Continued Airworthiness Assessments of Powerplant and Auxiliary Power Unit Installations of Transport Category Airplanes

9/8/03 AC 39-8 Appendix 1 POTENTIAL UNSAFE CONDITIONS 1. PURPOSE. The objective of this appendix is to provide the user with an overview of potentially unsafe conditions. Issuance of an Airworthiness Directive (AD), in accordance with Part 39, requires that an unsafe condition exist in a product, and the condition is likely to exist or develop in other products of the same type design. This appendix presents material that can be used in reviewing actual or potential problems to determine if they should be identified as unsafe conditions. Unsafe conditions may result from design, manufacturing, operational or maintenance deficiencies as well as unforeseen changes in operations or the operating environment.

2. IDENTIFICATION OF POTENTIAL UNSAFE CONDITIONS.

a. There are at least three areas of information that can be used as a guide in identifying potential unsafe conditions. The first, and most visible, are the conditions which alone or in combination with other contributing factors have led to accidents. Such conditions or combinations have clearly been demonstrated to be unsafe. The second includes conditions that have significantly increased the probability of, but not directly caused, serious injuries. If such “contributing conditions” occur frequently enough, this too is an unsafe condition. In fact, the majority of ADs are intended to correct this type of unsafe condition. The third area of information involves hazards identified as part of the product’s certification program.

Indications that the actual experience is worse than that allowed by the standards may require mitigating action to return the product to the level of safety required by the certification standards.

b. It is normal for the achieved level of safety of a product to vary throughout the lifetime of the fleet. This variation may result in some failure conditions occurring more frequently than permitted by initial certification requirements, in which case it is possible, but not necessarily the case, that an unsafe condition exists. If the risk to the airplane, passengers or crew is very much greater than permitted by initial certification standards, an unsafe condition is likely to exist.

Some assessment of the degree of risk is therefore advisable if the failure condition rates significantly exceed those assumed or intended in the initial certification.

c. Recognizing the size and complexity of today’s worldwide air transportation system, it would be unusual for an identified unsafe condition to be limited to a single airplane or engine.

Examples of singular events where AD action would not be expected are those caused by gross negligence or a rare meteorological phenomenon.

A1-1 AC 39-8 9/8/03 d. Conditions specified as potentially unsafe . For transport category airplanes, the FAA has defined certain specific conditions as potentially unsafe based upon previous service experience and relevant certification assessments: (1) Historical potentially unsafe conditions . Appendix 8 of this AC contains a list of conditions considered to be potentially unsafe, along with hazard ratios where they could be calculated. Historical hazard ratio data is also contained for certain conditions in the “Technical Report on Propulsion System and APU-Related Aircraft Safety Hazards” (FAA Related nd Reference (1) in paragraph 2b in the main body of this AC). The proposed “2 Technical Report on Propulsion System and Auxiliary Power Unit (APU) Related Aircraft Safety Hazards” (see paragraph 5a in the main body of this AC) will contain a fuller descriptive listing of the events covered in appendix 8.

(2) Potential unsafe conditions identified during certification assessments . Certification assessments often identify and classify failure and operating conditions according to the severity of the impacts they are expected to have on the continued operational safety of the airplane.

Very severe conditions are assigned to categories such as “catastrophic”, “preventing continued safe flight and landing”, or “critical” because of their potential to directly cause serious injuries to multiple persons. Severe conditions are assigned to categories such as “emergency” or “hazardous” because of their potential to either directly cause serious injuries to a limited number of persons or to impair the ability of the flightcrew to perform their tasks. Therefore, the occurrence of any of these conditions in service is by definition a potential unsafe condition regardless of the actual outcome. More moderate conditions are assigned to categories such as “abnormal” or “major”. The occurrence of any moderate conditions in service at a high frequency may be considered a potential unsafe condition if a reasonable potential exists for it to contribute to a more serious event.

3. CATEGORIES OF FAILURES LEADING TO POTENTIAL UNSAFE CONDITIONS.

a. Single failures . The type certification regulations limit the severity and frequency of single failures. Single failures that could result in a serious injury but are not expected to result in serious injuries to multiple persons are allowed by the regulations provided the frequency of occurrence is sufficiently low. Most single failures that could result in serious injuries to multiple persons are prohibited by the regulations. However, prohibition of certain single failures is currently impracticable. These include uncontained engine rotor failure, engine case burst, engine case burnthrough, and propeller separations. For these noted exceptions, the regulations require that the hazards be minimized. When these failures or their precursors occur (e.g., a flaw is detected in a disk before the disk actually fails), the design of the component or engine is carefully reviewed to determine cause, and appropriate action is developed, as necessary, to ensure that the occurrence of similar future events is minimized. The results of the A1-2 9/8/03 AC 39-8 investigation may require AD action to implement more effective monitoring or improved component inspections, shorter component life limits, improved maintenance procedures, or other means to minimize a reoccurrence. In addition, the design of the airplane is reviewed to ensure that the design covers the likelihood that these failures may continue to occur, and the installation incorporates design considerations to minimize the impact of these failures on the airplane.

b. Latent failures . Latent failures are failures that are unknown to the flight and maintenance crews. Certification requirements assume that any expected latent failure, in combination with the next failure, under any operating and environmental conditions approved for the airplane, should not jeopardize continued safe flight and landing. A simple example is undetected loss of fire containment in a fire zone. If the next failure releases flammable fluid into the zone, a potentially catastrophic condition exists. While the intent is that such latent failure conditions not exist, there are, as a practical matter, limitations on how frequently the operators can perform inspections on the powerplant and APU installations to note and correct such conditions. This is particularly true when such inspections require some degree of disassembly, or otherwise expose components to potential distress or human error. Where automated monitoring and indication is practical, this should be used to detect and annunciate failure conditions, especially when the next failure could lead to hazardous or catastrophic consequences. The intent is for the components of the powerplant and APU installations to continue to operate safely between normal inspections and overhauls. The intent of the inspection is not so much to discover the latent failure, but, rather, to note the proper functioning of the equipment and any safe limits of deterioration, so that the equipment can be replaced before any significant failure or malfunction occurs. An additional concern are those latent failures which were either not anticipated at all or were expected to be detectable by either the flight or maintenance crews.

c. Cascading failures: (1) Cascading failures are those for which the probability of occurrence of a subsequent failure is substantially increased by the existence of a previous failure. These types of failures are of particular concern because they can create interdependence between structural and system design elements that are intended or assumed to be independent, or even unrelated. This is especially true when the intended means of safely accommodating a failure is affected by that failure. For example, in the structural design area, the failure of one load path should not result in loads that compromise the intended redundancy. Another example is that engine failures, such as fan blade failures, that result in a high vibration condition should not cause loss of the fuel shutoff function. A cascading failure of this sort could lead to a hazardous or catastrophic condition.

A1-3 AC 39-8 9/8/03 (2) Cascading failures in the propulsion systems area can sometimes be difficult to anticipate. In transport aircraft, failures in the systems of one engine are typically required to be independent of failures in the systems of another engine. Furthermore, a system of one engine may need to be isolated from the effects of failures within another system of that same engine.

Engine systems areas where cascading failures are most likely to be of concern are the engine control systems and fuel systems.

d. Multiple failures and probability estimates.

(1) In general, the powerplant and APU installations are required to be fail-safe. That is, one assumes the failure and then ensures the resulting failure condition does not jeopardize continued safe flight and landing. For example, the shutdown of a single engine is assumed to be fail-safe since transport category airplanes have multiple engines and are certified to operate safely following the sudden failure of the most critical engine. Though combinations of failure conditions leading to violation of the fail-safe assumption are possible, the consideration of such combinations should, as a practical matter, be limited to those conditions anticipated to occur within the fleet life of the airplane type. To make such determinations, the safety assessment methods associated with § 25.1309(b) are often used. Two examples of such situations are uncontrolled engine overspeed and an adverse frequency of engine shutdowns. It is usually agreed that the first of these is a potential unsafe condition because the engine may liberate parts that could hazard the aircraft. For overspeed, the requirement for engine control system certification is that no single failure cause such a condition, and that the probability of such a -8 condition being caused by multiple failures be less than 10 per flight hour (i.e., extremely remote).

(2) The second example requires attention because it is recognized that if the engine shutdowns begin occurring at an abnormally high rate, from the same or different failure conditions, the likelihood of multiple independent engine failures should be addressed. Engine -4 shutdown rates below 2x10 failures per cycle should not be a cause for concern (note that other values may be listed elsewhere on a per-flight-hour basis; for example, ETOPs). In any case, if an anticipated failure or malfunction can significantly affect the continued safe operation of more that one engine within a given flight, a potential unsafe condition exists. Typically, business decisions to provide engine reliability improvements provide adequate protection against excessive IFSD rate concerns.

(3) In addition, it should be recognized that certain engine anomalies during critical flight regimes have, on occasion, resulted in accidents due to lack of recognition or appropriate A1-4 9/8/03 AC 39-8 response to a single engine failure, especially in cases of very startling or very subtle failures.

Excessive exposure to these events raises the possibility of an inappropriate response. Care should be taken in situations where certification assumptions of appropriate responses, and the timing of those responses, have been repeatedly called into question.

e. Common mode failures . This term refers to multiple otherwise independent failures occurring due to the same event. This type of failure differs from “cascading failures” in that the multiple failures occur in parallel rather than in series. That is, the same event causes each failure independently rather than the first failure causing the second, and so on. The most frequently encountered common mode threats are those associated with environmental conditions and human error. Environmental factors include heavy rain and hail, icing, bird ingestion, etc. Human-caused common failures include fuel contamination or mismanagement, procedural deviations, and maintenance errors. There are no regulations specifying that any engine-related maintenance be conducted on only one engine at a time. For example, prior to long flights, it is common to service engine oil in all engines. Some cases are probably unavoidable. However, it should be recognized that there are many instances of multiple engine shutdown due to common cause maintenance error (e.g., chip detector reinstall, O-ring removal, etc.) leading to unsafe conditions.

A1-5

AC 39-8 9/8/03 Appendix 2 CAAM EVENT HAZARD LEVELS AND DEFINITIONS 1. PURPOSE . This appendix outlines propulsion system malfunctions or related incidents, in certain cases coupled with crew error or other aircraft system malfunctions, resulting in the following consequences to the aircraft or its passengers/crew.

2. CAAM LEVELS.

LEVEL 5 - CATASTROPHIC CONSEQUENCES .

Catastrophic outcome (reference Catastrophe as defined by draft AC 25.1309-B) - an occurrence resulting in multiple fatalities, usually with the loss of the airplane.

LEVEL 4 - SEVERE CONSEQUENCES .

a. Forced landing. Forced landing is defined as the inability to continue flight due to the consequences of damage, uncontrolled fire or thrust loss where imminent landing is obvious but aircraft controllability is not necessarily lost (i.e., total power loss due to fuel exhaustion will result in a "forced landing”). The term "emergency landing" may also be used to mean a forced landing if there is an urgent requirement to land, but declaration of an emergency does not necessarily imply that a forced landing is imminent. An air turn back or diversion due to a malfunction is not a forced landing, since there is a lack of urgency and the crew has the ability to select where they will perform the landing. However, off-airport landings are almost always forced landings.

b. Actual loss (hull loss) of aircraft (as opposed to economic) while occupants were on board.

c. Serious injuries or fatalities. The NTSB definition of "serious injury" means any injury that: (1) Requires hospitalization for more than 48 hours, commencing within seven days from the date the injury was received, A2-1 9/8/03 AC 39-8 (2) results in the fracture of any bone (except simple fractures of fingers, toes or nose), (3) involves lacerations that cause severe hemorrhages, nerve, muscle or tendon damage, (4) involves injury to any internal organ, or (5) involves second or third degree burns or any burns affecting more than five percent of the body surface, and (6) "fatal injury" is defined as an injury that results in death within 30 days of the accident.

Note 1 : The level 4 risk guidelines are intended to cover exposures to the most severe of “serious injuries” (i.e., life-threatening injuries). Consequently, relaxation of these guidelines may be acceptable in cases where the associated “serious injuries” are clearly not life threatening (e.g., simple fractures).

Note 2 : Injuries resulting from an emergency evacuation rather than from the event which caused the evacuation are not considered in evaluating the severity of the event. It is recognized that emergency evacuations by means of the slides can result in injuries without regard to the kind of event precipitating the evacuation.

LEVEL 3 - SERIOUS CONSEQUENCES.

a. Substantial damage to the aircraft or second unrelated system.

(1) "Substantial damage" in this context means damage or structural failure that adversely affects the limit loads capability of a Primary Structural Element or the performance or flight characteristics of the aircraft, and that would normally require major repair or replacement of the affected components. Typically not considered “substantial damage” (because they do not generally result in the effects delineated above) are: • engine failure damage limited to the engine or its mounts, • bent fairings or cowlings, • dented skin, • small puncture holes in the skin or fabric, • damage to landing gear associated with runway departures, • wheel, tires, • flaps, A2-2 AC 39-8 9/8/03 • engine accessories on failed engine, • brakes or • wing tips.

