21.A.3B Airworthiness directives

UNSAFE CONDITION An unsafe condition exists if there is factual evidence (from service experience, analysis or tests) that:

(a)An event may occur that would result in fatalities, usually with the loss of the aircraft, or reduce the capability of the aircraft or the ability of the crew to cope with adverse operating conditions to the extent that there would be:

(i)A large reduction in safety margins or functional capabilities, or

(ii)Physical distress or excessive workload such that the flight crew cannot be relied upon to perform their tasks accurately or completely, or

(iii)Serious or fatal injury to one or more occupants unless it is shown that the probability of such an event is within the limit defined by the applicable certification specifications, or

(b)There is an unacceptable risk of serious or fatal injury to persons other than occupants, or

(c)Design features intended to minimise the effects of survivable accidents are not performing their intended function. Note 1: Non-compliance with applicable certification specifications is generally considered as an unsafe condition, unless it is shown that possible events resulting from this non-compliance do not constitute an unsafe condition as defined under paragraphs (a), (b) and (c). Note 2: An unsafe condition may exist even though applicable airworthiness requirements are complied with. Note 3: The above definition covers the majority of cases where the Agency considers there is an unsafe condition. There may be other cases where overriding safety considerations may lead the Agency to issue an airworthiness directive. Note 4: There may be cases where events can be considered as an unsafe condition if they occur too frequently (significantly beyond the applicable safety objectives) and could eventually lead to consequences listed in paragraph (a) in specific operating environments. Although having less severe immediate consequences than those listed in paragraph (a), the referenced events may reduce the capability of the aircraft or the ability of the crew to cope with adverse operating conditions to the extent that there would be, for example, a significant reduction in safety margins or functional capabilities, a significant increase in crew workload, or in conditions impairing crew efficiency, or discomfort to occupants, possibly including injuries.

DETERMINATION OF AN UNSAFE CONDITION It is important to note that these guidelines are not exhaustive. However, this material is intended to provide guidelines and examples that will cover most cases, taking into account the applicable certification requirements.

1.INTRODUCTION Certification or approval of a product, part or appliance is a demonstration of compliance with requirements which are intended to ensure an acceptable level of safety. This demonstration, however, includes certain accepted assumptions and predicted behaviours, such as: fatigue behaviour is based on analysis supported by test, modelling techniques are used for Aircraft Flight Manual performances calculations, the systems safety analyses give predictions of what the systems failure modes, effects and probabilities may be, the system components’ reliability figures are predicted values derived from general experience, tests or analysis, the crew is expected to have the skills to apply the procedures correctly, and the aircraft is assumed to be maintained in accordance with the prescribed instructions for continued airworthiness (ICAs) (or maintenance programme). In service experience, additional testing, further analysis, etc., may show that certain initially accepted assumptions are not correct. Thus, certain conditions initially demonstrated as safe, are revealed by experience as unsafe. In this case, it is necessary to mandate corrective actions in order to restore a level of safety consistent with the applicable certification requirements. To support the determination of an unsafe condition, the investigation may need to include examinations of worn, damaged and time-expired parts / analysis / certification demonstration / tests / statistical analysis, and comparison with the certification assumptions. See AMC1 21.A.3B(b) for the definition of ‘unsafe condition’ used in 21.A.3A(b).

2.GUIDELINES FOR ESTABLISHING IF A CONDITION IS UNSAFE The following paragraphs give general guidelines for analysing the reported events and determining if an unsafe condition exists, and are provided for each type of product, part or appliance subject to a specific airworthiness approval: type-certificates (TC) or supplemental type-certificates (STC) for aircraft, engines or propellers, or European Technical Standard Orders (ETSO). This analysis may be qualitative or quantitative, i.e. formal and quantitative safety analyses may not be available for older or small aircraft. In such cases, the level of analysis should be consistent with that required by the certification specifications and may be based on engineering judgement supported by service experience data.

2.1 Analysis method for aircraft

2.1.1 Accidents or incidents without any aircraft, engines, system, propeller or part or appliance malfunction or failure When an accident/incident does not involve any component malfunction or failure but when a crew human factor has been a contributing factor, this should be assessed from a man-machine interface standpoint to determine whether the design is adequate or not. Paragraph 2.5 gives further details on this aspect.

