Monitor Safety/Analyze Data

ORDER U.S. DEPARTMENT OF 8110.107B TRANSPORTATION FEDERAL

CHANGE

CHG 1 AVIATION ADMINISTRATION Effective Date: National Policy SUBJ: Monitor Safety/Analyze Data 1. Purpose. This change incorporates requirements from the Aircraft Certification, Safety, and Accountability Act (ACSAA) of 2020, as well as recommended changes from the National Academies of Sciences, Engineering, and Medicine (NASEM).

2. Who this change affects. This change affects all FAA Aircraft Certification Service (AIR) and Flight Standards Service (FS) staff responsible for acquiring, analyzing, and monitoring continued operational safety (COS) data from design approval holders (DAH) and production approval holders (PAH), as well as for addressing aircraft safety risks.

Note: FS acquires and analyzes COS data and monitors safety in accordance with FAA Order 8900.1, Flight Standards Information Management System . This order addresses AIR responsibilities and FS staff that support those AIR responsibilities.

3. Explanation of Changes. The FAA has removed references to the now-decommissioned MSAD tool, updated composition of the corrective action review board, addressed uncertainty in risk calculations, added expectations when calculating risk for special missions, clarified that the MSAD process can be used for light-sport category aircraft, added incremental improvements to our cybersecurity process, and incorporated FAA organizational changes.

4. Disposition of Transmittal Paragraph. Retain this transmittal sheet until this Directive is canceled by a new Directive.

Distribution: Electronic Initiated by: AIR-633 8110.107B Chg 1 PAGE CHANGE CONTROL CHART Remove Pages Dated Insert Pages Dated ii-iv 10/13/23 ii-iv 1-1 10/13/23 1-1 dd 1- A 2 2-1;2-13 10/13/23 2-1;2-13 2-15 (thru 2-24) 10/13/23 2-15 (thru2-24) 2-27; 2-28 10/13/23 2-27; 2-28 3-1 (thru 3-3) 10/13/23 3-1 (thru 3-3) 4-1 (thru 4-3) 10/13/23 4-1 (thru 4-3) 5-1;5-2 10/13/23 5-1;5-2 A-1 (thru A-6) 10/13/23 A-1 (thru A-6) Add A-7 (thru A-8) B-1 (thru B-2) 10/13/23 B-1 (thru B-2) C-1 10/13/23 C-1 D-1 (thru D-2) 10/13/23 D-1 (thru D-2) Add D-3 E-1 10/13/23 E-1 G-1 10/13/23 G-1 Daniel J. Elgas Aviation Safety Director, Policy and Standards Division, Aircraft Certification Service ii

ORDER

8110.107B

National Policy Effective Date: 10/13/2023 SUBJ: Monitor Safety/Analyze Data This order describes how the Aviation Safety Organization (AVS) staff use the Monitor Safety/Analyze Data (MSAD) process within the Aircraft Certification Service (AIR) Safety Management System (SMS) to help identify safety issues and manage risk in aviation products throughout their life cycle.

In addition, this order discusses the use of the companion MSAD information technology (IT) tool designed to support these procedures and the minimum requirements needed for use of alternative IT tools.

In this revision, the FAA incorporates requirements from the Aircraft Certification, Safety, and Accountability Act (ACSAA) of 2020 and the Cybersecurity Information Sharing Act (CISA) of 2015, as well as recommended changes from the National Academies of Sciences, Engineering, and Medicine (NASEM).

//signed// Michael J. Kaszycki for Daniel J. Elgas Director, Policy and Standards Division Aircraft Certification Service Distribution: Electronic Initiated by: AIR-633 8110.107B Chg 1 Table of Contents Paragraph ................................................................................................................................ Page Chapter 1. General Information............................................................................................... 1-1 1. Purpose. ....................................................................................................................... 1-1 2. Audience. ..................................................................................................................... 1-1 3. Where to Find This Order. .......................................................................................... 1-1 4. What This Order Cancels. ........................................................................................... 1-1 5. Explanation of Policy Changes. .................................................................................. 1-1 6. Identifying Requirements in This Order. .................................................................... 1-2 7. Definitions for Branches and Sections. ....................................................................... 1-2 Chapter 2. MSAD Process ......................................................................................................... 2-1 1. MSAD Process within SMS. ....................................................................................... 2-1 2. Range of the MSAD Process. ...................................................................................... 2-4 3. Special Considerations for ASISP and SSI Hazards. .................................................. 2-4 4. MSAD High-Level Overview. .................................................................................... 2-5 5. MSAD Detailed Process Flow. ................................................................................... 2-6 6. Step 1 - Acquire Data. ................................................................................................. 2-9 7. Step 2 - Identify Hazard(s) and Perform Preliminary Risk Assessment. .................... 2-9 8. Step 3 - Initiate Immediate Corrective Action. ......................................................... 2-12 9. Step 4 - Perform Risk Analysis. ................................................................................ 2-15 10. Step 5 - Corrective Action Review Board. ................................................................ 2-18 11. Step 6 - Determine if Causal Analysis is Required. .................................................. 2-21 12. Step 7 - Perform Causal Analysis.............................................................................. 2-22 13. Step 8 - Document the Cause(s). ............................................................................... 2-22 14. Identifying Contributing Factors. .............................................................................. 2-23 15. Step 9 - Evaluate and Select Mitigation for a Fleet Issue. ........................................ 2-23 16. Step 10 - Submit to AIR Process Owner for Further Analysis. ................................ 2-27 17. Step 11 - Submit Cause to Certificate Oversight Process. ........................................ 2-27 ii 8110.107B Chg 1 18. Step 12 - Document and Submit Issue to FAA Organization Outside of AIR. ......... 2-27 19. Step 13 – Initiate AD, SAIB, or other Mitigation Process. ....................................... 2-27 20. Step 14 – Prepare Internal Feedback to MSAD Process Owner (optional). ............. 2-28 21. Step 15 - Prepare Lessons Learned (optional)........................................................... 2-28 Chapter 3. Follow-On and Trending........................................................................................ 3-1 1. Monitor and Validate................................................................................................... 3-1 2. Trending. ..................................................................................................................... 3-1 Chapter 4. Applying MSAD to Foreign Products ................................................................... 4-2 1. Introduction. ................................................................................................................ 4-2 2. Addressing MCAI. ...................................................................................................... 4-2 3. Addressing Events. ...................................................................................................... 4-0 Chapter 5. Exceptions ................................................................................................................ 5-1 1. Exceptions. .................................................................................................................. 5-1 2. Applicability. ............................................................................................................... 5-1 3. Public Use and Military Aircraft. ................................................................................ 5-1 4. Optional Steps. ............................................................................................................ 5-2 5. Requirements Still in Effect ........................................................................................ 5-2 Chapter 6. Administrative Information................................................................................... 6-1 1. Distribution.................................................................................................................. 6-1 2. Authority to Change This Order. ................................................................................. 6-1 3. Suggestions for Improvement. .................................................................................... 6-1 4. Records Management. ................................................................................................. 6-1 Appendix A. Definitions and Acronyms ................................................................................. A-1 Appendix B. Related Publicationss ..........................................................................................B-1 Appendix C. Risk Assessment Methodologies ........................................................................ C-1 iii 8110.107B Chg 1 Appendix D. Potential Data Sources ....................................................................................... D-1 Appendix E. COS IT Tool Process ...........................................................................................E-1 Appendix F. MSAD Process Interactions ................................................................................E-1 Appendix G. FS Roles and Responsibilities in Support of MSAD Process ......................... G-1 1. ACSA and GASA. ...................................................................................................... G-1 2. Safety Analysis and Promotion Division, AFS-900. .................................................. G-1 3. AED, AFS-100. .......................................................................................................... G-1 Appendix H. Directive Feedback Information ....................................................................... G-1 iv

8110.107B Chg 1 Chapter 1. General Information 1. Purpose. This order explains how to use the MSAD process to analyze continued operational safety (COS) data and monitor safety in aircraft fleets throughout their life cycle.

2. Audience. All FAA AIR and Flight Standards Service (FS) staff responsible for acquiring, analyzing, and monitoring COS data, as well as addressing aircraft safety risks.

Note: FS acquires and analyzes COS data and monitors safety in accordance with FAA Order 8900.1, Flight Standards Information Management System . This order addresses AIR responsibilities and FS staff that support those AIR responsibilities.

3. Where to Find This Order. You can find this order on the FAA employee website, on the FAA public website, and in the FAA Dynamic Regulatory System (DRS).

4. What This Order Cancels. This order cancels FAA Order 8110.107A, Monitor Safety/Analyze Data , dated October 1, 2012.

5. Explanation of Policy Changes. This revision includes the following changes: a. Updates information based on ACSAA/National Academy of Sciences, Engineering and Medicine recommendations.

b. Adds sensitive security items and cybersecurity information.

c. Adds instructions to send TARAM information to Congress for certain fatal transport airplane accidents under Section 130(c) of the FAA ACSAA.

d. Aligns terminology with higher-level FAA Safety Risk Management (SRM) orders, such as Order 8040.4, Safety Risk Management Policy .

e. Adds AIR organizational changes.

f. Incorporates deviations related to 8110.107A.

g. Removes references to the now-decommissioned MSAD IT tool.

h. Updates the composition of the CARB.

i. Adds expectations when calculating risk for special missions.

j. Clarifies that the MSAD Process can be used for light-sport category aircraft.

1-1 8110.107B Chg 1 k. Addresses uncertainty in risk calculations.

6. Identifying Requirements in This Order. In this order, the use of the word “must” means a required or mandatory action(s) or step(s). The use of the word “will” does not mean a requirement. If you do not see the word “must” in a sentence, then the authors of this document did not intend it to be a requirement; there are no inferred requirements. When using this order, if you cannot meet a requirement in this order for any reason, you must contact the Organization and System Policy Branch (AIR-630) to request a deviation from the requirement before making any local interpretations or workarounds. A deviation typically drives improvements to future revisions of this order.

7. Definitions for Branches and Sections.

a. References to “certification branch” include branches and sections responsible for performing operational safety, COS, flight test and human factors, certification, or validation in the Integrated Certificate Management Division (AIR-500) or Compliance and Airworthiness Division (AIR-700).

b. References to “certificate management branch” or “CM branch” include branches responsible for the production approval and oversight aspects of this policy within AIR-500 and the System Oversight Division (AIR-800).

c. References to “certificate management section” or “CM section” include sections responsible for the production approval and oversight aspects of this policy within AIR-500 and AIR-800.

8. Disclosure. If this order is utilized by persons other than the FAA or the Administrator’s designees, it is a guidance document. Its content is not legally binding in its own right and will not be relied upon by the Department as a separate basis for affirmative enforcement action or other administrative penalty. Conformity with the guidance document is voluntary only.

Nonconformity will not affect rights and obligations under existing statutes and regulations.

1-1

8110.107B Chg 1 Chapter 2. MSAD Process 1. MSAD Process within SMS. The MSAD process addresses a major component of how AIR fulfills its part of the FAA’s State Safety Program (SSP) under Annex 19 issued by the International Civil Aviation Organization (ICAO). The FAA established the following orders directing its personnel to implement SMS policy and requirements: FAA-level • Order 8000.369, Safety Management System .

• Order 8040.4, Safety Risk Management Policy .

• Order 8040.6, Unmanned Aircraft Systems (UAS) Safety Risk Management (SRM) Policy.

AVS-level • Order VS 8000.367, AVS Safety Management System (AVSSMS) Requirements .

• Order VS 8000.370, Aviation Safety ( AVS) Safety Policy .

• Order 8000.377, Flight Standards Safety Management System (FSSMS) Requirements.

Service-level • Order 8000.368, Flight Standards Service Oversight .

