Airmotive Engineering Corp. v. FAA , 882 F.3d 1157 ( 2018 )

United States Court of Appeals
FOR THE DISTRICT OF COLUMBIA CIRCUIT
Argued December 4, 2017 Decided February 23, 2018
No. 16-1356
AIRMOTIVE ENGINEERING CORPORATION AND ENGINE
COMPONENTS INTERNATIONAL, INC.,
PETITIONERS
v.
FEDERAL AVIATION ADMINISTRATION,
RESPONDENT
On Petition for Review of an Order
of the Federal Aviation Administration
Laura G. Ferguson argued the cause for petitioners. With
her on the brief was Andrew D. Herman.
Laura Myron, Attorney, U.S. Department of Justice,
argued the cause for respondent. With her on the brief were
Charles W. Scarborough, Attorney, and Paul M. Geier,
Assistant General Counsel for Litigation, U.S. Department of
Transportation.
Before: HENDERSON and ROGERS, Circuit Judges, and
SENTELLE, Senior Circuit Judge.
Opinion for the Court filed by Circuit Judge ROGERS.
2
ROGERS, Circuit Judge: A manufacturer of replacement
aircraft parts petitions for review of an “airworthiness
directive” issued by the Federal Aviation Administration that
mandates removal of some of its engine cylinder assemblies.
The manufacturer challenges the application of a risk
management methodology and whether there was substantial
evidence in the record to support the conclusion that the
cylinders presented an “unsafe condition” under agency
regulations. It also contends that a failure to analyze the risks
associated with replacement itself undermined reasoned
decisionmaking. It seeks a remand for a new risk assessment
of the cylinder assemblies. For the following reasons, we deny
the petition for review.
I.
In support of the mandate to “promote safe flight of civil
aircraft,” the Federal Aviation Administration (“FAA”)
promulgates safety standards for aircraft and component parts.
49 U.S.C. § 44701 et seq. To produce replacement parts for
aircraft engines, a manufacturer is required to obtain a “parts
manufacturer approval” (“PMA”), 14 C.F.R. § 21.301–.320,
that the part “conforms to its approved design and is in a
condition for safe operation,” id. § 21.1(b)(1). Once a
replacement part is in production, the FAA, upon determining
that the part has an “unsafe condition” that “is likely to exist or
develop in other products of the same type design,” may issue
an “airworthiness directive.” Id. § 39.5. The FAA treats
airworthiness directives, which are published in the Federal
Register, id. § 39.13, as “legally enforceable rules,” id. § 39.3,
that can require inspections, impose conditions and limitations,
and require actions to resolve an unsafe condition, id. § 39.11.
The term “unsafe condition” is not defined by statute or FAA
regulation.
3
Airmotive Engineering Corporation and Engine
Components International, Inc. (collectively, “Airmotive”)
manufacture and market PMA-certified replacement “cylinder
assemblies” used in piston engines installed in small single- or
twin-engine aircraft. The head of a cylinder assembly is joined
to the barrel by heating the head and screwing it onto the
threaded barrel to create an “interference fit.” National
Transportation Safety Board (“NTSB”), Safety Rec. to Act.
FAA Adm’r, at 1 (Feb. 24, 2012).
In August 2013, the FAA published a notice of proposed
rulemaking for an airworthiness directive regarding the “unsafe
condition” created by Airmotive cylinder assemblies with part
number AEC631397 and serial numbers 1 to 61,176
(hereinafter “AEC63”). Continental Motors, Inc.
Reciprocating Engines (“CMRE”), 78 Fed. Reg. 48,828,
48,830 (Aug. 12, 2013) (“NPRM”). This followed the FAA’s
receipt of failure reports of multiple cylinder head-to-barrel
separations and cracked and leaking aluminum cylinder heads,
and recommendations from the NTSB and FAA maintenance
inspectors. The proposed directive would require initial and
repetitive inspections, replacement of cracked cylinders, and
replacement after reduced times-in-service. It would prohibit
future installation of AEC63 cylinder assemblies. Id. Public
comments were mostly negative. The FAA proceeded to add
certain technical documents to the rulemaking record, extend
the public comment period, and appoint an “independent,
multidisciplinary team” of agency experts. The team
concluded an “unsafe condition” existed and an airworthiness
directive was required, but recommended making compliance
less aggressive and less costly with revised compliance and
removal schedules. In January 2015, the FAA published a
revised proposal adopting the recommendations and reopened
the comment period. See CMRE, 80 Fed. Reg. 1008 (Jan. 8,
2015) (“Supp. NPRM”). After the FAA placed additional
4
technical documents in the record and provided responses to
public comments, it again reopened the comment period. See
CMRE, 80 Fed. Reg. 52,212 (Aug. 28, 2015) (“Second Supp.
