Change 1
• Information describing the order and method of removing and replacing parts and any precautions necessary to facilitate inspection;
• Diagram of structural access plates, or how to gain access when access plates do not exist;
• Details for utilizing special inspection techniques, including procedures for these techniques;
• Identification of fatigue critical structure;
• All data on structural fasteners, such as identification and torque values;
• List of required special tools;
• Any necessary shoring, jacking, or other special handling requirements;
• Any subsequent required inspections; and
• Instructions for notifying the FMP holder of positive and negative findings for structural elements directly related to the unsafe condition and positive findings for other fatigue critical structure. Normally, the ICA will include a form specifying all pertinent information about the finding.
(3) Order 8110.54A, Instructions for Continued Airworthiness, Responsibilities, Requirements and Contents, provides guidance about the content of an ICA or its equivalent.
The reference in paragraph 6c(5) gives direction in the preparation of maintenance data for the maintenance of general aviation airplanes, including ICA.
(4) Paragraph 11 provides guidance regarding the approval process for documenting the actions associated with an FMP.
11. Coordination and Approvals.
a. When addressing in-service issues, the FAA will approve FMPs that address the demonstrated risk and when an AD mandating an FMP is proposed or issued. The FAA may also approve an FMP as an AMOC to an AD. If approval is required, use the process explained in this paragraph.
b. When following the steps described in this AC, the applicant should communicate and coordinate with the cognizant FAA ACO and FSDO, as appropriate. These offices will coordinate with their respective Directorate and Aircraft Evaluation Group (AEG) offices when necessary. The FAA orders and ACs referenced in this paragraph describe roles and responsibilities depending on the method of approval needed for the specific application.
c. The process an applicant uses to get its FMP approved by the FAA varies according to whether the DAH or another applicant is seeking approval. The FAA encourages applicants to use the appropriately authorized designees to approve, or recommend for approval, the 24
substantiating data. Because of the detailed en gineering evaluation required to develop an FMP, the FAA will, in general, consider an FMP to be a major change to the type design (see § 21.93).
The cognizant FAA ACO should coordinate with the appropriate Directorate to verify that the proposed FMP is a major change to the type design.
(1) If the DAH is seeking approval of its FMP, it typically documents the required actions in a SB, Service Letter, or similar document. These instructions should include a section that specifies the actions needed to mitigate the demonstrated risk and those actions that address other fatigue critical structure. If the affected model has an ICA, then the DAH should revise the ICA to incorporate the FAA-approved FMP. If the affected model does not have an ICA, the DAH should create an ICA and incorporate the FMP to implement it. As a part of the design approval process, when the DAH submits an ICA to the FAA, the ACO and the AEG review the ICA in accordance with Order 8110.54A. The DAH could also use the TC process to gain FAA approval of their FMP as an STC.
(2) If the applicant is not the DAH, the applicant should apply for an STC to gain FAA approval of the FMP (see § 21.113). The STC sh ould include instructions similar to those normally contained in a DAH’s SB. These instructions, which make up an ICA, should include a section that specifies the actions needed to mitigate the demonstrated risk and those actions that address other fatigue critical structure (new STCs require an ICA as part of a design change per § 21.50(b)). As a part of the design approval proc ess, when the applicant submits an ICA to the FAA, the ACO and the AEG review the ICA in accordance with Order 8110.54A. AC 21-40A and Order 8110.4 provide policy and guidance on the STC process.
(3) See paragraph 10c(3) for discussions regarding certification basis of modifications.