• Order 8110.107, Monitor Safety/Analyze Data .

a. Purpose of the MSAD Process. This order addresses the COS component of AIR’s SMS process through the interrelated Safety Assurance (SA) and SRM functions, as shown in figure 1 “SA and SRM processes (from FAA Order 8040.4)”. The FAA, through the MSAD process, obtains, reviews, analyzes, and trends aviation safety data to help the FAA identify hazards associated with an aircraft that increase risk to an unacceptable level and mitigate safety risks across the fleet. This process also identifies other causes of hazards that cannot be addressed by aircraft fleet mitigations. Hazards that originate inside the purview of AVS but have a potentially systemic effect that impacts other FAA lines of business (LOB), should be worked with the FAA SMS Committee (see Order 8000.369), which helps coordinate hazards across LOBs and staff offices.

b. SRM within AVS. For safety investigations that remain within AVS, FAA Order 8040.4 permits AIR to use the MSAD process instead of nominating the safety issue for review by a cross - LOB team through Hazard Identification, Risk Management, and Tracking (HIRMT). This includes using AIR’s risk assessment methodologies, such as Transport Airplane Risk Assessment Methodology (TARAM) and Advisory Circular (AC) 39-8.

2-1 8110.107B Chg 1 Note: Information regarding AIR’s risk assessment methodologies can be found in appendix C of this order.

c. Sensitive Security Information (SSI) Investigations. SSI investigations require a dedicated and more restricted process. These investigations may include safety and security investigations (SaSI). This process parallels more routine SRM investigations but limits the personnel involved and restricts access to data.

Note: AVS employees should work with Security and Hazardous Materials Safety (ASH) organization through a Safety Program Branch (AIR-360) liaison for SSI investigations.

d. Cybersecurity/Aircraft System Information Security Protection (ASISP) Issues. For purposes of this order, the FAA is concerned with cybersecurity issues that are related to ASISP, which addresses aircraft system information security threats to aircraft, engine, and propeller system equipment and networks due to intentional unauthorized electronic interaction (IUEI).

IUEI is a circumstance or event with the potential to affect the aircraft due to human action resulting from unauthorized access, use, disclosure, denial, disruption, modification, or destruction of information and/or aircraft system interfaces. Note that this includes the consequences of malware and forged data and the effects of external systems on aircraft systems but does not include physical attacks or electromagnetic disturbance. Safety investigations related to IUEI cybersecurity issues also require similar handling as SSI.

Note: For additional information, FAA personnel may contact any Policy and Standards Division (AIR-600) cybersecurity or ASISP specialist, including in the Cybersecurity Section (AIR-628). IUEI is defined within Radio Technical Commission for Aeronautics (RTCA) document DO-356, Airworthiness Security Methods and Considerations .

e. COS Information Technology (IT) Tool. Many of the activities within the MSAD process rely on COS IT tools for tracking and recordkeeping purposes. Refer to the Integration and Performance Branch (AIR-740) for further details on official recordkeeping location and tool.

2-2 8110.107B Chg 1 Figure 1. SA and SRM Processes (from FAA Order 8040.4) Note: Revision B and Change 1 added the term “System” to “Conformance”/“Nonconformance” from Order 8040.4 to differentiate from production or design conformance and emphasize the functional impact at a system level.

2-3 8110.107B Chg 1 2. Range of the MSAD Process. The FAA uses the MSAD process to obtain and analyze data, including in-service fleet data, data collection tools (DCT), and other data sources, to help identify hazards, determine mitigations, and identify mandatory safety risk controls. ASEs and ASIs might use the MSAD process for any aviation product or appliance, including light-sport, experimental light-sport, and other experimental aircraft. If warranted, the FAA issues corrective actions, such as airworthiness directives (AD), special airworthiness information bulletins (SAIB), and other mitigations. If corrective actions are issued through the rulemaking process, refer to the appropriate order listed in appendix B.

a. The MSAD process also interfaces with other AIR and non-AIR FAA processes. For example, aviation safety engineers (ASE) and aviation safety inspectors (ASI) who oversee the activities or certificates held by a design approval holder (DAH) might analyze product design, production, operations, and maintenance process data to identify areas of risk within a DAH’s product, as well as mitigations that reduce aircraft fleet risks. FS staff who oversee operational certificate holders, such as airlines, for-hire companies, and repair agencies, analyze the effectiveness of the certificate holders’ technical processes. The exchange of data and product related risks between FS, Safety Management and Research Planning Division (AVP-300), AIR, and other organizations is essential to ensure detection of previously undetected hazards.

Note: For an example of information obtained in DCTs that could be useful to AIR ASEs, refer to FAA Order 8900.1, Volume 10, Chapter 8, Section 1, Safety Assurance System: Certificate Holder Evaluation Process . DCTs can be useful in monitoring implementation of hazard mitigations, the rate of implementation of ADs, operational performance of novel or unusual design features, and any other attribute that would benefit from monitoring the operations and maintenance. For the range of interfaces between the MSAD process and other FAA processes, see appendix F.

b. AIR should continue to foster the integration, such as via voluntary COS agreements, of the DAH’s and MSAD’s process wherever possible in a manner that is compatible with this order. In those instances, the DAH might accomplish many of the steps defined in this order to address the safety of their products by using existing product risk assessment methodologies. The certification branch ASEs perform an oversight role.

3. Special Considerations for ASISP and SSI Hazards. Both ASISP and SSI hazards within AIR follow the same SA/SRM steps outlined by the MSAD process and involve similar personnel. However, the data and details of the investigation must be restricted compared to routine SRM investigations. Depending on the sensitivity and security of the topic and as determined on a case-by-case basis, an investigation could be handled completely outside of the MSAD process. An ASISP specialist within AIR-600, such as from the Cybersecurity Section (AIR-628), would make the determination.

a. All FAA personnel have a duty to protect sensitive unclassified information by using protective measures to safeguard IUEI and SSI data from uncontrolled release outside the FAA and indiscriminate dissemination within the FAA. This will ensure only authorized FAA personnel will be given access to systems necessary to do their job. FAA personnel must have a need to know before being given access to IUEI and SSI data.

2-4 8110.107B Chg 1 b. Safety investigations that relate to national transportation safety or security issues fall within the scope of FAA Order 1600.75, Protecting Sensitive Unclassified Information (SUI) , and are defined as SSI in title 49, Code of Federal Regulations (49 CFR) 1520.5. SSI is a designation unique to the operating administrations of the Department of Transportation and Department of Homeland Security. It applies to information the FAA obtains or develops while conducting security activities, including research and development activities. Unauthorized disclosure of SSI would: • Constitute an unwarranted invasion of privacy (including, but not limited to, information contained in any personnel, medical, or similar file); • Reveal trade secrets or privileged or confidential information obtained from any person; or • Be detrimental to transportation safety or security.

4. MSAD High-Level Overview. The MSAD process provides a data-driven, risk-based approach for SA and SRM that supports aviation products throughout their life cycle. An ASE following the MSAD process will perform both a risk and causal analysis of the potential hazard that led to the issue. An AD, SAIB, other mitigation, or recommendations may be initiated at several points within the MSAD process. Event data, hazard information, risk analysis, causal analysis, and mitigation data is stored as a record for future use in accordance with FAA Order 1350.14, Records Management .

Note: Figure 2 is a high-level overview of the entire MSAD process. Although the components are displayed sequentially, there may be situations where portions of the process are worked concurrently or out of sequence.

2-5 8110.107B Chg 1 Figure 2. High-Level View of MSAD Note: The numbers in parenthesis below refer to the chapter and paragraph in this order where the topic is discussed in more detail. For example, 2.6 indicates chapter 2, paragraph 6.

If hazard Step 3: Initiate Immediate Corrective Action (2.8) is urgent (Steps 4-8 are still performed. See Figure 3 for details.)

Step 2: Identify Steps 9-11: Hazard and Evaluate, Select & Step 5: Corrective Step 1: Acquire Step 4: Perform Steps 6-8: Identify Perform Implement Action Review Data Risk Analysis Causes Preliminary Risk Mitigation for a Board (2.6) (2.9) (2.11-13) Assessment Fleet Issue (2.10) (2.7) (2.15-17) Disturbances, system Follow On and changes, etc.

Trending (of risk mitigations) (3.1-2) Risk is reduced as risk mitigations are incorporated Feedback Loop (data generated from fleet) into the affected fleet 5. MSAD Detailed Process Flow. Figure 3 shows the entire MSAD process, with each step described in the paragraphs noted within the figure.

2-6 8110.107B Chg 1 Figure 3. MSAD Process Flow – Page 1 START Numbers in boxes indicate the step in the Automation & MSAD process.

manual entry Event data 1. Acquire Data 2.Identify Hazards and Link B: Perform Monitor & Preliminary Validate Risk (Fig 8) Assessment Non-safety Results?

issue Multiple paths can be taken, for example, “Potentially Unsafe” and “Potential SRM” Unsafe & Urgent Potentially Unsafe Potential Aerospace Emergency AD Potential IUEI and/or SSI ASE System Level SRM or “Final Rule; 3. Initiate request for Emergency AD comment” ASE or IAR process information ASE Engage limited access Nominate a SRM per protocols, coordinate COS PM/Focal Order 8040.4 with AIR-620 (also initiate risk analysis) Convene a CARB ASE Product-specific risk 4. Conduct analysis Risk product-based methodologies & analysis quantitative risk decision guidelines results analysis (Fig 4) Link C: MCAI (Figs 9 & 10) Is risk at COS PM or above 2/3 of the Record results & Risk guidelines mandatory corrective No rationale for action risk decision(s) guideline?

Yes COS PM/Focal CARB: Corrective Action Review Board 5. Convene a CARB (Multiple CARBs might be required) A END Note : See chapter 3 for details on link B, chapter 4 for details on link C, and see figure 4 for details on step 4.

2-7 8110.107B Chg 1 Figure 3. MSAD Process Flow - Page 2 A Criteria for when to conduct a causal analysis (any one or more): 6. Determine 1. Is the safety issue cause(s) unclear?

NO if causal analysis 2. Was previous mitigation ineffective?

required 3. Does the CARB recommend a causal analysis be performed?

YES ASE Causal analysis 7. Perform results causal analysis ASE Cause(s) 8. Document the cause(s) Causal analysis can reveal multiple types Cause of causes. Select all paths that apply.

Type(s)?

Product/Part cause Other cause types ASE AD, SAIB, or 9. Evaluate & other mitigation select safety action decision security risk A causal analysis can reveal multiple types control of causes. Select all causes that apply.

People/process AD, SAIB, or Internal AIR process or people cause issue other mitigation ASE documentation ASE action 10. Submit to process owner for further analysis 13. Initiate AD, SAIB, or other mitigation DAH or Production Certificate Holder cause Process issue Link B process ASE Monitor & documentation validate (Ch. 3) 11. Submit cause to certificate oversight process ASE 14. Prepare Maintenance, operations, air traffic cause Other FAA Feedback internal ASE organization issues feedback to 12. Document & submit issue to other FAA documentation MSAD process organization owner (optional) ASE COS Lessons 15. Prepare COS Learned lesson learned as necessary END 2-8 8110.107B Chg 1 6. Step 1 - Acquire Data.

a. Data Acquisition. ASEs have many sources of data to use for their analyses, including FAA databases focusing on event information. A partial list of data sources, which include failure, malfunction, and defect data, can be found in appendix D. Not all event data needs to be analyzed through the complete MSAD process (see paragraph 7 of this chapter).

Note: ASIs and ASEs must report any hazard meeting the definition of a suspected unapproved part, as described in FAA Order 8120.16, Suspected Unapproved Parts Program .

b. Data Sharing. To address these hazards, ensure that data and information is communicated between AIR, FS, and other organizations: (1) AIR must share data , and any product-related risks identified with Safety Analysis Program Office (AFS-930). AFS-930 is responsible for analyzing and detecting hazards regarding the inspection and maintenance programs through FS’s Safety Assurance System (SAS).

(2) AIR must review information coming from FS’s SAS and use DCTs that AIR creates to track mitigations for design deficiencies at the operator and maintenance level.

c. SA and SRM Reviews. The AIR certification and CM branches are responsible for conducting SA and SRM reviews for hazards on products for which they have oversight responsibility. In addition, they must coordinate with other FAA offices, such as CM sections or Operational Safety Branch (AIR-720), when, for example, a nonconformance is discovered, or with AIR-720 if multiple products are involved.

Note: SA and SRM reviews should not be considered complete until all AIR certification branches involved have completed their review and taken appropriate action. Sometimes more than one office might need to remedy hazards related to a single event.

