Airmotive Eng'g Corp. v. Fed. Aviation Admin.

A manufacturer of replacement aircraft parts petitions for review of an "airworthiness directive" issued by the Federal Aviation Administration that mandates removal of some of its engine cylinder assemblies. The manufacturer challenges the application of a risk management methodology and whether there was substantial evidence in the record to support the conclusion that the cylinders presented an "unsafe condition" under agency regulations. It also contends that a failure to analyze the risks associated with replacement itself undermined reasoned decisionmaking. It seeks a remand for a new risk assessment of the cylinder assemblies. For the following reasons, we deny the petition for review.

I.

In support of the mandate to "promote safe flight of civil aircraft," the Federal Aviation Administration ("FAA") promulgates safety standards for aircraft and component parts. 49 U.S.C. § 44701 et seq . To produce replacement parts for aircraft engines, a manufacturer is required to obtain a "parts manufacturer approval" ("PMA"), 14 C.F.R. § 21.301 - .320, that the part "conforms to its approved design and is in a condition for safe operation," id. § 21.1(b)(1). Once a replacement part is in production, the FAA, upon determining that the part has an "unsafe condition" that "is likely to exist or develop in other products of the same type design," may issue an "airworthiness directive." Id. § 39.5. The FAA treats airworthiness directives, which are published in the Federal Register, id. § 39.13, as "legally enforceable rules," id. § 39.3, that can require inspections, impose conditions and limitations, and require actions to resolve an unsafe condition, id. § 39.11. The term "unsafe condition" is not defined by statute or FAA regulation.

Airmotive Engineering Corporation and Engine Components International, Inc. (collectively, "Airmotive") manufacture and market PMA-certified replacement "cylinder assemblies" used in piston engines installed in small single- or twin-engine aircraft. The head of a cylinder assembly is joined to the barrel by heating the head and screwing it onto the threaded barrel to create an "interference fit." National Transportation Safety Board ("NTSB"), Safety Rec. to Act. FAA Adm'r, at 1 (Feb. 24, 2012).

In August 2013, the FAA published a notice of proposed rulemaking for an airworthiness directive regarding the "unsafe condition" created by Airmotive cylinder assemblies with part number AEC631397 and serial numbers 1 to 61,176 (hereinafter "AEC63"). Continental Motors, Inc. Reciprocating Engines (" CMRE "), 78 Fed. Reg. 48,828 , 48,830 (Aug. 12, 2013) ("NPRM"). This followed the FAA's receipt of failure reports of multiple cylinder head-to-barrel separations and cracked and leaking aluminum cylinder heads, and recommendations from the NTSB and FAA maintenance inspectors. The proposed directive would require initial and repetitive inspections, replacement of cracked cylinders, and replacement after reduced times-in-service. It would prohibit future installation of AEC63 cylinder assemblies. Id . Public comments were mostly negative. The FAA proceeded to add certain technical documents to the rulemaking record, extend the public comment period, and appoint an "independent, multidisciplinary team" of agency experts. The team concluded an "unsafe condition" existed and an airworthiness directive was required, but recommended making compliance less aggressive and less costly with revised compliance and removal schedules. In January 2015, the FAA published a revised proposal adopting the recommendations and reopened the comment period. See CMRE , 80 Fed. Reg. 1008 (Jan. 8, 2015) ("Supp. NPRM"). After the FAA placed additional technical documents in the record and provided responses to public comments, it again reopened the comment period. See CMRE , 80 Fed. Reg. 52,212 (Aug. 28, 2015) ("Second Supp. NPRM").

The FAA promulgated the airworthiness directive a year later. See CMRE , 81 Fed. Reg. 52,975 (Aug. 11, 2016) ("Final Rule"). In further response to public comments, the FAA explained the basis for its conclusion that AEC63 cylinder assemblies presented an "unsafe condition." In the FAA's judgment, "[t]he impact of a cylinder failure separation in flight is an unacceptable compromise to safety." Id . at 52,980. Record evidence indicated that AEC63 cylinder assemblies fail at a rate "at least 32 times greater" than those of the original manufacturer. Id. at 52,979 . The FAA attributed the "root cause" of this high failure rate "to two inherent design deficiencies": "Insufficient dome transition radius and insufficient head-to-barrel interference fit." Id. at 52,980 . Record evidence further indicated that "in-flight cylinder head separation is an unsafe condition that presents multiple secondary effects," including in-flight fire and loss of aircraft control. Id. at 52,979 . Accident data confirmed that separated cylinders have also been a precipitating event in fatal accidents. Id. The directive required phased removal of AEC63 assemblies and prohibited their future installation. Id. at 52,991 . Airmotive petitions for review of the Final Rule, see 49 U.S.C. § 46110 (a), seeking a remand for a new risk assessment of the cylinder assemblies.

