AC 39-8A Appendix B APPENDIX B. HAZARD LEVEL DEFINITIONS The following definitions apply for the purpose of this AC:
B.1 Purpose.
This appendix outlines common propulsion system malfunctions or related incidents, in certain cases coupled with crew error or other airplane system malfunctions, resulting in consequences to the airplane or its passengers/crew.
B.2 Hazard Level Classification.
HLs are classified by their actual and direct outcomes to either the aircraft or its passengers or crew, not the collateral severity (e.g., injuries sustained during evacuation from the aircraft, hull loss due to lack of fire fighting support on the ground). Other methods are used to classify the severity of events, such as the assessment during certification of the worst anticipated outcome. These different classification systems were developed independently, based on both actual or projected outcomes, and serve different purposes. Therefore, there is not a one-to-one relationship for any given failure condition. For example, a disk burst may be classified as “catastrophic” or “hazardous” under certification assessments, but an actual disk burst event may range in severity from HL 1 (minor) up to HL 5 (catastrophic).
Note: A means to differentiate between HLs 0, 1, and 2, as delineated within the CAAM reports referenced in paragraph 1.4.5, is not necessary for the purposes of this AC.
B.3 Hazard Level 3 – Serious Consequences.
B.3.1 Substantial damage to the airplane or second unrelated system.
B.3.1.1 Damage or structural failure that adversely affects the limit loads capability of a primary structural element or the performance or flight characteristics of the airplane, and that would normally require major repair or replacement of the affected components.
Note: Typically, engine failure damage that is limited to the engine or its mounts, bent landing gear associated with runway departures, wheel, tires, flaps, engine accessories on failed engine, brakes, or wing tips do not generally result in the effects delineated above and are not considered “substantial damage.”
B.3.1.2 Damage to a second unrelated system that affects the ability to continue safe flight and landing. Coordination and agreement between the engine, propeller, APU manufacturers, and the airframe manufacturer may be required to categorize events related to second system damage. For B-1
AC 39-8A Appendix B example, an uncontained rotor event, which severed an unrelated hydraulic system line without significantly degrading the ability to continue safe flight, should not be considered an HL 3 event. In general, airplanes are designed to be under one part of a redundant system inoperative with no effect on flight safety.
B.3.1.3 Damage to a second engine that results in a significant loss of thrust or an operational problem requiring pilot action to reduce power. Minor damage that was not observed by the crew during flight and which did not affect the ability of the engine to continue safe operation for the rest of the flight should not be considered an HL 3 event.
B.3.2 Fires that escape the fire zone and impinge flames onto the wing or fuselage, or act as ignition sources for flammable material that might be present outside the fire zone. This category includes tailpipe fires that cause thermal damage or require the affected structure or control surface to be replaced or repaired. Refer to the latest CAAM publication on fire zone fire for more information.
B.3.3 Rapid depressurization of the cabin.
B.3.4 Permanent loss of thrust or power greater than one propulsion system (inflight).
B.3.5 Temporary loss of thrust greater than one propulsion system.
Note: For multiple-engine events that resulted in temporary total power loss, the following criteria were considered to place an event within HL 3: occurrence below 10,000 feet above ground-level or the loss of more than 5,000 feet altitude (as in situations where the airplane must descend to a suitable altitude prior to attempting restart). Consideration of transitory events of total power loss below 10,000 feet should consider length of transient vs. closeness to the ground as part of this evaluation.
B.3.5.1 Any temporary or permanent impairment of airplane controllability caused by, for instance, propulsion system malfunction, thrust reverser inflight deployment, propeller control malfunction, or propulsion system malfunction coupled with airplane control system malfunction, abnormal airplane vibration, or crew error. Events within the normal spectrum of crew response in requiring crew control inputs to regain the airplane flight path are not included.
B.3.5.2 Malfunctions or failures that result in smoke or other fumes delivered to the flight deck, thereby seriously impairing the flight crew. Serious impairment includes the loss of the crew’s ability to see flight deck instrumentation or perform expected flight duties. Purely psychological aspects of the concern of odors, etc., are not to be included, nor are concerns about long-term exposure.