The ALS of the ICA must be approved by the cognizant ACO. Appropriately authorized DERs or delegated organizations are expected to review and approve all technical aspects of the substantiating data and underlying technical changes per the applicable regulations in support of the STC process. These regulatory compliance fi ndings will be to the agreed upon certification basis. Up-front planning should be in accordance with Partnership for Safety (PSP) or Project Specific Certification Plans (PSCP) developed between the FAA and the applicant at the beginning of the STC project. See the reference in paragraph 6c(4) for information regarding PSPs and PSCPs.
d. The FAA may issue an AD to mitigate the demonstrated risk before the DAH or other applicant develops an FMP. In these cases, the applicant will submit their FMP to the cognizant ACO either as a method of compliance to the AD or as an AMOC to the AD. The ACO will evaluate the applicant’s justification and, if found acceptable, approve the FMP. Since the FAA determines if actions comply with an AD, ACO approval is the avenue toward granting a method of compliance for the AD. The manager of the cognizant ACO will grant approval to the applicant.
e. Appendix 3 contains examples of suitable AD language if the FAA decides to mandate an FMP with an AD.
Change 1
12. Implementing an FMP. Figure 3 on the next page illustrates the key elements of implementation discussed in detail below.
a. FMP Actions to Address the Demonstrated Risk.
(1) Part Replacement/Modification. Perform part replacement/modification per the instructions included in the ICA.
(2) Damage-Tolerance Based Inspections. Complete inspections per the instructions included in the ICA.
(a) If the inspections detect fatigue cracking, repair or replace the cracked part per FAA-approved repair instructions.
(b) Typically, the FAA includes instructions in the AD for operators to report to the FMP holder both negative and positive crack indications along with the time in service on the aircraft inspected. The AD may also require op erators to report positive crack indications and time in service to the FAA. In some cases, the FAA may require reporting of negative crack findings. (Appendix 3 contains ex amples of crack reporting requirements suitable for an AD.)
History of inspection results provides data to measure the success of an inspection program. The FMP holder uses reports of cracks found and their sizes, negative inspection results, and the airplane time in service to assess the inspection program effectiveness. Damage-tolerance based inspections must have a demonstrated high probability of detection so both positive and negative findings are statistically relevant to verify the inspection method is as reliable as assumed.
Report results per the instructions contained in the ICA.
(c) If the inspection program finds a crack and verifies another occurrence of the unsafe condition, the FAA will assess the overall risk to the fleet if inspections were to continue.
The inspections may continue if the FAA determines the risk level is acceptable. However, the FAA will mandate termination of the inspection program and development of a part replacement/modification program if the FAA determines continued reliance on inspections poses an unacceptable risk level. AC 91-56B contains guidance about the need for mandatory modification programs when reliance on repetitive inspections no longer provides adequate safety. The FAA uses a data-driven SMS approa ch for determining acceptable risk associated with continued reliance on repetitive inspections. SMS, as it relates to FMPs, is described in Appendix 1.
b. FMP Actions to Address Other Fatigue Critical Structure. Generally, an AD will require operators to accomplish the established inspections for other fatigue critical structure per the instructions specified in the ICA. A crack found by these inspections would require evaluation as a suspected risk of catastrophic failure due to fatigue, as described in Appendix 2.
The inspector should report positive inspection findings to the FMP holder and the FAA per the instructions contained in the ICA. Appendix 3 contains examples of suitable AD reporting requirement language for when the FAA uses an AD to mandate an FMP with crack reporting instructions.
Replace / Modify Structure (See paragraph 12a(1)) FAA Approval of FMP (See paragraph 11) FMP Component for Specific Unsafe Condition YES Report Finding and FMP Component for Other Fatigue Critical Structure Inspect Other Fatigue Critical Structure (See paragraph 12b) Report Results (See paragraph 12a(2)(b)) NO YES Report Finding and Replace / Repair Cracked Part (See paragraphs 12a(2)(a) and (b)) Replace / Repair Cracked Part (See paragraph 12b) Acceptable Risk Unacceptable Risk Determine Time in Service for Fleet Part Replacement / Modification (See paragraph 1 0c(2)) 8/23/11 AC 91-82A FIGURE 3. IMPLEMENTING AN FMP 27