II.

Under the Administrative Procedure Act ("APA"), the court must uphold agency action unless it is "arbitrary, capricious, an abuse of discretion, or otherwise not in accordance with the law." 5 U.S.C. § 706 (2)(A). "The scope of review ... is narrow and a court is not to substitute its judgment for that of the agency," provided the agency has "examine[d] the relevant data and articulate[d] a satisfactory explanation for its action including a rational connection between the facts found and the choice made." Motor Vehicle Mfrs. Ass'n v. State Farm Mut. Auto. Ins. Co. , 463 U.S. 29 , 43, 103 S.Ct. 2856 , 77 L.Ed.2d 443 (1983) (internal quotation marks and citation omitted); see Clark Cty., Nev. v. FAA , 522 F.3d 437 , 441 (D.C. Cir. 2008). The FAA's findings of fact "are conclusive" when "supported by substantial evidence," 49 U.S.C. § 46110 (c), namely, "evidence as a reasonable mind might accept as adequate to support a conclusion," Schoenbohm v. FCC , 204 F.3d 243 , 246 (D.C. Cir. 2000) (citation omitted). When applied to a rulemaking, the substantial evidence and arbitrary and capricious tests are "identical." See S.C. Pub. Serv. Auth. v. FERC , 762 F.3d 41 , 54 (D.C. Cir. 2014) (citation omitted).

The FAA used the risk-measurement methodology in FAA Order 8040.4A to assess the safety of Airmotive's AEC63 cylinders. Final Rule, 81 Fed. Reg. at 52 ,983 -84. It determined the "severity" of risk ( i.e. , the potential consequences of part failure) as defined at five levels, and the "likelihood" of risk ( i.e. , the failure rate), also defined at five levels. See FAA

Order 8040.4A, Safety Risk Management Policy, at 9 (Apr. 30, 2012). It entered the severity and likelihood findings on a matrix to identify the "overall level of risk": "acceptable," "acceptable with mitigation," and "unacceptable." Id . When overall risk is "unacceptable," Order 8040.4A requires "additional safety risk controls ... be designed/developed and evaluated." Id. at 10 .

The FAA based its "severity" analysis on record evidence such as warranty and service difficulty reports, airplane crash reports, and safety recommendations from the NTSB and FAA inspectors that addressed risks posed by failing cylinder assemblies generally and AEC63 cylinders specifically. It found that cylinder failure leads to three principal effects: (1) substantial reduction in engine horsepower of about 20%; (2) increased engine vibration, which can cause stress on aircraft components and in-flight fires; and (3) in twin-engine planes, asymmetric drag. Final Rule, 81 Fed. Reg. at 52 ,978 -80, 52,983-85. Each possible effect makes airplane takeoff, climbing, and cruising more difficult and less safe. Id . The FAA concluded that AEC63 cylinder assemblies present a "hazardous" risk in the event of failure (the second highest rating). This conclusion was supported by substantial evidence in the record.

Airmotive's evidentiary challenges to the "hazardous" determination are unpersuasive. It does not contest that a 20% reduction in engine power may result from cylinder failure, and this finding is supported by substantial evidence in the record. See Final Rule, 81 Fed. Reg. at 52 ,979 -80. Instead, Airmotive maintains that the FAA has not documented how a 20% reduction in engine power creates a "hazardous" condition when other FAA risk guidelines define partial power loss as a "minor" event. See Pet'rs' Br. 21-22, 24, 26 (citing FAA, Small Airplane Risk Analysis Handbook, at 10-12 (Sept. 30, 2010); FAA, Engine & Propeller Directorate, Continued Airworthiness Assessment Process Handbook, at 25 (Sept. 23, 2010); FAA, Risk Assessment for Reciprocating Engine Airworthiness Directives, at 3 (May 24, 1999) ). Airmotive also points to record evidence that when AEC63 cylinder assemblies have failed, pilots were able to land the plane safely. This challenge simply overlooks that the FAA has many analytical tools to carry out its statutory mandate, such that an event may be characterized as "minor" in one context while contributing to a "hazardous" determination in another. Airmotive's reliance on these other FAA guidelines does not advance its position. Indeed, in responding to comments, the FAA acknowledged that while one of its risk assessment policies classifies service problems that do not result in a significant power loss as minor, it had found that a 20% reduction in engine power translates into a 40% reduction in airplane rate of climb and constitutes a hazardous condition, not a "minor" condition. Final Rule, 81 Fed. Reg. at 52,979 .