B.3.5.3 Fuel leak resulting in a declared landing priority or mayday due to low fuel state. Any leak resulting in landing with fuel below reserve B-2
AC 39-8A Appendix B (minimum) fuel level. Holes or punctures in airplane fuel lines or tanks, greater than two square inches, caused by uncontained or cowl loss events.
B.4 Hazard Level 4 – Severe Consequences.
B.4.1 Forced landing is the inability to continue flight due to the consequences of damage, uncontrolled fire, or thrust loss where imminent landing is obvious, but airplane controllability is not necessarily lost. For example, total power loss due to fuel exhaustion will result in a forced landing.
Note: The term emergency landing may also be used to mean a forced landing if there is an urgent requirement to land, but the declaration of an emergency does not necessarily imply that a forced landing is imminent. An air turn back or diversion due to a malfunction is not a forced landing since there is a lack of urgency and the crew has the ability to select where they will perform the landing. However, off-airport landings are almost always forced landings.
B.4.2 Loss of Airplane While Occupants Were on Board.
Note: This refers to hull loss as opposed to an economic loss. Hull losses where the airplane could have been repaired, but the repair would not have been cost effective, are excluded. Additionally, hull losses that occurred well after the event because appropriate action was not taken to further mitigate damage are also excluded. For example, a fire that breaks out because no fire equipment was available would not be considered a hull loss. Some degree of judgment may be required in determining whether the hull loss qualifies for inclusion.
B.4.2.1 Serious Injuries or Fatalities.
See paragraph 1.5.11 for the definition of serious injury and fatal injury.
B.4.2.2 The HL 4 risk guidelines are intended to cover exposures to the most severe of serious injuries, such as life-threatening injuries. Consequently, relaxation of these guidelines may be acceptable in cases where the associated serious injuries are clearly not life threatening, such as simple fractures.
B.4.2.3 Injuries resulting from an emergency evacuation rather than from the event which caused the evacuation, are not considered in evaluating the severity of the event. It is recognized that emergency evacuations by means of the slides can result in injuries without regard to the kind of event precipitating the evacuation.
B.5 Hazard Level 5 – Catastrophic Consequences.
Catastrophic outcome, an occurrence resulting in multiple fatalities, usually with the loss of the aircraft.
B-3
AC 39-8A Appendix B B.6 General Notes Applicable to all Event Hazard Levels.
B.6.1 The severity of airplane damage is based on the consequences and damage that actually occurred.
B.6.2 With respect to an HL 3 secondary system damage event, uncontained event damage definitions are different from those used in other SAE publications. The objective of the wording used in CAAM has been to more clearly define and separate those events that had a major impact on continued safe flight and landing from those with lesser consequences.
B.7 Historical Comparison of Hazard Level Descriptions.
CAAM data has been collected over three periods (1982-1991, 1992-2000, and 2001- 2012). Subsequent to the initial CAAM 1 report, some of the HL definitions have been revised based on lessons learned. The definitions included in the latest CAAM report, CAAM 3, are included in this AC.
B-4
AC 39-8A Appendix C APPENDIX C. HAZARD RATIO DEVELOPMENT C.1 Purpose.
This appendix describes methodologies to estimate the hazard ratio for use in risk assessments.
C.2 Applying the Hazard Ratio.
The hazard ratio converts the basic event risk factor to a risk factor for HLs 3, 4, and/or 5 events. It does this by estimating the conditional probability of an HLs 3, 4, and/or 5 event given the occurrence of the basic event. The risk factor for the base event can be converted to a risk factor for an HL 3, 4, and/or 5 event by multiplying the base event risk factor by the hazard ratio. The HR for a given HL includes all events at that HL or higher. For example, HR3 is calculated by dividing the summation of all HLs 3, 4, and 5 events by the total number of events. This ensures the correct evaluation against the risk guidelines, which are also designed for events at or above the specified HL.
C.3 Hazard Ratio Development.