(2) Damage to a second unrelated system must impact the ability to continue safe flight and landing. Coordination and agreement between the engine/propeller/APU manufacturer and the airframe manufacturer may be required to properly categorize events related to second system damage. In general, aircraft are designed to be dispatched with one part of a redundant system inoperative with no effect on flight safety. Therefore, an uncontained rotor event which severed an unrelated hydraulic system line without significantly degrading the ability to continue safe flight should not be considered a level 3a event.

(3) Small penetrations of aircraft fuel lines or aircraft fuel tanks, where the combined penetration areas exceed two square inches, is a level 3a classification (The concern is exhaustion of fuel reserves.) Assistance of the airframe manufacturer should be sought when questions arise.

(4) Damage to a second engine that results in a significant loss of thrust or an operational problem requiring pilot action to reduce power is a level 3a event. Minor damage which was not observed by the crew during flight and which did not affect the ability of the engine to continue safe operation for the rest of the flight is should not be considered a level 3a event.

b. Uncontained (uncontrolled) fires. Fire outside the fire zone is level 3. The concern is impinging flames onto the wing/fuselage or acting as an ignition source for flammable material anticipated to be present. Localized fires with very limited fuel sources (such as gearbox and IDG fires) may exit the fire zone in locations remote from the wing, fuselage and airplane structure or flammable material anticipated to be present and thus not be deemed level 3 since they do not present the above concern. Fires inside the fire zone are not level 3 unless they escape.

c. Rapid depressurization of the cabin.

d. Permanent loss of thrust or power greater than one propulsion system (inflight).

e. Temporary or permanent inability to climb and fly 1000 feet above terrain (increased threat from terrain, inclement weather, etc.) along the intended route that results in restricted A2-3 9/8/03 AC 39-8 capability (i.e., multiple propulsion system malfunctions or single propulsion system malfunctions and/or other aircraft system malfunction or crew error.)

f. Any temporary or permanent impairment of aircraft controllability caused by, for instance, propulsion system malfunction, thrust reverser inflight deployment, propeller control malfunction, or propulsion system malfunction coupled with aircraft control system malfunction, abnormal aircraft vibration, or crew error.

g. Malfunctions or failures that result in smoke or other fumes, delivered through the ECS system, that result in a serious impairment. Serious impairment includes the loss of crew’s ability to see flight deck instrumentation or perform expected flight duties. Purely psychological aspects of the concern of odors, etc., are not to be included, nor are concerns about long-term exposure.

3. LOWER HAZARD LEVELS.

A means to differentiate between CAAM hazard levels 0, 1 and 2, as delineated within the “Technical Report on Propulsion System and APU-Related Aircraft Safety Hazards” (FAA Related Reference (1) in paragraph 2b in the main body of this AC), is not necessary for the purposes of this AC. Consequently, the FAA EPD and TAD have not attempted to reach agreement on or include these definitions in this AC.

4. GENERAL NOTES APPLICABLE TO ALL EVENT HAZARD LEVELS.

a. The severity of aircraft damage is based on the consequences and damage that actually occurred.

b. Uncontained event damage definitions have been modified from those used in Society of Automotive Engineers Aerospace Information Reports (AIR 1537, AIR 4003, and AIR 4770) with respect to a level 3 secondary system damage event. The objective has been to more clearly define and separate those events that had a major impact on continued safe flight and landing from those with lesser consequences.

c. These definitions have been revised slightly from the original CAAM data report (FAA Related Reference (1) in paragraph 2b of this AC) to reflect the activity associated with the planned updated report.

A2-4

AC 39-8 9/8/03 Appendix 3 HAZARD RATIO DEVELOPMENT 1. PURPOSE. This appendix describes methodologies to estimate the hazard ratio for use in risk assessments.

2. GENERAL. The hazard ratio converts the basic event risk factor to a risk factor for CAAM levels 3, 4, and/or 5 events. It does this by estimating the conditional probability of a 3, 4, and/or 5 CAAM level event given the occurrence of the basic event. Developing a hazard ratio will require considerable engineering judgment. The hazard ratio strongly influences the quantitative assessment results and, therefore, should have a sufficient validation basis or be assessed conservatively. Hazard levels are used for CAAM levels 3, 4 and/or 5, as is appropriate, to establish the appropriate comparison of the risk of the unsafe condition to the CAAM guidelines.

3. HAZARD RATIO DEVELOPMENT. The following methods should be employed to establish the hazard ratio for a given CAAM level (X): a. At least one level X or higher event has occurred.

(1) Data. When at least one level X or higher event has occurred, use the value obtained by dividing the number of level X or higher events by the total number of events. If the latest event used in the calculation was not level X or higher, add one additional level X event, and one additional event to the totals (e.g., 1:4 becomes 2:5). The addition of another event is to provide an element of conservatism for the true value of the hazard ratio as estimated by the data to date.

Alternatively, use the ratio obtained by counting only the events up to and including the most- recent level X event. For example, a history of 6 events, in the sequence 0 0 X 0 0 0, would result in a level X hazard ratio of 1:3 at the time the last level X occurred as opposed to assuming an additional event for a hazard ratio of 2:7. This method may be used when it produces a more conservative result (as in the example above).

(2) Analysis . If analysis suggests the true hazard ratio, that ratio may be used. For example - for a particular airplane, a propeller blade will pass through the fuselage if it is o released within a 90 arc. The hazard ratio (assuming level 4 for serious injury to passengers o o seated in the plane of the propeller) would then be 90 /360 =0.25 level 4 events given a blade A3-1 9/8/03 AC 39-8 release. This method has particular value where little data exists. Note that when the hazard ratio obtained by analysis is significantly different than what would be calculated from the observed data, it is strongly suggested that the observed data be used to establish the hazard ratio.

a. No level X or higher events have occurred.

(1) Historical data . Appendix 8 of this AC and the “Technical Report on Propulsion System and APU-Related Aircraft Safety Hazards” (FAA Related Reference (1) in paragraph 2b of this AC) provide hazard ratios for CAAM levels 3, 4 and (in the case of appendix 8) 5 events.

These historical hazard ratios should be used cautiously. The hazard ratio is installation dependent, and the historical hazard ratio may be skewed by the historical data available for the affected aircraft installation. Reading the summaries of the events from which the hazard ratios were developed will provide valuable insight into the applicability of the data. (Note that nd appendix 8 does not contain event summaries; however, the “2 Technical Report” will contain those summaries when it is published.) Some examples of the installation dependency of the hazard ratio are supplied here for illustration: (A) Engine separation. There are a large number of examples of engine separation in flight on older aircraft without adverse effects upon airplane control. More recent designs of aircraft, although designed with the same intent of allowing safe separation, have encountered difficulties after the separation of high bypass ratio engines. Separation of a wing-mounted engine may have very different consequences than separation of a tail-mounted engine.

(B) Uncontained rotor. The potential effect of an uncontained rotor depends largely upon the airplane systems in the plane of the rotor and their proximity to the engines. The effects may be very different for a wing-mounted installation and a fuselage-mounted installation.

(2) Next event assumption. Where no level X or higher event has occurred, and no industry-wide data are available or suitable, a conservative hazard ratio may be established by assuming the next event would be level X or higher (e.g., 0:4 becomes 1:5). There may be cases where this method is overly conservative.

(3) Analysis . As described above, engineering analysis may allow for accurate estimation of the hazard ratio.

A3-2 AC 39-8 9/8/03 4. NOTES ON HAZARD RATIO DEVELOPMENT. Communication between the engine/propeller/APU manufacturer, installer, operators and the FAA is often necessary, especially if no appropriate historical hazard ratio is available. Additionally, it may be necessary to use engineering judgment to assess the impact of unique features of a specific powerplant or APU installation.

5. USE OF THE HAZARD RATIO. Use of the hazard ratio allows the conversion of the base level event to the CAAM level event. For example, if, using the methods outlined above, the level 3 hazard ratio is estimated at 2/6 (.33), the risk factor for the base event can be converted to a risk factor for level 3 events by multiplying the base event risk factor by the hazard ratio.

A3-3 9/8/03 AC 39-8 Appendix 4 AIRWORTHINESS INFORMATION RESOURCES 1. PURPOSE. This appendix provides a brief description of some airworthiness information resources that may be of use in supporting continued airworthiness assessments. More complete data may be available from the manufacturer. The types of information resources chosen depend on the depth and scope of the required analysis, which in turn is based on the type, frequency and severity of the unsafe condition.

2. REPORTING OF AIRWORTHINESS INFORMATION.

a. Airworthiness information is available in many forms from many sources. Such information is provided to the FAA by the manufacturers, operators, and design approval holders of products in response to either routine reporting requirements (e.g., §§ 21.3, 121.703, 121.705, special agreements with manufacturers, bilateral reporting agreements with foreign authorities, etc.), or special airworthiness information requests made under the authority of section 44709 of Title 49 US Code (49 USC 44709). Safety recommendations issued by the NTSB and the FAA Office of Accident Investigation provide information on the airworthiness of powerplant and APU installations. Additional sources of information on the airworthiness of a product are frequently contained in documents (service bulletins, service letters, changes to flight or operations manuals) developed by the manufacturers. In addition, airworthiness information can be acquired by the FAA from technical committees, research programs, databases, etc.

b. Regular reporting . Sections 21.3, 121.703, and 121.705 mandate reporting of various service information. These reports should be reviewed to identify any existing or potential unsafe conditions. Additionally, the occurrence rate of any reported type of event, whether or not it is expected to individually result in an unsafe condition, should be monitored to ensure it does not unacceptably contribute to the risk of an unsafe condition. For example, § 21.3(c)(10) requires the reporting of all engine failures. The rate of engine failures should be tracked to ensure that the risk of dual-engine failure is not of concern. In addition, routine reporting can and should be used to establish what is “normal” so that when “abnormal” conditions occur, they are more easily recognized. Routine reporting is typically used proactively to monitor for trends that could affect continued airworthiness.

c. Special reporting . Based on the reviews outlined in paragraph 2a above, conditions may warrant the need for special reporting under the authority of section 44709 of Title 49 of the A4-1 AC 39-8 9/8/03 United States Code (40 USC 44709) and section 21.99 of Title 14 of the Federal Regulations (14 CFR 21.99). For example, the FAA may need special reporting to gather information to help establish the root cause, total rate of occurrence, and conditional probability of an unsafe condition. The FAA may also need inspection results to determine the number of incipient failures and operational information to establish the extent of the population at risk. The FAA may require immediate fleet-wide inspections to determine the extent of a condition. These actions may result in a one-time inspection and correction procedure or a periodic inspection to monitor a situation until a revised design or other permanent fix is available. Special reporting is typically used reactively to investigate, understand, and resolve specific problems or incidents.

d. Regular review of this airworthiness information is intended to help proactively identify potential or actual unsafe conditions. Continued monitoring after identification of the unsafe condition is necessary to ensure corrective actions are providing their intended effects.

e. Monitoring the available data on failure conditions against the assumptions inherent in the original certification compliance, both for occurrence rates as well as outcome, allows for a proactive comparison of the safety-significant assumptions of certification with the actual situation in the fleet.

3. OTHER SOURCES OF AIRWORTHINESS INFORMATION. Several other types of airworthiness information may be considered for use in a continued airworthiness assessment: a. In-service problems.

(1) In-service experience related to the type design: accident, incident, events, operational feedback, shop and test findings, and configuration status. The Air Transport Association of America (ATA) uses the “Airworthiness Concern Coordination Process” (ATA Spec 111) to coordinate fact finding and data reporting when airworthiness problems arise. This information is also collected and organized within numerous databases, many of which are readily accessible to the FAA and others (see paragraph 4 below).

(2) Relevant experience with similar designs/configurations.

(3) Procedural changes proposed or adopted by one or more operators.

b. Product design, production, and operational information.

A4-2 9/8/03 AC 39-8 (1) Certification compliance data.

(2) Quality review reports, test results.

(3) Maintenance, flight and ops manuals.

(4) Maintenance and operations specification.

(5) Maintenance and flight crew training materials.

(6) Simulations, mock-ups, models.

c. Design approval holder proposed changes.

(1) Proposed type design changes.

(2) Service bulletins.

(3) Changes to recommended operating procedures.