2.1.2 Events involving an aircraft, engines, system, propeller or part or appliance failure, malfunction or defect The general approach for analysis of in-service events caused by malfunctions, failures or defects will be to analyse the actual failure effects, taking into account previously unforeseen failure modes or improper or unforeseen operating conditions revealed by service experience. These events may have occurred in service, or have been identified during maintenance, or been identified as a result of subsequent tests, analyses, or quality control. These may result from a design deficiency or a production deficiency (non-conformity with the type design), or from improper maintenance. In this case, it should be determined if improper maintenance is limited to one aircraft, in which case an airworthiness directive may not be issued, or if it is likely to be a general problem due to improper design and/or maintenance procedures, as detailed in paragraph 2.5.

2.1.2.1 Flight An unsafe condition exists if: There is a significant shortfall of the actual performance compared to the approved performance (taking into account the accuracy of the performance calculation method), or The handling qualities, although having been found to comply with the applicable certification specifications at the time of initial approval, are subsequently shown by service experience not to comply.

2.1.2.2 Structural or mechanical systems An unsafe condition exists if the deficiency may lead to a structural or mechanical failure which: Could exist in a Principal Structural Element that has not been qualified as damage tolerant. Principal Structural Elements are those which contribute significantly to carrying flight, ground, and pressurisation loads, and whose failure could result in a catastrophic failure of the aircraft. Typical examples of such elements are listed for large aeroplanes in AMC 25.571(a) ‘Damage tolerance and fatigue evaluation of structure’, and in the equivalent material for rotorcraft. Could exist in a Principal Structural Element that has been qualified as damage tolerant, but for which the established inspections, or other procedures, have been shown to be, or may be, inadequate to prevent catastrophic failure. Could reduce the structural stiffness to such an extent that the required flutter, divergence or control reversal margins are no longer achieved. Could result in the loss of a structural piece that could damage vital parts of the aircraft, cause serious or fatal injuries to persons other than occupants. Could, under ultimate load conditions, result in the liberation of items of mass that may injure occupants of the aircraft. Could jeopardise proper operation of systems and may lead to hazardous or catastrophic consequences, if this effect has not been taken adequately into account in the initial certification safety assessment.

2.1.2.3 Systems The consequences of reported systems components malfunctions, failures or defects should be analysed. For this analysis, the certification data may be used as supporting material, in particular systems safety analyses. The general approach for analysis of in-service events caused by systems malfunctions, failures or defects will be to analyse the actual failure effects. As a result of this analysis, an unsafe condition will be assumed if it cannot be shown that the safety objectives for hazardous and catastrophic failure conditions are still achieved, taking into account the actual failure modes and rates of the components affected by the reported deficiency. The failure probability of a system component may be affected by: A design deficiency (the design does not meet the specified reliability or performance). A production deficiency (non-conformity with the certified type design) that affects either all components, or a certain batch of components. Improper installation (for instance, insufficient clearance of pipes to surrounding structure). Susceptibility to adverse environment (corrosion, moisture, temperature, vibrations etc.). Ageing effects (failure rate increase when the component ages). Improper maintenance. When the failure of a component is not immediately detectable (hidden or latent failures), it is often difficult to have a reasonably accurate estimation of the component failure rate since the only data available are usually results of maintenance or flight crew checks. This failure probability should therefore be conservatively assessed. As it is difficult to justify that safety objectives for the following systems are still met, a deficiency affecting these types of systems may often lead to a mandatory corrective action: back up emergency systems, or fire detection and protection systems (including shut off means). Deficiencies affecting systems used during an emergency evacuation (emergency exits, evacuation assist means, emergency lighting system ...) and to locate the site of a crash (Emergency Locator Transmitter) will also often lead to mandatory corrective action.

2.1.2.4 Others In addition to the above, the following conditions are considered unsafe: There is a deficiency in certain components which are involved in fire protection or which are intended to minimise/retard the effects of fire/smoke in a survivable crash, preventing them to perform their intended function (for instance, deficiency in cargo liners or cabin material leading to non-compliance with the applicable flammability requirements). There is a deficiency in the lightning or High Intensity Radiated Fields protection of a system which may lead to hazardous or catastrophic failure conditions. There is a deficiency which could lead to a total loss of power or thrust due to common mode failure. If there is a deficiency in systems used to assist in the enquiry following an accident or serious incident (e.g., Cockpit Voice Recorder, Flight Data Recorder), preventing them to perform their intended function, the Agency may take mandatory action.

2.2 Engines The consequences and probabilities of engine failures have to be assessed at the aircraft level in accordance with paragraph 2.1, and also at the engine level for those failures considered as Hazardous in CS E-510. The latter will be assumed to constitute unsafe conditions, unless it can be shown that the consequences at the aircraft level do not constitute an unsafe condition for a particular aircraft installation.

