviewing all critical elements, input data, assumptions, and judgment is most effective. The safety team should consist of experts from appropriate disciplines, such as stress analysis, fracture mechanics, reliability engineering, airworthiness, product support, inspection methods, etc. Agreement by consensus on critical assessment model inputs is essential, including validation of operational data by operators. Some examples of critical inputs include hazard ratio, inspection reliabilities, crack initiation and propagation data, failure distributions, part utilization, affected population definition, shop visit rates, material defect distributions, and rate of incorporating corrective actions. For example, realistic assessments of hazard ratio will often necessitate the involvement of the installer. The assessment should also consider the possibility of individual airplanes operating in a master minimum equipment list (MMEL) or other configuration that could adversely affect the risk associated with the unsafe condition. Although, it is neither necessary nor appropriate to assume that the entire fleet is operating in such a configuration. Consideration should be made as to whether it is appropriate to allow continued dispatch in all previously acceptable configurations or missions. Note: The risk assessment should be conducted objectively. This evaluation includes the severity and the conditional probability of an outcome given a failure condition. For 3-6 ### Page 24 AC 39-8A example, whether one starts with the assessment that disk bursts are catastrophic or observes that there has been an HL 3 disk burst in service, the risk assessment for a given outcome should be equivalent. 3.5.3 Calibrating Model to Actual Experience. It is essential that the model be capable of calibration to what has already happened. If the model does not calibrate, further team review by the stakeholders is necessary to determine which model assumptions may be in error. The model will not predict reliably if it cannot calibrate to the actual experience. 3.5.4 Reviewing All Critical Elements. Subject to ex parte restrictions, it is important that all critical elements, input data, assumptions, judgment, etc., of the model be made available to the affected parties with data accessibility privileges for detailed review. Review by the responsible FAA engineers is essential for ensuring regulatory safety goals are met. Information, such as current service experience, from operators, installers, and the involved FAA inspectors is important for ensuring accurate data and viable corrective actions. 3.5.5 Establishing a Consistent Set of Ground Rules. A consistent set of ground rules for constructing numerical assessments is necessary to ensure valid comparisons. Examples of areas where consistent ground rules are necessary include the determination of flight exposures, event HLs, hazard ratios, and event probability for each flight. There may be subtle yet significant differences in the ground rules used by different manufacturers in performing quantitative assessments. Therefore, it is important to refrain from comparing assessment results from different manufacturers, unless it can be verified that the assessments were performed using the same ground rules. The desire to have a consistent set of ground rules for comparative purposes factors into the recommended use of a 20-year fleet exposure for uncorrected risk. It also factors into the use of hazard ratios to predict the risk of events of equivalent severity, such as HLs 3, 4, or 5. 3.5.6 Utilizing Engineering Judgment. Regardless of how much engineering data is gathered to describe a problem mathematically, engineering judgment will always be necessary. Engineering judgment is, however, a potential source of subjectivity that can introduce uncertainty into the assessment. In assessing the need for action and the adequacy of a control program, it may be helpful to assess the potential variation in the major assumptions. This variation will result in a range of results. Acquiring additional data on model inputs will reduce the uncertainty and, therefore, reduce the range of possible results. This judgment and any other assumptions in the assessment need to be documented and validated to the greatest extent possible. The stakeholder should consider the amount of judgment and the level of confidence in the associated validations when determining the appropriate response to the problem. 3-7 ### Page 25 **AC 39-8A CHAPTER 4. RISK FACTOR GUIDELINES A ND PRIORITIZATION BASED ON RISK** 4.1 Hazard Level 3 and Level 4 Risk Guidelines. 4.1.1 There are long-term and short-term guidelines for risk factors and risk per flight as listed in table 1 of this AC. The risk factor guidelines apply to the aggregate fleet or subfleet suspected of having an unsafe condition. The per-flight guidelines apply to the average of the fleet or subfleet suspected of having an unsafe condition. These guidelines help establish whether immediate action is necessary and establish an acceptable risk for control programs. Note 1: There are guidelines for HL 3 events and HL 4 events. The HL 3 guidelines cover events predicted to be at least HL 3, such as levels 3, 4, and 5 events. The HL 4 guidelines cover events predicted to be at least HL 4, such as HLs 4 and 5 events. This categorization is necessary to assess the true risk exposure. Note 2: The per-flight guidelines can also be referred to as individual risk, and risk factor can be referred to as fleet risk (reference FAA Order 8110.107). 4.1.2 Control programs should be acceptable to both the HLs 3 and 4 short-term acceptable risks. Generally, for events unlikely to progress beyond HL 3, such as those that have low HL 4 or 5 hazard ratios, the HL 3 guidelines will be the limiting values. For those with a high hazard ratio for HL 4 and above, the HL 4 guidelines will be the limiting values. Corrective actions should reflect the event’s HL, the probability of an event, and the size of the affected fleet. For large fleet sizes, the risk factor guideline will likely be the limiting value. For small fleets, it is likely that the risk per flight guideline will be the limiting value. Note: Currently, there are no standardized guidelines for HL 5 events, and the engine community has no plans to develop them. The HL 4 guidelines cover most level 5 threats. Use the HL 4 guidelines when assessing hazards that could potentially result in a level 5 event. Table 1. Risk Guidelines Hazard Level 3 Hazard Level 4 Guidelines Guidelines Risk Per-flight Risk Per-flight factor factor Long-term - 1 x 10-8 - 1 x 10-9 acceptable risk Short-term 1.0 4 x 10-5 0.1 4 x 10-6 acceptable risk 4-1 ### Page 26 AC 39-8A 4.1.3 The risk guidelines in table 1 should not be regarded as targets or typical values. The control program values should usually be lower than these guidelines, unless a lower value would result in extreme resource availability difficulties such as the availability of parts. Any reasonable action that reduces the risk should be included as part of the control program, keeping in mind the principles of prioritization of resources. 4.1.4 The HL 4 risk guidelines are intended to cover exposures to the most severe of serious injuries, such as life-threatening injuries. Consequently, relaxation of these guidelines may be acceptable in cases where the associated serious injuries are clearly not life threatening, such as simple fractures. 4.2 Risk Guidelines for In-Flight Shutdown (IFSD) Rate Concerns. Typically, manufacturers seek to provide engine reliability improvements that will ensure adequate protection against excessive IFSD rate concerns. For rates below 2x10 -4 failures per cycle, an engine shutdown in which the only consequence is a loss of thrust should not be a cause for concern (other values may be listed elsewhere on a per-flighthour basis; for example, Extended Operations). This exclusion assumes that the event does not result from an initiating cause that can affect multiple engines at the same time. 4.3 Risk Guidelines for Immediate Action. If the uncorrected risk factor for the affected fleet would exceed the applicable shortterm risk factor within 60 days or the risk per flight to which an airplane would be exposed during that same 60-day period would exceed the applicable risk guideline, then immediate action should be considered. How immediate this action should be could vary from before the next flight to within 60 days depending on the nature and level of risk. If a quantitative assessment of the risk is unavailable, the decision as to the necessity of immediate action should be made based on objective judgment and expert opinion. This initial analysis is not meant to take the place of the complete and in-depth analysis typically performed during the continuing assessment of the risk posed by the identified unsafe condition. It is meant to give a best-estimate relative ranking compared to the overall contributions of all unsafe conditions and to indicate whether continued operation without immediate corrective action is acceptable. 4.4 Prioritization Based on Risk. Figures 1a and 1b provide a useful means to compare unsafe conditions, based on risk calculations and the HLs 3 and 4 risk guidelines that help to establish priorities. 4.4.1 High Risk. An HL 3 event is a likely occurrence when its risk plots in the area to the right of the sloped line in Figure 1a, which represents a risk factor of 1.0 for the predicted events. Furthermore, the malfunction is beginning to contribute more risk than the aggregate risk from all other causes, including contributions from the crew, when it plots in the area above the top horizontal line, 4x10 -5 per flight, displayed in Figure 1a. In instances where the short-term rate is exceeded, immediate actions may be necessary. Similar 4-2 ### Page 27 AC 39-8A values can be established for HL 4 events, an order of magnitude below the associated HL 3 values. The high-risk area for HL 4 events is greater than 0.1 predicted events, or above 4x10 -6 per flight (see Figure 1b). These values equate to the short-term acceptable risk guidelines. 