Change 1
13. List of Acronyms.
a. AC. Advisory Circular
b. ACO. Aircraft Certification Office
c. AD. Airworthiness Directive
d. AEG. Aircraft Evaluation Group
e. ALS. Airworthiness Limitations Section
f. AMOC. Alternative Method of Compliance
g. CAR. Civil Air Regulation
h. CFR. Code of Federal Regulations
i. CPCP. Corrosion Prevention and Control Program
j. DAH. Design Approval Holder
k. DER. Designated Engineering Representative
l. FAA. Federal Aviation Administration
m. FMP. Fatigue Management Program
n. FSDO. Flight Standa rds District Office
o. IAR. Immediately Adopted Rule
p. ICA. Instructions for Continued Airworthiness
q. NASA. National Aeronautics and Space Administration
r. NDE. Nondestructive Evaluation
s. NTIAC. Nondestructive Testing Information Analysis Center
t. NTSB. National Transportation Safety Board
u. PMA. Part Manufacturing Approval
v. POD. Probability of Detection
w. PSCP. Project Specific Certification Plan
x. PSP. Partnership for Safety Plan 28
y. SB. Service Bulletin
z. SDR. Service Difficulty Report aa. SIP. Supplemental Inspection Program bb. SMS. Safety Management System cc. SRM. Structural Repair Manual dd. STC. Supplemental Type Certificate ee. TC. Type Certificate s/ Earl Lawrence Manager, Small Airplane Director Aircraft Certification Service 29
Appendix 1 APPENDIX 1. FATIGUE MANAGEMENT PROGRAMS (FMP) AS THEY RELATE TO
SAFETY MANAGEMENT SYSTEM (SMS) The FAA Aircraft Certification Service (AIR) SMS is the foundation for decision making in managing safety throughout an airplane model’s complete life cycle. SMS is a systematic approach to identifying hazards and managing the risks associated with those hazards.
In support of SMS, each Directorate has developed risk analysis methods and acceptable risk guidelines unique to each area of product responsibility for addressing potential unsafe conditions. If the FAA determines an unsafe cond ition exists (based largely on the risk analysis of the airworthiness concern and the product risk guidelines), the FAA will work with the design approval holder (DAH) and other interested parties to develop potential mitigating actions (called “candidate control programs” in SMS).
The FAA will evaluate candidate control programs based largely on their effectiveness of reducing risk to an acceptable safe and practical level. The FAA may also consider other factors including availability of resources and financial impact.
An FMP is a control program that addresses the long-term risk associated with fatigue in metallic structures. (The FAA often addresses the short-term risk associated with fatigue by issuing immediate airworthiness actions requiring inspections or reducing the airplane’s operating envelope.) An FMP may incorporate damage-tol erance based inspections, part replacement or modification, or a combination of these two approaches. More than one FMP can be developed to address a specific unsafe condition. The FAA will evaluate candidate FMP(s) using the appropriate product risk analysis methods and risk guidelines.
The FAA’s policy is that design changes that remove the source of the unsafe condition provide a higher level of continued operational safety over time than long-term reliance on repetitive inspections. AC 91-56B and FAA-IR-M-8040.1C, chapter 8, explain that policy. Each Directorate will use its risk analysis methods, risk guidelines, and product specific policy and guidance to determine when repetitive inspections should cease and part replacement or part modification must take place.
A1-1
Appendix 2 APPENDIX 2. INVESTIGATION OF IN-SERVICE FINDINGS
1. Summary.
The FAA may suspect an airplane type design has a risk of catastrophic failure due to fatigue when fatigue may be a causal factor to an in-service finding such as an accident, incident, or service difficulty report, or after reports of in-service findings of fatigue cracks in a flight critical structure. In an accident or inci dent, the FAA is a party to the NTSB1 led investigation of the accident or incident. For reports of in-service findings of fatigue cracks, the FAA typically works with the DAH to investigate the reports of cracking.
In both cases, the FAA works to determine whether the suspected risk is an actual demonstrated risk of catastrophic failure due to fatigue.