4. AIRWORTHINESS DATABASES. This section lists some of the databases and how the FAA and others can access them. Please note that listed websites were correct at the time of publication. However, web addresses may have changed since then. Use of search engines is recommended to locate the current sites.

a. Many airworthiness databases are available through the National Aviation Safety Data Analysis Center (NASDAC). This center was established to serve as a centralized directory and repository of aviation safety data. It provides on-site technical and analytical support and a series of automated analysis tools. The data it provides includes a variety of historical accident/incident data as well as supporting data such as airport files, registry, and air taxi operator listings. NASDAC also maintains a document list of databases, which are available through NASDAC and other organizations, entitled, "Guide to Data Systems Used in Aviation Safety Analysis". On-line access to NASDAC is available through either the FAA Intraweb (“intraweb.nasdac.faa.gov”; requires password registration) or the Internet (“nasdac.faa.gov”).

b. In addition to NASDAC, there are other on-line sources of airworthiness information, including those maintained internally within the FAA’s Aircraft Certification Division (AIR).

A4-3 AC 39-8 9/8/03 These are individual to each directorate; see the directorate office for specific information. Some airworthiness databases are also published in paper document or digital medium (usually Compact Disc) form.

c. The following is a list of databases that contain information related to airworthiness issues.

Some of these databases are not available to the public and others may require a fee for access.

However, since airworthiness information resources change rapidly, this listing should be viewed as a dated guide and not an accurate or complete listing.

(1) NTSB aviation accident data system: Source : NTSB Available from : The NTSB website (www.ntsb.gov) or through NASDAC (1983 to date, updated weekly).

Contains : Information collected during investigations of accidents or incidents involving civil aircraft within the U.S., its territories and possessions, and international waters. NTSB is the official source of accident data and their causal factors. Database includes preliminary and final reports, narratives, and findings. In addition, “NTSB Recommendations and FAA Responses” are available.

(2) National Airspace Information Monitoring System (NAIMS): Source : FAA/ASY100 Available from : ASY website (www.asy.faa.gov) or through NASDAC (1987 to date, updated monthly).

Contains : Subsystems PDS, OEDS, NMACS, and VPDS as described below: (A) Pilot Deviation System (PDS) : Contains pilot deviation reports resulting from a violation of the Code of Federal Regulations (CFRs) or a NORAD Air Defense ID Zone tolerance. New reporting forms went into effect in 1992.

(B) Operational Error and Deviation System (OEDS) : This contains all operational error or deviation reports that have occurred in the NAS. Additionally, it also contains causal factor information.

A4-4 9/8/03 AC 39-8 (C) Near Midair Collision System (NMACS) : Contains pilot reported near midair collision incidents. Reporting is voluntary and often subjective, and pilots may report to NASA (through ASRS) instead of FAA. New reporting forms went into effect in 1992.

(D) Vehicle/Pedestrian Deviation System (VPDS) : Contains information on incidents involving entry or movement on an airport movement area by a vehicle operator or pedestrian that has not been authorized by ATC.

(E) Runway Incursion System (RI) : Contains information derived from OEDS, VPDS, and PDS airport surface incidents that created a collision hazard or resulted in loss of separation with an aircraft taking off, intending to take-off, landing, or intending to land.

(F) Aircraft Operations (operations) (tower counts) : This database contains operations conducted since 1987 at air traffic control facilities and is used to normalize accident and incident rates.

(3) FAA Accident/Incident Data System (AIDS): Source : FAA/Flight Standards (AFS) - AFS-410 Available from : ASY website ( www.asy.faa.gov/safety_data ) or through NASDAC (1985 to date, updated monthly).

Contains : Data records for incidents gathered from FAA Incident Report Form 8020-5, and teletype preliminary data. AIDS is most useful for incidents since NTSB is the official source of accident information.

(4) Service Difficulty Reporting System (SDRS): Source : FAA/AFS - 600 Available from : the FAA website redirects to an external search site ( http://www.landings.com/aviation.html ).

Contains : General aviation malfunction and defect reports and air carrier mechanical reliability report subsets. Air carriers, field offices, manufacturers, and individuals submit data.

(5) Aviation Safety Reporting System (ASRS): Source : NASA/Ames Laboratory Available from : NASA website ( http://asrs.arc.nasa.gov/report_sets_nf.htm; 1976 to date), A4-5 AC 39-8 9/8/03 NASDAC (1988 to date, updated quarterly), ASY website (www.asy.faa.gov/safety_data), or commercial CD-ROM.

Contains : Voluntary reports of occurrences that could impact aviation safety. Approximately 30,000 reports are submitted each year by pilots, controllers, flight attendants, mechanics, other interested parties, and users of the NAS. Human factors information in the narratives. All privacy or identifying data is expunged or “sanitized”.

(6) National Flight Data Center (NFDC): Source : NFDC Available from : Through the Bureau of Transportation Statistics ( www.bts.gov ) or through NASDAC (updated every 56 days).

Contains : Subsystems AF, LF, LI, NA, and FX as described below: (A) Landing Facilities (LF) : Contains information on all private and public use landing facilities (airports, heliports, gliderports, etc.) including location, services, runway, lighting, administrative, and remarks.

(B) Air Route Traffic Control Center (AF) : Contains records for each Air Route Traffic Control Center Facility. The Air Route Traffic Control Center Facility File (ARTCC) contains all Remote Air/Ground Facilities (RCAG), Air Route Surveillance Radars (ARSR), Secondary Radar (SECRA), and Center Radar Approach Control Facilities (CERAP), under US area of responsibility. The database does not include any foreign facilities or radars.

(C) Radio Fix (FX) : Contains named and numbered radio fixes used in airway navigation. Includes: waypoints, reporting points, turning points, military fixes, ARTCC boundary crossing points, and airway intersections. Information includes positional, charting, and fix facility makeup.

(D) Location Identifiers (LI) : One record for each identifier assigned to an active facility. Describes all facilities (airports, instrument landing systems, navigational aids, Flight Service States, Air Route Traffic Control Centers, and special use) assigned to that identifier.

(E) Navigational Aids (NA) : Description of all VHF Omni-directional Range (VOR), Non-directional Beacon (NDB), Tactical Air Navigation (TACAN), Fan Marker, and Consolan facilities used in airspace navigation. Information includes location, position, class, features, frequencies, and associated fixes.

A4-6 9/8/03 AC 39-8 (7) Aircraft Registry (AR): Source : FAA/AFS-700 Available from : AFS-700 website ( http://registry.faa.gov/ ), or through NASDAC (real time updates), or the Public Documents Room in the Registry Building at the Mike Monroney Aeronautical Center in Oklahoma City, Oklahoma.

Contains : The FAA aircraft registry data system used to record and track civil aircraft registered in the United States. Registration occurs at the Federal Aviation Administration in Oklahoma City where the appropriate information is obtained and recorded from the aircraft purchaser. The Registry maintains the permanent records of over 320,000 active civil aircraft. Information recorded in the registry includes the aircraft registrant's name, address and state. Information on the aircraft includes the engine manufacturer and type, the aircraft N number, serial number, make model code, year of manufacture and much more including special use of the aircraft (agricultural or patrolling for example) and number of seats.

(8) Aviation System Indicators (SI): Source : FAA/System Safety (ASY) Available from : FAA intranet ASY website (www.asy.faa.gov) or NASDAC (1987 to data, updated quarterly).

Contains : Excel spreadsheets with monthly flight-hours data and accident/incident rates categorized according to large air carriers, commuters, air taxis, general aviation and rotorcraft.

While published System Indicator reports cover limited periods, the database contains all data from 1987 to current, and is updated quarterly.

(9) FAA Flight Standards Service Aviation Information Website: Source : AFS Available from : AFS-AI website (av-info.faa.gov).

Contains : Utilization and fleet age information (by U.S. operator), Airworthiness Directives, Technical Standard Orders (TSO's), Special Airworthiness Information Bulletins (SAIB's) and other FAA notices, SDR query and summary capability, and Type Certificate Data Sheets (TCDS's) and Supplemental Type Certificates (STC's).

A4-7 AC 39-8 9/8/03 (10) Bureau of Transportation and Statistics (BTS) (Formerly RSPA): Source : BTS Available from : BTS website (www.bts.gov) or through NASDAC.

Contains : Subsets T1, T2, T3 and A1 as described below: (A) BTS Form 41 Reports - Traffic Schedule (T1) : Monthly totals since 1990 for large certified air carriers of capacity and traffic data including: departures, passenger and cargo traffic, and available seats and cargo capacity. All are classified as scheduled or nonscheduled, first class or coach, civilian or military.

(B) BTS Form 41 Reports - Traffic Schedule (T2) : Delivered quarterly by summarizing data submitted since 1991 by U.S. carriers in their monthly T-100 Segment/Market reports and their quarterly supplemental Schedule T-2. All data items summarized by carrier, date, and aircraft type.

(C) BTS Form 41 Reports - Traffic Schedule (T3) : Quarterly totals since 1991 for: reporting carriers, each airport served, departures and passenger and cargo traffic enplaned, both scheduled and nonscheduled service as well as departures by each aircraft type which served the airport.

(D) BTS Form 41, 298-C (A1) : Contains statistics pertaining to the commuter air carrier.

(E) BTS bulletin board system : Form 41 Financial Data, consisting of balance sheets, profit and loss statements, and aircraft operating expenses since 1992.

(11) Airclaims Data System (AC): Source : Airclaims Group, UK Available from : Airclaims ( www.airclaims.co.uk; subscription required) or through NASDAC (1952 to date); some directorates may have hard copy versions, which are updated yearly.

Contains : Worldwide accident data from government sources and insurance claim information on accidents involving fatalities or major financial loss, as well as exposure and other operations data. Airclaims also has world fleet registration and utilization data.

A4-8 9/8/03 AC 39-8 (12) Aviation data compact disc: Source : NASDAC Available from : NASDAC.

Contains the following listings : (A) Licensed pilots (B) Aircraft owners (C) Licensed mechanics (D) Medical examiners (E) Airports (F) SDRS (G) Air taxis (H) Schools (13) ATP navigator compact disc: Source : Aircraft Technical Publishers Available from : ATP or NASDAC.

Contains the following information : (A) Airworthiness Directives(AD) (B) Associated Service Information (C) Type Certificates (D) Supplemental Type Certificates (E) Advisory Circulars (ACs) A4-9 AC 39-8 9/8/03 (F) Orders (G) Code of Federal Regulations (CFRs) (14) Airworthiness Directives compact disc: Source : FAA/AIR (each directorate may have copies) Available from : Source or through NASDAC.

Contains : The following information: (A) Revisions for 97-10 (B) Airworthiness Directives (ADs) (C) Advisory Circulars (ACs) (D) Code of Federal Regulations (CFRs) 1-199 (E) Service Bulletins (F) Type Certificates V1-6 (15) Aviation publications compact disc: Source : Available from : Through NASDAC.

Contains : The following information: (A) Code of Federal Regulations (CFRs) (B) Airman’s Information Manual (AIM) (C) Advisory Circulars (ACs) (D) Airworthiness Directives (ADs) (16) Jane’s compact disc: A4-10 9/8/03 AC 39-8 Source : Jane’s Available from : Jane’s website (www.janes.com) or through NASDAC.

Contains : Jane’s Encyclopedia of Aircraft.

(17) Safety Performance Analysis System (SPAS): Source : FAA/AFS Available from : SPAS website ( home.spas.faa.gov/spas.asp; training required prior to access).

Contains : A computer-based application that can be used to evaluate both current and historical safety related aviation data. SPAS collects data over time to show trends, to help users spot anomalies, and to provide a visual comparison to already established thresholds. The data used comes from a variety of data sources, such as the National Program Tracking and Reporting Subsystem (NPTRS), National Vital Information Subsystem (NVIS), Service Difficulty Reporting Subsystem (SDRS), NTSB accident data base, AIDS, and Airworthiness Directives Subsystem (ADS).

(18) The Aviation Safety/Accident Prevention (ASAP): Source : FAA ASW-100 Available from : Contact ASW for access.

Contains : A locally-generated and maintained database tool that links Service Difficulty Reports (SDRs) and Accident/Incident Data by Air Transport Association of America (ATA) code, part number, etc. There are approximately 350,000 entries for rotorcraft and fixed-wing airplanes.

ASAP also includes Airworthiness Directives.

(19) World Airline Accident Summary (WAAS): Source : The British Civil Aviation Authority (CAA) Available from : CAA Contains : Accident summaries.

(20) Air Transportation Oversight System (ATOS): Source : FAA/AFS Available from : ATOS website (www.faa.gov/avr/afs/ATOS).

Contains : Airline oversight information, including surveillance system design, system safety attributes and risk indicators.

A4-11 AC 39-8 9/8/03 d. In addition to these readily-available airworthiness databases, there are numerous other databases indirectly available. These include databases maintained by individual manufacturers, operators, insurance companies, etc. Under the authority of section 44709 of Title 49 US Code (49 USC 44709), the FAA can request whatever airworthiness information is needed from those it regulates. The FAA also can purchase needed data from those entities, such as insurance companies, which it does not regulate. Access to individual manufacturer databases is obviously not available to the general public.

e. In addition to the described databases in this appendix, there are numerous other types of airworthiness information available to the FAA and others. An example of this information is the Boeing Commercial Airplane Group's "Statistical Summary of Commercial Jet Aircraft Accidents", which includes both Boeing and non-Boeing aircraft. A wide variety of expert assessments (and associated data) on specific safety trends (e.g., uncontained rotor failures, bird ingestion, icing) are also publicly available in report form through many organizations such as: the Society of Automotive Engineers (SAE), Flight Safety Foundation (FSF), International Civil Aviation Organization (ICAO), and the AIA. Additionally, the “Technical Report on Propulsion System and APU-Related Aircraft Safety Hazards” documents the 10 years of engine, propeller and APU events comprising the CAAM database.