7. Step 2 - Identify Hazard(s) and Perform Preliminary Risk Assessment. A preliminary risk assessment is used to triage incoming events to identify the hazard and determine how the events should be handled based on their type and potential severity using any available data. It is preferred to minimize single point safety decisions by doing multi-discipline assessments when resources permit. This assessment might be performed by a group of ASEs, such as a triage board or a standing safety oversight council. If a group assessment is performed, a cognizant senior ASE for the engineering discipline most affected by the event must participate. The senior ASE or group of ASEs must address the questions outlined in table 1. Please keep in mind that more than one action might be required (e.g., a hazard might need immediate action and be considered for FAA SRM).

2-9 8110.107B Chg 1 New information received might change the assessment of an issue for some questions in table 1.

This table may also be referred to at a later point of an investigation, as it might not be possible to answer the question(s) without more information.

2-10 8110.107B Chg 1 Table 1. Preliminary Risk Assessment Questions and Required Actions Questions: Required action if the answer is “yes”: Does an urgent unsafe You must immediately assign it to an ASE and put together an emergency condition exist that requires Corrective Action Review Board (CARB) to initiate urgent action, such as an immediate corrective action, emergency AD or IAR (see step 3). Once that action is complete, continue to such as an emergency AD or step 4 and conduct risk analysis to determine the risk posed by the hazard.

immediately adopted rule Note: Urgent action requires immediate briefing to management, for (IAR) (issued as a “final rule; communication up to executive management, and to discuss next steps to request for comment”)?

prevent catastrophic accidents. This typically requires additional actions not covered by the MSAD process.

Does this hazard potentially You must contact a liaison for Office of National Security Programs and contain SSI? Incident Response (AXE) through the SSI or ASISP specialist in AIR-600 who might determine that the hazard should be handled outside of the MSAD COS process for certain cybersecurity issues. It is recommended that AIR-500 and/or AIR-700, after coordinating with AIR-600, communicate(s) final risk mitigations with other ASEs and ASIs, if it is deemed appropriate and necessary to do so.

Does this hazard potentially You must contact a cybersecurity or ASISP specialist from AIR-600 if, in your contain IUEI? determination, the hazard involves IUEI, as defined in paragraph 1.d. or addresses any one of the conditions described in paragraph 3 in this chapter.

The AIR-600 cybersecurity specialist might determine that the hazard should be handled outside of the MSAD COS process for certain cybersecurity issues. It is recommended that AIR-500 and/or AIR-700, after coordinating with AIR-600, communicate(s) final risk mitigations with other ASEs and ASIs, if it is deemed appropriate and necessary to do so.

Is this a potential aerospace You must contact AIR-360, who must in turn work with AVP-300 HIRMT system level (ASL) safety issue Oversight team to enter the hazard information into HIRMT. Also contact your that requires an FAA SRM AVSSMS Coordination Group Representative to initiate an FAA SRM investigation per FAA Order assessment.

8040.4?

Is the event a design-related Identify the cross-product hazard and coordinate with the Fleet Safety Section cross-product hazard? (AIR-723) and other affected branch(es).

Does an FAA AD exist that You must link the prior AD with the current COS event report in the COS IT adequately addresses the tool (see paragraph 1.e. of this chapter) for future reference and management of hazard? the hazard.

Is the event a potential hazard You must assign the hazard to an ASE to proceed with the investigation and risk requiring more investigation analysis (see step 4).

through the MSAD process?

Is the event an issue of You must update the system of record with this determination. The event does negligible risk? not move any further in the event evaluation portion of the MSAD process but is retained for trending. Events may be investigated further if new information is received that suggest the risk is higher than previously analyzed.

2-11 8110.107B Chg 1 8. Step 3 - Initiate Immediate Corrective Action.

a. If a hazard is urgent, you must conduct an analysis, if possible, and brief management or conduct a CARB for a safety and corrective action determination. If so instructed, start either an emergency AD or IAR in accordance with FAA Order 8040.1, Airworthiness Directives; FAA Manual FAA-IR-M 8040.1, Airworthiness Directives Manual ; and any product-specific procedures. This ensures that the risk is mitigated in a timely fashion, without waiting for the remaining MSAD process steps. The assigned ASE can delay the comprehensive risk analysis and causal analysis until after initiating the emergency AD or IAR. Once the emergency AD or IAR is initiated, the assigned ASE must continue analyzing the hazard in the risk analysis step.

The COS Program Manager (PM) or the assigned ASE also might determine that an emergency AD or IAR may be necessary later in the MSAD process as new data becomes available.

b. If an AD is likely to be issued and is associated with a transport airplane accident with seating capacity of 30 people or more in which a loss of life occurred, you must send a report of findings and recommendations of the TARAM to AIR-500 or AIR-700 per applicable office procedures. They in turn must send the report to the Program Integration Branch (AIR-320) for congressional notification and copy the Policy and Standards Division (AIR-600). This is to meet requirements of ACSAA, section 130, dated December 27, 2020, as follows: “REQUIRED NOTICE. —The Administrator shall provide notice to the congressional committees of jurisdiction on the findings and recommendations of a TARAM conducted following a transport airplane accident— (1) in which a loss of life occurred; and (2) for which the Administrator determines that the issuance of an airworthiness directive will likely be necessary to correct an unsafe condition associated with the design of the relevant aircraft type.” Note: ACSAA Section 137, section (6), uses the following definition: “The term ‘transport airplane’ means a transport category airplane designed for operation by an air carrier or foreign air carrier type-certificated with a passenger seating capacity of 30 or more or an all-cargo or combi derivative of such an airplane.” 2-12 8110.107B Chg 1 Figure 4. Record Risk Analysis Results Flow Diagram From Identify Hazard(s) and Perform Preliminary START Risk Assessment (Figure 3, page Does 1, step 2) ASE safety issue Solicit support require ASI involvement YES from cognizant (FS or CM ASI branch**)?

NO Additional ASE Identify potential information outcomes* for issue (as necessary) under study All outcomes YES negligible?

NO ASE Potential Document potential outcomes outcomes For each outcome...

ASE Determine probability & severity ASE Risk values of Calculate & record issue risk value ASE Product-based Recommend type of risk guidelines risk mitigation to CARB ASE Records in COS Further action Document NO Record recommended?

results * A single event might have multiple undesired outcomes. It YES is recommended that you account for this with appropriate Proceed to conditional probabilities.

obvious End cause ** includes AED, FSDO, FS determination CMO, AIR-500, and AIR-800 (Figure 3, page 2, CM branches step 7) 2-13 10/13/2023 8110.107B Table 2. Risk Value Definition, Purpose, and Mathematical Basis Risk Value Definition Purpose Mathematical Basis Total Predicted risk expected, over Provides future risk if no corrective Computed by multiplying the average uncorrected remaining life of affected action is taken. Helps determine if an severity and average per-flight (or fleet risk fleet, if no corrective action unsafe condition may exist in future. flight-hour) probability of occurrence, is taken. Used to guide decisions for multiplied by the exposure (flights or corrective action. flight-hours) remaining in affected fleet life.

If known voluntary compliance to an existing service document is supported by data, then you can account for the existing control actions by adjusting the affected fleet numbers.

If only a subset of the fleet is subject to the risk, include only that portion in the analysis. Evaluate significant variations between identifiable subsets of the fleet (different models, different usages, operational conditions, etc.) as separate populations for the individual risk.

Uncorrected The probability of a given Provides future risk if no corrective Typically based on averages that apply individual risk outcome per unit of exposure action is taken. Needed for cases of to the fleet. However, there might be (per operation, flight hour, low fleet exposure that result in the circumstances where you can calculate opportunity, etc.) because of total uncorrected fleet risk, as individual risk including risk values for a given hazard. defined above, to be acceptable while special conditions and combinations of the risk to an individual aircraft or conditions, or for subsets of the fleet, person is unacceptable. Helps for example by model or usage.

determine if an unsafe condition If only a subset of the fleet is subject to might exist in future. Used to guide the risk, include only that portion in the the decision for corrective action.

analysis. Evaluate significant variations between identifiable subsets of the fleet (different models, different usages, operational conditions, etc.) as separate populations for the individual risk.

Time until Amount of time from when Provides information to assist in risk The period when risk accumulates in control the need for corrective action management planning, i.e., how the fleet to a value that equals the program risk is determined by the CARB much time is available to determine control program risk guideline (Note: guideline is to the time when the fleet root cause, develop service Control program risk guideline is reached would exceed the control information, coordinate, and process discussed further in paragraph 15.b.).

program risk guideline if no corrective action, and incorporate the action was taken. corrective action in the fleet while staying within the risk guideline. See figure 5.

2-14 8110.107B Chg 1 9. Step 4 - Perform Risk Analysis.

a. Risk Analysis. AIR has particular safety risk measures and acceptable risk guidelines based on the specific product type. MSAD risk analysis quantitatively characterizes hazards for probability and severity to determine the safety risk posed by each hazard. Risk analysis , compared with the risk guidelines for ADs , assists the CARB in determining if mandatory corrective action is warranted to control safety risk. If you are an assigned ASE, you are responsible for conducting or coordinating the safety risk analysis and ensuring that the analysis is complete. ASEs may need to consult experts in the field of risk analysis to perform this function. You must record the risk values described in table 2 and compare them to product- defined risk guidelines, as applicable, for issuing ADs or other mandatory corrective actions for the product type. In calculating these risk values, consider if the hazard is associated with a supplemental type certificate (STC), appliance, technical standard order (TSO) article, or standard part. If so, the hazard could be associated with multiple product types. In these situations, the assigned ASE must attempt to obtain information from the STC or article DAH to determine product applicability to support the risk assessment. In certain cases where the safety effect is different depending on the installation or when an STC or article is installed on multiple product types that use different product-defined risk guidelines, the assigned ASE must coordinate the COS issue with the cognizant type certificate or supplemental type certificate oversight office(s) for the products on which it is installed. This enables the ASE to perform risk analysis and subsequent follow-on actions.

b. Identify ASI Support. If you need manufacturing, maintenance, or operations support, it is recommended you contact an ASI responsible for the product and ask for information to support the risk analysis.

(1) For issues such as manufacturing escapes and nonconformances, the manufacturing ASIs provide vital assistance as subject matter experts (SME) of the production and quality control processes, as well as assessing feasibility of related safety risk controls. AIR- 800 also has aircraft certification specialists (ACS) that provide collaborative assistance and act as a liaison between branches for support.

(2) When FS ASI help is needed, such as for maintenance related issues or issues regarding aircraft operation, ASEs must either obtain the information through the cognizant Aircraft Evaluation Division (AED) as the primary interface with other FS ASIs in the field, Flight Standards District Office (FSDO), or FS Certificate Management Office (CMO) or at least notify the AED that information is requested directly from the field. FS ASIs might come from an AED, FSDO, and/or FS CMO.

(3) The AED assists and coordinates with manufacturers, operators, other FS offices, and AIR certification branches on product-specific COS issues. Information regarding the roles different FS groups have for COS oversight can be found in appendix G. This includes the appropriate Air Carrier Safety Assurance (ACSA) or General Aviation Safety Assurance (GASA) principal inspector (PI), Safety Analysis Program Office (SAPO) that standardizes analysis techniques responsible for providing analytical support through the SAS program, 2-15 8110.107B Chg 1 General Aviation and Commercial Division (AFS-800), and Automation Systems Management Branch (AFS-950). They are also a resource for working with Safety Performance and Analysis System (SPAS), which is an analysis and reporting tool that provides access to a variety of databases related to aviation safety.

c. Special Missions. Aircraft that perform special missions (firefighting, logging, military, flight instruction, etc.) have specific utilization that may not be captured by the existing product- specific risk methodology. The ASE performing the risk analysis must work with the Continued Operational Safety Systems Section (AIR-633) and the subject matter expert in FS as described in paragraph 2.9.a. to understand the operations and to make any needed adjustments to the product-specific risk methodology with these unique missions.

d. Identify Potentially Unsafe Outcomes. You must identify and document potentially unsafe outcomes for the hazard you are studying for further risk analysis. If you determine that the safety risk of an outcome is obviously negligible, there is no need to calculate it.

e. General Risk Calculation Guidance. To calculate the risk values of the hazard’s effects, you must: (1) Evaluate the risk based on the applicable methods and guidance for the particular product type listed in appendix C; (2) Document the assumptions, methods, and other supporting information describing how the probability and severity were determined; (3) Share issue details and conditional probability data for flight controls and human factors (i.e., pilot responses and inputs, etc.) with the cognizant certification branch, as well as with the Technical Policy Branch (AIR-620). This ensures that certification assumptions for system safety assessments can be validated, and if necessary corrected. Ensure this data is available to any certification personnel working or making delegation decisions on similar product programs for future certification efforts.