NPRM”).
The FAA promulgated the airworthiness directive a year
later. See CMRE, 81 Fed. Reg. 52,975 (Aug. 11, 2016) (“Final
Rule”). In further response to public comments, the FAA
explained the basis for its conclusion that AEC63 cylinder
assemblies presented an “unsafe condition.” In the FAA’s
judgment, “[t]he impact of a cylinder failure separation in flight
is an unacceptable compromise to safety.” Id. at 52,980.
Record evidence indicated that AEC63 cylinder assemblies fail
at a rate “at least 32 times greater” than those of the original
manufacturer. Id. at 52,979. The FAA attributed the “root
cause” of this high failure rate “to two inherent design
deficiencies”: “Insufficient dome transition radius and
insufficient head-to-barrel interference fit.” Id. at 52,980.
Record evidence further indicated that “in-flight cylinder head
separation is an unsafe condition that presents multiple
secondary effects,” including in-flight fire and loss of aircraft
control. Id. at 52,979. Accident data confirmed that separated
cylinders have also been a precipitating event in fatal accidents.
Id. The directive required phased removal of AEC63
assemblies and prohibited their future installation. Id. at
52,991. Airmotive petitions for review of the Final Rule, see
49 U.S.C. § 46110(a), seeking a remand for a new risk
assessment of the cylinder assemblies.
II.
Under the Administrative Procedure Act (“APA”), the
court must uphold agency action unless it is “arbitrary,
capricious, an abuse of discretion, or otherwise not in
accordance with the law.” 5 U.S.C. § 706(2)(A). “The scope
5
of review . . . is narrow and a court is not to substitute its
judgment for that of the agency,” provided the agency has
“examine[d] the relevant data and articulate[d] a satisfactory
explanation for its action including a rational connection
between the facts found and the choice made.” Motor Vehicle
Mfrs. Ass’n v. State Farm Mut. Auto. Ins. Co., 463 U.S. 29, 43
(1983) (internal quotation marks and citation omitted); see
Clark Cty., Nev. v. FAA, 522 F.3d 437, 441 (D.C. Cir. 2008).
The FAA’s findings of fact “are conclusive” when “supported
by substantial evidence,” 49 U.S.C. § 46110(c), namely,
“evidence as a reasonable mind might accept as adequate to
support a conclusion,” Schoenbohm v. FCC, 204 F.3d 243, 246
(D.C. Cir. 2000) (citation omitted). When applied to a
rulemaking, the substantial evidence and arbitrary and
capricious tests are “identical.” See S.C. Pub. Serv. Auth. v.
FERC, 762 F.3d 41, 54 (D.C. Cir. 2014) (citation omitted).
The FAA used the risk-measurement methodology in FAA
Order 8040.4A to assess the safety of Airmotive’s AEC63
cylinders. Final Rule, 81 Fed. Reg. at 52,983–84. It
determined the “severity” of risk (i.e., the potential
consequences of part failure) as defined at five levels, and the
“likelihood” of risk (i.e., the failure rate), also defined at five
levels. See FAA Order 8040.4A, Safety Risk Management
Policy, at 9 (Apr. 30, 2012). It entered the severity and
likelihood findings on a matrix to identify the “overall level of
risk”: “acceptable,” “acceptable with mitigation,” and
“unacceptable.” Id. When overall risk is “unacceptable,”
Order 8040.4A requires “additional safety risk controls . . . be
designed/developed and evaluated.” Id. at 10.
The FAA based its “severity” analysis on record evidence
such as warranty and service difficulty reports, airplane crash
reports, and safety recommendations from the NTSB and FAA
inspectors that addressed risks posed by failing cylinder
6
assemblies generally and AEC63 cylinders specifically. It
found that cylinder failure leads to three principal effects: (1)
substantial reduction in engine horsepower of about 20%; (2)
increased engine vibration, which can cause stress on aircraft
components and in-flight fires; and (3) in twin-engine planes,
asymmetric drag. Final Rule, 81 Fed. Reg. at 52,978–80,
52,983–85. Each possible effect makes airplane takeoff,
climbing, and cruising more difficult and less safe. Id. The
FAA concluded that AEC63 cylinder assemblies present a
“hazardous” risk in the event of failure (the second highest
rating). This conclusion was supported by substantial evidence
in the record.
Airmotive’s evidentiary challenges to the “hazardous”
determination are unpersuasive. It does not contest that a 20%
reduction in engine power may result from cylinder failure, and
this finding is supported by substantial evidence in the record.