Developing a hazard ratio will require considerable engineering judgment. The hazard ratio strongly influences the quantitative assessment results and, therefore, should have a sufficient validation basis or be assessed conservatively. HLs are used for levels 3, 4, and/or 5, as is appropriate to establish a comparison of the risk of the unsafe condition to the guidelines. The following methods should be employed to calculate the hazard ratio for a given HL X event, where X represents either HLs 3, 4, or 5 depending on the assessment:
C.3.1 If At Least One Level X or Higher Event Has Occurred.
C.3.1.1 Data.
Use the value obtained by dividing the number of level X or higher events by the total number of events. If the latest event used in the calculation was not level X or higher, add one additional level X event and one additional event to the totals. For example, one out of four total (1:4) becomes 2:5. The addition of another event is to provide an element of conservatism for the true value of the hazard ratio as estimated by the data to date. Alternatively, use the ratio obtained by counting only the events up to and including the most-recent level X event. For example, a history of 6 events, in the sequence 0 0 X 0 0 0, would result in a level X hazard ratio of 1:3 at the time the last level X occurred as opposed to assuming an additional event for a hazard ratio of 2:7. This method may be used when it produces a more conservative result, as depicted in the example above.
There may be some circumstances that justify not adding another level X event if the number of level X events are of significant quantity.
C-1
AC 39-8A Appendix C C.3.1.2 Analysis.
If the true hazard ratio can be calculated by analysis, then that ratio may be used. For example, for a particular airplane, a propeller blade will pass through the fuselage if it is released within a given 90° arc. The hazard ratio, assuming HL 4 for serious injury to passengers seated in the plane of the propeller, would then be 90°/360° = 0.25 HL 4 events given a blade release. This method has particular value when little data exists.
Note: When the hazard ratio obtained by analysis is significantly different than what would be calculated from the observed data, it is strongly suggested that the observed data be used to establish the hazard ratio.
C.3.2 If No level X or Higher Events Have Occurred.
C.3.2.1 Historical Data.
Use appendix D of this AC and the CAAM reports to provide historical hazard ratios for HLs 3, 4, and 5 events. These historical hazard ratios should be regarded as the primary source of hazard ratios in the absence of sufficient data or analysis specific to the unsafe condition under analysis.
However, they should be used cautiously. The hazard ratio is installation dependent, and the historical hazard ratio may be skewed by the historical data available for the affected airplane installation. Reading the summaries of the events from which the hazard ratios were developed will provide valuable insight into the applicability of the data. See CAAM reports referenced in paragraph 1.4.5 for event summaries. Below are some examples of the installation dependency of the hazard ratio for illustration purposes:
• Engine separation. There are a large number of examples of engine separation in-flight on older airplanes without adverse effects on airplane control. Airplanes designed recently have encountered difficulties after the separation of high bypass ratio engines, although designed with the same intent of allowing safe separation. Separation of a wing-mounted engine may have very different consequences than separation of a tail-mounted engine.
• Uncontained rotor. The potential effect of an uncontained rotor depends largely upon the airplane systems in the plane of the rotor and their proximity to the engines. The effects may be very different for a wing-mounted installation and a fuselage-mounted installation.
C.3.2.2 The Next Event Assumption.
• No HL 3 or higher events. When no HL 3 or higher event has occurred, and no historical data is available or suitable, a conservative hazard ratio may be established by assuming the next event would be HL 3 or higher. For example, zero out of 4 (0:4) becomes 1:5. There may be cases where this method is overly conservative and may not be C-2
AC 39-8A Appendix C appropriate to use if it conflicts with the observed physics of the failure(s). Calculate only the HL 3 hazard ratio (HR) unless there is reason to suspect a significant risk of an HL 4 or higher outcome.
• One or more HL 3 events have occurred, but no HL 4 or higher events.