Note: High uncertainty affects the calculated risk values. You should perform a sensitivity study when high uncertainty exists, particularly for hazards with high severity, or hazards above 2/3 of the Risk Guideline. Contact AIR-633 or AIR-722 for guidance.

f. Calculate the Risk Value of Each Outcome. You must use the product-specific risk analysis method identified in appendix C (units convertible to fatal accidents) to calculate the quantitative probability, severity, and risk value for each potentially unsafe outcome. If fleet data is available, you must calculate and record the following risk values: (1) Total uncorrected fleet risk; (2) Uncorrected individual risk (per flight or per flight hour); and (3) Time until control program risk guideline is reached.

2-16 8110.107B Chg 1 Note: An investigation might determine that there is negligible safety risk, meaning the risk is not credible and that calculation of the risk is not required. Recording of the risk values are not required if both the total uncorrected fleet risk and the uncorrected individual risk are below 2/3s of the product-specific risk guidelines, but the rationale for closure should still be included.

Detailed descriptions of risk values are in table 2.

g. Include Documents in the COS Record. You must include the risk analysis documents in the record. Include information that supports recommendations and decisions, such as probabilities, severities, and risk values for total uncorrected fleet risk and individual risk, per flight or flight hour.

h. DAH Risk Analysis. Some AIR certification branches have negotiated agreements with certain DAHs to perform risk analysis on behalf of the FAA. In those cases, you must review the DAH risk analysis to verify that their risk analysis meets the objectives of this section. The depth and scope of each review is left to the appropriate AIR certification branch to decide.

Figure 5. Corrective Action Timeline (Notional) Safety Corrective action Fleet Corrected Determination developed Date Date AD corrective AD writing and actions implemented comment period Safety in fleet determination AD Effective Date AD worksheet and control submitted program incorporation time accepted at Corrective the CARB Action Buffer Time Time Until Control Program Risk Guideline is Reached i. Requirements for Control Program Risk Guideline. You must calculate the time until the control program risk guideline is reached if either the total uncorrected fleet risk or the uncorrected individual risk is above the product-specific risk guidelines.

j. Determine Necessary Action. To assist the CARB in determining the type and/or need for mitigation (mandatory, non-mandatory, or no action), you must compare the risk values calculated for the hazard against the product risk guideline(s) for ADs or other mandatory corrective action. The minimum requirement is to provide an uncorrected individual risk value.

See figure 6, “Risk Guideline Diagram.” 2-17 8110.107B Chg 1 Figure 6. Risk Guideline Diagram 10. Step 5 - Corrective Action Review Board. The goal of the CARB is to improve aviation safety through better decision-making techniques achieved by: • Reducing the number of single thread safety decisions.

• Composing the CARB of high-expertise, cross-functional, or inter-disciplinary membership.

• Fostering an environment to allow others to raise concerns and contribute knowledge about a hazard and proposed mitigation or corrective action plan.

• Facilitating real-time, open exchange of hazards across the product lifecycle among key disciplines of design, production, and operation oversight staff.

• Providing a regular forum for the review of the risk and causal analyses, as well as proposed mitigations.

• Expanding knowledge and experience of the trends and improvements in aviation risk analysis.

Note: CARB is a forum where the technical experts assess the analysis, make informed decisions, agree on the acceptable level of safety risk to accept, and concur with the corrective action plan for risk mitigation. At the completion of the CARB, a recommendation for safety actions is provided to the responsible Branch Manager for consideration. CARBs are designed to precede the AD process, not replace it.

2-18 8110.107B Chg 1 a. CARB Applicability. The responsible certification branch (as defined in chapter 1, paragraph 7), facilitated by the COS PM or COS focal must bring forward the following situations to be reviewed by the CARB: (1) Hazards with a calculated risk above two-thirds of the product-specific risk guidelines for AD or other mandatory corrective action; (2) Recommendations for ADs or other mandatory corrective actions regardless of risk; and (3) Unilateral (FAA only) corrective action considered on foreign products and technical no action required (NAR) decisions involving mandatory continuing airworthiness information (MCAI). See chapter 4 for further information on handling MCAIs within the MSAD process.

Note 1: Non-technical NAR actions, as defined in Order 8040.5, appendix 1, are not subject to CARB applicability.

Note 2: Although it is a recognized best practice, management approval is not required to bring forward a potential safety issue to be reviewed by the CARB, provided it is supported by a senior staff individual (i.e., senior engineer, PM, etc.).

b. Presenting recommended actions to the CARB for a safety and/or mitigation decision.

Prior to CARB presentations, the quantitative risk assessment assumptions, results, and associated recommendations must be reviewed by a COS Technical Advisor (TA), COS PM, or a risk analysis expert who did not perform the analysis. The assigned ASE must present to the CARB the recommended action and substantiating data. Unless covered by exceptions in chapter 5, the presentation must include, at a minimum a: (1) Description of the issue/hazard; (2) Risk analysis; (3) Causal analysis; (4) List of previous similar incidents (such as from the Accident Lessons Learned library), if any; (5) Prior risk reduction resulting from previous corrective actions, if applicable; and Note: In some cases, with COS PM/focal concurrence, you may present the recommended action prior to completing all the analysis. For example, if there are challenges quantifying the risk, or it is a high-visibility hazard that needs immediate CARB awareness or attention.

2-19 8110.107B Chg 1 c. CARB Evaluation. The CARB will evaluate the data for completeness and coherence of the conclusion; and will provide concurrence with the recommended action, select a different course of action, or defer the issue (generally to allow the ASE time to obtain more information).

Some cases may warrant several CARB sessions for further assistance in developing the assessment for final mitigation and/or corrective action. If possible, reach consensus on a safety decision. In cases where consensus cannot be reached, the AIR certification branch manager or responsible office manager has final decision authority.

d. CARB Participants. Each AIR certification branch manager is responsible for selecting and assigning representatives to CARBs, and for designating alternates for unavailable representatives.

(1) Mandatory Participants. The AIR certification branch must maintain a list of current representatives to select CARB participants from; and coordinate with Flight Test & Human Factors Branch (AIR-710), CM branch, and AED management to facilitate representation (see table 3).

Table 3. CARB Participants Roles and Responsibilities Role Responsibility Certification branch (as defined in chapter 1, paragraph Identifies voting participants for the CARB. Serve as 7) manager or AIR-720 Manager. the CARB co-chair, with the COS TA.

COS TA Serve as the CARB co-chair, with the certification branch manager.

CARB co-chairs Support the COS PM in ensuring the CARB stays focused and on-track. Should consensus not be reached, they will determine next steps, which could be determining if time permits for further discussion or a revisiting at follow-up CARB, or elevating for quick decision.

COS PM Sets the agenda and leads the CARB. Ensures minutes are taken, (which must document CARB attendees, issues presented, and decisions made), records all decisions, and tracks any associated actions at the CARB. Administrative actions can be delegated to other support personnel.

ASE or pilot assigned and presenting the hazard. Brings all relevant information to the CARB, including developing the main presentation.

At least three other ASEs, one with experience in the SMEs for the analyses or technical subjects.

hazard and two others that support CARB technical discipline diversity. This can be satisfied using senior engineers, SMEs, program managers, or technical section managers with the appropriate experience.

Representation from flight test, AED, and CM branch. SMEs able to bring perspective from the production, maintenance, avionics, or operation of the aircraft.

(2) Conditional participants: 2-20 8110.107B Chg 1 • AIR-600 staff might participate on a case-by-case basis, such as SMEs for policy, standards, risk assessment methodologies, product policy managers, process improvements, and other safety topics.

• Other FAA representatives (such as chief scientific and technical advisors (CSTAs) related to the discipline associated with the hazard, etc.) might attend on a case-by-case basis to provide a comprehensive view of the hazard and mitigation.

• AIR-360, as the liaison to AVP, must attend in cases where there is AVP or National Transportation Safety Board (NTSB) involvement (such as due to an accident/incident investigation, safety recommendation, etc.) or a related Accident Lessons Learned module. They also might attend on a case-by-case basis.

e. CARB Participant Training. All CARB participants must receive the appropriate level of training. Please refer to the AIR-720 for further details.

f. Other Factors in the CARB Decision. In rare situations, the ASE or FAA management may make recommendations not consistent with risk guidelines for ADs or other mandatory corrective actions. The CARB decides whether to accept or reject these recommendations, and that decision will be documented in the meeting minutes. The risk analysis is a quantitative input into the CARB decision, and unrelated factors are not used as inputs to risk analyses.

g. Documenting CARB Decision. The CARB is accountable for its safety decisions. The CARB co-leads must confirm that the meeting minutes are available within AIR and contain the following information: Issues/hazards presented; CARB decision; CARB attendees; and If the calculated risk value is above the risk guideline, and the decision is to take no action to mitigate risk, include a memo affirming the decision and confirming risk acceptance signed by the certification branch manager.

Note: To ensure integrity in the assessment process, it is recommended that those responsible for presenting to the CARB, including producing the risk analysis, be separate from those making the CARB decision.

11. Step 6 - Determine if Causal Analysis is Required.

The MSAD process identifies and mitigates product risk from hazards (see figure 3). The goal is to determine the cause(s) for the hazard. A structured causal analysis typically creates a diagram that shows the interconnection of causes and effects. The structured approach supports your assumptions and conclusions during the process and guides the documentation of the cause(s), effect(s), and the causal analysis report. You must document the causes, which is an important 2-21 8110.107B Chg 1 step to support future trending activity and quick identification of systemic problems when causes reoccur.

a. You must conduct a structured causal analysis when any of the following conditions are met: (1) For high-profile hazards (such as high public interest or fatalities); (2) If directed by the CARB; (3) Previous mitigation(s) were not effective; (4) For complex systems, such as hazards involving multiple systems or software. A complex hazard might include cases where more than one potential cause is identified from one or more certification branches; or (5) The causes are unclear.

b. If none of the conditions in paragraph 11.a. applies, a structured causal analysis is not required for issues with obvious causes and clearly identifiable fleet solution(s). Fleet solutions include inspections, re-designs, limitations, and/or other product/part mitigations.

12. Step 7 - Perform Causal Analysis. When you perform a structured causal analysis, you trace the chain of events, identify contributing factors, and develop a list of candidate solutions.

The structured approach supports your assumptions and conclusions during the process and guides the documentation of the cause(s), effect(s), and the causal analysis report.

a. Identify Part or Product Causes. You focus on identifying the part or product causes that can be addressed using fleet risk mitigations (AD, SAIB, or other mitigation).

b. Identify Other Causes. You might also identify other causes that contributed to the event.

These “contributing factors” might include design, manufacturing, operations, and maintenance failures and might have surfaced from “people” and/or “process” issues in a manufacturer, designer, or operator’s organization. They might also include FAA process shortfalls. Review FAA rules, policy, and guidance for potentially contributing to the issue, in particular, new technology that results in new rules (special conditions) where the FAA and industry have not yet acquired significant experience.

c. Review DAH Causal Analysis. Some certification branches have negotiated agreements with DAHs that perform the causal analysis on behalf of the FAA. In those cases, you must review the DAH causal analysis to verify that it meets the objectives of this section.

13. Step 8 - Document the Cause(s). Documenting all causes is an important step to support future trending activity and quick identification of systemic problems when causes reoccur.

Whether the causes were obvious based on engineering expertise and judgement or were 2-22 8110.107B Chg 1 determined through a structured causal analysis. The assigned ASE must document the causes in the COS record using the causal taxonomy, including at least a: a. Problem statement (might be similar to the defined hazard); b. Product or part causes; c. People or process causes, also called “contributing factors,” if applicable; and d. Causal analysis report (for structured causal analysis only).