4.4.2 Elevated Risk. Exposure within the enclosed envelope in Figures 1a and 1b, to the left of the sloped line and above the bottom horizontal line, imposes sufficient risk to warrant concern and action. Effective management of the risk may be possible through voluntary compliance to the manufacturer's recommended corrective actions. However, even if the risk becomes mitigated, issuance of an AD may still be necessary to minimize the potential for the unsafe condition being reintroduced in future products 4.4.3 Reasonable Risk. Risk factors of one HL 3 events in every 100 million airplane flights (1x10 -8) meet the long-term acceptable risk guidelines assuming no other aspects of the original basis of certification have been violated. The equivalent value for HL 4 events is one event occurring in every 1 billion flights (1x10 -9). Note: The long-term acceptable risk guideline for type certification may sometimes appear less restrictive. However, as noted earlier, certification and continued airworthiness assessments and guidelines are not necessarily equivalent. For example, the additional accuracy that could lead to less data uncertainty and better life prediction potentially afforded to continued airworthiness assessments over certification assessments should be compensated for within the guidelines. 4-3 ### Page 28 AC 39-8A Figure 1a. Airplane Threat Comparison (Hazard Level 3) Figure 1b. Airplane Threat Comparison (Hazard Level 4) 4-4 ### Page 29 **AC 39-8A CHAPTER 5. MISCELLANEOUS C ONDISDERATIONS** 5.1 Corrected Risk. The final goal in addressing an unsafe condition is the development and implementation of corrective actions that, when fully incorporated, minimize the probability of future events to less than the long-term acceptable risk guidelines. Interim measures, such as recurring inspections, are often effective in providing immediate risk reduction to a high-risk problem. However, recurring inspections should not be relied on to serve as a final corrective action unless there is no practicable alternative. If the interim measures minimize the probability of additional events to below the long-term guidelines, the incorporation of the final corrective actions can be delayed. The completion of all actions to correct the unsafe condition should be done as soon as feasible and in accordance with the risk guidelines and principles. The actions should return the product to the level of safety intended by that product's original basis of certification. 5.2 Cumulative Risk. The cumulative risk of having several unsafe conditions being addressed concurrently on the same powerplant installation may represent an unacceptable risk level for that airplane type, even if each taken individually does not. Furthermore, repeated exposure to risk levels acceptable against any single unsafe condition could reasonably be expected to result in an unacceptable risk of serious injury at some point in the life of the worldwide transport airplane fleet with its various unsafe conditions. The Poisson distribution explains the statistical variation associated with average prediction for rare events; see Figure 2. The 0.1 risk factor guideline for HL 4 equates to a 9.5 percent probability of one or more HL 4 events. If, during the life of a fleet, there are seven different malfunctions, which are each managed to an HL 4 risk factor of 0.1 events, equivalent to a cumulative HL 4 forecast of 0.7 events, then it is likely that an HL 4 event will occur at some point due to one of these malfunctions. Additionally, for an event forecast of 0.7, there is a 16 percent probability of two or more events and a 3 percent probability of three or more events. Figure 2. Event Probability vs. Event Forecast (Risk Factor) 5-1 ### Page 30 AC 39-8A 5.2.1 It is neither expected nor required to calculate cumulative risk, nor track cumulative risk across the life of the fleet. The intent of this paragraph is only to provide recognition that acceptable risk levels should be regarded as upper limits, and stakeholders should reduce the risk further when possible. The goal of risk analysis is not to find the most lenient program possible within acceptable risk levels. The plot of risk factor versus impact on resources follows an asymptotic relationship. This means that at some point, any additional reduction in risk comes only at great increase in the required resources. This particular point varies from situation to situation. The stakeholders should decide if the reduction in risk warrants the additional burden against the available resources. 5.2.2 Currently, no definitive standards exist for what is an acceptable cumulative risk. Additionally, no definitive standards currently exist for where the balance should be struck between decreasing risk and increasing burden. Therefore, the FAA should judge what actions best serve the public interest on a case-by-case basis, with the appropriate allocation of resources. Since no guidelines have been developed for cumulative risk, the guidelines published in this AC apply to individual unsafe conditions being addressed by a control program. Although, the individual unsafe condition may apply to several products. 5.3 Lessons Learned. Throughout the assessment process for any one potential unsafe condition, the stakeholders should apply the experience gained and lessons learned to future certification, including any regulatory action necessary and continued airworthiness monitoring processes. This ensures continuous improvement in the effectiveness of the continued airworthiness assessment process for current products and improves the certification assessment process and instructions for continued airworthiness for new products. Centralized accessible repositories for CAAM “lessons learned” are a valuable resource. 5.4 Alternative Methods of Compliance (AMOC). The risk assessment process described in this AC can be used to help determine if a proposed AMOC provides an acceptable level of safety. An AMOC should not result in an increase of the total risk assessed against the unsafe condition. 5.5 Airplane and Engine Stakeholder Coordination. Different risk management objectives may lead to differences of opinions between stakeholders as to the appropriate actions to address identified unsafe conditions, or to the timing of those actions. With most unsafe conditions, there is inter-involvement between the airplane stakeholders, as well as between the engine stakeholders. Close coordination is recommended to resolve any differences that arise, especially those that are highly installation-dependent. However, if these differences persist after coordination and discussion of the assumptions, available data and objectives, the final control program decisions rest with the stakeholders with the most relevant specialized technical expertise. This means, for unsafe conditions caused primarily by shortcomings 5-2 ### Page 31 AC 39-8A within the engine type design, the engine stakeholders are responsible for making the final control program decisions. In cases of significant installation-dependency of an engine-related unsafe condition, special care should be taken to address any installation concerns raised by the airplane stakeholders. For unsafe conditions that are caused primarily by shortcomings in the airplane type design, exclusive of the engine type design, the airplane stakeholders are responsible for making the final control program decisions. All stakeholders should respect their primary responsibility and any tendency towards writing competing ADs against the same unsafe condition should be avoided. 5-3 ### Page 32 AC 39-8A Appendix A APPENDIX A. POTENTIAL UNSAFE CONDITIONS A.1 Purpose. This appendix provides the user with an overview of potential unsafe conditions. Issuance of an AD requires that an unsafe condition exists in a product and the condition is likely to exist or develop in other products of the same type design, per 14 CFR section 39.5. This appendix presents guidance on potential unsafe conditions that may result from design, manufacturing, operational, or maintenance deficiencies as well as unforeseen changes in operations or the operating environment. A.2 Identification of Potential Unsafe Conditions. A.2.1 The stakeholders can use at least three areas of information as a guide in identifying potential unsafe conditions. The first and most visible are the conditions, which alone or in combination with other contributing factors, have led to accidents. Such conditions or combinations have been demonstrated to be unsafe. The second includes conditions that have significantly increased the probability of, but not yet directly caused, serious injuries. If such “contributing conditions” occur frequently enough, this too is an unsafe condition. The third area of information involves hazards identified as part of the product’s certification program. Indications that the field experience is worse than that allowed by the design standards may require mitigating action to return the product to the level of safety required by the design standards. A.2.2 It is normal for the achieved level of safety of a product to vary throughout the lifetime of the fleet. This variation may result in some failure conditions occurring more frequently than permitted by initial certification requirements, in which case it is possible, but not necessarily the case, that an unsafe condition exists. Some assessment of the degree of risk is advisable if the failure condition rates significantly exceed those assumed or intended in the initial certification. If the risk to the airplane, passengers, or crew is much greater than permitted by initial certification standards, an unsafe condition is likely to exist. A.2.3 It