First, calculate the HL 3 HR as described under paragraph C.3.1. Next, calculate a hazard ratio for HL 4 or higher, given that an HL 3 event has occurred (L4:L3 HR). Accomplish this by assuming the next HL 3 event will be HL 4 and calculate that value. Finally, multiply the L3 HR by the L4:L3 HR to obtain the level 4 HR ratio from the base event. For example, ten events, of which four were HL 3, and none were HL 4. Calculate L3 HR = 4:10 = 0.40. For the four HL 3 events, add one more and assume it is HL 4, = 1:5 = 0.20, L4:L3 HR. Multiply the L3 HR by the L4:L3 HR 0.4 * 0.2 = 0.08 Level 4 HR.
C.3.2.3 Analysis.
As described above, engineering analysis may allow for an accurate estimation of the hazard ratio. For example, the release of a high-energy fragment in a specific direction could impact a critical component or system, resulting in an HL 3 event. An appropriate hazard ratio could be developed based on the probability of a randomly released fragment being able to impact the critical system. There may also be instances where a failure can only release a small volume of fuel in a fire zone. If the result is a localized fire that exhausts the limited fuel source and the uncontrolled fire is not a credible outcome, it may be appropriate to assume that the hazard ratio is negligible.
C.4 Notes on Hazard Ratio Development.
Communication between the engine, propeller, APU manufacturers, installers, operators, and the FAA is often necessary, especially if no appropriate historical hazard ratio is available. Additionally, it may be necessary for the stakeholder to use engineering judgement to assess the impact of unique features of a specific powerplant or APU installation.
C-3
APPENDIX D. UNSAFE CONDITIONS D.1 Purpose.
The objective of this appendix is to provide the user with a descriptive listing of generic transport airplane powerplant and APU failure conditions that have been defined as potentially unsafe based on previous service experience or traditional assumptions, or both. This appendix is intended to be an example list based on the CAAM reports and not an inclusive or prescriptive checklist, since it may not include all the information relevant to the failure conditions of a specific transport airplane with its various functions and its intended use. This list includes estimates of the conditional probability of the severity outcome (hazard ratio) given the occurrence of the basic failure condition.
D.2 CAAM Database.
The historical data and hazard ratio tables in this appendix are based on the service data for the period 1982-2012. See the CAAM reports referenced in paragraph 1.4.5 of this AC. Later only a few more CAAM reports on specific subjects were published on the website Engines and Propellers - Data and Reports | F ederal Aviation Administration.
The CAAM reports also contain event descriptions for the particular failure condition being assessed.
D.3 Hazard Ratio Calculation.
D.3.1 Hazard ratio calculations include all higher-level events. For example, the level 3 hazard ratio also includes the HL 4 and 5 events.
D.3.2 If there have been relatively few occurrences within the database of a particular failure condition where the number of the base events is under-reported, or if no events of a given HL or higher have occurred, hazard ratios have not been listed in the following tables and marked with an “*.”
D.3.3 Separate hazard ratios are calculated for turboprop, low-bypass pressure ratio (LBPR), and high-bypass pressure ratio (HBPR) engines.
Note: Care should be taken when using any published hazard ratio to ensure that the data source is relevant to the intended application. Since the hazard ratios in this appendix have been developed using the full range of the available data, they should be considered a general guide and not a replacement for more specific guidance and assessments for a particular airplane type, environment, or operating condition. For the latest guidance on Hazard Ratio applicability, refer to the latest data and Technical Reports on Propulsion System and Auxiliary Power Unit (APU) Related Aircraft Safety Hazards, located at the web address listed in paragraph 1.4.5 (Engines and Propellers - Data and Reports | Federal Aviation Administration).
AC 39-8A Appendix D D-1
AC 39-8A Appendix D D.4 Failure Condition: Uncontained.
An uncontained failure condition is a potentially significant unsafe condition, which initiates from an uncontained release of debris from a rotating component malfunction (blade, disk, spacer, impeller, drum or spool). In order to be classified as uncontained, the debris must pass completely through the nacelle envelope. Parts that puncture the nacelle skin, but do not escape or pass completely through, are considered contained.