14. Identifying Contributing Factors.

a. Causal analyses might identify contributing factors that can influence a part- or system- level failure. Since contributing factors are not always addressed by ADs or SAIBs, you, the assigned ASE, must submit these factors to the appropriate organization for analysis and possible action.

b. If you identify that an operational, maintenance, or manufacturing process is contributing to a hazard, you must send your analysis results and hazard information to the appropriate organization for review and action (e.g., AED, CM branch, etc.). It is recommended that you follow-up to ensure that the organization understands and has sufficient information to address the hazard.

c. If you identify a shortfall in the FAA’s process, you must submit the causes to the appropriate organization for their review and mitigation.

15. Step 9 - Evaluate and Select Mitigation for a Fleet Issue. Based on the cause(s) identified and documented in steps 6 thru 8, you must identify candidate corrective action(s) and select the appropriate one(s) to reduce the fleet risk presented by the hazard.

a. Identify Candidate Corrective Actions (CCAs). CCAs can range from initial mitigating to extensive final and terminating. The assigned ASE must evaluate each CCA for its appropriateness and timeliness to mitigate the safety risk. Corrective actions typically are developed by DAHs, who submit these to the FAA. The FAA has the option of accepting, rejecting, or developing alternative corrective action(s). When a DAH does not timely submit corrective action(s) for a concern as required under part 21.99, for reasons including unwilling, unable, or no longer in business, the FAA must develop necessary corrective action(s) to mitigate the risk to an acceptable level. Examples of CCAs include, but are not limited to: • Inspections; • Part repairs or replacements; • Modification/kit installations; • Limitations 2-23 8110.107B Chg 1 • Software updates; • Rework; • Process or procedure changes; and • Grounding a fleet.

b. Determine the Corrective Action Vehicle.

(1) The assigned ASE must calculate CCA control program fleet and individual risk as defined in table 4. If the CARB decides not to follow the recommended corrective action, the decision and rationale must be documented in the CARB minutes. The assigned ASE must attach supporting documentation in the record of the COS IT tool.

(2) If new information becomes available late in the control program development that shows that the risk was much greater than first calculated, or if there was a significant delay in implementing the control program due to some unforeseen mistake/problem, you may find that the control program will now exceed the risk guidelines. In this case, interim action should be considered as part of the mitigation plan. Care should be taken to avoid getting into these situations. The AIR certification branch manager must make their division director aware that the FAA is temporarily accepting this increased risk and/or extended exposure.

c. Evaluate AD CCAs. Use the control program fleet risk and control program individual risk guidelines (CPRGs) to evaluate AD CCAs. This applies to AD CCAs only. Skip this task if you are proposing non-mandatory mitigation. You must ensure that the CCA (or combination of mitigations) calculated control program risk is at or below both the fleet and individual CPRG.

(1) During this analysis, consider combined actions of a “bundle” of CCAs, for example interim action such as a repetitive inspection followed by a final action, such as a part replacement. Evaluate the mitigation plan for the total effect on the risk.

(2) If the risk of a CCA exceeds either fleet or individual CPRG, consider eliminating or revising the candidate by either accelerating the implementation (for example, replacing at ‘B’ check rather than at ‘C’ check, or “inspect at 100-hr vs. 200-hr intervals”) and/or adding or modifying mitigations. Use the product specific CPRG analysis method to determine the action’s acceptability and timing by comparing it to the control program fleet and CPIRGS.

Note: When considering compliance times for mandatory corrective action, do not unnecessarily extend the compliance time even if doing so would keep the control program fleet or control program individual risk below the CPRG. Work within existing maintenance schedules, where possible, and act as soon as reasonably practical.

2-24 10/13/2023 8110.107B Table 4. Control Program Risk Value Definition, Purpose, and Mathematical Basis Risk Value Definition Purpose Mathematical Basis Control Risk within Helps ASEs evaluate Computed by multiplying the average program fleet affected fleet candidate corrective severity and average per flight or per risk while actions against a flight-hour probability of the corrective maximum allowable risk occurrence, multiplied by the control action is taken value with respect to program exposure (predicted number of (plus any effectiveness and flights or flight-hours for the fleet residual risk timeliness. during the time taken to accomplish the not remedied corrective actions).

by corrective If only a subset of the fleet is subject to action).

the risk (different models, different usages, operational conditions, etc.), include only that portion in the analysis if possible; otherwise include a factor representing the likelihood that a given airplane is in the affected subset.

The start of the control program is when CARB determines there is an unsafe condition. The risk typically includes the exposure since that time—it includes corrective action preparation time and AD flow time, as applicable. If actual corrective action incorporation rate is unknown, estimate control program duration (flights or flight- hours) by using estimated time for AD issuance plus half the AD compliance time.

Control The probability Needed for cases of low Typically based on averages that apply program of a given fleet exposure that result to the fleet during the control program.

individual outcome per in the control program However, there might be circumstances unit of fleet risk, as defined where you can calculate individual risk risk exposure (per above, to be acceptable including risk values for special operation, while the risk to an conditions and combinations of flight hour, individual aircraft or conditions, or for subsets of the fleet, opportunity, person during the control for example by model or usage.

etc.) because program is unacceptable.

If only a subset of the fleet is subject to of a given Helps ASEs evaluate the risk, include only that portion in the hazard during candidate corrective analysis. Evaluate significant variations the control actions against a between identifiable subsets of the fleet program. maximum allowable risk (different models, different usages, value with respect to operational conditions, etc.) as separate effectiveness and populations for the individual risk.

timeliness.

2-25 10/13/2023 8110.107B Figure 7. Evaluate and Select Mitigation(s) Flow Diagram From causal analysis/document causes (figure 3 steps 7 & 8) ASE Identify individual or CCA(s) bundles of CCAs for consideration Risk analysis supports recommendation of what action?

Other* Mandatory recommendation (AD proposal) Repeat these steps for each candidate correction action ASE (CCA) option Calculate CCA control program risk values ASE Does CCA Revise, delete or flag CCA CPRG option meet the NO as needing consideration CPRG?

at the SRB YES (revised to be at or below CPRG ASE or flagged) Solicit AFS & AIR-800 CM branch input for evaluation (if needed) • Ability to reduce risk • Material, labor & opportunity ASE cost Conduct CCA • Timeliness of implementation Evaluation • Complexity of implementation ASE Selected corrective Select preferred action(s) CCA: candidate corrective action CCA(s)* CPRG: control program risk guideline CARB decision ASE CARB: Corrective Action information Initiate CARB Review Board * Note: May include validation Proceed to of a single available corrective AD or action or no action.

other** ** Other = no action, SAIB , or process, if other non-mandatory corrective applicable actions 2-26 8110.107B Chg 1 d. CCA Evaluation. Ideal candidates for corrective action are inexpensive, easy to perform, implemented quickly, 100 percent effective at reducing risk, and do not introduce a risk of unintended consequences. No situation meets these ideals. Therefore, the assigned ASE must conduct a short evaluation of each candidate action(s) that consider effectiveness, cost, timeliness of implementation, and complexity.

e. Select Preferred Corrective Action. After you have evaluated all candidate corrective actions against the attributes in figure 7, select the most appropriate one(s), balancing the attributes. Document and submit your recommendation with all supporting documentation for review by the CARB.

f. Interim Mitigation. When issuing interim mitigation, you must continue tracking progress of the final action until it is issued to ensure it meets the control program risk guideline.

g. Terminating Corrective Action. When the terminating corrective action is defined, you must calculate the control program fleet and control program individual risk to ensure it meets the fleet and individual CPRGs. Proceed through the corrective action selection process as defined in figure 7. The CARB must review terminating corrective actions not previously discussed in the initial CARB.

16. Step 10 - Submit to AIR Process Owner for Further Analysis. As described in figure 3, assigned ASEs discovering causes in other AIR business processes (like certification and rulemaking) must communicate those causes to process owners for action.

17. Step 11 - Submit Cause to Certificate Oversight Process. Assigned ASEs who identify causes originating with the production approval holder (production escapes), must communicate them to the AIR certificate oversight representative for action.

18. Step 12 - Document and Submit Issue to FAA Organization Outside of AIR. The MSAD process might identify a cause or contributing factor that originates in FS, air traffic, and other non-AIR FAA organization or the companies they oversee. The condition might warrant mitigation by their organization, as determined by their business process. When such a condition is identified, the assigned ASEs must submit information to the responsible organization. If the responsible organization is FS (e.g., ACSA, GASA, FSDO, CMO, etc.), the assigned ASE must either submit the information through the AED or, at a minimum, notify the AED that information has been submitted directly to the field.

19. Step 13 – Initiate AD, SAIB, or other Mitigation Process.

a. CARB Selection of Risk Mitigation. The CARB must use the risk analysis outputs to guide its decision whether to choose an AD, SAIB, or other mitigation. If the CARB selects any of these options, the assigned ASE starts the mitigation process. If an AD is likely to be issued and is associated with a transport airplane accident in which a loss of life occurred, you must prepare a report of findings and recommendations of the TARAM as described in step 3.

2-27 8110.107B Chg 1 b. Initiate Corrective Action. AD, SAIB, and other mitigation processes are outside the scope of the MSAD process. They are defined in appropriate orders and procedural documents.

Once the AD or SAIB is issued, the assigned ASE or other administrative personnel must enter the corrective action information (AD number, SAIB number, or other applicable information) into the record in the COS IT tool. Developing and issuing mitigations might require exchange of information and further MSAD process analysis. You must use the MSAD process to track changes to the technical decision-making.

20. Step 14 – Prepare Internal Feedback to MSAD Process Owner (optional). AVS MSAD users can submit feedback directly to AIR-630 using the form in appendix H.

21. Step 15 - Prepare Lessons Learned (optional). Lessons from events, hazards, risk analyses, or mitigation selections that are valuable teaching cases can be captured and submitted to the AVSSMS Coordination Group through AIR-360.

2-28

8110.107B Chg 1 Chapter 3. Follow-On and Trending 1. Monitor and Validate. The cognizant ASE must validate the effects of risk mitigation in the fleet. You do this by monitoring in-service data to ensure that the risk has been properly controlled and by working with the branch responsible for the product’s certification. The responsible certification branch can also use this process to validate assumptions AIR makes during the certification process, in coordination with the AIR-600 standards branch responsible for any special conditions. You must also document the introduction of risk due to unintended consequences of the mitigating action. If AIR DCTs were utilized as a mitigating action (such as monitoring the effectiveness of an AD) or for monitoring new and novel designs, then AIR must obtain those DCTs from FS to verify the assumptions made during the approval process. It is recommended to contact the System Approach for Safety Oversight Program Office (SASO) (AFS-910) in the Safety Analysis and Promotion Division (AFS-900) who can develop DCTs to provide feedback on mitigations, especially for ADs that are high-profile or that mitigate potentially catastrophic hazards. This data is key for the FAA to maintain safety at the product level as part of the product lifecycle and to perform internal SA responsibilities. If a potential hazard is identified during the process of monitoring and validating, you must enter it into the MSAD process for evaluation.

2. Trending. Data trending (safety assurance) is defined as collecting and monitoring existing data to identify items that meet specific criteria or exceed established guidelines.

a. Monitoring data for trends is important because it: (1) Enables tracking known hazards to ensure that their rate of occurrence does not cause risk to exceed established guidelines and is consistent with the intent of the certification assumptions and analyses.

(2) Allows the monitoring of the results of implemented mitigations to verify that the implementation and results are as presumed, and that new problems were not introduced by any actions.

(3) Identifies emerging hazards.

b. Conducting Trending. Trend analysis can be conducted by all AIR personnel responsible for monitoring and addressing product safety risks. If trending identifies a potential hazard, the staff member who identified the issue must go to step 2 (chapter 2, paragraph 7) to evaluate whether further analysis is necessary. If an ASI identifies a potential hazard, the ASI must submit that information to the cognizant certification branch to assess the safety risk and take appropriate mitigating action, as necessary. It is a recommended practice to reach out to the FS SAPO to see if they are seeing similar trends in SAS or to utilize SAS to help with your trending.

