Airworthiness directives and service bulletins

Lesson 6 ended with a distinction: most problems found in service are corrected through the type certificate holder's recommendations, while unsafe conditions are corrected through mandatory action by the authority. This lesson examines both tools. Service bulletins are the manufacturer's way of telling operators about improvements, inspections and modifications. Airworthiness directives are the authority's legally binding orders to correct an unsafe condition. The Petrel 19's first airworthiness directive, issued in its third year of service, shows how the two work together.

Service bulletins

A service bulletin is a document issued by the type certificate holder, or by the holder of an approval for an engine, propeller or appliance, that describes a recommended inspection, modification or procedure. It typically contains a reason for the bulletin, the aircraft affected by serial number, the compliance recommendation, a parts list, the labor estimate, detailed instructions and the effect on weight and balance. The holder may label a bulletin as optional, recommended, alert or mandatory, but these labels are the manufacturer's assessment of urgency. A service bulletin is not, by itself, a legal requirement for most operators.

Service bulletins can become mandatory in several ways. The authority can issue an airworthiness directive that requires compliance with the bulletin, often referencing it directly as the method. An operator's approved maintenance program can incorporate bulletins as a condition of its approval. And for some operators, contracts or leases require compliance with manufacturer recommendations. Operators that ignore recommended bulletins are not breaking a rule, but they may find themselves operating a different aircraft from the one the manufacturer supports.

Airworthiness directives

An airworthiness directive is issued by the FAA under 14 CFR Part 39 when an unsafe condition exists in a product and the condition is likely to exist or develop in other products of the same type design. It is a legally enforceable rule: under 14 CFR 39.7, anyone who operates a product that does not meet the requirements of an applicable directive is in violation. FAA directives are numbered in the form year-biweekly period-sequence, such as AD 2027-14-05. The FAA also issues directives for foreign products used in the United States, usually adopting the action taken by the state of design.

Because directives are rules, the FAA normally issues them through rulemaking: a notice of proposed rulemaking (NPRM) is published in the Federal Register, comments are considered, and a final rule is issued. When the unsafe condition requires action faster than the comment period allows, the FAA issues a final rule with a request for comments, effective on publication, or an emergency directive, which is sent directly to known owners and operators and is effective on receipt.

A directive identifies the products affected, describes the unsafe condition and its cause where known, sets out the required actions, and specifies the compliance time. Compliance times are often expressed in more than one measure, such as flight hours, cycles and calendar time, with the requirement to comply by whichever comes first. A directive may require a one-time inspection, repetitive inspections until a terminating action is taken, a modification, a limitation in the flight manual, or a combination.

The Petrel 19's first directive

In year three, a Petrel 19 operated by Kuskokwim Air Link has an uncommanded shutdown of one propulsion unit in cruise. The crew land safely on the remaining unit and the battery. The investigation by Prairiewind Aerospace finds a cracked solder joint in an inverter power module, caused by thermal cycling at a rate higher than the qualification test assumed. Short sectors with frequent high-power climbs, typical of the launch operator, accelerate the cracking. Two other inverters removed from the fleet show the same cracking at an earlier stage.

The safety assessment classifies the loss of one propulsion unit as major. But if both inverters on one aircraft are cracked by the same mechanism, simultaneous failure becomes plausible, and the failure condition becomes catastrophic. This is the common cause problem of Lesson 4 appearing in service. the FAA agrees with Prairiewind Aerospace that an unsafe condition exists. Prairiewind Aerospace issues an alert service bulletin with an inspection of the inverter power modules using a thermal imaging test at ground power, and a replacement module with a redesigned solder joint. the FAA then issues AD 2027-14-05, which requires the inspection within 600 flight hours, 800 cycles or 180 days of the effective date, whichever comes first, repetitive inspections every 400 hours, and replacement with the redesigned module within two years as a terminating action.

Tomasz's team helps Kuskokwim Air Link plan compliance. The code below computes the due date for each aircraft from its utilization.

# Airworthiness directive due dates: whichever comes first of hours, cycles or calendar.
from datetime import date, timedelta
ad = {'hours': 600, 'cycles': 800, 'days': 180}      # compliance time after the effective date
effective = date(2027, 3, 15)
fleet = {'N191PW': (1840, 2210, 3.1, 4.0), 'N192PW': (920, 1300, 2.6, 3.3), 'N193PW': (2450, 3020, 3.4, 4.6)}
# tail: hours, cycles at effective date, average hours per day, cycles per day
for tail, (h, c, hpd, cpd) in fleet.items():
    d_h = ad['hours'] / hpd; d_c = ad['cycles'] / cpd; d_t = ad['days']
    days = min(d_h, d_c, d_t); names = ['hours', 'cycles', 'calendar']; limits = [d_h, d_c, d_t]; which = names[limits.index(days)]
    print(f"{tail}: due {effective + timedelta(days=int(days))} ({which} limit), at about {h + hpd*days:.0f} h / {c + cpd*days:.0f} cycles")

N191PW: due 2027-09-11 (calendar limit), at about 2398 h / 2930 cycles
N192PW: due 2027-09-11 (calendar limit), at about 1388 h / 1894 cycles
N193PW: due 2027-09-04 (cycles limit), at about 3041 h / 3820 cycles

Two aircraft reach the calendar limit first, on 11 September 2027, because their utilization is modest. The third, with higher cycles per day, reaches the cycle limit first on 4 September. The operator schedules all three during the planned summer maintenance window, well before the limits, so that a finding of cracking can be dealt with without grounding an aircraft at a remote station.