A4-12 9/8/03 AC 39-8 Appendix 5 STRUCTURED ASSESSMENT METHODS AND TOOLS 1. PURPOSE. This appendix briefly describes various structured methods and tools that are available to provide qualitative and quantitative insights into the existence, causes, risks, and resolutions of potential and actual unsafe conditions. These structured methods and tools should be used to support experienced engineering and operational judgment.

2. RELEVANT STRUCTURED METHODS AND TOOLS. There are a variety of analytical tools that can aid in the process of identifying potential unsafe conditions and resolving those judged to be actually unsafe. These include both qualitative and quantitative techniques. Listed below are categories of methods. These are described in greater detail in Society of Automotive Engineers (SAE) Aerospace Recommended Practice (ARP) 4761, “Guidelines and Methods for Conducting the Safety Assessment Process on Civil Airborne Systems and Equipment”. The tools listed are variously applicable to both the identification and risk estimation steps.

a. Deductive analysis methods . The following tools enable analytical assessments of components and systems from the general level to the specific: Decision tree, fault tree analysis, Markov analysis, dependency diagram analysis, success trees, functional hazard assessment, similarity assessment, common cause analysis, root cause analysis, and consensus expert opinion.

b. Inductive analysis methods . The following tools enable analytical assessments of components and systems from the specific level to the general: Failure modes and effects analysis, failure modes and effects summary, and manufacturing tolerance assessments.

c. Statistical and numerical methods . Often, either inductive or deductive analysis methods are used to qualitatively identify the characteristics of either populations or failure conditions, or both, for which quantitative insight is desired. The following tools are used to quantitatively model and evaluate those characteristics: Weibull and other distributional analyses, and Monte Carlo simulation.

d. Trend analysis . The following tools help to identify time-related changes in a monitored characteristic: Time series and cu-sum (cumulative sum).

A5-1

AC 39-8 9/8/03 e. Population analysis . The following tools help to identify whether segments of the exposed population are at greater or lesser risk of the unsafe condition: Pattern plot (i.e., pictorial representation of data), and analysis of variance (ANOVA).

f. Automated event, threshold level, or trend alarms . These tools provide alerts/warnings when typical or expected event rates are exceeded. Some examples of such tools are the alerts/warnings from the FAA Flight Standards Safety Performance Analysis System (SPAS) and the Extended-range Twin-engine Operations (ETOPS) warning and alert levels.

3. MATRIX OF STRUCTURED METHODS AND REFERENCES. The following matrix of objectives, available methods and tools, and associated references can be used to locate relevant details on some of the more prominent structured methods, tools and associated information.

RELEVANT REFERENCES OBJECTIVE METHODS AND TOOLS Identify failure modes of a Similarity Analysis using Mil-Std-217-E; specified component historical failure modes data “Reliability Engineers’ Toolkit” Rome Laboratory/ERSR 525 Brooks Road Griffiss AFB, NY 13441 Common Cause Analysis – used SAE ARP 4761; to look at the “zonal”, “particular AC 25.1309-1B risk”, and “common mode” stresses to which installed components will be exposed A5-2

9/8/03 AC 39-8 RELEVANT REFERENCES OBJECTIVE METHODS AND TOOLS Identify failure modes of a Stress Analysis (Parts stress Mil-Std-217; specified component (continued) method, structural, Mil-Std-756B; Electromagnetic Compatibility System Safety Analysis (EMC), etc.) – used to determine Handbook , 1993; the effects of applied stresses on Stress and Strain Data Handbook , the component Hsu, Teng H., 1986; NASA Structural Analysis (NASTRAN) Identify potential unsafe Trend or event rate-based alarms FAA SPAS; conditions AC120-42A, "Extended Range Operation with Two-Engine Airplanes (ETOPS)" Conditional Similarity Appendix 8 of this AC; SAE ARP 4761; AC 25.1309-1B Analysis of Variance (ANOVA) Snedecor and Cochran, Statistical Methods , or any other statistics textbook Cumulative Sum Analysis (Cu- Sachs, Lothar (1984), Applied Sum) to sum the cumulative Statistics: A Handbook Of occurrence rate of events versus Techniques , New York: time Springer-Verlag., pp. 201-202 A5-3

AC 39-8 9/8/03 RELEVANT REFERENCES OBJECTIVE METHODS AND TOOLS Common Cause Analysis SAE ARP4761; AC 25.1309-1B Identify potential unsafe Failure Modes and Effects SAE ARP 4761; conditions (continued) Analysis (FMEA) – a qualitative AC 25.1309-1B; or quantitative bottom-up Mil-Std-1629A analysis for conditions typically due to foreseeable single or multiple failures at the component, assembly, system, or aircraft level. A failure mode, effects, and criticality analysis (FMECA) is the combination of an FMEA and a criticality analysis.

Functional Hazard Assessment SAE ARP 4754; (FHA) – a qualitative top-down SAE ARP 4761; analysis for conditions due to AC 25.1309-1B foreseeable malfunctions Identify potential causes of a Fault Tree Analysis (FTA); SAE ARP 4761; specified condition Dependence Diagram Analysis – AC 25.1309-1B qualitative top-down for conditions due to multiple independent failures or events A5-4

9/8/03 AC 39-8 RELEVANT REFERENCES OBJECTIVE METHODS AND TOOLS Identify potential causes of a Failure Modes and Effects SAE ARP 4761 specified condition (continued) Analysis (FMEA) – qualitative bottom-up for conditions due to single or multiple failures Common Cause Analysis – SAE ARP 4761; qualitative top-down for AC 25.1309-1B conditions due to multiple failures resulting from a single event Root Cause Analysis “Root Cause Analysis – Effective Problem Solving and Beyond”, Apollo Associated Services Identify the effects of a specified Failure Modes and Effects SAE ARP 4761; failure Analysis (FMEA) AC 25.1309-1B Event Tree Analysis System Safety Analysis Handbook , 1993 Fault Insertion Testing Common Cause Analysis SAE ARP4761; AC 25.1309-1B A5-5

AC 39-8 9/8/03 RELEVANT REFERENCES OBJECTIVE METHODS AND TOOLS Assess the rate of a specified Historical failure rate data on Mil-Std-217-E; failure similar components Mil-Std-756B; “Reliability Engineers’ Toolkit” Rome Laboratory/ERSR 525 Brooks Road Griffiss AFB, NY 13441 (315) 330-4726; “Summary of Failure Rates”, GIDEP Lognormal, Poisson, and other Snedecor and Cochran, Statistical Statistical analyses. Methods , or any other statistics textbook Weibull Analysis for failure life AFWAL-TR-83-2079, “Weibull distributions Analysis Handbook” Assess the severity of a specified Historical Hazard Ratio FAA, “Technical Report on condition Propulsion System and APU- Related Aircraft Safety Hazards”; Appendix 8 of this AC Hazard Classification SAE ARP 4761; AC 25.1309-1B Common Cause Analysis SAE ARP 4761; AC 25.1309-1B A5-6

9/8/03 AC 39-8 RELEVANT REFERENCES OBJECTIVE METHODS AND TOOLS Assess the probability of Fault Tree Analysis (FTA), SAE ARP 4761; occurrence of specified failure Dependence Diagram Analysis, AC 25.1309-1B; conditions or Markov Analysis – An Introduction to Reliability quantitative top down for Modeling of a Fault-tolerant conditions due to single or System , The Charles Stark multiple failures or conditions Draper Laboratory, Inc., Cambridge, MA, 1986 Failure Modes and Effects SAE ARP 4761; Analysis (FMEA), Failure Mode, AC 25.1309-1B; Effects, and Criticality Analysis Mil-Std-1629A (FMECA) -quantitative Event Tree Analysis - System Safety Analysis quantitative Handbook , 1993 Identify potential mitigating Hazard and Operability Study System Safety Analysis actions (HAZOP) - structured team Handbook , 1993 review to identify potential hazards/operability problems and recommend corrective actions What-If/Checklist Analysis; Task System Safety Analysis Analysis - Handbook , 1993 Structured team review to identify potential hazards and recommend corrective actions A5-7

AC 39-8 9/8/03 RELEVANT REFERENCES OBJECTIVE METHODS AND TOOLS Assess the relative mitigation of Monte Carlo Simulation used to Simulation Modeling and various actions help judge the acceptability of Analysis , Law and Kelton, 1991 various proposed corrective actions and implementation schedule Markov Analysis used when SAE ARP 4761; evaluating various repair AC 25.1309-1B; scenarios, due to the ease of An Introduction to Reliability Modeling of a Fault-tolerant inputting repair information System , The Charles Stark Draper Laboratory, Inc., Cambridge, MA, 1986 Cost/Benefit Analysis FAA Order 8040.4; FAA/APO-89-10 Report; FAA Aviation Data and Analysis System (ADA) Sensitivity Analysis Sensitivity Analysis, Uncertainty SAE ARP 4754; Analysis - qualitatively or System Safety Analysis quantitatively assess the Handbook , 1993 sensitivity of the results to changes in input parameters Monte Carlo Analysis Simulation Modeling and Analysis , Law and Kelton, 1991 Monitor Effectiveness of Risk Tracking Techniques “NASA Systems Engineering Corrective Actions Handbook”, SP-6105, 1995 A5-8 9/8/03 AC 39-8 Appendix 6 ADDITIONAL TRANSPORT AIRPLANE DIRECTORATE (TAD) GUIDANCE 1. PURPOSE. This appendix provides supplemental risk assessment guidance and guidelines that may be used internally by the TAD to augment those contained in the main body of this AC.

2. DEFINITIONS. Paragraph 4 of the main body of this AC also applies to this appendix. The following additional definitions are defined for the purpose of this appendix only: a. Risk forecast (injury risk factor) . A quantitative assessment output that is proportional to the average number of persons expected to be seriously injured within a given time period. Risk forecasts are derived from the risk factor and therefore can be differentiated into the same three types (i.e., “uncorrected, “control program”, and “corrected”).

b. Risk level (injury risk level) . The risk forecast for a single flight or flight-hour. As with risk factor and risk forecasts, risk levels can be differentiated into the same three types (i.e., “uncorrected”, “control program”, and “corrected”).

3. BACKGROUND. Within the Transport Category Airplane fleet, there is significant diversity in both the severity of potential unsafe conditions and the numbers of persons potentially affected by those conditions. To further differentiate between the unsafe conditions of a given CAAM hazard level, TAD may go beyond the airplane level event-focused assessments and also consider the number of serious injuries that could reasonably be expected to result from a given airplane level event. To that end, TAD may use “risk forecasts” and “risk guidelines”, in addition to “event forecasts” and “event guidelines”, as common measures and standards for assessing, prioritizing and responding to continued airworthiness risks. This can result in two unsafe conditions with identical “event forecasts” not warranting the same response from TAD if one “event” is expected to seriously injure more persons than the other. To aid in joint decision making between the EPD and TAD in cases of shared product responsibility, close coordination is highly recommended, especially if TAD intends to use the supplemental guidance and guidelines of this appendix to support TAD decision making.

4. SUPPLEMENTAL GUIDANCE AND GUIDELINES FOR PARAGRAPH 7f, “Estimate the uncorrected risk factor".

a. The objective under this paragraph can either be accomplished by direct numerical assessments such as those recommended in the following paragraphs, or alternatively by “severity classification” based assessments such as those described in this AC and in AC 25.1309-1B. Whatever assessment methods are used, the risk forecast (injury risk factor) should A6-1 AC 39-8 9/8/03 remain below the 0.1 short-term risk factor guideline and the risk level (injury risk level) below a -5 1x10 serious injuries per-flight guideline throughout the control program.

b. Estimate the average number of persons expected to be exposed to serious injury per event . Assign or calculate from specific or similar service experience or System Safety Assessment (SSA) data the relative fraction of occurrences which would result in any serious injury and the average number of persons expected to be exposed to serious injury during such occurrences. Note that not all persons exposed to serious injury will be seriously injured.

Furthermore, serious injury may arise from a number of outcomes. For example, a disk uncontainment may pose a direct injury threat due to fuselage penetration, or an indirect threat due to damage to the flight control system. Delineate the fractions of the events resulting in the various potential outcomes and the average number of persons expected to be exposed to serious injury from that outcome. Then, calculate a weighted average of those outcomes to arrive at the average number of persons expected to be exposed to serious injury per event. For example, an uncontained engine rotor failure may result in: (1) No threat of serious injuries (e.g., 80 percent of the events are expected to result in no serious injuries).