would be unusual for an identified unsafe condition to be limited to a single airplane or engine because of the size and complexity of today’s worldwide air transportation system. Examples of singular events where AD action would not be expected are those caused by gross negligence or rare meteorological phenomenon. A.2.4 Conditions Specified as Potentially Unsafe. For transport category airplanes, the FAA has defined certain specific conditions as potentially unsafe, based upon previous service experience and relevant certification assessment. A.2.4.1 Historical Potentially Unsafe Conditions. A list of engine-related conditions considered potentially unsafe, along with hazard ratio data is provided for certain conditions in the CAAM A-1 ### Page 33 AC 39-8A Appendix A Reports and appendix D. See references listed in paragraph 1.4.5 of this AC. A.2.4.2 Potential Unsafe Conditions Identified During Certification Assessments. Certification assessments, such as those performed under § 25.1309, often identify and classify failure and operating conditions according to the severity of the impacts they are expected to have on the continued operational safety of the airplane. Very severe conditions are assigned to categories such as “catastrophic,” “preventing continued safe flight and landing,” or “critical” because of their potential to cause serious injuries to multiple persons. Severe conditions are assigned to categories such as “emergency” or “hazardous” because of their potential either to cause serious injuries to a limited number of persons or to impair the ability of the flight crew to perform their tasks. Therefore, the occurrence of any of these conditions in service is a potential unsafe condition regardless of the actual outcome. Conditions that are more moderate are assigned to categories such as “abnormal” or “major.” The occurrence of any moderate conditions in service at a high frequency may be considered a potential unsafe condition if a reasonable potential exists for it to contribute to a more serious event. A.3 Categories of Failures Leading to Potential Unsafe Conditions. A.3.1 Multiple FAA regulations limit the severity and frequency of single failures, such as 14 CFR §§ 33.75(a)(3), 25.901(c), and 25.1309(b)(1). Single failures that could result in a serious injury but are not expected to result in serious injuries to multiple persons are allowed by these regulations provided the frequency of occurrence is sufficiently low. Prohibition of certain single failures is currently impracticable. These include uncontained engine rotor failure, engine case burst, engine case burnthrough, and propeller separations. For these noted exceptions, regulations such as § 25.903(d)(1) require that the hazards be minimized. When these failures or their precursors occur (e.g., a flaw is detected in a disk before the disk actually fails), the stakeholder will carefully review the design of the component or engine to determine cause and appropriate action is developed, as necessary, to ensure that the occurrence of similar future events is minimized. The results of the investigation may require AD action to implement more effective monitoring or improved component inspections, shorter component life limits, improved maintenance procedures, or other means to minimize a reoccurrence. In addition, the stakeholder reviews the design of the airplane to ensure that the design covers the likelihood that these failures may continue to occur, and the installation incorporates design considerations to minimize the impact of these failures on the airplane. A-2 ### Page 34 AC 39-8A Appendix A A.3.2 Latent Failures. Latent failures are failures that are unknown to the flight and maintenance crews. Certification requirements, such as those contained in §§ 33.75 and 25.1309, assume that any expected latent failure, in combination with the next failure, under any operating and environmental conditions approved for the airplane, should not jeopardize continued safe flight and landing. A simple example is undetected loss of fire containment in a fire zone. If the next failure releases flammable fluid into the zone, a potentially catastrophic condition exists. While the intent of the FAA’s regulations is such that latent failure conditions do not exist, there are, as a practical matter, limitations on how frequently the operators can perform inspections on the powerplant and APU installations to note and correct such conditions. This is particularly true when such inspections require some degree of disassembly or otherwise expose components to potential distress or human error. Automated monitoring and indication should be used to detect and annunciate failure conditions when practical, especially when the next failure could lead to hazardous or catastrophic consequences. The intent of the inspection is not so much to discover the latent failure, but rather to note the proper functioning of the equipment and any safe limits of deterioration so that the equipment can be replaced before any significant failure or malfunction occurs. An additional concern is those latent failures which were either not anticipated at all or were expected to be detectable by either the flight or maintenance crews. A.3.3 Cascading Failures. Cascading failures are those for which the probability of occurrence of a subsequent failure is substantially increased by the existence of a previous failure. These types of failures are of particular concern because they can create interdependence between structural and system design elements that are intended or assumed to be independent or even unrelated. This is especially true when the intended means of safely accommodating a failure is affected by that failure. For example, in the structural design area, the failure of one load path should not result in loads that compromise the intended redundancy. Another example is that engine failures, such as fan blade failures, that result in a high vibration condition should not cause loss of the fuel shutoff function. A cascading failure of this sort could lead to a hazardous or catastrophic condition. Cascading failures in propulsion systems can sometimes be difficult to anticipate. In transport airplanes, failures in the systems of one engine are typically required by § 25.903(b) to be independent of failures in the systems of another engine. Furthermore, a system of one engine may need to be isolated from the effects of failures within another system of that same engine. Engine systems areas where cascading failures are most likely to be of concern are the engine control systems and fuel systems. A.3.4 Multiple Failures and Probability Estimates. A.3.4.1 In general, the powerplant and APU installations are designed to be failsafe. That is, one assumes their failure and then ensures the resulting failure condition does not jeopardize continued safe flight and landing. For example, the shutdown of a single engine is assumed to be fail-safe, since transport category airplanes have multiple engines and are certified to A-3 ### Page 35 AC 39-8A Appendix A operate safely following the sudden failure of the most critical engine. Though combinations of failure conditions leading to violation of the failsafe assumption are possible, the consideration of such combinations should, as a practical matter, be limited to those conditions anticipated to occur within the fleet life of the airplane type. To make such determinations, the safety analysis methods associated with § 25.1309(b) are often used. Two examples of such situations are uncontrolled engine overspeed and an adverse frequency of engine shutdowns. The stakeholders usually agree that the first of these is a potential unsafe condition because the engine may liberate parts that could hazard the airplane. For overspeed, the requirement of § 33.28(d)(3) for engine control system certification is that no single failure can cause such a condition, and that the probability of such a condition being caused by multiple failures must be less than 10-8 per flight hour (extremely remote). A.3.4.2 The second example requires attention because it is recognized that if the engine shutdowns begin occurring at an abnormally high rate, from the same or different failure conditions, the likelihood of multiple independent engine failures should be addressed (See paragraph 4.2). In any case, if an anticipated failure or malfunction can significantly affect the continued safe operation of more than one engine within a given flight, a potentially unsafe condition exists. Typically, business decisions to provide engine reliability improvements provide adequate protection against excessive IFSD rate concerns. In addition, the stakeholder should recognize that certain engine anomalies during critical flight regimes have, on occasion, resulted in accidents due to lack of recognition or appropriate response to a single engine failure, especially in cases of very startling or very subtle failures. Excessive exposure to these events raises the possibility of an inappropriate response. The stakeholders should address any situations where certification assumptions of appropriate responses, and the timing of those responses, have been repeatedly called into question. A.3.5 Common Cause Failures. “Common cause failures” refers to multiple failures occurring due to the same event. These types of failures differ from “cascading failures” in that the multiple failures occur in parallel rather than in series. That is, the same event causes each failure independently rather than the first failure causing the second, and so on. Environmental conditions and human error are examples of occurrences that can give rise to common cause failures. Environmental factors include heavy rain and hail, icing, and bird or wildlife ingestion. Human-caused common cause failures include fuel contamination or mismanagement, procedural deviations, and maintenance errors. There