When the NTSB or FAA/DAH investigation finds that fatigue contributed to the accident, incident, or in-service finding, and that the unsafe condition is likely to develop on other airplanes of the same type design, the FAA may determine that a demonstrated risk exists. The FAA may then consider AD action to maintain the continued operational safety of the fleet (see § 39.5).
2. Failure Investigation.
Failure investigations should look at the evidence from a broad perspective, including the conditions and circumstances surrounding the accident or incident. If partial or complete structural fracture(s) contributed to the accident or incident, the investigator2 should determine if fatigue was a contributor and if it is likely to occur in other airplanes.
1 The NTSB is responsible for the organization, conduct, and control of all accident and incident investigations within the United States where the accident or incident involves any civil aircraft or certain public aircraft (see 49 CFR § 831.2(a)(1)). The NTSB may designate additional parties to accident or incident investigations. The NTSB limits these designated parties to those persons, government agencies, companies, and associations whose employees, functions, activities, or products were involved in the accident or incident and who can provide suitable qualified technical personnel to assist in the investigation (see 49 CFR § 831.11(a)(1)). The FAA is the only entity afforded the right to be a designated party of an NTSB accident or incident investigation.
The NTSB determines the probable cause of an accident and may also issue safety recommendations to address safety issues identified during the accident investigation. The FAA, based on the findings of the NTSB-led investigation and NTSB-issued safety recommendations, may make a determination that an unsafe condition exists and that airworthiness directive action is necessary to maintain the continued airworthiness of the airplane type.
2 “Investigator” could be someone from the NTSB, the FAA, the DAH, or an owner’s group. Typically, it is a combination of any or all of these.
A2-1
Appendix 2
a. Did fatigue contribute to failure?
The failure investigation will answer this question by considering the airplane loading at the time of the failure, usage and maintenance history of the airplane, and examining the fracture surfaces.
Accident and Incident Investigation. Airplane accidents result in many broken parts and therefore many fracture surfaces. Investigators will examine all fracture surfaces of primary structure for the mode of failure, including evidence of fatigue. An investigator can sometimes observe evidence of fatigue cracking in the field; however, a laboratory fractographic analysis should verify all potential fatigue damage sites.
Many fracture surfaces will indicate static overload resulting from the accident impact or flight loads. Examination of these fracture surfaces , including the failure direction (e.g., wing bending up or down), can assist in determining whether fatigue contributed to the failure.
Investigators will review all available airplane logs. The airplane usage and maintenance history may reveal that it was susceptible to the effects of fatigue.
Investigators will also study the conditions associated with the accident. A qualitative estimate of the loading at the time the failure occurred, as a minimum, can help determine if the airplane exceeded its design limits. Investigators will review the operating environment, including weather conditions, at the time of the failure. This information will help determine if the pilot was operating the airplane outside its design envelope or if turbulence or upset recovery maneuvers subjected the airplane to high loads. The investigator should also consider the flight phase and attitude at the time of the accident. For example, if the aircraft was in level flight in good weather, it is unlikely that the failure was due to static overload based on load considerations only.
In an incident, the fracture surfaces may not be accessible for examination. The investigator may need to rely on indications of deformation in primary load path as well as secondary load paths
(e.g., ribs and stringers). In th ese cases, the investigator may excise the fracture surfaces from the airplane so metallurgists can examine the fractures.
(Note: When the NTSB invest igates accidents or incidents, it documents all of the above information to the greatest extent possible. If structural failure is a possible cause, the NTSB’s metallurgists will thoroughly examine the fracture surfaces.)
In-Service Findings. In-service findings of failures or cracks are similar to an incident in that the fracture surfaces may not be easily accessible for examination. If the repair of the failed area removes and replaces the failed or cracked part, the investigator should obtain the removed part for examination.