(2) Threat of serious injuries (e.g., 20 percent of the events are expected to result in some serious injuries).

(A) Serious injuries limited to a specific subset of occupants (e.g., if 10 seats are within the debris zone/area of an airplane which operates at an average 70 percent load factor and 10 percent of the total events are expected to have this outcome, then 10 x 0.70 = 7 persons should be assumed to be exposed to serious injury for 10 percent of the events).

(B) Serious injuries to occupants in general but without hull loss (e.g., if the failure would cause the cabin of a 100-passenger airplane which operates at an average 70 percent load factor to be exposed to conditions (e.g., toxic fumes, depressurization, etc.) which would expose 40 percent of a typical occupant demographic to serious injury and five percent of the total events are expected to have this outcome, then 100 x 0.70 x 0.40 = 28 persons should be assumed to be exposed to serious injury for five percent of the events).

A6-2 9/8/03 AC 39-8 (C) Catastrophic accident (e.g., if the failure would prevent the airplane from making a safe landing (e.g., cause inflight breakup, loss of control, critical loss of performance, etc.) and five percent of the total events are expected to have this outcome, then 100 x 0.70 = 70 persons should be assumed to be exposed to serious injury for five percent of the events).

NOTE: The result of the above example would mean an average of 5.6 persons are expected to be exposed to serious injury per event (i.e., 0.80 x 0 + 0.1 x 7 + 0.05 x 28 + 0.05 x 70).

c. Estimate the average number of persons expected to be seriously injured per event.

Historical data indicates that the actual number of persons seriously injured is proportionally less than those exposed to serious injury. Furthermore, a scalar is needed to allow a single risk guideline to fit historically acceptable AD responses to both low and high severity outcomes.

Consequently, the number of persons expected to be seriously injured per event should be taken to be x , where x = the number of persons expected to be exposed to serious injury per event from 4.b. above. (E.g., of the 5.6 persons expected to be exposed to serious injury per event in the above example, an average of 2.4 persons are expected to actually be seriously injured per event.) Note that since this scalar is not effective for average injury exposures of less than 1.0, use the exposure as the actual injury number (e.g., 0.7 average number of persons exposed to serious injury equals 0.7 persons expected to be seriously injured.)

d. Calculate the uncorrected risk forecast and uncorrected risk level. The uncorrected risk forecast is calculated by multiplying the uncorrected risk factor (derived in paragraph 7f in the main body of this AC) by the number of persons expected to be seriously injured per event from paragraph 4c above. Since this is an average, it may be a fractional number. Additionally, convert this uncorrected risk forecast into a uncorrected risk level to facilitate comparing risks on a common exposure basis. This is normally done on a per flight or per flight hour basis by dividing the uncorrected risk forecast by the total number of flights or flight hours within the exposure period used.

5. SUPPLEMENTAL GUIDANCE FOR PARAGRAPH 9g, “Risk guidelines for immediate action”. If the risk forecast would exceed 0.1 within 60 days or the risk level during -5 that same 60-day period would be greater than 1x10 serious injuries per flight, immediate action should be considered. How “immediate” this action must be could vary from before the next flight to within 60 days depending on the nature and level of risk. To establish what the A6-3 AC 39-8 9/8/03 maximum short term uncorrected event forecast should be for the causal event itself, simply divide the risk forecast guideline provided above (risk forecast < 0.1 serious injuries) by the results of 4c. For the example used above, the maximum short term uncorrected event forecast for the uncontained engine rotor failure itself would be 0.043 events (0.1 injuries ÷ 2.3 injuries/event). To establish what the maximum short-term event forecast rate should be for the -5 causal event itself, likewise divide the risk level guideline (risk level < 1x10 serious injuries per flight) by the results of 4c. For the example used above, the maximum short-term event forecast -6 -5 rate for the uncontained engine rotor failure itself would be 4.3x10 events/flight (1x10 injuries/flight ÷ 2.3 injuries/event). When flight hours have been used in the analysis, the -5 guideline for immediate action may be established by dividing the per-flight risk (1x10 /flight) by the average number of hours per-flight. For example, a three-hour average flight length -6 corresponds to a risk criterion of 3.3x10 per flight hour.

6. SUPPLEMENTAL GUIDANCE AND GUIDELINES FOR PARAGRAPH 7k, “Estimate potential risk reduction”. Once the candidate actions have been identified, the risk under the proposed mitigation program should be estimated using the same process described above. This process should be performed for all actions under consideration, which allows for the effects of different programs to be compared. The objective is to keep the risk forecast (injury forecast) below a 0.1 risk factor guideline and the risk level (injury risk level) below a -5 1x10 per flight guideline until final action can be incorporated to bring the product back to the level of safety intended by the product's original basis of certification.

7. SUPPLEMENTAL GUIDANCE AND GUIDELINES FOR PARAGRAPH 7u. The objective throughout the entire correction program is to keep the risk forecast (injury risk factor) -5 below a 0.1 risk factor guideline and the risk level (injury risk level) below a 1x10 per-flight guideline until the product is brought back to the level of safety intended by the product's original basis of certification. Therefore, the schedule for follow-on actions should be established such that these guidelines will be met.

A6-4 9/8/03 AC 39-8 Appendix 7 ASSESSMENT EXAMPLES 1. PURPOSE. The objective of this appendix is to provide detailed step-by-step examples of the risk assessment process detailed in this AC, taking the reader through several typical fictitious service problem scenarios from identification to resolution.

2. EXAMPLE 1: Compressor disk fracture th a. An 8 stage compressor disk installed in a low-bypass turbofan engine fractures during takeoff roll. The fracture occurs prior to V1, and the takeoff is safely aborted. The fractured disk has 12,508 cycles part life. The fracture is uncontained, but does not cause any damage to the aircraft, or injury to any passenger or crew. Control is maintained at all times, and the aircraft stops on the runway. Failure investigation reveals the disk fractured in low-cycle fatigue due to corrosion. The investigation further indicates the corrosion occurred because the failed part had not been properly coated during manufacture. The problem is identified and corrected in production; however, the risk posed by other improperly-coated parts in service must be assessed.

b. Estimate the number of aircraft exposed: Initial evaluation of the extent of the problem detects no known manufacturing process changes that might have accounted for the coating problem. However, this part number disk is processed at a dedicated coating facility (i.e., the facility produces only this part), and while all disks of this part number are potentially at risk, the problem is not considered to extend to other part numbers (no evidence of any problems with the parts produced by other facilities). Four hundred and thirty-three (433) disks (including spares) of the suspect part number are currently in service, and are considered to be at risk of a repeat event.

c. The engine manufacturer immediately performs a Weibull analysis using a typical fatigue wearout slope against the population of current disks. This analysis gives a material property life distribution to input into a Monte Carlo simulation. The simulation runs a computer model of the fleet forward in time. This model predicts 1.3 additional disk fractures if all current parts are allowed to remain in service until their certified retirement life (15,000 cycles). Calibration of this risk model (by backing up the simulation to the start of service and running the fleet model to the present) gives a prediction of 0.95 events to date (versus 1 occurred), which is judged to be indicative of a valid model.

A7-1 AC 39-8 9/8/03 d. Estimate the uncorrected risk and risk per flight. While this event did not result in serious injury or other CAAM level 4 or 5 event, historical data available at the time on similar disk fractures over the previous 15 years (see the CAAM report referenced in paragraph 2b(1)) indicate a record of seven CAAM level 3 and 4 events out of a total of 10 uncontainments due to low-bypass ratio turbofan high-pressure compressor fractures. Four of those events (40 percent) resulted in hull loss or fatality (CAAM level 4) due to on-ground fire; one of these (10 percent) was also CAAM level 5 (hull loss/multiple fatalities). Structural review by the engine th manufacturer predicts that fracture of this 8 stage disk would be expected to result in uncontainment 100 percent of the time. Coordination with the aircraft manufacturer, validated by the TAD, indicates that, for this installation (wing-mounted engine), 50 percent of the uncontainments would be at least CAAM level 3, and 80 percent of the level 3 events would be hull loss/injury events (level 4). The assumption is made that 40 percent of the events (0.50 level 3 x 0.80 level 4 given level 3 = 0.40) would be expected to result in serious injury or other CAAM level 4 event. 10 percent of all events are assumed to be level 5 (0.40 level 4 x 0.25 level 5 given level 4 = 0.10). Since 1.3 events are predicted, and 40 percent of those would be expected to result in a CAAM level 4 event, 0.52 level 4 events would be expected if no action is taken (1.3 x 0.40 = 0.52), and 0.13 level 5 events. There are two at-risk engines per aircraft, and the 433 disks have an average of 5000 cycles remaining until retirement. Therefore, the average -7 per-flight risk of a CAAM level 4 (or higher) event if no action is taken is 4.8 x 10 [0.52 / (433 -7 disks x 5000 cycles/disk / 2 cycles/flight) = 4.8 x 10 ]. Note that the spare disks are included in the analysis. While these level 4 risks are clearly in the region where action must be taken, the -6 per-flight risk is below the guideline for immediate action (4x10 per-flight for CAAM level 4 events), so the disks are allowed to remain in service while an inspection and replacement plan is developed. CAAM level 3 events are also calculated: there are 0.65 level 3 (or higher) events -7 predicted (1.3 events x 0.50 at least level 3 = 0.65), with a per-flight risk of 6.0x10 [0.65 / (433 -7 disks x 5000 cycles/disk / 2 cycles/flight) = 6.0 x 10 ].

e. Estimate effects of candidate actions . Over the next few weeks, while a plan is being developed, a number of retired disks are located and inspected, along with several disks in engines currently undergoing scheduled shop visit. One disk is found to have a crack resulting from a corrosion pit. These inspection findings, along with structural modeling by the engine manufacturer, allow for a more refined quantitative analysis, including initiation and propagation distributions. The Monte Carlo simulation is revised, and is performed against a number of inspection and replacement scenarios to find one that acceptably mitigates the risk of serious injury. The engine manufacturer submits a plan to the EPD which calls for replacement of the A7-2 9/8/03 AC 39-8 disks at next shop visit, with engines above 10,000 cycles part life to be removed no later than within the next 2,000 cycles. The simulation predicts that this plan would result in 0.18 uncontainments, of which 0.09 would be at least level 3 (0.50 level 3 x 0.18 = 0.09), 0.07 would be level 4 (0.40 level 4 x 0.18 events = 0.07), and .02 would be level 5 (0.10 level 5 x 0.18 events = 0.02). Both the level 3 and level 4 predictions are below the risk guidelines (see table 1, paragraph 9 in the main body); the level 5 risk is well controlled within the level 4 exposure.

This plan calls for an aggressive production schedule of replacement disks. Shop visit capacity will also be strained, but is expected to be capable of meeting the increase in inducted engines with only minor schedule disruptions. The engine manufacturer issues a Service Bulletin recommending disk replacement to the above schedule.

f. Implement and monitor corrective action plan . The EPD reviews the assumptions and results of the risk analysis. Though the EPD would like to further reduce the risk of this event, it agrees that a more aggressive schedule would result in significant service disruptions. The EPD issues an NPRM, followed by an AD, to mandate the engine manufacturer’s Service Bulletin.

Disks are inspected as they are replaced, with the results compared at regular intervals to the month-by-month predicted crack findings from the Monte Carlo simulation. Subsequent inspection findings indicate the initial risk analysis is somewhat conservative. However, both the engine manufacturer and the EPD believe that no alleviation of the disk replacement schedule should be pursued due to the potential seriousness of another event. After nine months, the EPD also requests a comparison of the actual shop visit (disk replacement) rate with the predictions from the risk analysis. The actual is found to be within two percent of the predicted, so no additional action is taken. After four and one-half years, the last of the suspect disks is replaced.

No additional events have occurred during that period.