See Final Rule, 81 Fed. Reg. at 52,979–80. Instead, Airmotive
maintains that the FAA has not documented how a 20%
reduction in engine power creates a “hazardous” condition
when other FAA risk guidelines define partial power loss as a
“minor” event. See Pet’rs’ Br. 21–22, 24, 26 (citing FAA,
Small Airplane Risk Analysis Handbook, at 10–12 (Sept. 30,
2010); FAA, Engine & Propeller Directorate, Continued
Airworthiness Assessment Process Handbook, at 25 (Sept. 23,
2010); FAA, Risk Assessment for Reciprocating Engine
Airworthiness Directives, at 3 (May 24, 1999)). Airmotive also
points to record evidence that when AEC63 cylinder
assemblies have failed, pilots were able to land the plane safely.
This challenge simply overlooks that the FAA has many
analytical tools to carry out its statutory mandate, such that an
event may be characterized as “minor” in one context while
contributing to a “hazardous” determination in another.
Airmotive’s reliance on these other FAA guidelines does not
advance its position. Indeed, in responding to comments, the
7
FAA acknowledged that while one of its risk assessment
policies classifies service problems that do not result in a
significant power loss as minor, it had found that a 20%
reduction in engine power translates into a 40% reduction in
airplane rate of climb and constitutes a hazardous condition,
not a “minor” condition. Final Rule, 81 Fed. Reg. at 52,979.
Airmotive’s challenge to the sufficiency of the evidence of
asymmetric thrust to support a “hazardous” determination
betrays a similar misunderstanding. The airworthiness
directive refers to a 2002 NTSB report on a plane crash in
which one cylinder of a twin-engine plane failed, resulting in
asymmetric thrust as to the other engine, which was left to carry
the entire load. NTSB, Factual Report – Aviation, at 1d (Sept.
2, 2002) (ID: NYC02FA178) (citing an FAA Airplane Flying
Handbook). Airmotive’s point is that “the NTSB report, at
most, supports a conclusion that the failure of an entire engine
in a twin-engine airplane — not the failure of one of the six
cylinders in the engine — could result in an asymmetric thrust
condition.” Pet’rs’ Br. 25. This simply overlooks that in the
FAA’s judgment, “[a] cylinder separating from its engine is an
engine failure.” Final Rule, 81 Fed. Reg. at 52,985. Aside
from the NTSB report, the FAA explained that because
cylinder failure results in a substantial reduction in engine
power, it produces “a potentially hazardous condition for twin-
engine airplanes due to the resultant asymmetric thrust
condition.” Id. at 52,979.
No more availing is Airmotive’s challenge to the
sufficiency of the evidence on in-flight fires to support a
“hazardous” determination. Here its point is that while the
airworthiness directive refers to two fires caused by the failure
of non-Airmotive cylinders, there is no record evidence that
AEC63 cylinders have ever caused an in-flight fire. Yet FAA
regulations, 14 C.F.R. § 39.5(b), in addition to the FAA’s
8
methodology in assessing risk, call for a comparative analysis
of cylinder failure. See Final Rule, 81 Fed. Reg. at 52,979. The
FAA confirmed that fires have resulted from cylinder head
separation, see id. at 52,980, and Airmotive points to no basis
for questioning the legitimacy of considering general cylinder
information in concluding that AEC63 cylinders can fail in the
same ways as other cylinders and lead to similar consequences
upon failure.
For its “likelihood” analysis, the FAA, relying on data
submitted by Airmotive, determined the probability of failure:
Airmotive had produced approximately 43,000 AEC63
cylinder assemblies. See id. at 52,985. Using service difficulty
reports and other separation data, the FAA calculated that 1 in
1,000 cylinders fail on average. Id. Because AEC63 cylinders
are installed in piston engines with six cylinders, the risk of
failure is approximately 1 in 166 for a single-engine airplane,
and 1 in 83 for a twin-engine airplane. Id. The FAA further
observed that under-reporting occurs, as shown by the
submission of 23 reported after the initial NPRM was
published, and that future failures could be expected based on
service experience. Id. On the basis of the quantitative and
qualitative data, the FAA concluded that the AEC63 cylinders
present a “remote” risk of failure, i.e., “expected to occur
infrequently.” Id. Entering the “severity” and “likelihood”
determinations on the risk matrix resulted in a risk level of
“unacceptable.” Id.
Airmotive maintains that the FAA’s calculation is inflated
and unreliable. The record is to the contrary. Based on an FAA
estimate of the number of AEC63 cylinder assemblies that will
be in service when the airworthiness directive takes effect on
September 15, 2016, Airmotive states that the relevant
population should be 37,000. Based on an FAA graph of
AEC63 cylinder separations, the failure count should be 23.
9
Using those numbers, the average failure rate would be 0.62 in
1,000, significantly lower than the FAA’s calculation.
