AC 39-8A Appendix E
APPENDIX E. RISK ASSESSMENT EXAMPLE E.1
E.2
E.2.1
E.2.2
Purpose.
The objective of this appendix is to provide a detailed step-by-step example of the risk assessment process detailed in this AC, taking the reader through a typical fictitious service problem scenario from identification to resolution.
Example – Compressor Disk Fracture.
An 8th stage compressor disk installed in a low-bypass turbofan engine fractures during the takeoff roll. The fracture occurs before V1, and the takeoff is safely aborted. The fractured disk had accumulated 12,508 cycles in service prior to the fracture. The fracture is uncontained but does not cause any damage to the airplane or injury to any passenger or crew. Control is maintained at all times and the airplane stops on the runway. Failure investigation reveals the disk fractured in low-cycle fatigue due to corrosion. The investigation further indicates the corrosion occurred because the failed part had not been properly coated during manufacture. The problem is identified and corrected in production; however, the risk posed by other improperly coated parts in service must be assessed.
Estimate the number of airplanes exposed.
Initial evaluation of the extent of the problem detects no known manufacturing process changes that might have accounted for the coating problem. However, this part number disk is processed at a dedicated coating facility (i.e., the facility produces only this part), and while all disks of this part number are potentially at risk, the problem is not considered to extend to other part numbers (no evidence of any problems with the parts produced by other facilities). Four hundred and thirty-three (433) disks (including spares) of the suspect part number are currently in service and are considered to be at risk of a repeat event. There are another 36 disks that have been retired.
Perform a Weibull Analysis.
The engine manufacturer immediately performs a Weibull analysis using a typical fatigue wear out slope against the total population of disks (433+36) to establish the disk life distribution (Note: It is acceptable to use uninspected disks that are known not to have failed for a failure life distribution, but not for time to crack, which requires a known inspection result). This life distribution is then used to predict the future risk of disks still in service as an input to a simulation. The simulation runs a computer model of the current fleet forward in time. This simulation model predicts 1.3 additional disk fractures if all current parts are allowed to remain in service until their certified retirement life (15,000 cycles). Calibration of this risk model, by backing up the simulation to the start of service and running the fleet model to the present, gives a prediction of 0.95 events to date, versus one occurred, which is judged to be indicative of a valid model.
E-1
AC 39-8A Appendix E E.2.3 Estimate the uncorrected risk and risk per flight.
This event did not result in serious injury or other HL 4 or 5 events. Historical data available at the time on similar disk fractures indicated a record of 13 disk fractures.
Nine of the 13 (69 percent: 9/13) resulted in HL 3 or higher severity level events. Four of the 13 events (30 percent: 4/13) resulted in hull loss or fatality (HL 4 or higher severity level event) due to on-ground fire; one of the 13 events (8 percent: 1/13) was also HL 5 (hull loss/multiple fatalities). Coordination with the airplane manufacturer indicates that, for this installation, use of the historical CAAM data would be appropriate. Structural review by the engine manufacturer predicts that fracture of this 8th stage disk would be expected to result in non-containment 100 percent of the time.
Since 1.3 events are predicted and 30 percent of those would be expected to result in an HL 4 event, 0.39 HL 4 events would be expected if no action is taken (1.3 x 0.30 =
0.39), and 0.1 (1.3 x 0.08 = 0.1) HL 5 events. There are two at-risk engines per airplane and the 433 disks have an average of 5000 cycles remaining until retirement. Therefore, the average per-flight risk of an HL 4 (or higher) event if no action is taken is 3.6 x 10 -7 [0.39 / (433 disks x 5000 cycles/disk / 2 cycles per flight*) = 3.6 x 10 -7]. Note that the spare disks are included in the analysis. While these HL 4 risks are clearly in the region where action must be taken, the per-flight risk is below the guideline for immediate action (4x10 -6 per-flight for HL 4 events), so the disks are allowed to remain in service while an inspection and replacement plan is developed. HL 3 events are also calculated:
there are 0.90 level 3 (or higher) events predicted (1.3 events x 0.69 at least level 3 =
0.90), with a per-flight risk of 8.3x10 -7 [0.90 / (433 disks x 5000 cycles/disk / 2 cycles per flight*) = 8.3 x 10 -7].