3. EXAMPLE 2: Boost pump wiring chafing a. Inspection of a fuel leak problem on a transport aircraft revealed that the leak was the result of a conduit burn through caused by an electrical arc between the conduit and a boost pump wire inside the conduit that had chafed completely through the insulation. The penetrated conduit lies within the fuel tank, thus raising a concern about a possible fuel tank ignition. A different airplane type had experienced an unexplained catastrophic fuel tank ignition eight years earlier.

b. Estimate the number of aircraft exposed. The boost pump wiring on this airplane type is common to all models. The worldwide fleet includes about 3000 airplanes with two engine A7-3 AC 39-8 9/8/03 models and a variety of derivatives. Since the vibration characteristics for the different engine types which might affect chafing is not known, it must be assumed that all airplanes in the fleet could be affected. The analyst has a total of three inspection records. Two of the inspections had been performed prior to the one that indicated conduit penetration. A Weibull analysis of the data indicates a strong wearout mode (i.e., the likelihood of chafing increases with the age of the wiring). The Weibull analysis predicts 0.92 burned-through conduits should have occurred to date, which calibrates with the actual experience. The analysis as applied to the fleet indicates that airplanes with more than 30,000 hours contribute significantly to the overall risk of a bare wire event. Although only one airplane has been found with a burned-through conduit, the analysis indicates that there may be 76 airplanes still flying with undetected exposed wires. The analyst concludes that the entire fleet should be included in the actions to control the situation.

c. Since there is no life limit on the fuel tank wiring, the statistical analysis described in (a) predicts that 76 bare wire events are already latent in the fleet and many more will occur in the remaining life of the fleet. Information gained in investigation of a similar situation in a different airplane type shows that the wing tanks on the airplane type where the bare wire was found are in a flammable condition for three percent of each flight. The center tanks are flammable for 30 percent of each flight.

d. Estimate the uncorrected risk factor and risk per flight. There is no known experience of a bare wire event causing an ignition event; therefore, the analyst must estimate the hazard ratio - the conditional probability of an ignition event given that a bare wire event has occurred. This is conservatively accomplished by assuming that an ignition event in one of the predicted 76 airplanes flying with bare wires is imminent. The hazard ratio, which can also be expressed as the conditional probability, P , of an ignition event, is estimated by using the model developed C by the analysis to compute how long each airplane predicted to have a bare wire has been flying after the event occurred. The analyst determines that the total after-event flight hours accumulated by the 76 airplanes predicted by the model to have bare wires is 624,217 hours.

-6 Thus, P is estimated to be 1/624,217 ≅ 1.6E . This is a conservative approach, but the only C objective estimate of P available to the analyst. The only actual fuel tank ignition event on this C airplane type resulted in a level 5 event. Although the airplane was on the ground at the time of the ignition, a number of passengers were killed and the airplane was destroyed. No cause for the accident was recorded. Therefore, the analyst concludes that any ignition source in a fuel A7-4 9/8/03 AC 39-8 tank will have level 5 potential. From this information, the risk can be now be calculated for any length of time, including the next 60 days to determine if immediate action is warranted. (The guideline for immediate action, as defined in paragraph 9g of the main body, applies to a 60-day period.) This airplane accumulates, on average, 341 hours in a 60-day period. The Weibull analysis estimates that 6 additional bare wires will develop over the next 60 days.

76 latent bare wires in the fleet plus 6 more in 341 fleet hours = 82 -6 1.6E per-hour probability of ignition event given bare wire 341 hours operation -6 = 82 x 1.6E x 341 = 0.045 level 5 events in the next 60 days of US fleet-wide operation.

The risk does not exceed the short-term acceptable level 4 risk guideline (remember, level 5 risk must at least meet level 4 guidelines) within the next 60 days. However, since the event in question has a high injury forecast, the analyst concludes that immediate mitigating action is necessary.

e. Estimate effects of candidate actions . The analyst uses the information generated above to establish an inspection and repair plan that will meet the risk guidelines. The analyst determines that if all airplanes older than 65,000 flight hours (126 airplanes) are inspected and repaired within 20 days, the risk factor is decreased more than 40 percent. Additional inspections are also proposed: Airplanes with 55,000 but <65,000 flight hours (152 airplanes) should be inspected within 45 days. Airplanes with 45,000 but <55,000 flights (116 airplanes) should be inspected within 90 days. Airplanes with 38,000 but <45,000 flights (154 airplanes) should be inspected within 180 days. Airplanes with 30,000 but <38,000 flights (283 airplanes) should be inspected within one year. Airplanes with 1 but <30,000 flights (2062 airplanes) should be inspected by the time the airplane reaches 30,000 flights. There are 0.09 level 5 events expected in the fleet within the full inspection period. Because this is a conservative analysis (no events to date, but one assumed, among other conservatism), this prediction is judged to be acceptable for a level 5 risk exposure.

f. Implement and monitor corrective action plan . A telegraphic AD is issued to implement the proposed inspection plan. An updated analysis made from the information obtained from the inspections indicates that the safety objectives will not be met without adjustments to the inspection schedule. The original AD is amended to show the following: A7-5 AC 39-8 9/8/03 Al airplanes older than 65,000 flight hours to be inspected and repaired within 20 days.

Airplanes with 55,000 but <65,000 flight hours should be inspected within 40 days.

Airplanes with 45,000 but <55,000 flights should be inspected within 60 days. Airplanes with 38,000 but <45,000 flights should be inspected within 90 days. Airplanes with 25,000 but <38,000 flights should be inspected within 180 days. Airplanes with 1 but <25,000 flights should be inspected by the time the airplane reaches 25,000 flights. This new inspection schedule brings the safety objective back to the original expectation of 0.09 level 5 events within the inspection period.

g. The corrective action taken to eliminate the wearout problem consists of a Teflon sleeve over the original wire bundle. Since there has been no time to prove that the corrective action will be effective in the long term, the fleet will require inspections to assure that the safety objectives are maintained in the future. Therefore, the AD is further amended to require that the conduits and wiring be inspected at 30,000 flights since new or last replacement of the wiring.

A7-6 9/8/03 AC 39-8 Appendix 8 HISTORICALLY POTENTIALLY UNSAFE CONDITIONS 1. PURPOSE. The objective of this appendix is to provide the user with a descriptive listing of generic transport airplane powerplant and APU failure conditions that have been defined as potentially unsafe based on previous service experience or traditional assumptions, or both. This appendix is intended to be an example list and not an inclusive or prescriptive checklist, since it may not include all the information relevant to the failure conditions of a specific transport airplane with its various functions and its intended use. This list includes estimates of the conditional probability of the severity outcome (hazard ratio) given the occurrence of the basic failure condition.

2. DATABASE. Unless stated otherwise, these estimates are based on the service data for the time period 1992-2000 as reported to the AIA/AECMA CAAM data update team. Earlier data were added in situations where there were few or no recent high-level events. Historical hazard ratios and event details for the earlier CAAM data (time period 1982-1991) for some of the listed conditions are contained within the “Technical Report on Propulsion System and APU-Related Aircraft Safety Hazards (FAA Related Reference (1) in paragraph 2b in the main body of this nd AC). The pending “2 Technical Report,” based on the CAAM data update team activities, will include the 1992-2000 hazard ratios and event details for the conditions listed below.

3. HAZARD RATIO CALCULATION. Where there have been relatively few occurrences within the database of a particular failure condition, and no events of a given CAAM level or higher, hazard ratios have not been listed. This is to avoid both the implication that high-level events are not possible, if a “.000” were to be listed, and possibly overly-conservative estimates, if a “<.XXX” were to be listed. For situations where there are many occurrences of the failure condition without high-level events, “<.XXX” hazard ratios are listed. They are also used for cases of significant under-reporting. Details on how to estimate hazard ratios in the absence of high-level events are provided in appendix 3 of this AC.

NOTE : Care should be taken when using any published hazard ratio that the data source is relevant to the intended application. Since the hazard ratios in this appendix have been developed using the full range of the available data, they should be considered a general guide and not a replacement for more specific guidance and assessments for a particular aircraft type, environment, or operating condition.

A8-1

AC 39-8 9/8/03 FAILURE CONDITION CONSIDERED POTENTIALLY UNSAFE 1 Propeller Debris Release If resulting debris, aircraft operating characteristics or loads could directly impact primary aircraft structure, critical system functions, or critical flight crew functions such that continued safe flight and landing at an airport would be prevented (e.g., debris could cause loss of the other operating engines, the dynamic yaw/roll could lead to loss of control, or the rotor imbalance could cause critical structural failure).

If propeller blade release could cause additional potential unsafe failure conditions (e.g., uncontained engine fire).

Any other time. This failure is assumed to always pose a risk of serious injury to individuals within the debris zone inside the aircraft. This failure could cause serious injury to individuals outside the aircraft, a significant reduction in aircraft capabilities (e.g., cabin depressurization), and could pose a hazard to adjacent aircraft or facilities. Therefore, if such a condition is occurring in service, the uncorrected risk should be assessed to determine whether the condition is reasonably expected to result in one or more serious injuries.

If it is, then the condition is unsafe and must be corrected.

A8-2

9/8/03 AC 39-8 FAILURE CONDITION CONSIDERED POTENTIALLY UNSAFE Propeller Debris Release (continued) 29 events inflight Hazard ratios: 1 level 5 (inability to maintain flight) 84 events inflight/on ground 17 level 3; 1 level 4 (serious injury from fuselage penetration) Note that only inflight events were used to calculate level 5 HR. That value was then added to the level 3 and 4 risk (from all events minus the one level 5) to produce inflight level 3+ and 4+ HRs. On-ground risk exposure thus does not include the “inability to maintain flight” risk.

Inflight On-ground level 3+ HR .251 .217 level 4+ HR .047 .012 level 5 HR .034 - 2 Uncontained Engine or APU For the same reasons identified for Propeller Debris Release.

Rotor Failure. Includes: shafts, disks, drums, impellers, fan blades, turbine blades, compressor blades, etc. See AC 20-128A for definition of rotor.

A8-3 AC 39-8 9/8/03 Event totals and hazard ratios by engine type and section (note that hazard ratios are for the given event level or higher). Data period 1982-2000. Events are those uncontained by the nacelle. Low-bypass ratio (LBPR) includes turbojets (Stage 1 in a turbojet is listed under Fan).

Disks/spools/hubs/impellers: TP LBPR HBPR ALL 3 4 5 ALL 3 4 5 ALL 3 4 5 FAN N/A N/A N/A N/A 8 2 1 0 5 2 1 2 0.375 0.125 1.000 0.600 0.400 LPC 7 1 0 0 0 0 0 0 1 0 0 0 0.143 IPC 0 0 0 0 0 0 0 0 1 1 0 0 1.000 HPC 3 0 0 0 12 5 3 1 12 3 0 0 0.750 0.333 0.083 0.250 HPT 18 1 2 0 0 0 0 0 11 4 1 0 0.167 0.111 0.455 0.091 IPT 1 1 0 0 0 0 0 0 0 0 0 0 1.000 LPT 6 1 0 0 7 3 0 0 15 4 0 0 .167 0.429 0.267 A8-4 9/8/03 AC 39-8 Blades/bluckets: TP LBPR HBPR ALL 3 4 5 ALL 3 4 5 ALL 3 4 5 FAN N/A N/A N/A N/A 28 3 0 1 103 2 0* 0 0.143 0.036 0.036 0.019 Platforms N/A N/A N/A N/A 1 0 0 0 4 0 0 0 LPC 0 0 0 0 9 0 0 0 2 0 0 0 HPC 1 0 0 0 4 0 0 0 0 0 0 0 HPT 5 0 0 0 4 0 0 0 3 0 0 0 IPT 1 0 0 0 0 0 0 0 0 0 0 0 LPT/PT 10 0 1 0 45 7 0 0 94 1 0 0 0.100 0.100 0.156 0.011 * Note: HBPR level 4 event outside the data period A8-5 AC 39-8 9/8/03 Spinners/cooling plates/other: TP LBPR HBPR ALL 3 4 5 ALL 3 4 5 ALL 3 4 5 FAN N/A N/A N/A N/A 0 0 0 0 3 1 0 0 0.333 HPC 0 0 0 0 6 1 0 0 1 0 0 0 0.167 HPT 3 0 0 0 0 0 0 0 7 1 0 0 0.143 LPT/PT 0 0 0 0 0 0 0 0 5 2 0 0 0.400 APUs: ALL 3 4 5 uncontainment 68 0 0 0 axial ‘uncontainment’ 15 0 0 0 (1992-2000) A8-6

9/8/03 AC 39-8 FAILURE CONDITION CONSIDERED POTENTIALLY UNSAFE 3 Engine/Pylon Separations For the same reasons identified for Propeller Debris Release.

Note that during initial or partial separations, the engine can Includes both partial and total produce significant abnormal thrust vectors that should be restraint failures. taken into account.

Hazard ratios: Time period 1982-2000 Turboprops: 2 events; 0 level 3; 1 level 4; 0 level 5 LBPR TFs: 8 events; 1 level 3; 2 level 4; 1 level 5 HBPR TFs: 5 events; 2 level 3; 1 level 4; 2 level 5 TP LBPR HBPR level 3+ HR .500 .500 1.000 level 4+ HR .500 .375 .600 level 5 HR - .125 .400 4 Contained Engine or APU If a subsequent occurrence could reasonably be expected to Rotor Failure result in uncontainment.

If the mode of containment is not conditional, then it is usually assumed that the next occurrence will also be contained. However, this is a judgment that should be made by the EPD with assistance from the manufacturer.

If the resulting aircraft operating characteristics or loads (especially those due to rotor imbalance) could directly impact primary aircraft structure, critical system functions, or critical flight crew functions such that continued safe flight and landing at an airport would be prevented.