Airmotive fights with the FAA’s chosen methodology to assess
likelihood based on past production and operational data
without explaining why doing so is suspect. See id. at 52,983.
Tellingly, Airmotive misreads the FAA explanation of the data
on which it relies. The FAA estimated about 35 percent of the
total population of 43,000 AEC63 cylinders would be removed
from service based on a prior airworthiness directive, leaving
approximately 28,000 cylinders. Resp’t’s Br. 38. A chart
listing 33 confirmed cylinder separations included four that
were addressed in a prior airworthiness directive. See Excerpt,
FAA-Assessed List of Airmotive Separations, at tbl.1 (Sept.
20, 2013) (“2013 Excerpt”); Resp’t’s Br. 38 n.12 (referencing
Airworthiness Dir.; Engine Components Inc. (ECi)
Reciprocating Engine Cylinders, 69 Fed. Reg. 21,049 (Apr. 20,
2004)). The ultimate resulting calculation is a 1 in 1,000 failure
rate. Although a graph shows 23 (not 29) cylinder separations,
see 2013 Excerpt at fig.4, the disparity is explained in the
notation accompanying figure 4 that the FAA subsequently
determined some excluded separations should have been
included. In any event, Airmotive’s own technical report, as a
practical matter, undercuts its numbers objection, for its report
stated the airworthiness directive “could affect as many as
27,000 cylinders,” which had “experienced 29 confirmed head-
to-barrel separations.” Airmotive 2013 Technical Report, at 7,
9.
Because the record shows that the FAA’s calculation of
the safety of AEC63 cylinders was based on a proper
application of the Order 8040.4A methodology and is
supported by substantial evidence, absent more specific data as
would identify fundamental error casting doubt on the FAA’s
conclusion, Airmotive fails to show that the case should be
remanded for the FAA to conduct a new risk assessment. We
10
conclude that Airmotive fails to show fundamental error and
that it is necessary only to address the following challenges.
Airmotive responds to the FAA’s calculation that AEC63
cylinders fail at a rate 32 times higher than those of the original
manufacturer, see Final Rule, 81 Fed. Reg. at 52,978, by
maintaining that a comparative approach runs afoul of a
purported requirement that airworthiness directives are to be
based on an individualized determination. By this we
understand Airmotive to mean that absent evidence specific to
AEC63 cylinders, the FAA lacked substantial evidence to
support its directive. But FAA regulations require that it
determine whether the unsafe condition “is likely to exist or
develop in other products of the same type design.” 14 C.F.R.
§ 39.5(b). Comparative information is relevant if for no other
reason than that AEC63 cylinder assemblies are a replacement
part. The FAA reasonably considered a comparison between
the original and replacement parts.
No more availing is Airmotive’s view that the FAA’s
reliance on two fatal airplane accidents was improper because
neither crash involved AEC63 cylinders and neither crash was
caused by faulty cylinders alone. The FAA’s reliance on the
crash reports was reasonable because they too provided
relevant information showing that failed cylinders created
dangerous situations that at least partially caused forced plane
landings that resulted in fatalities. See Final Rule, 81 Fed. Reg.
at 52,983–84. So too, the FAA reasonably considered
Airmotive’s ongoing efforts to improve its manufacturing
process. The data showed a major decrease in failure rates after
Airmotive’s 2009 design improvements to AEC63 cylinders,
supporting the FAA’s finding that older AEC63 cylinders
suffered from design problems.
11
Finally, Airmotive maintains that the FAA ignored public
comments stating that the risks posed by replacing faulty
cylinders are greater than those posed by the faulty cylinders
themselves. The FAA’s “regulatory framework presumes that
maintenance will be performed correctly by experienced
personnel authorized by the FAA.” Final Rule, 81 Fed. Reg. at
52,981. This presumption was unrebutted by record evidence.
The FAA noted that it “had not observed any negative effects
on safety due to removal of these cylinder assemblies during
maintenance.” Id. Although the FAA had previously required
cylinder replacement, Airmotive pointed to no evidence of
safety or other problems stemming from the requirement.
In sum, the FAA gathered the record evidence over a
period of years, with multiple rounds of public comment, on
the safety risks posed by AEC63 cylinder assemblies. Its
“unsafe condition” determination was based on a proper
application of the FAA 8040.4A methodology and is supported
by substantial evidence in the record on cylinder assembly
failures, including a far higher rate of AEC63 failures than the
cylinders manufactured by the original manufacturer,
notwithstanding Airmotive’s emphasis on the absence of
certain evidence specific to AEC63 cylinders and the
infrequency of some evidence of the harmful consequences of
cylinder assembly failures, such as in-flight fires and cylinder
failure resulting in fatalities. See Schoenbohm, 204 F.3d at 246.
Accordingly, we deny the petition for review.