are no regulations specifying that any engine-related maintenance is conducted on only one engine at a time, except for ETOPS maintenance requirements for some airplanes. For example, before long flights, it is common to service engine oil in all engines on the same airplane. Some cases of performing maintenance to multiple engines on the same airplane are likely unavoidable. However, the stakeholder should recognize that there A-4 ### Page 36 AC 39-8A Appendix A are many instances (as documented in the CAAM reports) of multiple engine shutdown due to common cause maintenance error, such as chip detector reinstall or O-ring removal, that lead to unsafe conditions. A-5 ### Page 37 AC 39-8A Appendix B APPENDIX B. HAZARD LEVEL DEFINITIONS The following definitions apply for the purpose of this AC: B.1 Purpose. This appendix outlines common propulsion system malfunctions or related incidents, in certain cases coupled with crew error or other airplane system malfunctions, resulting in consequences to the airplane or its passengers/crew. B.2 Hazard Level Classification. HLs are classified by their actual and direct outcomes to either the aircraft or its passengers or crew, not the collateral severity (e.g., injuries sustained during evacuation from the aircraft, hull loss due to lack of fire fighting support on the ground). Other methods are used to classify the severity of events, such as the assessment during certification of the worst anticipated outcome. These different classification systems were developed independently, based on both actual or projected outcomes, and serve different purposes. Therefore, there is not a one-to-one relationship for any given failure condition. For example, a disk burst may be classified as “catastrophic” or “hazardous” under certification assessments, but an actual disk burst event may range in severity from HL 1 (minor) up to HL 5 (catastrophic). Note: A means to differentiate between HLs 0, 1, and 2, as delineated within the CAAM reports referenced in paragraph 1.4.5, is not necessary for the purposes of this AC. B.3 Hazard Level 3 – Serious Consequences. B.3.1 Substantial damage to the airplane or second unrelated system. B.3.1.1 Damage or structural failure that adversely affects the limit loads capability of a primary structural element or the performance or flight characteristics of the airplane, and that would normally require major repair or replacement of the affected components. Note: Typically, engine failure damage that is limited to the engine or its mounts, bent landing gear associated with runway departures, wheel, tires, flaps, engine accessories on failed engine, brakes, or wing tips do not generally result in the effects delineated above and are not considered “substantial damage.” B.3.1.2 Damage to a second unrelated system that affects the ability to continue safe flight and landing. Coordination and agreement between the engine, propeller, APU manufacturers, and the airframe manufacturer may be required to categorize events related to second system damage. For B-1 ### Page 38 AC 39-8A Appendix B example, an uncontained rotor event, which severed an unrelated hydraulic system line without significantly degrading the ability to continue safe flight, should not be considered an HL 3 event. In general, airplanes are designed to be under one part of a redundant system inoperative with no effect on flight safety. B.3.1.3 Damage to a second engine that results in a significant loss of thrust or an operational problem requiring pilot action to reduce power. Minor damage that was not observed by the crew during flight and which did not affect the ability of the engine to continue safe operation for the rest of the flight should not be considered an HL 3 event. B.3.2 Fires that escape the fire zone and impinge flames onto the wing or fuselage, or act as ignition sources for flammable material that might be present outside the fire zone. This category includes tailpipe fires that cause thermal damage or require the affected structure or control surface to be replaced or repaired. Refer to the latest CAAM publication on fire zone fire for more information. B.3.3 Rapid depressurization of the cabin. B.3.4 Permanent loss of thrust or power greater than one propulsion system (inflight). B.3.5 Temporary loss of thrust greater than one propulsion system. Note: For multiple-engine events that resulted in temporary total power loss, the following criteria were considered to place an event within HL 3: occurrence below 10,000 feet above ground-level or the loss of more than 5,000 feet altitude (as in situations where the airplane must descend to a suitable altitude prior to attempting restart). Consideration of transitory events of total power loss below 10,000 feet should consider length of transient vs. closeness to the ground as part of this evaluation. B.3.5.1 Any temporary or permanent impairment of airplane controllability caused by, for instance, propulsion system malfunction, thrust reverser inflight deployment, propeller control malfunction, or propulsion system malfunction coupled with airplane control system malfunction, abnormal airplane vibration, or crew error. Events within the normal spectrum of crew response in requiring crew control inputs to regain the airplane flight path are not included. B.3.5.2 Malfunctions or failures that result in smoke or other fumes delivered to the flight deck, thereby seriously impairing the flight crew. Serious impairment includes the loss of the crew’s ability to see flight deck instrumentation or perform expected flight duties. Purely psychological aspects of the concern of odors, etc., are not to be included, nor are concerns about long-term exposure. B.3.5.3 Fuel leak resulting in a declared landing priority or mayday due to low fuel state. Any leak resulting in landing with fuel below reserve B-2 ### Page 39 AC 39-8A Appendix B (minimum) fuel level. Holes or punctures in airplane fuel lines or tanks, greater than two square inches, caused by uncontained or cowl loss events. B.4 Hazard Level 4 – Severe Consequences. B.4.1 Forced landing is the inability to continue flight due to the consequences of damage, uncontrolled fire, or thrust loss where imminent landing is obvious, but airplane controllability is not necessarily lost. For example, total power loss due to fuel exhaustion will result in a forced landing. Note: The term emergency landing may also be used to mean a forced landing if there is an urgent requirement to land, but the declaration of an emergency does not necessarily imply that a forced landing is imminent. An air turn back or diversion due to a malfunction is not a forced landing since there is a lack of urgency and the crew has the ability to select where they will perform the landing. However, off-airport landings are almost always forced landings. B.4.2 Loss of Airplane While Occupants Were on Board. Note: This refers to hull loss as opposed to an economic loss. Hull losses where the airplane could have been repaired, but the repair would not have been cost effective, are excluded. Additionally, hull losses that occurred well after the event because appropriate action was not taken to further mitigate damage are also excluded. For example, a fire that breaks out because no fire equipment was available would not be considered a hull loss. Some degree of judgment may be required in determining whether the hull loss qualifies for inclusion. B.4.2.1 Serious Injuries or Fatalities. See paragraph 1.5.11 for the definition of serious injury and fatal injury. B.4.2.2 The HL 4 risk guidelines are intended to cover exposures to the most severe of serious injuries, such as life-threatening injuries. Consequently, relaxation of these guidelines may be acceptable in cases where the associated serious injuries are clearly not life threatening, such as simple fractures. B.4.2.3 Injuries resulting from an emergency evacuation rather than from the event which caused the evacuation, are not considered in evaluating the severity of the event. It is recognized that emergency evacuations by means of the slides can result in injuries without regard to the kind of event precipitating the evacuation. B.5 Hazard Level 5 – Catastrophic Consequences. Catastrophic outcome, an occurrence resulting in multiple fatalities, usually with the loss of the aircraft. B-3 ### Page 40 AC 39-8A Appendix B B.6 General Notes Applicable to all Event Hazard Levels. B.6.1 The severity of airplane damage is based on the consequences and damage that actually occurred. B.6.2 With respect to an HL 3 secondary system damage event, uncontained event damage definitions are different from those used in other SAE publications. The objective of the wording used in CAAM has been to more clearly define and separate those events that had a major impact on continued safe flight and landing from those with lesser consequences. B.7 Historical Comparison of Hazard Level Descriptions. CAAM data has been collected over three periods (1982-1991, 1992-2000, and 2001- 2012). Subsequent to the initial CAAM 1 report, some of the HL definitions have been revised based on lessons learned. The definitions included in the latest CAAM report, CAAM 3, are included in this AC. B-4 ### Page 41 AC 39-8A Appendix C APPENDIX C. HAZARD RATIO DEVELOPMENT C.1 Purpose. This appendix describes methodologies to estimate the hazard ratio for use in risk assessments. C.2 Applying the Hazard Ratio. The hazard ratio converts the basic event risk factor to a risk factor for HLs 3, 4, and/or 5 events. It does this by estimating the conditional probability of an HLs 3, 4, and/or 5 event given the occurrence of the basic event. The risk factor for the base event can be converted to a risk factor for an HL 3, 4, and/or 5 event by multiplying the base event risk factor by the hazard ratio. The HR for a given HL includes all events at that HL or higher. For example, HR3 is calculated by dividing