A8-7

AC 39-8 9/8/03 FAILURE CONDITION CONSIDERED POTENTIALLY UNSAFE Contained Engine or APU If contained engine rotor failure could cause additional Rotor Failure (continued) potential unsafe failure conditions (e.g., uncontained engine fire).

Hazard ratios: In general, the effects of a contained engine failure are more benign than the uncontained failures, which are covered in #2, above. There has been an instance of a level 3-equivalent outcome due to airframe vibration (and associated difficulty of the crew to read cockpit instrumentation) generated by the windmilling load of the contained failure of a wide- chord fan blade in a HBPR engine.

The hazard ratios for contained fan blade failures that exit the inlet are considered comparable to the fan blade uncontainment failure hazard ratios (see #2, above).

5 Separation of Significant If the resulting debris, aircraft operating characteristics or Nacelle Components loads could directly impact primary aircraft structure, critical system functions, or critical flight crew functions Includes both partial and total such that continued safe flight and landing at an airport restraint failure for: Inlet, Fan, would be prevented (e.g., debris could cause critical damage Core, and Reverser Cowls; to the horizontal tail or the aerodynamic effects could cause Nozzles and Plugs; Dense or critical loss of controllability or performance).

Large Fairings; etc.

If nacelle component separations could cause additional potential unsafe failure conditions (uncontained engine fire, unsafe changes in the magnitude or direction of thrust, etc.)

A8-8

9/8/03 AC 39-8 FAILURE CONDITION CONSIDERED POTENTIALLY UNSAFE Separation of Significant Any other total separation.

Nacelle Components This failure could pose a risk of serious injury to individuals (continued) both inside and outside the aircraft, could cause a significant reduction in aircraft capabilities (e.g., cabin depressurization), and could impact other aircraft or facilities. Therefore, if such a condition is occurring in service, the uncorrected risk must be assessed to determine whether the condition is reasonably expected to result in one or more serious injuries. If it is, then the condition is unsafe and must be corrected.

Hazard Ratios: Time period 1982-2000 Turboprops: 3 events (suspected under-reporting); 0 level 3, 4 or 5 LBPR TFs: 55 events; 1 level 3; 1 level 4 (high-drag forced landing due to partial separation after internal engine failure); 0 level 5 HBPR TFs: 195 events; 2 level 3; 0 level 4 or 5 TP LBPR HBPR level 3+ HR - .036 .010 level 4+ HR - .018 - A8-9

AC 39-8 9/8/03 FAILURE CONDITION CONSIDERED POTENTIALLY UNSAFE 6 Uncontained Powerplant or If fire, heat or smoke could spread to the aircraft cabin and APU Fire cause serious injuries.

Includes: engine case rupture or burn through, engine or APU fires which breach the fire wall, or fires which initiate outside a fire zone.

If fire, heat or smoke could impact primary aircraft structure, critical system functions, or critical flight crew functions such that continued safe flight and landing would be prevented.

Any other time hazardous quantities of flammable materials are potentially available to feed the fire.

Uncontained fire is sufficiently unpredictable and potentially damaging as to always be considered a potential unsafe condition unless there will clearly be insufficient flammable material available to create a hazard. Flammable materials of concern include, but are not limited to, fuel, oil, hydraulic fluid, wiring, magnesium, and many components of the cabin interior. Therefore, if such a condition is occurring in service, the uncorrected risk should be assessed to determine whether the condition is reasonably expected to result in one or more serious injuries. If it is, then the condition is unsafe and must be corrected.

A8-10 9/8/03 AC 39-8 FAILURE CONDITION CONSIDERED POTENTIALLY UNSAFE Uncontained Powerplant or APU Fire (continued) Hazard ratios: Case ruptures: Time period 1982-2000 Turboprops: 12 events; 0 level 3, 4 or 5 LBPR TFs: 27 events; 2 level 3; 1 level 4; 1 level 5 HBPR TFs: 17 events; 2 level 3; 0 level 4 or 5 TP LBPR HBPR level 3+ HR - .148 .118 level 4+ HR - .074 - level 5 HR - .037 - ------------------------------------------------------------------- Case burnthroughs: Time period 1982-2000 Turboprops: 9 events; 2 level 3; 0 level 4 or 5 LBPR TFs: 9 events; 0 level 3, 4 or 5 HBPR TFs: 71 events; 1 level 3; 0 level 4 or 5 TP LBPR HBPR level 3+ HR .222 - .014 A8-11 AC 39-8 9/8/03 FAILURE CONDITION CONSIDERED POTENTIALLY UNSAFE Uncontained Powerplant or APU Fire (continued) Uncontained fires: By definition, an uncontained (uncontrolled) fire is a level 3b event. Therefore, the hazard ratios below are for fires that become (or start as) uncontained to evaluate the conditional probability of a level 4 or 5 event. The hazard ratios for fires becoming uncontained are given under Failure Condition 7, below.

Note that these fires occurred below 10,000 feet (while parked, during taxi, takeoff/early climb or landing).

Turboprops: 11 events (level 3+); 1 level 4 (forced landing due to fire); 0 level 5 LBPR TFs: 5 events (level 3+); 2 level 4 (hull loss due to fire, one with a serious injury); 0 level 5 HBPR TFs: 14 events (level 3+); 0 level 4 or 5 APUs: 8 events (level 3+); 0 level 4 or 5 TP LBPR HBPR APU level 4+ HR .091 .400 - - A8-12

9/8/03 AC 39-8 FAILURE CONDITION CONSIDERED POTENTIALLY UNSAFE 7 Fires Within Engine or APU If a subsequent occurrence could reasonably be expected to Fire Zones be uncontained. The potential fire intensity or duration may exceed fire zone containment criteria. Furthermore, latent failures or foreseeable crew errors could usually cause fire containment to be ineffective. Therefore, if such a condition is occurring in service, the uncorrected risk should be assessed to determine whether the condition is reasonably expected to result in one or more serious injuries. If it is, then the condition is unsafe and must be corrected.

Hazard ratios: In general, the effects of a fire contained within a fire zone are much more benign than the uncontained fires, which are covered in #6, above. The hazard ratios below are for fires that propagate out of the fire zone. They do not include events where the fire protection system was defeated by an uncontainment that subsequently caused a fire.

Fires within a fire zone Turboprops: 20 events; 4 level 3; 1 level 4; 0 level 5 LBPR TFs: 12 events; 1 level 3; 0 level 4 or 5 HBPR TFs: 90 events; 7 level 3; 0 level 4 or 5 APUs: 47 events; 8 level 3; 0 level 4 or 5 TP LBPR HBPR APU level 3+ HR .250 .083 .078 .170 level 4+ HR .050 - - - A8-13

AC 39-8 9/8/03 FAILURE CONDITION CONSIDERED POTENTIALLY UNSAFE Fires Within Engine or APU Fire Zones (continued) Tailpipe fires: Turboprops: 8 events (suspected under-reporting), 1 level 3 (uncontained fire); 0 level 4 or 5 Turbofans: 215 events; 1 level 3; 0 level 4 or 5 APUs: 28 events; 1 level 3 (one report of assumed uncontained fire); 0 level 4 or 5 TP TF APU level 3+ HR .125* .005 .036 * likely conservative due to under-reporting 8 Nacelle, Pylon, or APU If the resulting heating, pressurization, or debris could Compartment “Overheat” impact primary aircraft structure, critical system functions, Includes: Engine or APU Bleed or critical flight crew functions such that continued safe Air Duct Failure; Loss of flight and landing at an airport would be prevented.

Thermal Insulation, etc.

If Overheat could cause additional potential unsafe failure conditions (e.g., uncontained engine fire).

If the resulting heating, pressurization, or debris could leave the aircraft vulnerable to a foreseeable subsequent failure or crew error that would prevent continued safe flight and landing at an airport.

A8-14

9/8/03 AC 39-8 FAILURE CONDITION CONSIDERED POTENTIALLY UNSAFE Nacelle, Pylon, or APU Compartment “Overheat” (continued) Hazard ratios: All engine types: 972 reported air leaks/nacelle, etc., overheats (significant under-reporting); 0 level 3, 4 or 5 APUs: 242 reported overheats (under-reporting); 0 level 3, 4 or 5 Engine APU level 3+ HR <~ .001 <.004 9 Engine or APU Exhaust Gas For the same reasons identified for Nacelle, Pylon, or APU Impingement Compartment “Overheat”.

Hazard ratios: Data not reported. No known significant events.

A8-15

AC 39-8 9/8/03 FAILURE CONDITION CONSIDERED POTENTIALLY UNSAFE 10 Errant Magnitude or Direction If the resultant increase, loss, or asymmetry of airplane of Thrust Within Certified thrust render the aircraft incapable of continued safe flight Engine Operating Limits and landing at an airport. Total loss of thrust is the most common example of a potentially catastrophic failure Includes any errant thrust condition in this category. However, relatively small resulting from system faults or undetected thrust losses (over approx. 2-3 percent of crew errors, whether detected or airplane thrust) at powerset can significantly impact the undetected (e.g., over/under required runway distances and therefore, the ability to fueling, engine shutdown, errant perform safe takeoffs or aborts. Asymmetric thrust caused propeller control, errant thrust by a thrust run-up or an inadvertent thrust reversal on one reverser deployment, inlet flow engine could cause loss of aircraft directional control. Even separation, compressor stall, symmetric overthrust conditions could be potentially hazardously misleading catastrophic if they occur at an inopportune time or lead to indications, autofeather system the failure of multiple engines. Errant changes in thrust that failures, etc.) affect multiple engines are typically considered a potential unsafe condition. Multiple engine events that occur as a result of bird, ice, or other foreign object ingestion should be reviewed for any design implications with regard to assumed powerloss percent and frequency of occurrence.

A8-16 9/8/03 AC 39-8 FAILURE CONDITION CONSIDERED POTENTIALLY UNSAFE Errant Magnitude or Direction of Thrust (continued) Hazard ratios: Multiple engine small undetected thrust loss: Data not reportable by nature of the event. No known significant events.

------------------------------------------------------------------ Asymmetric thrust - throttle split: Data not reported. Unrecognized throttle split has led to 2 level 5 events during the time period (one during early climb, one during descent), both on HBPR turbofans.

A8-17 AC 39-8 9/8/03 FAILURE CONDITION CONSIDERED POTENTIALLY UNSAFE Errant Magnitude or Direction Asymmetric thrust – reverser deployment/inflight beta: of Thrust Within Certified Time period 1982-2000 Engine Operating Limits Turboprops: 4 reported events of inflight beta; 1 level 4; 3 (continued) level 5 (Note that these events are considered crew error due to inflight selection of beta mode. The rate of non- serious events due to inflight beta usage is unknown.)

Turbofans: includes significant partial deployments LBPR TFs: 18 events; 1 level 3; 1 level 4; 0 level 5 HBPR TFs: 34 events; 8 level 3; 0 level 4; 2 level 5 TP LBPR HBPR level 3+ HR 1.000 .111 .294 level 4+ HR 1.000* .056 .059 level 5 HR .750* - .059 * likely conservative due to under-reporting of base events Additionally, see the April 15th, 1992 AIA Committee report on “Criteria for Assessing Transport Turbojet Fleet Thrust Reverser System Safety”.

------------------------------------------------------------------- Asymmetric thrust – single engine reverser non- deployment/no beta on landing: Turboprops: 6 reported events (suspected significant under- reporting); 4 level 3; 0 level 4 or 5 Turbofans: 760 events (suspected under-reporting); 2 level 3; 2 level 4; 0 level 5 TP TF level 3+ HR - .005 level 4+ HR - .003 level 5 HR - - A8-18 9/8/03 AC 39-8 FAILURE CONDITION CONSIDERED POTENTIALLY UNSAFE Errant Magnitude or Direction Single engine IFSD/Powerloss: of Thrust Within Certified Turboprops: Base data not reported. There was 1 level 4 Engine Operating Limits (during approach) and 5 level 5 (1 takeoff, 1 rejected (continued) takeoff, 1 cruise, 1 approach, 1 approach/go-around) PSM+ICR events in the time period.

Note the data does not include propeller events reported under “Errant propeller control”, below.

Turbofans: 13,000 events in the time period. (This is under-reported due to incomplete participation.) During the same time period, there were 3 level 4 (2 during approach, 1 unknown regime) and 4 level 5 (1 takeoff, 1 RTO, 1 descent, 1 approach/go-around) PSM+ICR events following engine IFSD or powerloss. There were also 5 reported level 3 (1 takeoff, 3 rejected takeoffs, 1 approach) PSM+ICR events.

Note that due to level 3 PSM+ICR events likely being under-reported, hazard ratios are only presented for level 4+ events.

Turbofans: level 4+ HR <.001 level 5 HR <.001 A8-19 AC 39-8 9/8/03 FAILURE CONDITION CONSIDERED POTENTIALLY UNSAFE Errant Magnitude or Direction Overthrust: of Thrust Within Certified Base data not reported.