Summary. Conclusively determining whether or not fatigue contributed to the failure is usually possible based on examination of fracture surfaces and consideration of the loads likely experienced during the accident sequence. If the investigation determines fatigue contributed to the accident, incident, or in-service finding, the investigation must then determine whether other airplanes in the fleet are likely to develop similar fatigue damage.
A2-2
Appendix 2
b. Is the Fatigue Cracking Scenario Likely to Occur on Other Airplanes?
If the investigation determines fatigue contributed to the accident, incident, or in-service finding, then it is important to determine if fatigue is likely to occur on other airplanes in the fleet. An investigator can answer this question by performing a detailed investigation that identifies all fatigue cracking sites in the structure, the possible cause of the cracking, and how the cracks progressed.
Site. In addition to the initial fatigue crack(s) identified, the failure investigation may find other fatigue cracking sites in the structure. This is often the case when cracking is due to normal fatigue (often called “fatigue wear-out”). For example, the general location of a failure may be the attachment of the wing at the wing root. However, signs of fatigue cracking could also exist at other locations in the same load path, such as at hole(s) in a spar cap, wing skin, or wing/stringer details. This would be an indication of fatigue wear-out and therefore likely to occur in other airplanes.
It is also possible that evidence of fatigue exists in other load paths. For example, the accident, incident, or in-service finding may involve a fatigue crack in the attachment of the wing at the wing root. However, additional fatigue cracks ma y exist in other wing fittings further outboard, in the horizontal tail, or control surface attachments.
Identification of all sites of fatigue cracking can help determine the likely scenario that caused the cracking.
Scenario. An effort should be made to determin e if there is any correlation between the fatigue cracking sites and the most fatigue critical area on the component under investigation.
This requires some knowledge of relative gross area stress levels and physical details of the type design. If the observed cracks are in areas of high gross or local stress, it would be reasonable to expect that similar cracking would eventually occur in other airplanes in the fleet.
Anomalies. The investigator should evaluate the fatigue cracking sites to determine if they contain signs of physical anomalies not expected to occur in the rest of the fleet. These anomalies could be significant manufacturing or service-induced defects exceeding what would be expected or allowed to exist normally. One indication of an anomaly might be if the fatiguecracking site is in an area of relatively low stress while there are no sites identified in more highly stressed areas. If this is the case, the inspector should carefully examine the site(s) for evidence of tool marks, corrosion, accidental damage or other distress that could have precipitated the apparent premature cracking.
If corrosion is a likely causal factor, the investigation should determine if there are environmental conditions unique to this airplane. SDRs should be searched for other similar occurrences. If a CPCP exists, it should be reviewed. AC 43-4A, Corrosion Control for Aircraft, is a good source for information regarding corrosion prevention, detection, and control.
On occasion, fatigue cracking occurs in one airplane of a fleet due to an anomaly. If demonstrated that the site and scenario observed are unique to the accident or incident airplane, there would be no need to develop a fleet wide FMP. However, the demonstration should include data from a survey of part or all of the fleet to validate the uniqueness of the condition A2-3
Appendix 2 observed. The survey should include an SDR sear ch for other reported occurrences of cracking.
Reports of similar cracking on other aircraft could confirm likelihood. However, you should not conclude that cracking is unlikely because of a lack of reports. Experience shows that in many cases cracking incidents go unreported. (Often re pairs are made to cracked structure using the DAH published SRM or standard repair procedures per AC 43.13-1B. Although the damage causing the repair should be reported, it is often not.)
Summary. Historically, fatigue cracking found in service or test is later found in other airplanes in the fleet. Although si ngular fatigue cracking events do occur, they are rare. In making the final determination of whether or not the cracking is likely to occur in other airplanes, one should err on the side of caution. In most cases, discovery of fatigue cracking in an airplane identifies a fatigue critical detail in the basic type design. When this occurs, one should not ignore the warning.