Airmotive's challenge to the sufficiency of the evidence of asymmetric thrust to support a "hazardous" determination betrays a similar misunderstanding. The airworthiness directive refers to a 2002 NTSB report on a plane crash in which one cylinder of a twin-engine plane failed, resulting in asymmetric thrust as to the other engine, which was left to carry the entire load. NTSB, Factual Report-Aviation, at 1d (Sept. 2, 2002) (ID: NYC02FA178) (citing an FAA Airplane Flying Handbook). Airmotive's point is that "the NTSB report, at most, supports a conclusion that the failure of an entire engine in a twin-engine airplane-not the failure of one of the six cylinders in the engine-could result in an asymmetric thrust condition." Pet'rs' Br. 25. This simply overlooks that in the FAA's judgment, "[a] cylinder separating from its engine is an engine failure." Final Rule, 81 Fed. Reg. at 52,985 . Aside from the NTSB report, the FAA explained that because cylinder failure results in a substantial reduction in engine power, it produces "a potentially hazardous condition for twin-engine airplanes due to the resultant asymmetric thrust condition." Id. at 52,979 .

No more availing is Airmotive's challenge to the sufficiency of the evidence on in-flight fires to support a "hazardous" determination. Here its point is that while the airworthiness directive refers to two fires caused by the failure of non-Airmotive cylinders, there is no record evidence that AEC63 cylinders have ever caused an in-flight fire. Yet FAA regulations, 14 C.F.R. § 39.5 (b), in addition to the FAA's methodology in assessing risk, call for a comparative analysis of cylinder failure. See Final Rule, 81 Fed. Reg. at 52,979 . The FAA confirmed that fires have resulted from cylinder head separation, see id. at 52,980 , and Airmotive points to no basis for questioning the legitimacy of considering general cylinder information in concluding that AEC63 cylinders can fail in the same ways as other cylinders and lead to similar consequences upon failure.

For its "likelihood" analysis, the FAA, relying on data submitted by Airmotive, determined the probability of failure: Airmotive had produced approximately 43,000 AEC63 cylinder assemblies. See id. at 52,985 . Using service difficulty reports and other separation data, the FAA calculated that 1 in 1,000 cylinders fail on average. Id. Because AEC63 cylinders are installed in piston engines with six cylinders, the risk of failure is approximately 1 in 166 for a single-engine airplane, and 1 in 83 for a twin-engine airplane. Id. The FAA further observed that under-reporting occurs, as shown by the submission of 23 reported after the initial NPRM was published, and that future failures could be expected based on service experience. Id . On the basis of the quantitative and qualitative data, the FAA concluded that the AEC63 cylinders present a "remote" risk of failure, i.e. , "expected to occur infrequently." Id. Entering the "severity" and "likelihood" determinations on the risk matrix resulted in a risk level of "unacceptable." Id.