the summation of all HLs 3, 4, and 5 events by the total number of events. This ensures the correct evaluation against the risk guidelines, which are also designed for events at or above the specified HL. C.3 Hazard Ratio Development. Developing a hazard ratio will require considerable engineering judgment. The hazard ratio strongly influences the quantitative assessment results and, therefore, should have a sufficient validation basis or be assessed conservatively. HLs are used for levels 3, 4, and/or 5, as is appropriate to establish a comparison of the risk of the unsafe condition to the guidelines. The following methods should be employed to calculate the hazard ratio for a given HL X event, where X represents either HLs 3, 4, or 5 depending on the assessment: C.3.1 If At Least One Level X or Higher Event Has Occurred. C.3.1.1 Data. Use the value obtained by dividing the number of level X or higher events by the total number of events. If the latest event used in the calculation was not level X or higher, add one additional level X event and one additional event to the totals. For example, one out of four total (1:4) becomes 2:5. The addition of another event is to provide an element of conservatism for the true value of the hazard ratio as estimated by the data to date. Alternatively, use the ratio obtained by counting only the events up to and including the most-recent level X event. For example, a history of 6 events, in the sequence 0 0 X 0 0 0, would result in a level X hazard ratio of 1:3 at the time the last level X occurred as opposed to assuming an additional event for a hazard ratio of 2:7. This method may be used when it produces a more conservative result, as depicted in the example above. There may be some circumstances that justify not adding another level X event if the number of level X events are of significant quantity. C-1 ### Page 42 AC 39-8A Appendix C C.3.1.2 Analysis. If the true hazard ratio can be calculated by analysis, then that ratio may be used. For example, for a particular airplane, a propeller blade will pass through the fuselage if it is released within a given 90° arc. The hazard ratio, assuming HL 4 for serious injury to passengers seated in the plane of the propeller, would then be 90°/360° = 0.25 HL 4 events given a blade release. This method has particular value when little data exists. Note: When the hazard ratio obtained by analysis is significantly different than what would be calculated from the observed data, it is strongly suggested that the observed data be used to establish the hazard ratio. C.3.2 If No level X or Higher Events Have Occurred. C.3.2.1 Historical Data. Use appendix D of this AC and the CAAM reports to provide historical hazard ratios for HLs 3, 4, and 5 events. These historical hazard ratios should be regarded as the primary source of hazard ratios in the absence of sufficient data or analysis specific to the unsafe condition under analysis. However, they should be used cautiously. The hazard ratio is installation dependent, and the historical hazard ratio may be skewed by the historical data available for the affected airplane installation. Reading the summaries of the events from which the hazard ratios were developed will provide valuable insight into the applicability of the data. See CAAM reports referenced in paragraph 1.4.5 for event summaries. Below are some examples of the installation dependency of the hazard ratio for illustration purposes: • Engine separation. There are a large number of examples of engine separation in-flight on older airplanes without adverse effects on airplane control. Airplanes designed recently have encountered difficulties after the separation of high bypass ratio engines, although designed with the same intent of allowing safe separation. Separation of a wing-mounted engine may have very different consequences than separation of a tail-mounted engine. • Uncontained rotor. The potential effect of an uncontained rotor depends largely upon the airplane systems in the plane of the rotor and their proximity to the engines. The effects may be very different for a wing-mounted installation and a fuselage-mounted installation. C.3.2.2 The Next Event Assumption. • No HL 3 or higher events. When no HL 3 or higher event has occurred, and no historical data is available or suitable, a conservative hazard ratio may be established by assuming the next event would be HL 3 or higher. For example, zero out of 4 (0:4) becomes 1:5. There may be cases where this method is overly conservative and may not be C-2 ### Page 43 AC 39-8A Appendix C appropriate to use if it conflicts with the observed physics of the failure(s). Calculate only the HL 3 hazard ratio (HR) unless there is reason to suspect a significant risk of an HL 4 or higher outcome. • One or more HL 3 events have occurred, but no HL 4 or higher events. First, calculate the HL 3 HR as described under paragraph C.3.1. Next, calculate a hazard ratio for HL 4 or higher, given that an HL 3 event has occurred (L4:L3 HR). Accomplish this by assuming the next HL 3 event will be HL 4 and calculate that value. Finally, multiply the L3 HR by the L4:L3 HR to obtain the level 4 HR ratio from the base event. For example, ten events, of which four were HL 3, and none were HL 4. Calculate L3 HR = 4:10 = 0.40. For the four HL 3 events, add one more and assume it is HL 4, = 1:5 = 0.20, L4:L3 HR. Multiply the L3 HR by the L4:L3 HR 0.4 * 0.2 = 0.08 Level 4 HR. C.3.2.3 Analysis. As described above, engineering analysis may allow for an accurate estimation of the hazard ratio. For example, the release of a high-energy fragment in a specific direction could impact a critical component or system, resulting in an HL 3 event. An appropriate hazard ratio could be developed based on the probability of a randomly released fragment being able to impact the critical system. There may also be instances where a failure can only release a small volume of fuel in a fire zone. If the result is a localized fire that exhausts the limited fuel source and the uncontrolled fire is not a credible outcome, it may be appropriate to assume that the hazard ratio is negligible. C.4 Notes on Hazard Ratio Development. Communication between the engine, propeller, APU manufacturers, installers, operators, and the FAA is often necessary, especially if no appropriate historical hazard ratio is available. Additionally, it may be necessary for the stakeholder to use engineering judgement to assess the impact of unique features of a specific powerplant or APU installation. C-3 ### Page 44 APPENDIX D. UNSAFE CONDITIONS D.1 Purpose. The objective of this appendix is to provide the user with a descriptive listing of generic transport airplane powerplant and APU failure conditions that have been defined as potentially unsafe based on previous service experience or traditional assumptions, or both. This appendix is intended to be an example list based on the CAAM reports and not an inclusive or prescriptive checklist, since it may not include all the information relevant to the failure conditions of a specific transport airplane with its various functions and its intended use. This list includes estimates of the conditional probability of the severity outcome (hazard ratio) given the occurrence of the basic failure condition. D.2 CAAM Database. The historical data and hazard ratio tables in this appendix are based on the service data for the period 1982-2012. See the CAAM reports referenced in paragraph 1.4.5 of this AC. Later only a few more CAAM reports on specific subjects were published on the website Engines and Propellers - Data and Reports | F ederal Aviation Administration. The CAAM reports also contain event descriptions for the particular failure condition being assessed. D.3 Hazard Ratio Calculation. D.3.1 Hazard ratio calculations include all higher-level events. For example, the level 3 hazard ratio also includes the HL 4 and 5 events. D.3.2 If there have been relatively few occurrences within the database of a particular failure condition where the number of the base events is under-reported, or if no events of a given HL or higher have occurred, hazard ratios have not been listed in the following tables and marked with an “*.” D.3.3 Separate hazard ratios are calculated for turboprop, low-bypass pressure ratio (LBPR), and high-bypass pressure ratio (HBPR) engines. Note: Care should be taken when using any published hazard ratio to ensure that the data source is relevant to the intended application. Since the hazard ratios in this appendix have been developed using the full range of the available data, they should be considered a general guide and not a replacement for more specific guidance and assessments for a particular airplane type, environment, or operating condition. For the latest guidance on Hazard Ratio applicability, refer to the latest data and Technical Reports on Propulsion System and Auxiliary Power Unit (APU) Related Aircraft Safety Hazards, located at the web address listed in paragraph 1.4.5 (Engines and Propellers - Data and Reports | Federal Aviation Administration). AC 39-8A Appendix D D-1 ### Page 45 AC 39-8A Appendix D D.4 Failure Condition: Uncontained. An uncontained failure condition is a potentially significant unsafe condition, which initiates from an uncontained release of debris from a rotating component malfunction (blade, disk, spacer, impeller, drum or spool). In order to be classified as uncontained, the debris must pass completely through the nacelle envelope. Parts that puncture the nacelle skin, but do not escape or pass completely through, are considered contained. Fragments that pass out of the inlet or exhaust opening without passing through any structure are not uncontained. Table D-1 - Uncontained Disk Hazard Ratios of Fan and Low-Pressure Compressor (LPC) † The data is combined here for convenience. The user should review the event descriptions and definitions in the CAAM