3. FAA Determination of Demonstrated Risk.
The investigation may find fatigue cracking did not contribute or was a singular event not likely to occur in other airplanes of the same type design. In this case, a demonstrated risk due to fatigue does not exist.
If the investigation finds that fatigue cracking contributed to the accident, incident, or in-service finding, and it is likely to exist or develop in other airplanes of the same type design, the FAA would analyze the risk per accountable directorate risk analysis guidelines to determine if a demonstrated risk exists. If a demonstrated risk exists, the FAA would consider issuing an AD requiring mandatory actions to maintain the continued operational safety of the affected fleet.
These actions would be included in an FMP to mitigate the demonstrated risk and proactively address the broader risk posed by other fatigue critical structure.
In some instances, the FAA will issue an AD mandating initial, short-term actions to provide short-term mitigation of the demonstrated risk and allow the fleet to return to service. These short-term actions often include operating limitations or immediate and short-interval inspections. The FAA often issues these short- term actions as emergency ADs or IAR ADs.
Information learned from these short-term actions, including inspection results, will help the FAA and the applicant to determine a long-term or permanent solution to mitigate the demonstrated risk.
Designers commonly use an exact or similar design detail (e.g., skin splice) previously used on a prior type design for a subsequent type design. For example, when a design detail is simply scaled up or down dimensionally to accommodate higher or lower loads respectively without changing materials. When this is done, it is a common practice for the applicant to demonstrate compliance with the same analysis and test results they used to demonstrate compliance for the prior type design. If the FAA determines the original design detail and its derivative are sufficiently similar, no further showing is required. Consistent with this practice, if the FAA determines a demonstrated risk exists for a design detail for one type design, it may also determine a demonstrated risk exists for other type designs based on the similarity of the design detail. Consequently, ADs would be issued for all those type designs.
A2-4
Appendix 3 APPENDIX 3. AIRWORTHINESS DIRECTIVES WORDING EXAMPLES FOR
FATIGUE MANAGEMENT PROGRAMS
1. Summary.
FMPs are essential to continued airworthiness when the FAA identifies an unsafe condition due to fatigue. When the FAA determines a demonstr ated risk exists and an FMP is necessary, the FAA will work with the design approval holder or other applicant to determine the appropriate scope of the FMP and necessary steps to execute it properly.
The FAA is also responsible to mandate necessary actions with an AD. Because an AD is a rule change, the FAA requires specific language to meet certain legal standards. The following paragraphs are examples of wording that can be inserted into an AD when the specific actions are necessary.
2. Fatigue Management Programs.
When the FAA determines an FMP is necessary to mitigate an unsafe condition, the following language is suitable for stating the necessary AD action:
Within (insert appropriate length of time) months after the effective date of this AD, do the specified actions at the times identified in the FMP approved specifically for this AD by the Manager, (insert name of authorizing ACO), FAA.
Note: Guidance for developing an FMP that the FAA may approve can be found in FAA Advisory Circular 91-82A, Fatigue Management Programs for In-Service Issues. You may find this document at:
http://www.faa.gov/regulations_policies/advisory_circulars/index.cfm/go/document.list/p arentTopicID/129.
In some cases, an AD may specify interim actions until an FMP is approved or they are specified in a separate AD. In that case, the following additional language is suitable:
Accomplishment of an FMP approved specifically for this AD by the Manager, (insert name of authorizing ACO), FAA, terminates the requirements of (insert paragraphs that contain interim action requirements, or AD number that specifies those actions).
The above examples are worded in a general nature. For any application, the FAA ACO engineer should work with the AD writers and legal counsel to ensure necessary actions are clearly described and achievable.
3. Inspection Reporting Requirements.
This AC explains the importance of reporting cracks found as a result of an FMP’s inspection program. It states inspection results should be reported to the holder of the approved FMP. All cracks found may also be reported to the FAA. If the FAA mandates an FMP with an AD, include crack-reporting instructions in the AD. The following AD language is suitable for stating the information to report when a crack is found:
A3-1