2.3 Propellers The consequences and probabilities of propeller failures have to be assessed at the aircraft level in accordance with paragraph 2.1, and also at the propeller level for those failures considered as hazardous in CS P-70. The latter will be assumed to constitute unsafe conditions, unless it can be shown that the consequences at the aircraft level do not constitute an unsafe condition for a particular aircraft installation.

2.4 Parts and appliances The consequences and probabilities of equipment failures have to be assessed at the aircraft level in accordance with paragraph 2.1.

2.5 Human factors aspects in establishing and correcting unsafe conditions This paragraph provides guidance on the way to treat an unsafe condition resulting from a maintenance or crew error observed in service. It is recognised that human factors techniques are under development. However, the following is a preliminary guidance on the subject. Systematic review should be used to assess whether the crew or maintenance error raises issues that require regulatory action (whether in design or other areas), or should be noted as an isolated event without intervention. This may need the establishment of a multidisciplinary team (designers, crews, human factors experts, maintenance experts, operators etc.) The assessment should include at least the following: Characteristics of the design intended to prevent or discourage incorrect assembly or operation; Characteristics of the design that allow or facilitate incorrect operation, Unique characteristics of a design feature differing from established design practices; The presence of indications or feedback that alerts the operator to an erroneous condition; The existence of similar previous events, and whether or not they resulted (on those occasions) in unsafe conditions; Complexity of the system, associated procedures and training (has the crew a good understanding of the system and its logic after a standard crew qualification programme?); Clarity/accuracy/availability/currency and practical applicability of manuals and procedures; Any issues arising from interactions between personnel, such as shift changeover, dual inspections, team operations, supervision (or lack of it), or fatigue. Apart from a design change, the corrective actions, if found necessary, may consist of modifications of the manuals, inspections, training programmes, and/or information to the operators about particular design features. The Agency may decide to make mandatory such corrective action if necessary.

This GM provides guidelines to assist in establishing rectification campaigns to remedy discovered defects.

1.STATUS This document contains GM of a general nature for use in conjunction with engineering judgement, to aid airworthiness engineers in reaching decisions in the state of technology at the material time. While the main principles of this GM could be applied to small private aeroplanes, helicopters, etc. the numerical values chosen for illustration are appropriate to large aeroplanes for public transport.

2.INTRODUCTION

2.1 Over the years, target airworthiness risk levels underlying airworthiness requirements have developed on the basis of traditional qualitative airworthiness approaches; they have been given more precision in recent years by being compared with achieved airworthiness levels (judged from accident statistics) and by the general deliberations and discussions which accompanied the introduction of rational performance requirements, and more recently, the Safety Assessment approach in requirements. Although the target airworthiness risk level tends to be discussed as a single figure (a fatal accident rate for airworthiness reasons of not more than 1 in 10 000 000 flights/flying hours for large aeroplanes) it has to be recognised that the requirements when applied to particular aircraft types will result in achieved airworthiness levels at certification lying within a band around the target level and that thereafter, for particular aircraft types and for particular aircraft, the achieved level will vary within that band from time to time.

2.2 The achieved airworthiness risk levels can vary so as to be below the target levels, because it is difficult if not impossible to design to the minimum requirements without being in excess of requirements in many areas; also because aircraft are not always operated at the critical conditions (e.g., aircraft weight, CG position and operational speeds; environmental conditions - temperature, humidity, degree of turbulence). The achieved level may vary so as to be above the target level because of undetected variations in material standards or build standards, because of design deficiencies, because of encountering unforeseen combinations of failures and/or combinations of events, and because of unanticipated operating conditions or environmental conditions.

2.3 There is now a recognition of the need to attempt to monitor the conditions which tend to increase the level and to take appropriate corrective action when the monitoring indicates the need to do so in order to prevent the level rising above a predetermined ‘ceiling’.

2.4 The Agency also has a duty in terms of providing the public with aviation services and therefore should consider the penalties associated with curtailment or even removal (by ‘grounding’) of aviation services when establishing the acceptability of any potential variation in airworthiness level.

2.5 Thus, the purpose of this GM is:

(a)To postulate basic principles which should be used to guide the course of actions to be followed so as to maintain an adequate level of airworthiness risk after a defect has occurred which, if uncorrected, would involve a potential significant increase of the level of risk for an aircraft type.

(b)For those cases where it is not possible fully and immediately to restore an adequate level of airworthiness risk by any possible alleviating action such as an inspection or limitation, to state the criteria which should be used in order to assess the residual increase in risk and to limit it to an appropriate small fraction of the mean airworthiness through life risk.