reports for relevance to the particular issue being assessed. D-2 ### Page 46 AC 39-8A Appendix D Table D-2 - Uncontained Disk Hazard Ratios of High-Pressure Compressor (HPC), Intermediate Pressure Compressor (IPC), High-Pressure Turbine (HPT) and Intermediate Pressure Turbine (IPT) † The data is combined here for convenience. The user should review the event descriptions and definitions in the CAAM reports for relevance to the particular issue being assessed. ‡ The CAAM 1 and CAAM 2 reports collected IPT blade events separately. There was one turboprop IPT blade event in each report that was combined with the HPT events. ⁰ The CAAM 2 report collected IPC events separately. There was one high bypass turbofan L3 IPC event identified in CAAM 2 that was combined with the HPC events. ⁱ The CAAM 1 and CAAM 2 reports collected IPT events separately. There was one L3 turboprop IPT event identified in the CAAM 1 report that was combined with HPT events. D-3 ### Page 47 Table D-3 - Uncontained Disk Hazard Ratios of Low-Pressure Turbine (LPT) AC 39-8A Appendix D Note: Hazard ratios were not calculated by rotor type in the CAAM 1 report and are not shown in the CAAM 1 section of the table. The CAAM 1 report did not include L5 as a classification. These events were reclassified as L5 in the original release of AC 39-8. The CAAM 2 report collected IPC events separately. There was one high bypass turbofan L3 IPC event identified in CAAM 2 that was combined with the HPC events. The CAAM 1 and CAAM 2 reports collected IPT events separately. There was one L3 turboprop IPT event identified in the CAAM 1 report that was combined with HPT events. † The data is combined here for convenience. The user should review the event descriptions and definitions in the CAAM reports for relevance to the particular issue being assessed. D-4 ### Page 48 AC 39-8A Appendix D Table D-4 - Uncontained Blade Hazard Ratios (Fan and Platforms) † The data is combined here for convenience. The user should review the event descriptions and definitions in the CAAM reports for relevance to the particular issue being assessed. D-5 ### Page 49 Table D-5 - Uncontained Blade Hazard Ratios (LPC and HPC) AC 39-8A Appendix D † The data is combined here for convenience. The user should review the event descriptions and definitions in the CAAM reports for relevance to the particular issue being assessed. D-6 ### Page 50 AC 39-8A Appendix D Table D-6 - Uncontained Blade Hazard Ratios (HPT/IPT and LPT) Note: Hazard ratios were not calculated by rotor type in the CAAM 1 report and are not shown in the CAAM 1 section of the table. † The data is combined here for convenience. The user should review the event descriptions and definitions in the CAAM reports for relevance to the particular issue being assessed. ‡ The CAAM 1 and CAAM 2 reports collected IPT blade events separately. There was one turboprop IPT blade event in each report that was combined with the HPT events. D-7 ### Page 51 AC 39-8A Appendix D Table D-7 - Uncontained "Other" Hazard Ratios (Fan and HPC) † The data is combined here for convenience. The user should review the event descriptions and definitions in the CAAM reports for relevance to the particular issue being assessed. D-8 ### Page 52 AC 39-8A Appendix D Table D-8 - Uncontained "Other" Hazard Ratios (HPT and LPT/PT) "Other" includes spinners, cooling plates, spacers, and air seals. Note: Hazard ratios were not calculated by rotor type in the CAAM 1 report and are therefore not shown in the CAAM 1 section of the table. † The data is combined here for convenience. The user should review the event descriptions and definitions in the CAAM reports for relevance to the particular issue being assessed. D-9 ### Page 53 AC 39-8A Appendix D D.5 Failure Condition: Fire Zone Fire. D.5.1 In previous CAAM work this category “Fire Zone Fire” was referred to as "Under-Cowl Fire". The CAAM made this change to recognize that in some installations it is possible to have a fire in an area under a cowl, but not in a fire zone with the recognition that the specifics of where a fire occurs can influence the hazard it presents. To provide a more accurate description of what the dataset contains, CAAM decided to adopt the "Fire Zone Fire" nomenclature. There is not a one-to-one correlation between the historically published data and the present data. Familiarization with the prior work will help add context to currently published CAAM work and aid the analyst in understanding progression of the topic. D.5.2 Tables D-9a and D-9b show the fire events and hazard ratios for fire events based on the latest fire zone fire data collected by CAAM following its definitions and noncollimated. D-10 ### Page 54 AC 39-8A Appendix D Table D-9a - Fire Zone Fire Data Fire Events – High Bypass Total and by Generation Engine Type All High Bypass 1st Generation HBTHF 2nd Generation HBTF 3rd/4th/5th Generation Hazard Level All 3 4 5 All 3 4 5 All 3 4 5 All 3 4 5 Number of Events by Fire Type Fire Zone Fires 200 5 0 0 N/A N/A N/A N/A 131 3 0 0 69 2 0 0 Total 200 5 0 0 N/A N/A N/A N/A 131 3 0 0 69 2 0 0 Table D-9b - Fire Zone Fire Data Hazard Ratios for Fire Events – High Bypass Total and by Generation Engine Type All High Bypass 1 st Generation HBTF 2 nd Generation HBTF 3rd/4th/5th Generation HBTF Hazard Level 3+4+5 /All 4+5/A ll 5/All 3+4+5 /All 4+5/A ll 5/All 3+4+5 /All 4+5/A ll 5/All 3+4+5 /All 4+5/A ll 5/All Hazard Ratio by Fire Type Fire Zone Fires 5/200 = 0.025 0/5 = * 0/0 = * N/A N/A N/A 3/131 = 0.023 0/3 = * 0/0 = * 2/69 = 0.029 0/2 = * 0/0 = * Total 5/200 = 0.025 0/5 = * 0/0 = * N/A N/A N/A 3/131 = 0.023 0/3 = * 0/0 = * 2/69 = 0.029 0/2 + * 0/0 = * *Hazard ratio not calculated. D-11 ### Page 55 AC 39-8A Appendix D D.6 Failure Condition: Tailpipe Fire. A tailpipe fire is defined as a fire within the tailpipe where visible sustained flames exit the tailpipe, including very short duration fires or fires of very small size, such as a candle flame at the centerbody. Engine surge/stall events and events resulting from deicing fluid ingestion are excluded. Table D-10 - Tailpipe Fire Data † Data was not combined due to the changes in the definition across the three reports, specifically clarification to the HL 3 uncontrolled fire definition may have resulted in some tailpipe fires in the CAAM 3 report being graded differently from CAAM 2. D-12 ### Page 56 AC 39-8A Appendix D D.7 Failure Condition: Case Rupture. A case rupture is a significant safety event that initiates from a sudden rupture of a highpressure vessel or case with the resultant release of high-pressure gases into the undercowl cavity. Case ruptures resulting from the uncontained release of debris from a rotating component malfunction are excluded. Case ruptures include those events that propagate from fatigue cracks as well as ruptures related to secondary malfunctions (e.g., flame impingement). Table D-11 - Case Rupture Hazard Ratios † The data is combined here for convenience. The user should review the event descriptions and definitions in the CAAM reports for relevance to the particular issue being assessed. Note: The CAAM 1 report did not include L5 as a classification. One L4 event was reclassified as L5 in the original release of AC 39-8, and the classification is preserved here. D-13 ### Page 57 AC 39-8A Appendix D D.8 Failure Condition: Case Burnthrough. A case burnthrough failure condition is defined as a local case penetration that initiates from local overtemperature of the case external wall due to an internal engine malfunction (e.g., fuel nozzle leakage, internal bearing compartment fires, and titanium fires). Burnthroughs are distinguished from ruptures by their lack of an explosive release of high-pressure gas. A common cause of case burnthrough is localized penetration due to fuel nozzle malfunction. Events involving accessory component cases also contribute to this category. For example, sump fires that propagate internally and result in burnthrough of piping or that initiate gearbox fires fall into this category. The key aspect, whether in the primary gas path or accessories, is that fire initiates from an internal malfunction and proceeds to burn through a case, tube, or gearbox to reach external regions. Table D-12 - Case Burnthrough Hazard Ratios † The data is combined here for convenience. The user should review the event descriptions and definitions in the CAAM reports for relevance to the particular issue being assessed. D-14 ### Page 58 AC 39-8A Appendix D D.9 Failure Condition: Multiple-Engine Events. A multiple-engine event initiation from simultaneous power loss from multiple propulsion systems due to the following: • Bird ingestion; • Environmental cause, such as ice, rain, hail, or volcanic ash ingestion; • Fuel contamination. Sequential power loss and recovery is excluded; • Complete exhaustion of the airplane fuel reserves; • Improper management of the airplane fuel system (e.g., tank crossfeed). Sequential power loss and recovery is excluded; • Improper maintenance (e.g., failure to restore oil system integrity after inspection); or • Reasons other than those characterized elsewhere or where the initiating event(s) are unknown. These reasons include unrelated events of engine power loss within the same flight. D-15 ### Page 59 AC 39-8A Appendix D Table D-13 - Multiple-Engine Event (Fuel Related) Hazard Ratios † The data is combined here for convenience. The user should review the event descriptions and definitions in the CAAM reports for relevance to the particular issue being assessed. ‡ Hazard ratios not calculated due to under-reporting of base events. D-1 ### Page 60 AC 39-8A Appendix D Table D-14 - Multiple-Engine Event (Non-Fuel) Hazard Ratios The event count for all events is likely under-reported. † The data is combined here for your convenience. The user should review the event descriptions and definitions in the CAAM reports for relevance to the particular issue being assessed. D-2 ### Page 61 AC 39-8A Appendix D ‡ The CAAM 3 report separates the bird related events from the non-bird related events. The two were combined for this AC. ⁰ The CAAM 1 report multi-engine data was not collected using the same categories as the CAAM 2 and CAAM 3 reports. D-3 ### Page 62 AC 39-8A Appendix D D.10 Failure Condition: Engine/Pylon Separations. An engine/pylon separation is defined as a separation of the engine, with or without the strut/pylon. Events resulting from ground contact are excluded. Table D-15 - Engine/Pylon Separations † The data is combined here for convenience. The user should review the event descriptions and definitions in the CAAM reports for relevance to the particular issue being assessed. D-4 ### Page 63 AC 39-8A Appendix D D.11 Failure Condition: Cowl Separation. A cowl separation is defined as a separation of nacelle components such as inlets, cowls, thrust reversers, exhaust nozzles, tail plugs, etc. Separation of relatively small sections of skin, blow-out panels, or other small pieces that are unlikely to hazard continued safe flight and landing are excluded. Events resulting from ground contact are excluded. Table D-16 - Cowl Separation Hazard Ratios † The data is combined here for convenience. The user should review the event descriptions and definitions in the CAAM reports for relevance to the particular issue being assessed. D-5 ### Page 64 AC 39-8A Appendix D D.12 Failure Condition: Asymmetric Thrust Reverser Deployment/Inflight Beta. An asymmetric thrust reverser deployment/inflight beta is defined as a significant safety event wherein a thrust reverser deploys in-flight, or a propeller enters beta mode inflight (exclusive of design intent). Table D-17 - Thrust Reverser Deploy - Inflight Hazard Ratios † Data was not combined due to the changes in the definition across the three reports. Note: ‡ The CAAM 1 report did not include L5 as a classification. One L4 event was re-classified as L5 in the original release of AC 39-8, and the classification is also used here. D-6 ### Page 65 AC 39-8A Appendix D D.13 Failure Condition: Fuel Leak. A fuel leak is defined as a leak of fuel into the pylon or dry bay, or under the engine cowls, which could credibly lead to a fire. Leaks collected from shrouds and components and drained directly overboard by a dedicated drain were excluded from those leaks under consideration due to their lack of being fire safety concerns. Drips and seeps were also excluded. In-tank leakage was excluded. Table D-18 - Fuel Leak Data † Data was not combined due to the changes in the definition across the three reports, the wide variety of circumstances surrounding the source of the fuel leak, and significant under-reporting of base events. D-7 ### Page 66 AC 39-8A Appendix D D.14 Failure Condition: Propeller System Events. • Propeller separation and debris release. Separation of single or multiple blades, or large pieces thereof, due to blade or hub malfunction. Note that events occurring after a ground strike are included for their information on their threat to the airplane or its occupants. • Autofeather and pitch lock. Propeller system malfunction leading to the inability to control the propeller. Control hunting is excluded as a normal product behavior. • Propeller system malfunction recognition and response (PSMRR). A significant safety event initiating from a propeller system malfunction which, by itself, does not hazard the airplane, passengers, or crew, but is compounded by inappropriate crew response. • Crew error. In the context of the propeller system, a significant safety event caused by a propeller system malfunction or improper operation that was caused by an inappropriate crew action, excluding sabotage, gross negligence, and suicide (e.g., operation in beta mode in violation of operating instructions). Also not included are events where inappropriate crew action causes a propeller system malfunction through very indirect means such as flying the airplane into the ground or running the airplane into equipment on the taxiway and runway. This category has previously been referred to as Propulsion System Malfunction plus Inappropriate Crew Response – PSM+ICR. • Propeller gearbox and attachment. A propeller gearbox and attachment failure are defined as an in-flight separation of a propeller assembly as the result of a propeller gearbox or attachment malfunction. • Loss of control (negative thrust). The loss of control is defined as a propeller system malfunction leading to negative thrust (high drag). • Other. A significant propeller-related safety event not included in the propeller categories discussed above and for which the initiating cause(s) is unique to one HL 3 or 4 event in the reporting period. D-8 ### Page 67 AC 39-8A Appendix D Table D-19 - Propeller System Hazard Ratios † The data is combined here for convenience. The user should review the event descriptions and definitions in the CAAM reports for relevance to the particular issue being assessed. ‡ Data for these categories was only collected in CAAM 1 and not included in the Combined totals. ⁰ Hazard ratios not calculated due to under-reporting of base events. D-9 ### Page 68 AC 39-8A Appendix D D.15 Failure Condition: APU System Event. • Uncontained. An uncontained rotating component malfunction that allows debris to exit through the APU containment casings. • Axial uncontained. Major rotating components that exit the APU containment casings in an axial direction (i.e., without penetrating the case). • Overspeed. Acceleration of a rotor beyond the speed sanctioned in the Type Certificate Data Sheet. • Fire. Combustion external to the APU casings. Tailpipe fire data and hot air leaks resulting in fire warnings, without combustion, are excluded from the definition and documented separately. • Tailpipe fire. Fires within the tailpipe and exiting the tailpipe, where flames are visible. Hot starts resulting in a “glow” are excluded. • Compartment overheat. High-temperature air leaks due to casing highpressure/temperature air duct system malfunctions within the APU. D-10 ### Page 69 AC 39-8A Appendix D Table D-20 - APU Data † The data is combined here for convenience. The user should review the event descriptions and definitions in the CAAM reports for relevance to the particular issue being assessed. ‡ Data was only collected in either CAAM 1 report or CAAM 2 report, not both. Not included in “Combined.” ⁰ No APU data was collected in CAAM 3 report. ⁱ Hazard ratios not calculated due to likely under-reporting of base events. D-11 ### Page 70 AC 39-8A Appendix D D.16 Failure Condition: Propulsion System malfunction Recognition and Response (PSMRR). PSMRR is defined as a safety-significant event initiating from a single propulsion system malfunction, excluding the propeller system, which, by itself, does not hazard the airplane, but is compounded by an inappropriate crew response. For example, the crew did not execute their checklist during normal flying duties. A typical example of PSMRR is an IFSD followed by inappropriate crew response that caused the airplane to crash. Not counted are cases of gross error negligence, such as deciding to take off with an engine known to be inoperative. See the AIA and AECMA Project Report on Propulsion System Malfunction plus Inappropriate Crew Response (PSM+ICR), dated November 1998, for additional examples. Note that this condition has previously been referred to as PSM+ICR. Table D-21 - Propulsion System Malfunction Recognition and Response Data † The data is combined here for convenience. The user should review the event descriptions and definitions in the CAAM reports for relevance to the particular issue being assessed. ‡ Due to the lack of data and likely under-reporting of base events, hazard ratios are not calculated. D-12 ### Page 71 AC 39-8A Appendix D D.17 Failure Condition: Crew Error. A crew error is defined as a significant safety event caused by a propulsion system malfunction or improper operation that was caused by an inappropriate crew action, excluding sabotage, gross negligence, and suicide. Not included are events where inappropriate crew action causes a propulsion system malfunction through very indirect means such as flying the airplane into the ground or running the airplane into equipment on the taxiway/runway. Table D-22 - Crew Error Data † The data is combined here for convenience. The user should review the event descriptions and definitions in the CAAM reports for relevance to the particular issue being assessed. ‡ Due to the lack of data and likely under-reporting of base events, hazard ratios are not calculated. D-13 ### Page 72 AC 39-8A Appendix D D.18 Previously Reported Hazards Not Included. Not all potential hazards that the FAA identified in the prior version of this AC were included for the reasons identified below. You may contact the FAA for additional information on developing hazard ratios in these cases. D.18.1 The following potential hazards were previously identified and may have resulted in a limited number of multiple HLs 3, 4, or 5 events, but were found to have low hazard ratios or hazard ratios calculated based on significant under-reporting of the base events: • Contained engine or APU rotor failure; • Asymmetric thrust – throttle split; • Asymmetric thrust – single engine reverser non-deployment/no beta on landing; • Single engine IFSD/power loss; • Overthrust; • Engine or APU overspeed; • Hazardously misleading powerplant or APU indications; • Loss of inflight restart capability on a critical number of engines; • Excessive fuel tank differential pressures; • Flammable fluid leakage – oil/hydraulic; and • Smoke or toxic products in the cabin. D.18.2 The following potential hazards were previously identified but either had no data collected, or did not result in any HL 3, 4, or 5 events over the reporting periods: • Nacelle, pylon, or APU compartment “overheat”; • Engine or APU exhaust gas