Data in SAS that identifies potential issues with the product design , or the maintenance program developed by the DAH is crucial to AIR’s oversight efforts.

3-1 8110.107B Chg 1 c. Identifying Trends. Trending activities can include: (1) Identifying items to trend (parts, products, failures, etc.); (2) Analyzing cross-product trends; (3) Tracking trends and items of significant interest; (4) Tracking repeat events (within makes, models and series or across them) or similar failures that have occurred on multiple occasions, including repeat part failures, high part replacement, and repeat hazards; (5) Identifying causes (during MSAD process); (6) Identifying most common part category or system failures; and (7) Identifying patterns or potential correlations (for example, when part A fails and part B fails, then event C occurs).

Note: Not all events necessitate a trend analysis. It is recommended you focus on anticipated concerns. Figure 8 illustrates the trending process.

3-2 8110.107B Chg 1 Figure 8. Data Trending Process Flow Diagram START trending process On-demand Continuous trending trending Aviation safety data sources (See appendix D) Trend criteria ASE (items of Establish trend interest) criteria ASE Enter search criteria ASE Potential trend Continuous information search for trends Trend identified Trend identified ASE View and store results Does trend information Potential safety ASE YES indicate a potential unsafe Document potential issue condition?

safety issue NO ASE/ASI Submit to MSAD process Step 2 (Go to Figure 3, link B) ASE YES Recommend Document different different action? action and pass to appropriate party NO Initiate/ continue continuous YES trending?

NO END 3-3

8110.107B Chg 1 Chapter 4. Applying MSAD to Foreign Products 1. Introduction. This chapter describes how MSAD applies to hazards on products designed and manufactured outside the United States. It covers how to handle events on these products, as well as how to review and disposition MCAI.

2. Addressing MCAI. MCAI are documents issued by other State of Design Authorities (SoDA), following ICAO Annex 8, regarding unsafe conditions on products designed or manufactured in other countries. FAA Order 8040.5, Airworthiness Directive Process for Mandatory Continuing Airworthiness Information , provides procedures for FAA employees to follow for MCAI. Most FAA ADs following MCAI are issued according to Order 8040.5.

However, in certain situations, the FAA may choose not to adopt the MCAI directly and instead evaluate the hazard using the MSAD process.

a. Action Different from SoDA Decision. After evaluating a safety concern, the FAA may choose to take unilateral action or may decide that the risk is acceptable (an FAA AD is not required). If you determine a mitigating action that is different from the SoDA decision, use table 5 to determine the necessary action.

b. How to Apply MSAD to MCAIs. For an illustrated version of how to apply MSAD to MCAIs, see figure 9.

Table 5. Handling MCAI Disagreements within MSAD Scenario: ASE required action: (1) Is unilateral action, as defined If yes, you must create a record in the appropriate COS IT tool (See chapter by FAA Order 8040.5, 2, paragraph 1.e., and appendix E for further definition). Apply the MSAD necessary? process steps, beginning with risk analysis outlined in step 4. When requesting more technical information from the SoDA, specifically request information needed to perform the MSAD risk analysis.

(2) Is the MCAI for an issue with If yes, you must present your no action required (NAR) decision to the low enough risk that a CARB for potential closure (See chapter 2, paragraph 10.a.).

corresponding AD is not needed?

This does not apply when decisions are made that no AD is required for administrative reasons. A typical administrative reason is when the SoDA has issued a revised or superseding MCAI and the FAA decides no AD is required for the initial or preceding MCAI and instead writes an AD for the later MCAI.

4-1 8110.107B Chg 1 Figure 9. MSAD Process for MCAI START ASE MCAI Data Receive MCAI ASE MCAI Process (per Order 8040.5) Proceed to ASE Unilateral perform risk UNI- Continue with or no action NEITHER analysis (Go to LATERAL MCAI Process decision Figure 3, link C) (per Order 8040.5) NO ACTION ASE Administrative Document YES NAR?

decision NO ASE Present NAR to CARB 3. Addressing Events. Some events on foreign products need to be reviewed by the appropriate certification branch (AIR-520 or AIR-730). If you are responsible for a foreign product, you must review and disposition all events associated with that product using the MSAD process for foreign product data described in this section. You must inform the SoDA of any hazards to ensure they can address them.

4-2 8110.107B Chg 1 a. Perform Preliminary Risk Assessment.

(1) If you have identified a hazard requiring emergency corrective action or a potential safety issue, you must coordinate the COS report and the results of the preliminary risk assessment with the SoDA. This will determine whether they intend to address the hazard with an MCAI, are preparing an MCAI, or have issued an MCAI.

(2) If an FAA AD exists that adequately addresses the hazard, you must include the MCAI details in the COS IT tool for the FAA AD and reference it for future management of the issue.

(3) If you determine that no further action is necessary, you must include the MCAI details in the COS IT tool for the FAA AD and reference it for future management of the issue.

b. Take Corrective Action . For cases when immediate action is warranted, you must notify the SoDA and initiate FAA corrective action. If the SoDA notifies us that they are taking no action or you determine that the SoDA action is not adequate, you must continue through the MSAD process to perform risk analysis, outlined in step 4, to determine what further action, if any, is necessary. You might need to take unilateral action following the process described in FAA Order 8040.5.

Note: It is not necessary to wait for the SoDA to act or for the eventual MCAI. Figure 10 is a depiction of the MSAD process flowchart including other SoDAs.

4-3 10/13/2023 8110.107B Figure 10. MSAD Process for Foreign Product Data START Automation/manual entry Acquire data ASE Perform hazard identification and preliminary risk assessment ASE Is emergency Coordinate corrective action YES emergency action required?

with SoDA NO Potential safety NO issue?

YES Does an FAA AD address this YES issue?

NO Is SoDA action YES adequate?

NO ASE Inform SoDA (that corrective action might be warranted) Proceed to perform risk END analysis (Go to Figure 3, link C) 4-4

8110.107B Chg 1 Chapter 5. Exceptions 1. Exceptions. When certain higher-level policies require that an AD be written, MSAD risk analysis results are optional. The policy decision to write ADs in those cases was made during rulemaking or other policy deliberations and overrides the MSAD risk guidelines. The following are the limited authorized cases of an overriding higher-level policy: a. ADs for mandatory modifications required by the Aging Airplane Program: Widespread Fatigue Damage Rule (75 FR 69746) November 15, 2010, or later revision.

b. ADs to mandate the incorporation in the airworthiness limitations section of the maintenance manual for the following situations when required by §§ 23.571, 25.571, 27.571, 29.571, 33.14, 33.70, or 35.37: (1) New or revised damage tolerance inspections; or (2) New or revised safe-life limits.

c. ADs that are needed for fuel tank protection, ignition prevention, flammability reduction, or ignition mitigation, required for compliance with Special Federal Aviation Regulation (SFAR) 88, § 25.954, or § 25.981, as applicable.

d. ADs required by the Aging Airplane Safety Rule (70 FR 5518) February 2, 2005, or later revisions for changes to supplemental structural inspection programs and Corrosion Prevention and Control Programs (CPCP).

e. SSI and IUEI ADs.

2. Applicability. ADs are issued to correct an unsafe condition in an aircraft, engine, propeller, or appliance (products), and have a defined applicability at the time of issuance. On occasion, after AD issuance, the FAA might discover that the applicability did not include all the affected products, and the AD is superseded to increase the applicability. When the FAA supersedes an AD solely for this reason, it is not necessary to perform a quantitative risk analysis, as the supersedure will be issued regardless of the risk result to meet ICAO obligations or as general policy. This exception only applies when the unsafe condition of the superseding AD is the same (the supersedure must be solely to add applicability).

3. Public Use and Military Aircraft. Commercial derivative aircraft (CDA) are aircraft that have been modified with specialized equipment to perform military and other non-civil missions.

CDA are typically operated by, or under the operational control of, governmental entities. With certain limited exceptions, they are operated as public use aircraft. When conducting risk analysis on these aircraft, situations might arise where certain data is not attainable by the FAA.

For example, a decision has already been made to implement a safety risk control(s), by the United States military, or an accurate quantitative analysis cannot otherwise be completed. In 5-1 8110.107B Chg 1 these instances, the ASE should attempt to perform the quantitative analysis using the best data they have available and inform CARB of any deficiencies in the data or analysis. Due to the challenges identified here, certification branches are excepted from the requirement to perform a specific quantitative risk analysis as defined in chapter 2, paragraph 9 for these aircraft.

a. In the case of military CDA, work with the Military Certification Branch (AIR-780) and to the extent possible, AIR-780 should work with the Department of Defense.

b. In the case of non-military CDA, the best source of data is likely the DAH. If the public agency is domestic, you may attempt to reach out directly to the agency.

4. Optional Steps.

a. For the situations defined above in paragraphs 1 through 3, the following steps (referenced from chapter 2) are optional: (1) Step 4, Perform Risk Analysis.

(2) Step 6, Determine if Causal Analysis is Required.

(3) Step 7, Perform Causal Analysis.

(4) Step 8, Document the Cause(s).

5. Requirements Still in Effect. When exceptions are made in accordance with this chapter, the following limitations and requirements from step 9 (which points to the CARB in step 5) remain in effect: a. Issue and recommended mitigation must be presented to the CARB for concurrence.

b. CARB decision of the issue must be documented in the CARB meeting minutes.

5-2

8110.107B Chg 1 Chapter 6. Administrative Information 1. Distribution. Distribute this order to all AVS branches and offices.

2. Authority to Change This Order. The issuance, revision, or cancellation of the material in this order is the responsibility of the AIR Organization and System Policy Branch (AIR-630).

This branch will accomplish all changes, as required, to carry out the FAA’s responsibility to provide guidance for the MSAD process.

3. Suggestions for Improvement. Please forward all comments on deficiencies, clarifications, or improvements regarding the contents of this order to the Directives Management Officer (DMO) at 9-AVS-AIR-Directives-Management-Officer@faa.gov. Your suggestions are welcome. FAA Form 1320-19, Directive Feedback Information , is in appendix H of this order for your convenience.

4. Records Management. Refer to FAA Order 0000.1, FAA Standard Subject Classification System ; FAA Order 1350.14, Records Management ; or your office Records Management Officer (RMO)/Directives Management Officer (DMO) for guidance regarding retention or disposition of records.

6-1 8110.107B Chg 1 Appendix A Appendix A. Definitions and Acronyms AC Advisory Circular ACSA Air Carrier Safety Assurance ACSAA Aircraft Certification, Safety, and Accountability Act AD Airworthiness Directive AED Aircraft Evaluation Division (AFS-100) AIDS Accident/Incident Data System AIR Aircraft Certification Service ASL Aerospace system level ASL Criteria Per Order 8040.4, if a safety issue meets one or more of the following criteria, it is considered an ASL issue and must be reported and tracked through HIRMT: 1. The safety issue is tracked and managed by the FAA SMS Committee; 2. The safety issue is present in the National Airspace System (NAS), its safety risk has not been accepted, and it is expected to have high risk (e.g., it is identified as a result of an accident or incident, or it is assumed to have high risk, but an assessment has not been completed); 3. The safety issue has high risk and has a potentially systemic effect (e.g., the effect crosses LOBs or impacts an industry segment rather than an individual certificate holder); or 4. Any safety issue that an FAA organization’s management elects to track in HIRMT.

Contact AVP-300 for additional information.

ASAP Aviation Safety Action Program ASE Aviation safety engineer ASI Aviation safety inspector ASIAS Aviation Safety Information Analysis and Sharing Office A-1 8110.107B Chg 1 Appendix A ASISP Aircraft System Information Security Protection Assigned ASE ASE with COS responsibilities for a specific aircraft or product hazard ASRS Aviation Safety Reporting System ATO Air Traffic Organization AVP Office of Accident Investigation and Prevention AVS Aviation Safety Organization CAAM Continued Airworthiness Assessment Methodology CAAP Continued Airworthiness Assessment Process CARB Corrective Action Review Board Causes Underlying circumstances, occurrences, and/or failures that contribute, or could contribute, directly or indirectly, to an event.