3.DISCUSSION

3.1 Several parameters are involved in decisions on safety matters. In the past the cost of proposed action has often been compared with the notional 'risk cost', i.e. the cost of a catastrophe multiplied by its probability of occurrence.

3.2 This can be a useful exercise, but it should be held within the constraint of acceptable airworthiness risk levels, i.e., within airworthiness risk targets which represent the maximum levels of risk with which an aircraft design must comply, i.e., in the upper part of the 'band'. Currently for large aeroplanes the mean airworthiness risk level is set at a catastrophe rate for airworthiness reasons of not more than one in every ten- million flights/flying hours. The constraint is overriding in that any option, which could be permitted on risk cost considerations, or other grounds, is unacceptable if it leads to significant long-term violation of this safety requirement.

3.3 While it should clearly be the objective of all to react to and eliminate emergency situations, i.e., those involving a potentially significant increase of airworthiness risk levels, without unreasonable delay, the Agency should be able finally to rule on what is a minimum acceptable campaign programme. It has therefore seemed desirable to devise guidelines to be used in judging whether a proposed campaign of corrective actions is sufficient in airworthiness terms, and clearly this ought to be based on determining the summation of the achieved airworthiness risk levels for the aircraft and passengers during any periods of corrective action and comparing them with some agreed target.

3.4 As the period of corrective action will not be instantaneous (unless by grounding), there is potentially an increase in the achieved airworthiness risk level possibly to and, without controls, even above the higher part of the 'band', and the amount by which the level is above the mean target figure, and the period for which it should be allowed to continue, has been a matter of some arbitrary judgement. [Figure or form omitted from this preview — available in the Avioverse workspace library.]3.5 It would appear desirable to try to rationalise this judgement. For example, if an aircraft were to spend 10 % of its life at a level such that the risk of catastrophe was increased by an order of magnitude, the average rate over its whole life would be doubled which may not be in the public interest. A more suitable criterion is perhaps one which would allow an average increase in risk of, say one third on top of the basic design risk when spread over the whole life of the aircraft an amount which would probably be acceptable within the concept (See Figure 1). It would then be possible to regard the 'through life' risk to an aircraft - e.g., a mean airworthiness target of not more than one airworthiness catastrophe per 10 million ( ) hours, as made up of two parts, the first being 3/4 of the total and catering for the basic design risk and the other being 1/4 of the total, forming an allowance to be used during the individual aircraft's whole life for unforeseen campaign situations such as described above.

3.6 Investigation has shown that a total of ten such occasions might arise during the life of an individual aircraft.

3.7 Using these criteria, there could then be during each of these emergency periods (assumed to be ten in number) a risk allowance contributed by the campaign alone of: 1 x 10-7 for 2.5% of the aircraft's life; or 5 x 10-7 for 0.5% of the aircraft's life; or 1 x 10-6 for 0.25% of the aircraft's life; or 1 x 10-5 for 0.025% of the aircraft's life, etc. without exceeding the agreed 'allowance' set aside for this purpose.

3.8 Thus a 'reaction table' can be created as indicated in Table 1 (the last two columns assuming a typical aircraft design life of 60,000 hours and an annual utilisation of 3 000 hours per annum) showing the flying or calendar time within which a defect should be corrected if the suggested targets are to be met.

Table 1

3.9 These principles may be applied to a single aircraft or a number of aircraft of a fleet but in calculating risk, all the risk should be attributed to those aircraft which may carry it, and should not be diluted by including other aircraft in the fleet which are known to be free of risk. (It is permissible to spread the risk over the whole fleet when a source is known to exist without knowing where). Where a fleet of aircraft is involved Column 2 may be interpreted as the mean time to rectification and not the time to the last one.

3.10 There is one further constraint. However little effect a situation may have on the 'whole life' risk of an aircraft, the risk should not be allowed to reach too high a level for any given flight. Thus while a very high risk could be tolerated for a very short period without unacceptable degradation of the overall airworthiness target, the few flights involved would be exposed to a quite unacceptable level of risk. It is therefore proposed that the Table 1 should have a cut-off at the 2 x 10-6 level so that no flight carries a risk greater than 20 times the target. At this level the defect is beginning to contribute to a greater likelihood of catastrophe than that from all other causes, including non-airworthiness causes, put together. If the situation is worse than this, grounding appears to be the only alternative with possibly specially authorised high-risk ferry flights to allow the aircraft to return to base empty. Figures 2 and 3 show a visualisation chart equivalent to Table 1, giving average rectification time (either in flight hours or months) based on probability of defect that must be corrected.