impingement; • Multiple engines small undetected thrust loss; and • Fuel load imbalance. D-14 ### Page 73 AC 39-8A Appendix E **APPENDIX E. RISK ASSESSMENT EXAMPLE E.1** E.2 E.2.1 E.2.2 Purpose. The objective of this appendix is to provide a detailed step-by-step example of the risk assessment process detailed in this AC, taking the reader through a typical fictitious service problem scenario from identification to resolution. Example – Compressor Disk Fracture. An 8th stage compressor disk installed in a low-bypass turbofan engine fractures during the takeoff roll. The fracture occurs before V1, and the takeoff is safely aborted. The fractured disk had accumulated 12,508 cycles in service prior to the fracture. The fracture is uncontained but does not cause any damage to the airplane or injury to any passenger or crew. Control is maintained at all times and the airplane stops on the runway. Failure investigation reveals the disk fractured in low-cycle fatigue due to corrosion. The investigation further indicates the corrosion occurred because the failed part had not been properly coated during manufacture. The problem is identified and corrected in production; however, the risk posed by other improperly coated parts in service must be assessed. Estimate the number of airplanes exposed. Initial evaluation of the extent of the problem detects no known manufacturing process changes that might have accounted for the coating problem. However, this part number disk is processed at a dedicated coating facility (i.e., the facility produces only this part), and while all disks of this part number are potentially at risk, the problem is not considered to extend to other part numbers (no evidence of any problems with the parts produced by other facilities). Four hundred and thirty-three (433) disks (including spares) of the suspect part number are currently in service and are considered to be at risk of a repeat event. There are another 36 disks that have been retired. Perform a Weibull Analysis. The engine manufacturer immediately performs a Weibull analysis using a typical fatigue wear out slope against the total population of disks (433+36) to establish the disk life distribution (Note: It is acceptable to use uninspected disks that are known not to have failed for a failure life distribution, but not for time to crack, which requires a known inspection result). This life distribution is then used to predict the future risk of disks still in service as an input to a simulation. The simulation runs a computer model of the current fleet forward in time. This simulation model predicts 1.3 additional disk fractures if all current parts are allowed to remain in service until their certified retirement life (15,000 cycles). Calibration of this risk model, by backing up the simulation to the start of service and running the fleet model to the present, gives a prediction of 0.95 events to date, versus one occurred, which is judged to be indicative of a valid model. E-1 ### Page 74 AC 39-8A Appendix E E.2.3 Estimate the uncorrected risk and risk per flight. This event did not result in serious injury or other HL 4 or 5 events. Historical data available at the time on similar disk fractures indicated a record of 13 disk fractures. Nine of the 13 (69 percent: 9/13) resulted in HL 3 or higher severity level events. Four of the 13 events (30 percent: 4/13) resulted in hull loss or fatality (HL 4 or higher severity level event) due to on-ground fire; one of the 13 events (8 percent: 1/13) was also HL 5 (hull loss/multiple fatalities). Coordination with the airplane manufacturer indicates that, for this installation, use of the historical CAAM data would be appropriate. Structural review by the engine manufacturer predicts that fracture of this 8th stage disk would be expected to result in non-containment 100 percent of the time. Since 1.3 events are predicted and 30 percent of those would be expected to result in an HL 4 event, 0.39 HL 4 events would be expected if no action is taken (1.3 x 0.30 = 0.39), and 0.1 (1.3 x 0.08 = 0.1) HL 5 events. There are two at-risk engines per airplane and the 433 disks have an average of 5000 cycles remaining until retirement. Therefore, the average per-flight risk of an HL 4 (or higher) event if no action is taken is 3.6 x 10 -7 [0.39 / (433 disks x 5000 cycles/disk / 2 cycles per flight*) = 3.6 x 10 -7]. Note that the spare disks are included in the analysis. While these HL 4 risks are clearly in the region where action must be taken, the per-flight risk is below the guideline for immediate action (4x10 -6 per-flight for HL 4 events), so the disks are allowed to remain in service while an inspection and replacement plan is developed. HL 3 events are also calculated: there are 0.90 level 3 (or higher) events predicted (1.3 events x 0.69 at least level 3 = 0.90), with a per-flight risk of 8.3x10 -7 [0.90 / (433 disks x 5000 cycles/disk / 2 cycles per flight*) = 8.3 x 10 -7]. * Two engines per airplane, each engine experiencing one cycle per flight. E.2.4 Estimate the effects of candidate actions. Over the next few weeks, while a plan is being developed, many retired disks are located and inspected, along with several disks in engines currently undergoing scheduled shop visits. One disk is found to have a crack resulting from a corrosion pit. These inspection findings, along with structural modeling by the engine manufacturer, allow for a more refined quantitative analysis, including initiation and propagation distributions. The Monte Carlo simulation is revised and is performed against many inspection and replacement scenarios to find one that acceptably mitigates the risk of serious injury. The engine manufacturer submits a plan to the FAA. The manufacturer’s proposed plan calls for the replacement of the disks at next shop visit, with engines above a part life of 10,000 cycles to be removed no later than within the next 2,000 cycles. The simulation predicts that this plan would result in 0.18 uncontained events of which 0.12 would be at least level 3 (0.69 level 3 x 0.18 = 0.12), 0.05 would be HL 4 (0.30 HL 4 x 0.18 events = 0.05), and .01 would be level 5 (0.08 level 5 x 0.18 events = 0.01). Both the HLs 3 and 4 predictions are below the risk guidelines outlined in table 1 in paragraph 4.1.2. The HL 5 risk is well controlled within HL 4 exposure. This plan calls for an aggressive production schedule of replacement disks. Shop visit capacity will also be strained but is expected to be capable of meeting the increase in inducted engines with only minor schedule disruptions. The engine manufacturer issues a service bulletin recommending disk replacement to the above schedule. E-2 ### Page 75 AC 39-8A Appendix E E.2.5 Implement and monitor corrective action plan. The FAA reviews the assumptions and results of the risk analysis and issues a notice of proposed rulemaking, followed by a final rule after notice, to mandate the engine manufacturer’s service bulletin. Disks are inspected as they are replaced, with the results compared at regular intervals to the month-by-month predicted crack findings from the Monte Carlo simulation. Subsequent inspection findings indicate the initial risk analysis is somewhat conservative. However, both the engine manufacturer and the FAA believe that no alleviation of the disk replacement schedule should be pursued due to the potential seriousness of another event. After nine months, the FAA also requests a comparison of the actual shop visit (disk replacement) rate with the predictions from the risk analysis. The actual rate is found to be within two percent of the predicted rate, so no additional action is taken. After 4.5 years, the last of the suspect disks are replaced. No additional events have occurred during that period. E-3 ### Page 76 : : Date AC 39-8A Appendix E Advisory Circular Feedback Form OMB Control Number: 2120-0746 Expiration Date: 12/31/2027 Paperwork Reduction Act Burden Statement: A federal a gency may not c onduct or sponsor, and a person is not required to respond to, nor shall a person be subject to a penalty for failure to comply with a collection of information subject to the requirements of the Paperwork Reduction Act unless that collection of information displays a currently valid OMB Control Number. The OMB Control Number for this information collection is 2120-0746. Public reporting for this collection of information is estimated to be approximately 20 minutes per response, including the time for reviewing instructions, searching existing data sources, gathering, and maintaining the data needed, completing, and reviewing the collection of information. All responses to this collection of information are voluntary. Send comments regarding this burden estimate or any other aspect of this collection of information, including suggestions for reducing this burden to: Information Collection Clearance Officer, Federal Aviation Administration, 10101 Hillwood Parkway, Fort Worth, TX 76177-1524. If you find an error in this Advisory Circular, have recommendations for improving it, or have suggestions for new items/subjects to be added, you may let us know by emailing this form to 9- avs-air-directives-management-officer@faa.gov. Continued Airworthiness Assessment Methodologies of Powerplant and Subject: Auxiliary Power Unit Installations on Transport Category Airplanes Date: Mark all appropriate line items: An error (p rocedural or typographical) has been noted in paragraph on page Recommend pa ragraph on page be changed as follows: . In a fu tur (Briefly d e change to this AC, please cover the following subject: escribe what you want added.) Other comments: I would like to discuss the above. Please contact me using the information below. Submitted by FAA 1320-73 (01/25) SUPERSEDES PREVIOUS EDITIONS --- From OpenAirDocs.org, an independent open copy of FAA data. Only the Federal Register edition on govinfo.gov is the official legal text of an AD.