CCA Candidate corrective action CDA Commercial derivative aircraft. CDA are aircraft that have been modified with specialized equipment to perform military and other non-civil missions. CDA are operated-by, or under the operational control of, governmental entities. With certain limited exceptions, they are operated as public aircraft. For further information, see AC 20-169 and Order 8110.101.

Certificate For the purposes of this order, “certificate holder” means person or Holder organization who holds or is required to hold an air carrier certificate or operating certificate issued under 14 CFR part 119.

CISA Cybersecurity Information Sharing Act CM Branch Certificate Management Branch (AIR). References to “Certificate Management Branch” or “CM Branch” include branches responsible for production/oversight aspects of this policy within the System Oversight Division (AIR-800) and Integrated Certificate Management Division (AIR-500).

CMO Flight Standards Certificate Management Office Condition See “Hazard” A-2 8110.107B Chg 1 Appendix A Corrected risk Residual risk that remains after corrective action is taken. When highly effective corrective action is taken, corrected risk is zero. See also chapter 2 for added details, as well as “Uncorrected Risk.” Corrective action An action to eliminate or mitigate the cause or reduce the effects of a detected nonconformity or other undesirable situation.

COS Continued Operational Safety COS IT Tool(s) IT Tool(s), used for entry, storage and tracking of COS issue data, sharing of data, and monitoring/trending of data.

CPCP Corrosion Prevention and Control Program CPRG Control Program Risk Guidelines. The upper limit of acceptable risk which assists the ASE in determining the adequacy, in terms of risk reduction, of a proposed candidate corrective action. These guidelines are characterized in terms of both fleet risk and individual risk.

-11 Credible A probability of an outcome at or above greater than or equal to 1 × 10 .

-11 If the probability of an outcome is less than 1 × 10 , it is considered not credible and does not need to be formally assessed or considered as part of the safety risk analysis.

Cross-product Can be across product lines within a manufacturer, across products from various manufacturers, and/or across product-types, if parts, components, or processes are common to other aircraft or engines.

DAH Design Approval Holder DCT Data Collection Tool - A series of questions to assist ASIs to perform periodic audits to assess process performance against defined process requirements, and process nonconformance identification and correction procedures. This is useful to AIR personnel for monitoring and validating items of interest, such as implementation of corrective action and special conditions.

DRS Dynamic Regulatory System – a comprehensive knowledge center of regulatory and guidance material from the FAA Office of Aviation Safety and other Services and Offices. https://drs.faa.gov.

EON Emergency Operations Network A-3 8110.107B Chg 1 Appendix A ETOPS Extended Operations – an airplane flight operation, other than an all- cargo operation in an airplane with more than two engines, during which a portion of the flight is conducted beyond a time threshold identified in 14 CFR part 121 or part 135 that is determined using an approved one- engine-inoperative cruise speed under standard atmospheric conditions in still air.

Event Any individual occurrence involving an aircraft or its components described in terms of what is observed (the symptoms) or recorded during the occurrence. Events typically trigger investigations that seek causes of a hazard. The hazard (or condition) is then evaluated for safety implications.

Experimental Experimental light-sport category aircraft are aircraft issued experimental Light-Sport airworthiness certificates under 14 CFR 21.191.

Category Aircraft Expected Value Equal to the probability of an event times the exposure to the event (expected number of events). Example: for a series of coin flips, the expected number of heads is equal to the probability of heads times the number of coin flips.

FAA Federal Aviation Administration Fleet Aircraft, engine, or propeller products of a type currently in-service affected by a certain hazard.

Frequency of Ratio of the number of events of interest to the exposure period, for Occurrence example, one event in 1 million flight hours. Frequency is often expressed with the denominator normalized to a single unit, 1x10-6 per flight hour.

FS Flight Standards Service FSDO Flight Standards District Office GASA General Aviation Safety Assurance Hazard A condition or an object with the potential to cause or contribute to an aircraft accident or incident, as defined in 49 CFR 830.2.

HIRMT Hazard Identification, Risk Management, and Tracking IAR Immediately Adopted Rule A-4 8110.107B Chg 1 Appendix A ICAO International Civil Aviation Organization IT Information Technology IUEI From the RTCA SC-216/Eurocae WG-72 joint committee glossary, intentional unauthorized electronic interaction is defined as “[a] circumstance or event with the potential to affect the aircraft due to human action resulting from unauthorized access, use, disclosure, denial, disruption, modification, or destruction of information and/or aircraft system interfaces. This includes the consequences of malware and forged data and the effects of external systems on aircraft systems but does not include physical attacks or electromagnetic disturbance.” Light-Sport Light-sport category aircraft are aircraft issued airworthiness certificates Category under 14 CFR 21.190.

Aircraft LOB Line of Business MCAI Mandatory Continuing Airworthiness Information MCB Military Certification Branch Mitigation A means to reduce or eliminate the effects of hazards.

MOR Mandatory Occurrence Report Monitor Safety / Analyze Data – the policy and procedures as MSAD documented in this order.

NAR No action required NTSB National Transportation Safety Board Outcome Result of an event, condition, or failure at aircraft level.

PI Principal Inspector PM Program Manager Preliminary risk An initial assessment of the risk posed by a hazard, often performed with assessment limited data or qualitative information. This assessment is meant to quickly determine a hazard’s potential risk and urgency and is followed by comprehensive and quantitative analysis as data and circumstances permit unless the hazard is deemed to entail very little risk.

Probability Ratio of the number of occurrences of interest to the total number of possible occurrences. For example, “20 percent probability that an event A-5 8110.107B Chg 1 Appendix A will lead to an unsafe outcome” means that out of 100 events, we expect 20 unsafe outcomes.

Public Aircraft A government-owned aircraft limited to certain government operations within United States airspace. See 49 USC § 40102(a)(41).

RA Risk analysis. Process whereby hazards are objectively characterized for their severity and probability. The process is either qualitative or quantitative.

Risk A generic expression that combines the probability and severity of a given outcome. In practice, risk is specific to an affected population, exposure, and a given hazard (individual risk, individual personal risk, collective risk, etc.) Risk might be expressed in terms of rates or probabilities. See also "corrected risk” and “uncorrected risk."

Risk assessment Comparison of the risk analysis to the product-specific risk guideline.

Risk guideline The upper limit of acceptable risk which assists the ASE in determining the need for AD or other mandatory corrective actions and the adequacy, in terms of risk exposure, of a proposed candidate mitigation.

Risk level The likely operational outcome of a hazard.

Risk measure The units used as part of the risk analysis calculations (i.e. fatal accident, fatalities, etc.).

Risk value The result of the risk analysis for a particular risk level addressing total uncorrected fleet risk, uncorrected individual risk, control program fleet risk, control program individual risk, and time until control program risk guideline is reached.

SA Safety Assurance Safety issue From FAA Order 8040.4, a safety issue is “any information (e.g., event, report, data) suggesting (1) an emerging safety concern (including novel features and technologies being introduced into the aerospace system) that has not been thoroughly analyzed and requires further evaluation or (2) a concern that was identified in the past but circumstances have changed since the concern was initially identified, possibly requiring reevaluation. Some safety issues may need to be elevated to an appropriate level of management to be adequately addressed.” Safety Risk A means to reduce or eliminate the effects of hazards. The terms Control , Control Mitigation , and Safety Risk Control are used synonymously.

SAIB Special Airworthiness Information Bulletin A-6 8110.107B Chg 1 Appendix A SAPO Safety Analysis Program Office (AFS-930) SARA Small Airplane Risk Assessment SAS Safety Assurance System SaSI Safety and security investigations SASO System Approach for Safety Oversight Program Office (AFS-910) SB Service Bulletin. One type of "service document" (see below). In this order, the terms are synonymous.

SFAR Special Federal Aviation Regulation Service Publications by a design approval holder, appliance or component documents manufacturer that offer information on safety, product improvement, economics and operational and/or maintenance practices. Publications include service bulletins, all-operators' letters, service newsletters and service digests or magazines. Not included in this definition are documents required for FAA type certification or approval, such as flight manuals and certain maintenance manuals. (Source: AC 20-176A, Service Bulletins Related to Airworthiness Directives and Indicating FAA Approval on Service Documents ) Severity The consequence or impact of a hazard in terms of degree of loss or harm.

SME Subject matter expert SMS Safety Management System SoDA State of Design Authority SPAS Safety Performance and Analysis System. SPAS is a comprehensive analysis and reporting tool that provides access to a variety of aviation safety related databases. It can be found at spas.faa.gov.

SRM Safety Risk Management SSI Sensitive Security Information SSP State Safety Program Substitute risk Risk of unintended consequences from implementing mitigation SUI Sensitive Unclassified Information A-7 8110.107B Chg 1 Appendix A TARAM Transport Airplane Risk Assessment Methodology TSO Technical standard order Uncorrected risk Risk if no mitigation is taken for a certain hazard. See also chapter 2 for added details, as well as “corrected risk.” UPN Unapproved Parts Notification WebOPSS Web-Based Operations Safety System WOC Washington Operations Center A-8 8110.107B Chg 1 Appendix B Appendix B. Related Publications The following regulations and other documents referenced in this order are available on the Dynamic Regulatory System (DRS) or as noted. Unless otherwise stated, please refer to the latest version.

1. Title 14 CFR. The following 14 CFR regulations are related to this AC. You can download the full text of these regulations from the Federal Register website at eCFR.

• Section 21.3, Reporting of failures, malfunctions, and defects.

• Section 21.4, ETOPS reporting requirements.

• Section 91.1415, CAMP: Mechanical reliability reports.

• Section 91.1417, CAMP: Mechanical interruption summary report.

• Section 121.374, Continuous airworthiness maintenance program (CAMP) for two- engine ETOPS.

• Section 107.9, Safety event reporting .

• Section 121.703, Service difficulty reports.

• Section 121.705, Mechanical interruption summary report.

• Section 135.364, Maximum flying time outside the United States.

• Section 135.415, Service difficulty reports.

• Section 135.417, Mechanical interruption summary report.

• Section 145.221, Service difficulty reports.

• Section 183.63, Continuing requirements: Products, parts, or appliances.

2. Title 49 CFR. Section 830.5, Immediate Notification .

3. Advisory Circular.

• AC 20-169, Guidance for Certification of Military and Special Mission Modifications and Equipment for Commercial Derivative Aircraft (CDA).

• AC 39-8, Continued Airworthiness Assessments of Powerplant and Auxiliary Power Unit Installations of Transport Category Airplanes.

B-1 8110.107B Chg 1 Appendix B 4. FAA Orders.

• FAA-IR-M 8040.1, Airworthiness Directives Manual.

• Order 8000.369, Safety Management System.

• Order 8000.377, Flight Standards Safety Management System (FSSMS) Requirements.

• Order 8040.1, Airworthiness Directives.

• Order 8040.4, Safety Risk Management Policy.

• Order 8040.5, Airworthiness Directive Process for Mandatory Continuing Airworthiness Information.

• Order 8040.6, Unmanned Aircraft Systems (UAS) Safety Risk Management (SRM) Policy.

• Order 8110.100, Special Airworthiness Information Bulletin.

• Order 8110.101, Type Certification Procedures For Military Commercial Derivative Aircraft.

• Order 8110.103, Alternative Methods of Compliance (AMOC).

• Order 8120.16, Suspected Unapproved Parts Program.

• Order 8900.1, Flight Standards Information Management System.

• Order VS 8000.367, Aviation Safety Safety Management System (AVSSMS) Requirements.

• Order VS 8000.370, Aviation Safety (AVS) Safety Policy.

5. Industry Standards. RTCA DO-356, Airworthiness Security Methods and Considerations is referenced in this order.

6. Other Documents. FAA Policy Memo PS-ANM-25-05, Risk Assessment Methodology for Transport Category Airplanes , is referenced in this order. It is available on DRS.

B-2 8110.107B Chg 1 Appendix C Appendix C. Risk Assessment Methodologies 1. AIR has developed four product-specific risk assessment methodologies, reflecting the different product types for which we have design oversight responsibility. For more information for any of these methodologies, contact AIR-630.

• Continued Airworthiness Assessment Process (CAAP) – covers risk determination and management during the resolution of engine, propeller, and auxiliary power units (APU) hazards and is based on AC 39-8, Continued Airworthiness Assessments of Powerplant and Auxiliary Power Unit Installations of Transport Category Airplanes. Often will be referenced as “Continued Airworthiness Assessment Methodology (CAAM),” which is primarily for engines on transport airplanes.