3.11 It will be seen that the above suggestions imply a probability of catastrophe from the campaign alone of 1.5/10 000 per aircraft during each separate campaign period (i.e., p = 0.015 per 100 aircraft fleet).

3.12 In addition, in order to take into account large fleet size effect, the expected probability of the catastrophic event during the rectification period on the affected fleet shall not exceed 0.1. See Figure 4.

3.13 It should also be noted that in assessing campaign risks against 'design risk', an element of conservatism is introduced, since the passenger knows only 'total risk' (i.e. airworthiness plus operations risks) and the fatal accident rate for all reasons is an order of magnitude greater than that for airworthiness reasons only (i.e., 10-6 as against 10-7). The summated campaign risk allowance proposed by this GM is therefore quite a small proportion of the total risk to which a passenger is subject. When operating for short periods at the limit of risk proposed (2 x 10-6 per hour) the defect is however contributing 100 % more risk than all other causes added together.

3.14 A similar approach is proposed to cover the case of defects associated to hazardous failure conditions for which the safety objectives defined by the applicable certification specifications are not met. According to CS 25.1309, the allowable probability for each hazardous failure condition is set at 10-7 per flight hour compared to 10-9 per flight hour for a catastrophic failure condition. Figure 5 is showing a visualisation chart giving average rectification time based on probability of defect that should be corrected. This is similar to Figure 2 but with lower and upper boundaries adapted to cover the case of hazardous failure conditions (probabilities of 10-7 and 2x10-4 respectively).

3.15 In addition, in order to take into account large fleet size effect, the expected probability of the hazardous event during the rectification period on the affected fleet shall not exceed 0.5. See Figure 6.

4.GUIDELINES

4.1 The above would lead to the following guidelines for a rectification campaign to remedy a discovered defect associated to a catastrophic failure condition without grounding the aircraft:

(i)Establish all possible alleviating action such as inspections, crew drills, route restrictions, and other limitations.

(ii)Identify that part of the fleet, which is exposed to the residual risk, after compliance has been established with paragraph (i).

(iii)Using reasonably cautious assumptions, calculate the likely catastrophic rate for each aircraft carrying the risk in the affected fleet.

(iv)Compare the speed with which any suggested campaign will correct the deficiency with the time suggested in Figure 2. The figure should not be used beyond the 2x10-6 level, except for specially authorised flights.

(v)Also ensure that the expected probability of the catastrophic event during the rectification period on the affected fleet is in accordance with Figure 4.

4.2 Similarly, the following guidelines would be applicable for a rectification campaign to remedy a discovered defect associated to a hazardous failure condition without grounding the aircraft:

(i)Establish all possible alleviating action such as inspections, crew drills, route restrictions, and other limitations.

(ii)Identify that part of the fleet, which is exposed to the residual risk, after compliance has been established with paragraph (i).

(iii)Using reasonably cautious assumptions, calculate the likely hazardous rate for each aircraft carrying the risk in the affected fleet.

(iv)Compare the speed with which any suggested campaign will correct the deficiency with the time suggested in Figure 5.

(v)Also ensure that the expected probability of the hazardous event during the rectification period on the affected fleet is in accordance with Figure 6.

4.3 It must be stressed that the benefit of these guidelines will be to form a datum for what is considered to be the theoretically maximum reaction time. A considerable amount of judgement will still be necessary in establishing many of the input factors and the final decision may still need to be tempered by non-numerical considerations, but the method proposed will at least provide a rational 'departure point' for any exercise of such judgement.

4.4 It is not intended that the method should be used to avoid quicker reaction times where these can be accommodated without high expense or disruption of services.

[Figure or form omitted from this preview — available in the Avioverse workspace library.] Figure 1 - Visualisation Chart for CS-25

[Figure or form omitted from this preview — available in the Avioverse workspace library.] Figure 2 - Visualisation Chart for CS-25 (Flight hours)

[Figure or form omitted from this preview — available in the Avioverse workspace library.] Figure 3 - Visualisation Chart for CS-25 (Calendar basis)

[Figure or form omitted from this preview — available in the Avioverse workspace library.] Figure 4 - Visualisation Chart for CS-25 (Flight Hours)

[Figure or form omitted from this preview — available in the Avioverse workspace library.] Figure 5 - Visualisation Chart for CS-25 (Flight hours)

[Figure or form omitted from this preview — available in the Avioverse workspace library.] Figure 6 - Visualisation Chart for CS-25 (Flight hours)