Engine Operating Limits Turboprops: 1 level 3 reported event (continued overspeed (continued) approach.) This event is considered a Propulsion System Malfunction Plus Inappropriate Crew Response (PSM+ICR) event.

Turbofans: 1 level 4 event (high-speed rejected takeoff/hull loss) in the data period. There are different opinions as to whether or not this event should be considered a Propulsion System Malfunction Plus Inappropriate Crew Response (PSM+ICR) event.

------------------------------------------------------------------ Errant propeller control: 76 events (suspected under-reporting); 1 level 3 (full reverse selected with pitchlocked propeller); 1 level 4 (hull loss after highspeed abort); 0 level 5. These are considered PSM+ICR events.

level 3+ HR .026 level 4+ HR .013* * likely conservative due to under-reporting of base events A8-20 9/8/03 AC 39-8 Hazard ratios – Multiple-engine events: TP LBPR HBPR ALL 3 4 5 ALL 3 4 5 ALL 3 4 5 Fuel * Environmental ** 12 4 1 2 7 4 0 1 36 6 0 0 .583 .250 .167 . 714 .143 .143 .167 Maintenance 0 0 0 0 0 0 0 0 7 2 3 0 .714 .429 Autothrottle 0 0 0 0 0 0 0 0 3 0 0 0 Other/unknown 1 0 1 0 7 4 1 1 26 6 0 0 1.000 1.000 .857 .286 .143 .231 * Under Failure Condition #16, below ** Icing, turbulence/stability, rain/hail, lightning, bird ingestion A8-21 AC 39-8 9/8/03 Hazard ratios - Total Powerloss: TP LBPR HBPR ALL 3 4 5 ALL 3 4 5 ALL 3 4 5 Fuel * 9 0 6 3 5 0 3 2 3 0 3 0 1.000 1.000 .333 1.000 1.000 .400 1.000 1.000 Environmental ** 9 3 1 2 1 0 0 1 5 4 0 0 .667 .333 .222 1.000 1.000 1.000 .800 Oil system maintenance 0 0 0 0 0 0 0 0 3 0 3 0 1.000 1.000 Other/unknown 1 0 1 0 3 2 1 0 8 2 0 0 1.000 1.000 1.000 .333 .250 * Exhaustion, mismanagement or contamination (applicable events from #16, below) ** Icing, turbulence/stability, rain/hail, lightning Note that oil system maintenance level 4 events were powered imminent landings.

Hazard ratios – Ratio of level 5 to level 4+ events given non-recovered total powerloss: A. From table above, data 1992-2000 TPs: 5 level 5 out of 13 level 4+ = .385 TFs: 3 level 5 out of 10 level 4+ = .300 LBPR: 3 level 5 out of 7 level 4+ = .429 HBPR: 0 level 5 out of 3 level 4+ = B. Data period 1982 – 2000 TPs: 8 level 5 out of 35 level 4+ = .229 TFs: 10 level 5 out of 21 level 4+ = .476 LBPR: 9 level 5 out of 14 level 4+ = .643 HBPR: 1 level 5 out of 7 level 4+ = .143 A8-22

9/8/03 AC 39-8 FAILURE CONDITION CONSIDERED POTENTIALLY UNSAFE 11 Engine or APU Overspeed If it could lead to an Uncontained Engine Rotor Failure.

If it could lead to an unsafe change in the magnitude of thrust.

Hazard ratios: Turboprops: Data not reported.

Turbofans: 447 reported overspeeds 401 control system failures – 0 uncontainments; none were reported above 120 percent redline (some unknown) 46 torque path failures – 23 uncontainments; 0 level 3, 4 or 5 APUs: 63 reported overspeeds 4 due to de-ice fluid ingestion – 1 uncontainment 10 torque path failures – 0 uncontainments 49 control system failures – 0 uncontaiments Uncontainment HR (NOT level 3; multiply this HR by the level 3+ hazard ratios under Failure Condition #2, above): TF APU Control system failure overspeeds: <.003 <.020 Torque path failure overspeeds: .500 - De-ice fluid ingestion overspeeds: - .250 A8-23

AC 39-8 9/8/03 FAILURE CONDITION CONSIDERED POTENTIALLY UNSAFE 12 Hazardously Misleading If an inappropriate, errant or missing indication is Powerplant or APU Indications reasonably expected to elicit a hazardous crew response, including inaction.

See: Errant Changes in the Magnitude or Direction of Thrust Within Certified Operating Limits; Engine or APU Overspeed; and Uncontained Engine Fire. Misleading displays can create other potentially unsafe conditions (e.g., if a fire or overlimit condition on one engine is indicated as being on a different engine, the affected engine will not get the needed crew attention and a good engine is likely to be shutdown. If the primary powersetting parameter on all engines reads low at powerset, this can significantly impact the required runway distances and therefore, the ability to perform safe takeoffs or aborts. If all main engine displays are lost and the engine controls do not have inherent limits protection, then changing flight conditions can result in unaccommodated overlimit conditions on all engines.

Misleading fuel quantity indications can lead to potentially unsafe conditions associated with fuel mismanagement.)

A8-24

9/8/03 AC 39-8 FAILURE CONDITION CONSIDERED POTENTIALLY UNSAFE Hazardously Misleading Powerplant or APU Indications (continued) Hazard ratios: Turboprops: 268 reported events (under-reporting); 0 level 3 or 4; 1 level 5 (false oil pressure warning; engine throttled; airplane configuration not properly handled; high-drag go- around led to crash). Note that the false indication itself did not lead directly to the accident. Improper handling of the airplane’s energy state with one engine at idle and propeller not feathered.

Turbofans: Over 9000 reported events (under-reporting), of which approximately 7000 were false indications; 0 level 3, 4 or 5. (While there were no high level events during the data period, one prior level 5 event occurred when the crew disagreed over the interpretation of erroneous engine indications and takeoff was continued with inadequate thrust.)

Note that Propulsion System Malfunction plus Inappropriate Crew Response (PSM+ICR) level 3 and lower events are likely under-reported.

TP TF level 4+ HR .004* <<.001 level 5 HR .004* <<.001 * likely conservative due to under-reporting of base events A8-25

AC 39-8 9/8/03 FAILURE CONDITION CONSIDERED POTENTIALLY UNSAFE 13 Loss of Inflight Restart If not detectable within one flight. All engine out conditions Capability on Critical Number are sufficiently common that the inability to restart at least of Engines the critical number of engines (i.e., one engine on a twin and two engines on a tri or quad) is considered a potential unsafe condition.

Hazard ratios: Data not reported. The hazard ratios below are for total powerloss events contained elsewhere in this appendix where the engines were theoretically restartable (thus, these events do not include fuel exhaustion, engine hardware failure, etc.) These hazard ratios should therefore be used against complete, potentially recoverable powerloss combined with inability to relight the critical number of engines.

The only level 4 or 5 event involved incorrect use of emergency procedures.

Note that level 3 events are due to altitude loss until relight capability (e.g., descent from cruise after icing flameouts).

Self-recovering events are not included.

Turboprops: 4 reported events; 1 level 3; 0 level 4; 1 level 5 LBPR TFs: 2 events; 2 level 3; 0 level 4 or 5 HBPR TFs: 8 events; 5 level 3; 0 level 4 or 5 TP LBPR HBPR level 3+ HR .500 1.000 .625 level 4+ HR .250 - - level 5 HR .250 - - A8-26

9/8/03 AC 39-8 FAILURE CONDITION CONSIDERED POTENTIALLY UNSAFE 14 Excessive Fuel Tank If the resulting differential pressure could impact primary Differential Pressures structure, critical system functions, or critical flight crew functions such that continued safe flight and landing at an Includes failures and errors airport would be prevented (errant refueling, defueling, fuel associated with refueling, vent failures, fuel tank vapor ignition, etc., could result in defueling, fuel transfer, fuel differential pressures across a fuel tank wall that lead to jettison, fuel feed, fuel tanks, etc. failure of primary structure or critical systems.)

If excessive fuel tank differential pressures could cause additional potential unsafe conditions (resulting fuel leaks could lead to uncontained fire, equipment contamination, vapors in the cabin, etc.)

Hazard ratios: Data not reported. No known significant events due to fire, contamination or vapors. 2 level 5 fuel tank explosions/ruptures within the time period.

15 Fuel Load Imbalance If the resulting imbalance could impact primary structure, aircraft handling qualities, performance, or range such that Includes failures and errors continued safe flight and landing at an airport is prevented associated with refueling, (errant refueling, defueling, fuel transfer, leaking or trapped defueling, fuel transfer, fuel fuel, vent failures, etc., could cause critical changes in jettison, fuel feed, fuel tanks, etc. aircraft longitudinal or lateral CG, or both).

Hazard ratios: Data not reported. No significant events known due to fuel load imbalance/CG issues.

A8-27

AC 39-8 9/8/03 FAILURE CONDITION CONSIDERED POTENTIALLY UNSAFE 16 Loss of Adequate Engine If the fuel feed and thrust required for continued safe flight and Fuel Feed landing cannot always be restored in the altitude available (total fuel starvation can occur due to leaking or trapped fuel, Includes failures and errors inadequate initial fuel loading, over jettisoning, fuel boost or associated with refueling, feed failures, etc.)

defueling, fuel transfer, fuel jettison, fuel feed, fuel tanks, etc., which can lead to total or partial fuel starvation Any other time the failure affects multiple engines.

Hazard ratios – Multiple Engine Fuel Problems: TP LBPR HBPR ALL 3 4 5 ALL 3 4 5 ALL 3 4 5 Fuel contamination * 0 0 2 1 0 0 0 4 0 1 0 * * * .250 .250 Fuel mismanagement * 0 1 0 2 0 1 0 14 1 0 0 * * * .500 .500 .071 Fuel exhaustion 6 0 5 1 4 0 2 2 2 0 2 0 1.000 1.000 .167 1.000 1.000 .500 1.000 1.000 * Incomplete reporting.

Note that fuel exhaustion leads to at least a level 4a (forced landing). Fuel contamination/mismanagement affecting multiple engines is sometimes recoverable; hence the hazard ratios are less than 1.0.

A8-28

9/8/03 AC 39-8 FAILURE CONDITION CONSIDERED POTENTIALLY UNSAFE 17 Flammable Fluid Leakage If the resulting ignition, equipment or cockpit contamination, etc., could impact primary aircraft structure, critical system functions, or critical flight crew functions such that continued safe flight and landing would be prevented (e.g., leaking fuel onto critical equipment could result in equipment malfunction or create an uncontained fire condition; fuel vapor in the cockpit could significantly impair crew abilities).

If vapors from the leakage could spread into the aircraft cabin and causing serious injuries to occupants.

If leakage could create an additional potential unsafe condition (fuel leakage can lead to loss of fuel feed, fuel load imbalance; fuel vapor ignition can result in uncontained fire, etc.)

Hazard ratios: Oil/hydraulic fluid leaks: Does not include multi-engine oil leaks due to maintenance error.

Turboprops: 405 reported events (incomplete reporting of base events in database); 0 level 3, 4 or 5 Turbofans: 1796 reported fuel leaks; 0 level 3, 4 or 5 TP TF level 3+ HR <.002* < .001 * conservative due to under-reporting of base events A8-29

AC 39-8 9/8/03 FAILURE CONDITION CONSIDERED POTENTIALLY UNSAFE 17 Flammable Fluid Leakage (continued) Fuel leaks: All high-level events were due to fuel leakage.

All were related to uncontained fires, including 1 hull loss (no fatalities) due to fire from a fuel leak. There were no cases within the data period of forced landings (level 4a) due to fuel exhaustion from a fuel leak; however, there has since been such an instance.

Note that all the level 3 and higher fires (and possibly all fires from fuel leaks) occurred below 10,000 feet (ground, takeoff/early climb or landing).

Turboprops: 63 reported events (incomplete reporting of base events in database); 3 reported level 3 (uncontained fires); 0 level 4 or 5 Turbofans: 2756 reported fuel leaks; 14 level 3 (uncontained fire); 1 level 4 (hull loss due to fire); 0 level 5 TP TF level 3+ HR .048* .005 level 4+ HR - <.001 level 5 HR - <.001 * conservative due to under-reporting of base events A8-30

9/8/03 AC 39-8 FAILURE CONDITION CONSIDERED POTENTIALLY UNSAFE 18 Smoke or Toxic Products in the If smoke or toxic products could significantly impair the Cabin health of any passenger or crew, the ability of any flight crew member to perform their duties, or any critical aircraft function (for example, cause critical contamination of a system, corrosion of primary structure) Hazard ratios: Several thousand reported events of engine or APU fumes 2 level 3 (significant distress/difficulty reading instruments) reported; 0 level 4 or 5 level 3+ HR <.001 Note that non-propulsion-related smoke in the cockpit has contributed to at least one level 5 event.

A8-31