Airmotive maintains that the FAA's calculation is inflated and unreliable. The record is to the contrary. Based on an FAA estimate of the number of AEC63 cylinder assemblies that will be in service when the airworthiness directive takes effect on September 15, 2016, Airmotive states that the relevant population should be 37,000. Based on an FAA graph of AEC63 cylinder separations, the failure count should be 23. Using those numbers, the average failure rate would be 0.62 in 1,000, significantly lower than the FAA's calculation. Airmotive fights with the FAA's chosen methodology to assess likelihood based on past production and operational data without explaining why doing so is suspect. See id. at 52,983 . Tellingly, Airmotive misreads the FAA explanation of the data on which it relies. The FAA estimated about 35 percent of the total population of 43,000 AEC63 cylinders would be removed from service based on a prior airworthiness directive, leaving approximately 28,000 cylinders. Resp't's Br. 38. A chart listing 33 confirmed cylinder separations included four that were addressed in a prior airworthiness directive. See Excerpt, FAA-Assessed List of Airmotive Separations, at tbl.1 (Sept. 20, 2013) ("2013 Excerpt"); Resp't's Br. 38 n.12 (referencing Airworthiness Dir.; Engine Components Inc. (ECi) Reciprocating Engine Cylinders, 69 Fed. Reg. 21,049 (Apr. 20, 2004) ). The ultimate resulting calculation is a 1 in 1,000 failure rate. Although a graph shows 23 (not 29) cylinder separations, see 2013 Excerpt at fig.4, the disparity is explained in the notation accompanying figure 4 that the FAA subsequently determined some excluded separations should have been included. In any event, Airmotive's own technical report, as a practical matter, undercuts its numbers objection, for its report stated the airworthiness directive "could affect as many as 27,000 cylinders," which had "experienced 29 confirmed head-to-barrel separations." Airmotive 2013 Technical Report, at 7, 9.

Because the record shows that the FAA's calculation of the safety of AEC63 cylinders was based on a proper application of the Order 8040.4A methodology and is supported by substantial evidence, absent more specific data as would identify fundamental error casting doubt on the FAA's conclusion, Airmotive fails to show that the case should be remanded for the FAA to conduct a new risk assessment. We conclude that Airmotive fails to show fundamental error and that it is necessary only to address the following challenges.

Airmotive responds to the FAA's calculation that AEC63 cylinders fail at a rate 32 times higher than those of the original manufacturer, see Final Rule, 81 Fed. Reg. at 52,978 , by maintaining that a comparative approach runs afoul of a purported requirement that airworthiness directives are to be based on an individualized determination. By this we understand Airmotive to mean that absent evidence specific to AEC63 cylinders, the FAA lacked substantial evidence to support its directive. But FAA regulations require that it determine whether the unsafe condition "is likely to exist or develop in other products of the same type design." 14 C.F.R. § 39.5 (b). Comparative information is relevant if for no other reason than that AEC63 cylinder assemblies are a replacement part. The FAA reasonably considered a comparison between the original and replacement parts.

No more availing is Airmotive's view that the FAA's reliance on two fatal airplane accidents was improper because neither crash involved AEC63 cylinders and neither crash was caused by faulty cylinders alone. The FAA's reliance on the crash reports was reasonable because they too provided relevant information showing that failed cylinders created dangerous situations that at least partially caused forced plane landings that resulted in fatalities. See Final Rule, 81 Fed. Reg. at 52 ,983 -84. So too, the FAA reasonably considered Airmotive's ongoing efforts to improve its manufacturing process. The data showed a major decrease in failure rates after Airmotive's 2009 design improvements to AEC63 cylinders, supporting the FAA's finding that older AEC63 cylinders suffered from design problems.

Finally, Airmotive maintains that the FAA ignored public comments stating that the risks posed by replacing faulty cylinders are greater than those posed by the faulty cylinders themselves. The FAA's "regulatory framework presumes that maintenance will be performed correctly by experienced personnel authorized by the FAA." Final Rule, 81 Fed. Reg. at 52,981 . This presumption was unrebutted by record evidence. The FAA noted that it "had not observed any negative effects on safety due to removal of these cylinder assemblies during maintenance." Id. Although the FAA had previously required cylinder replacement, Airmotive pointed to no evidence of safety or other problems stemming from the requirement.

In sum, the FAA gathered the record evidence over a period of years, with multiple rounds of public comment, on the safety risks posed by AEC63 cylinder assemblies. Its "unsafe condition" determination was based on a proper application of the FAA 8040.4A methodology and is supported by substantial evidence in the record on cylinder assembly failures, including a far higher rate of AEC63 failures than the cylinders manufactured by the original manufacturer, notwithstanding Airmotive's emphasis on the absence of certain evidence specific to AEC63 cylinders and the infrequency of some evidence of the harmful consequences of cylinder assembly failures, such as in-flight fires and cylinder failure resulting in fatalities. See Schoenbohm , 204 F.3d at 246 . Accordingly, we deny the petition for review.