• Rotorcraft Risk Analysis (RA) – guidance for estimating the associated risk and determining unsafe conditions for hazards on rotorcraft, including rotorcraft under the light-sport or experimental light-sport categories. The rotorcraft RA is also based on the risk analysis framework established by AC 39-8.

• Small Airplane Risk Analysis (SARA) – guidance for estimating the associated risk and determining unsafe conditions for hazards on small airplanes, or normal category airplanes, including airplanes under the light-sport or experimental light-sport categories. SARA is also based on the risk analysis framework established by AC 39-8.

• Transport Airplane Risk Assessment Methodology (TARAM) – PS-ANM-25-05 contains guidance for estimating the associated risk and determining unsafe conditions for hazards on transport category airplanes. It explains how to use such risk analysis calculations when making determinations of unsafe conditions, and selecting, and implementing corrective actions.

Note: These methodologies are available on the FAA internal employee’s website at AIR Continued Operational Safety (COS).

2. Reserve C-1 8110.107B Chg 1 Appendix D Appendix D. Potential Data Sources Depending on the type of product and investigation, there are several aviation safety data sources that can be utilized as part of the analysis and assessment of safety events, as well as tracking of any mitigations to those potential hazards. You are not expected to utilize every data source listed, but there might be some helpful data sources that you have not considered.

Note: Tables D-1 and D-2 provide an overview of various safety databases and recording systems used by the FAA. This list is by no means comprehensive but should give you a good start in finding the data you need for SA monitoring or SRM analysis.

Table D-1. Potential FAA Data Sources for SA and SRM Data or System Name Overview Section 21.3 Reports (also Reports of failures, malfunctions, and defects from the design or sometimes referred to as production approval holder, as required under § 21.3, or from the “COS Reports”) organization designation authorization (ODA) holder as required under § 183.63.

Accident/Incident Data The AIDS contains data records for all general aviation and System (AIDS) commercial air carrier incidents since 1978.

Aviation Safety Action ASAP promotes voluntary reporting of safety issues and events Program (ASAP) that come to the attention of employees of certain certificate holders. It includes enforcement-related incentives to encourage employees to voluntarily report safety issues, even though the issues may involve an alleged violation of 14 CFR.

Aviation Safety Information ASIAS is a data warehouse and integrated database system. It Analysis and Sharing enables users to perform queries across multiple databases and (ASIAS) System display queries in useful formats. It includes accidents, incidents, and voluntary data.

Comprehensive Electronic A web-based, comprehensive data reporting, collection, and Data Analysis and analysis tool used by both quality control and quality assurance Reporting (CEDAR) to record data associated with their respective organizational responsibilities.

CEDAR Mandatory ATO preliminary event information. The preliminary reports are Occurrence Report (MOR) received by FS through the CEDAR program.

Communications from Communications received by the FAA in the normal course of Certificate Holders business (emails, phone calls, letters, etc.). Some communications might result from a certificate holder’s SMS activity (14 CFR part 5), monitoring performance of safety risk D-1 8110.107B Chg 1 Appendix D Data or System Name Overview controls, trending, or identification of a new hazard, for example.

Data Collection Tools Findings from FS ASIs that are important to AIR’s (DCT) in SAS understanding of how a product is operated, including validating assumptions made during certification (including new and novel technologies), implementation rates of corrective action, and effectiveness of our mitigations. DCTs give us data to see whether the FAA has been successful at mitigating hazards.

Emergency Operations Deployed to provide the FAA with collaborative Network (EON) communication, continuity of operations and adaptive situational awareness for enhanced decision support at all levels within FAA, often the first group to receive word of an incident or accident. Formerly known as the Daily Alert Bulletin (DAB) (and “Page Outs”).

Extended Operations Reports of failures, malfunctions, and defects on any flight under (ETOPS) Reports ETOPS approval for anyone voluntarily operating an ETOPS route (travelling more than one hour away from a suitable airport). These reports are mandatory under §§ 121.374 and 135.364 and appendix G to part 135.

FAA Safety FAA safety recommendations are sent directly to the Office of Recommendations Accident Investigation and Prevention and disseminated to the responsible FAA office.

Mechanical Interruption Monthly reports required by all operators for events that do not Summary Reports rise to the level of a Service Difficulty Report (SDR), but result in a flight diversion, cancellation, or interruption due to mechanical issues.

Service Difficulty Reporting Database containing failure, malfunction, and defect reports System from operators and repair agencies as SDRs required under §§ 121.703 and 135.415, and other regulations and voluntary malfunction or defect reports. Analogous to § 21.3 reports.

Unapproved Parts Primary method used to notify the aviation community of Notifications (UPN) relevant information obtained from a suspected unapproved parts investigation concerning unapproved part(s) Washington Operations See EON. Some reports first come through the WOC.

Center (WOC) Web Based Operations Data from monitoring air operator and air agency compliance Safety System (WebOPSS) with safety, operations, and economic authority policies, D-2 8110.107B Chg 1 Appendix D Data or System Name Overview procedures, and regulations. Also provides information retrieval and decision support components to help meet the FAA’s oversight requirements for aviation safety.

Table D-2. Potential External Data Sources for SA and SRM Data or System Name Overview Aircraft type clubs and These organizations can provide operational and maintenance industry associations experience for general aviation aircraft.

Aviation Herald Summary of global accidents and incidents published as news articles.

Aviation Safety Network Detailed information of global accidents and incidents.

Aviation Safety Reporting Established by NASA to identify issues in the aviation system System (ASRS) which need to be addressed. NASA collects voluntarily submitted aviation safety incident/situation reports in the ASRS database from pilots, controllers, and other personnel. It identifies system deficiencies and issues messages to alert individuals in a position to correct the identified issues.

Cybersecurity Information Incident reporting regarding cybersecurity safety.

Sharing Act (CISA) data Commercial sources of For general aviation aircraft, the commercial sources of aircraft aircraft for sale for sale, Aircraft Bluebook and Trade-a-Plane, can provide airframe hours and hours since last engine overhaul information.

Continued Airworthiness Summary of historical safety data that document propulsion Assessment Methodologies system and APU-related aircraft safety hazards to help identify (CAAM) Reports and prioritize responses to potential engine, propeller, and APU unsafe conditions.

Manufacturer’s Safety Service documents released by manufacturers of light-sport Directives category aircraft required under 14 CFR 21.190(c)(5) to correct safety-of-flight issues.

NTSB Accident and The official repository of aviation accident data and causal Incident Database factors. In this database, personnel categorize events as accidents or incidents.

NTSB Safety Recommendations that address specific issues uncovered during Recommendations investigations and specify actions to help prevent similar accidents from occurring in the future.

D-3 8110.107B Chg 1 Appendix E Appendix E. COS IT Tool Process 1. This appendix provides expectations for a COS IT tool, which is also referred to as a COS management tool. Ensure the following requirements are met for any COS IT tool used: a. AIR-740 is responsible for assisting the ASE community in analyzing safety data in support of COS processes. As part of this role, AIR-740 develops AIR-level strategies to implement and standardize usage of advanced data analytics systems for use by the ASE community to enhance the COS processes throughout AIR. This includes the processes associated with integration and usage of safety data sources.

b. AIR-740 approval prior to beginning development or improvements for all new and substantially updated IT tools. Contact AIR-740 with any recommendations or enhancements for consideration in the COS IT tool process.

2. Reserve.

E-1 10/13/2023 8110.107B Appendix F Appendix F. MSAD Process Interactions Our safety process can be viewed as a simple control system model (figure F-1), where green (with vertical stripes) indicates how we sense or monitor the system we are controlling; light blue (with horizontal stripes) indicates how we analyze and use our sensed signals to make decisions on what to do (how to act on our system); and pink indicates components we use to act on our system.

Figure F-1. Simple Control System Model The MSAD process, depicted in light blue (with horizontal stripes) in figure F-2 below, interacts with many other COS processes within AIR. We have also added interactions that involve FAA personnel outside of AIR (depicted as shapes without a fill color) F-1 10/13/2023 8110.107B Appendix F Figure F-2. FAA AIR COS System Sharing data & info Work With Airborne Lock down security SSI/Cybersecurity SSI/Cybersecurity between FS, AVP, Cybersecurity Team (need to know) process and other orgs Nominate AVS Items meeting Go to Order 8040.4 Initiate DCT in FS or FAA SRM using cross-service SRM SAS HIRMT SRM criteria Event data National Analyze Data, Complete AD Monitor and Mandatory Aerospace System Make Decisions Draft/Issue AD Worksheet Validate AD Actions Operation (AIR SA & SRM) MSAD decisions for a DCT, investigation, given hazard can and other data involve any combination of items (in some (mandatory, AVS SRM cases) Monitor and (In some (In some candidate, non Reassess cases) cases) (If requested) Non-Mandatory mandatory) Airworthiness Feedback Loop Actions Limitations Approve/Deny Disturbances, changes AMOCs Release non- Other Identify Org. Accident Compliance and ICA mandatory alert, non-mandatory Issues, Improve Lessons Enforcement such as SAIB, UPN actions system Learned Actions on, changes to NAS Operation Acronyms AVS – Aviation Safety SAIB – Special Airworthiness Information Bulletin AD – Airworthiness Directive DCT – Data Collection Tool SAS – Safety Assurance System AIR – Aircraft Certification FS – Flight Standards SRM – Safety Risk Management AMOC – Alternate Methods of Compliance HIRMT – Hazard Identification, Risk Management & Tracking SSI – Sensitive Security Inforation ATO – Air Traffic Organization ICA – Instructions for Continued Airworthiness UPN – Unapproved Parts Notification AVP – Office of Accident Investigation and NAS – National Airspace Prevention SA – Safety Assurance F-2 8110.107B Chg 1 Appendix G. FS Roles and Responsibilities in Support of MSAD Process 1. ACSA and GASA . The ACSA and GASA monitor safety and analyze data in accordance with FAA Order 8900.1 Flight Standards Information Management System .

2. Safety Analysis and Promotion Division, AFS-900 .

a . AFS-900 provides regulatory oversight and analytical support to ACSA and GASA, Safety Standards, and Foundational Business.

b . Maintains SAS and standardizes analysis techniques and is responsible for providing analytic support to AVS in support of SRM.

c. Develops, delivers, and manages safety data, analysis, and reporting within systems outside of SAS.

3. AED, AFS-100. An AED ASI is a technical resource for other FS ASIs and serves as a liaison with the responsible AIR office.

a . Obtains and assesses information and data of failures, malfunctions, and defects relevant to products and articles they are assigned.

b . Determines if condition(s) affect the airworthiness or operation of the aircraft.

c . Interfaces with aircraft manufacturers, operators, AIR certification branches, other FS offices, and industry personnel throughout the operational life of an aircraft.

d . Interfaces with Safety Performance and Analysis System (SPAS). SPAS is a comprehensive analysis and reporting tool that provides access to a variety of aviation safety related databases. Within SPAS, users can access and analyze a wide range of data in critical areas related to flight operations, airworthiness, and hazardous materials safety 4. General Aviation and Commercial Division, AFS-800 . Provides a valuable interface with the general aviation community, including a forum for safety outreach efforts.

G-1 8110.107B Chg 1 Appendix H Appendix H. Directive Feedback Information Please submit any written comments or recommendation for improving this directive or suggest new items or subjects to be added to it. Also, if you find an error, please tell us about it.

Subject: FAA Order 8110.107B, Change 1, Monitor Safety Analyze Data .

To: Directive Management Officer, at 9-avs-air-directives-management-officer@faa.gov .

Please mark all appropriate line items: on An error (procedural or typographical) has been noted in paragraph page .

be changed as follows: Recommend paragraph on page (attached separate sheet if necessary) In a future change to this order, please include coverage on the following subject: (briefly describe what you want added): Other comments: I would like to discuss the above. Please contact me.

Submitted by: __________________________________Date: __________________ Telephone Number: _____________________________Routing Symbol: _________________ FAA Form 1320-19 (11/23) Supersedes Previous Edition H-1