Fragments that pass out of the inlet or exhaust opening without passing through any structure are not uncontained Table D-1 - Uncontained Disk Hazard Ratios of Fan and Low-Pressure Compressor (LPC) Fan LPC İL3 İL4 ;L5 IL3 İL4 {L5 Total Total Events | Events HR ; Events HR : Events HR Events ; Events HR Events HR Events HR CAAM 1 (1982-1991) Turboprop NA NA NA NA NA LBPR 6 1 HBPR 4 2 2‡ * 1 CAAM 2 (1992-2000) Turboprop NA NA NA NA NA NA LBPR 2 1 1.0 HBPR 1.0 1.0 CAAM 3 (2001-2012) Turboprop NA NA NA NA NA NA NA LBPR o HBPR 1 Combined t Turboprop NA 8 0.125
0.333 1 † The data is combined here for convenience. The user should review the event descriptions and definitions in the CAAM reports for relevance to the particular issue being assessed.
D-2
AC 39-8A Appendix D Table D-2 - Uncontained Disk Hazard Ratios of High-Pressure Compressor (HPC), Intermediate Pressure Compressor (IPC), High-Pressure Turbine (HPT) and Intermediate Pressure Turbine (IPT)
HPC / IPC HPT / IPT | L3 IL4 L5 IL3 IL4 ; L5 Total Total Events | Events HR 1 Events HR : Events HR Events | Events HR Events HR Events HR CAAM 1(1982-1991) Turboprop 3 16' 2i LBPR 8 2 HBPR 4 6 1 CAAM 2 (1992-2000 Turboprop 0.33 0.33 LBPR 2 0.75 HBPR 90 : 30 0.25: 0 5: 2 0.2 : 0 * CAAM 3 (2001-2012) Turboprop LBPR 1 * * * HBPR 2 0.5 1 0.67 : 1 0.33 ;
Combined + Turboprop LBPRI 13 HBPR 15 5 † The data is combined here for convenience. The user should review the event descriptions and definitions in the CAAM reports for relevance to the particular issue being assessed.
‡ The CAAM 1 and CAAM 2 reports collected IPT blade events separately. There was one turboprop IPT blade event in each report that was combined with the HPT events.
° The CAAM 2 report collected IPC events separately. There was one high bypass turbofan L3 IPC event identified in CAAM 2 that was combined with the HPC events.
i The CAAM 1 and CAAM 2 reports collected IPT events separately. There was one L3 turboprop IPT event identified in the CAAM 1 report that was combined with HPT events.
D-3
Table D-3 - Uncontained Disk Hazard Ratios of Low-Pressure Turbine (LPT) AC 39-8A Appendix D Note: Hazard ratios were not calculated by rotor type in the CAAM 1 report and are not shown in the CAAM 1 section of the table. The CAAM 1 report did not include L5 as a classification. These events were reclassified as L5 in the original release of AC 39-8.
The CAAM 2 report collected IPC events separately. There was one high bypass turbofan L3 IPC event identified in CAAM 2 that was combined with the HPC events.
The CAAM 1 and CAAM 2 reports collected IPT events separately. There was one L3 turboprop IPT event identified in the CAAM 1 report that was combined with HPT events.
† The data is combined here for convenience. The user should review the event descriptions and definitions in the CAAM reports for relevance to the particular issue being assessed.
D-4
AC 39-8A Appendix D Table D-4 - Uncontained Blade Hazard Ratios (Fan and Platforms) Fan Platforms L3 ¡L4 : L5 IL3 IL4 :L5 Total Events | Events Events HR | Events HR Events Events HR Events HR : Events HR CAAM 1(1982-1991) Turboprop NA NA NA NA NA NA NA NA NA × 3 NA NA × З LBPR 22 2 HBPR 64 CAAM 2(1992-2000) Turboprop NA NA NA NA NA NA NA NA NA NA NA NA LBPR 6 0.333 0.333 0.333 HBPR 39 0.03 CAAM 3 (2001-2012) Turboprop NA NA NA NA NA LBPR 6 HBPRI 38 0.05 1 0.03 Combined t Turboprop NA LBPR 34 HBPRI 141 0.028 + The data is combined here for convenience. The user should review the event descriptions and definitions in the CAAM reports for relevance to the particular issue being assessed.
D-5