Alternative methods of compliance

Sometimes an operator cannot comply with a directive exactly as written, or has a better way of achieving the same result. Under 14 CFR 39.19, anyone may propose an alternative method of compliance (AMOC) or a change in compliance time, provided it gives an acceptable level of safety. The request goes to the FAA office identified in the directive, often through the operator's principal inspector. An approved AMOC applies only to the aircraft and conditions stated in the approval.

For the inverter directive, Kuskokwim Air Link has two aircraft at stations without ground power capable of running the thermal imaging test. It proposes an alternative: removing the inverter and testing it on a bench at the main base, with a spare installed in its place. The authority approves this as an alternative method, because the test is the same and the bench conditions are better controlled.

Recording and tracking

Every applicable directive must be recorded in the aircraft's technical records, with the method of compliance, the date, the hours and cycles at compliance, and for repetitive actions the next due time. Operators keep a directive status list for each aircraft and component, and directive compliance is one of the first things an inspector checks when an aircraft changes hands. Directives apply to components as well as aircraft: an engine, a propeller or an appliance may carry its own directives, and when a component moves between aircraft, its directive status must go with it.

A common error is to treat a directive as complete when a one-time inspection has been done, forgetting the repetitive requirement or the terminating action. Another is to miss a directive on a component installed after the original status review. Good tracking systems link each directive to serial numbers, not just to aircraft registrations, and generate forecasts so that compliance can be planned into scheduled maintenance.

Mandatory continuing airworthiness information across borders

Under ICAO Annex 8, the state of design is responsible for issuing mandatory continuing airworthiness information for its products and for sending it to other states that have the type on their registers. States of registry are then responsible for ensuring that their aircraft comply, either by adopting the state of design's directives or by issuing their own. For the Petrel 19, Canada and the United States each need a mechanism to receive and act on the other's directives once the type is validated. Rachel arranges that every directive issued by the state of design is sent promptly to the validating authority, with the supporting service bulletin, so that operators in both countries receive the same instructions at the same time.

Differences can arise. A validating authority may judge that a compliance time is too long for its operating environment, or may add an action. Operators of the same type in different countries can then face different requirements. Harmonization efforts aim to avoid this, but where it happens, an operator flying aircraft registered in more than one country must comply with each state's requirements for each aircraft.

Judgment in issuing directives

Directives impose cost. The inverter directive will cost Kuskokwim Air Link hundreds of labor hours and the replacement modules several hundred thousand US dollars, mostly covered by Prairiewind Aerospace under warranty. Authorities therefore weigh the urgency of the unsafe condition against the burden of compliance, and set compliance times that reduce risk quickly enough without grounding fleets unnecessarily. A directive with too short a compliance time can cause operators to rush work, introducing new risks. One with too long a time leaves aircraft exposed. The risk assessment methods used in certification, together with fleet data, inform these decisions.

Hélène Lavoie, now responsible for in-service support of production, raises a point about the supply chain. The redesigned module must be produced in enough numbers to replace every inverter in the fleet within the two-year terminating action period. If the supplier cannot meet that rate, the authority may need to extend the period, with continued repetitive inspections in the meantime. She starts the supplier capacity review the same week the alert service bulletin is issued.

Closing the loop to design

A directive corrects the fleet; it should also correct the process that let the problem through. Élise Fournier asks why the qualification test missed the solder cracking. The answer is that the thermal cycling profile in the test was based on a generic mission with long cruise segments, while Kuskokwim Air Link's sectors average 35 minutes with a full-power climb on each. The inverter saw roughly three times as many large temperature swings per flight hour as the test assumed. Prairiewind Aerospace revises its qualification method to derive thermal cycling from the most demanding expected operator, not an average one, and reviews every other power electronics item on the aircraft against the new profile. Two more items are found to have reduced margin, and are corrected by service bulletin before any failure occurs.

The lesson for designers is that the assumptions behind a test are part of the design. When an aircraft enters service, its real usage should be compared with those assumptions as early as possible. Kenji Watanabe makes this comparison a formal deliverable of the in-service engineering team at the end of the first year of operation of every new product, so that the next directive is found before it is needed.