* Two engines per airplane, each engine experiencing one cycle per flight.
E.2.4 Estimate the effects of candidate actions.
Over the next few weeks, while a plan is being developed, many retired disks are located and inspected, along with several disks in engines currently undergoing scheduled shop visits. One disk is found to have a crack resulting from a corrosion pit.
These inspection findings, along with structural modeling by the engine manufacturer, allow for a more refined quantitative analysis, including initiation and propagation distributions. The Monte Carlo simulation is revised and is performed against many inspection and replacement scenarios to find one that acceptably mitigates the risk of serious injury. The engine manufacturer submits a plan to the FAA. The manufacturer’s proposed plan calls for the replacement of the disks at next shop visit, with engines above a part life of 10,000 cycles to be removed no later than within the next 2,000 cycles. The simulation predicts that this plan would result in 0.18 uncontained events of which 0.12 would be at least level 3 (0.69 level 3 x 0.18 = 0.12), 0.05 would be HL 4
(0.30 HL 4 x 0.18 events = 0.05), and .01 would be level 5 (0.08 level 5 x 0.18 events =
0.01). Both the HLs 3 and 4 predictions are below the risk guidelines outlined in table 1 in paragraph 4.1.2. The HL 5 risk is well controlled within HL 4 exposure. This plan calls for an aggressive production schedule of replacement disks. Shop visit capacity will also be strained but is expected to be capable of meeting the increase in inducted engines with only minor schedule disruptions. The engine manufacturer issues a service bulletin recommending disk replacement to the above schedule.
E-2
AC 39-8A Appendix E E.2.5 Implement and monitor corrective action plan.
The FAA reviews the assumptions and results of the risk analysis and issues a notice of proposed rulemaking, followed by a final rule after notice, to mandate the engine manufacturer’s service bulletin. Disks are inspected as they are replaced, with the results compared at regular intervals to the month-by-month predicted crack findings from the Monte Carlo simulation. Subsequent inspection findings indicate the initial risk analysis is somewhat conservative. However, both the engine manufacturer and the FAA believe that no alleviation of the disk replacement schedule should be pursued due to the potential seriousness of another event. After nine months, the FAA also requests a comparison of the actual shop visit (disk replacement) rate with the predictions from the risk analysis. The actual rate is found to be within two percent of the predicted rate, so no additional action is taken. After 4.5 years, the last of the suspect disks are replaced.
No additional events have occurred during that period.
E-3
: :
Date AC 39-8A Appendix E Advisory Circular Feedback Form OMB Control Number: 2120-0746 Expiration Date: 12/31/2027 Paperwork Reduction Act Burden Statement: A federal a gency may not c onduct or sponsor, and a person is not required to respond to, nor shall a person be subject to a penalty for failure to comply with a collection of information subject to the requirements of the Paperwork Reduction Act unless that collection of information displays a currently valid OMB Control Number. The OMB Control Number for this information collection is 2120-0746. Public reporting for this collection of information is estimated to be approximately 20 minutes per response, including the time for reviewing instructions, searching existing data sources, gathering, and maintaining the data needed, completing, and reviewing the collection of information.
All responses to this collection of information are voluntary. Send comments regarding this burden estimate or any other aspect of this collection of information, including suggestions for reducing this burden to: Information Collection Clearance Officer, Federal Aviation Administration, 10101 Hillwood Parkway, Fort Worth, TX 76177-1524.
If you find an error in this Advisory Circular, have recommendations for improving it, or have suggestions for new items/subjects to be added, you may let us know by emailing this form to 9- avs-air-directives-management-officer@faa.gov.
Continued Airworthiness Assessment Methodologies of Powerplant and Subject: Auxiliary Power Unit Installations on Transport Category Airplanes Date:
Mark all appropriate line items:
An error (p rocedural or typographical) has been noted in paragraph on page Recommend pa ragraph on page be changed as follows:
.
In a fu tur (Briefly d e change to this AC, please cover the following subject:
escribe what you want added.)
Other comments:
I would like to discuss the above. Please contact me using the information below.
Submitted by FAA 1320-73 (01/25) SUPERSEDES PREVIOUS EDITIONS