# AC 120-17A: Maintenance Control by Reliability Methods - Type: Advisory circular (guidance, not mandatory unless a rule or AD requires it) - Status: Historical - Version in force: [AC 120-17B Ed Update](https://openairdocs.org/ac/120-17), approved July 9, 2026. This is a historical version - Approved: March 27, 1978 - Last reviewed: August 6, 2024 - Family: AC 120-17 - Cancels: [AC 120-17](https://openairdocs.org/ac/120-17) - Cancelled by: [AC 120-17B](https://openairdocs.org/ac/120-17B) - 14 CFR parts: 121, 126 - Pages: 41 - PDF: https://openairdocs.org/files/sha256/ea/ed/eaed2b938066f1013d3d48aede6913d69662fa6c77f1adc4f085a3157b126fc1 - FAA DRS: https://drs.faa.gov/browse/excelExternalWindow/30A327DB2CEBF922862569EA00695DD7.0001 - DRS record last changed: November 22, 2025 - Page: https://openairdocs.org/ac/120-17A ## Versions - [AC 120-17B Ed Update](https://openairdocs.org/ac/120-17) (Current), approved Jul 9, 2026, 51 pages. Editorial update of AC 120-17B. - [AC 120-17B](https://openairdocs.org/ac/120-17B) (Historical), approved Dec 19, 2018, 51 pages - [AC 120-17A](https://openairdocs.org/ac/120-17A) (Historical), approved Mar 27, 1978, 41 pages ## Text Each page's text from the PDF; open the PDF at a page with #page=N. This is OCR from the scanned FAA advisory circular. OCR can misread letters and numbers. ### Page 1 (OCR) 7886-444 0014627 AC NO: 120-17A DATE: March 27, 1978 NAT DE TRANSPORT ADVISORY TED STATES OF RAND CIRCULA R# **FAA AERO COMPER** **RECEIVED MAY 17 1378** **LIBRARY** - MAINTENANCE CONTROL BY RELIABILITY METHODS **DEPARTMENT OF TRANSPORTATION** FEDERAL AVIATION ADMINISTRATION Initiated by: AFS-230 ### Page 2 (OCR) AC NO: 120-17A DATE: 3/27/78 **ADVISORY** **AND THE ORAN CIRCULAR** **DEPARTMENT OF TRANSPORTATION** FEDERAL AVIATION ADMINISTRATION SUBJECI: MAINTENANCE CONTROL BY RELIABILITY METHODS PURPOSE. This circular provides information and guidance material which may be used to design or develop maintenance control programs utilizing reliability control methods. 20 CANCELLATION. Advisory Circular 120-17, dated December 31, 1964, is canceled. REFERENCES. This circular is appropriate for guidance of certificate holders who operate aircraft in accordance with Federal Aviation Regulations, Parts 121 and 127. enarese A. FERRARESE Acting Director Flight Standards Service Initiated by: AFS-230 ### Page 3 (OCR) TABLE OF CONTENTS Page No. **CHAPTER 1. INTRODUCTION.** 1. Purpose. 2. Authority. 3. Background. 40-12. RESERVED• CHAPTER 2. RELIABILTTY CONTROL FUNDAMENTALS. 13. General. 14. Primary Maintenance Processes. 15. Reliability Control Systems. **16.-24. RESERVED.** **CHAPTER 3. PROGRAM ADMINISTRATION. 25** 25. General. 25 26. Reliability Program Document. 25 27.-34. RESERVED. 26 CHAPTER 4. PROGRAM APPROVAL. 35 35• Initial Approval. 35 36. Revision Approval. 35 APPENDIX 1. AIRLINE/MANUFACTURER MAINTENANCE PROGRAM PLANNING DOCUMENT - MSG-2 (26 pages) Page iii ### Page 4 (OCR) **CHAPTER 1. INTRODUCTION** 1. PURPOSE. This publication provides information on the application of reliability control methods as an integral part of an approved aircraft maintenance program for operators subject to the provisions of Federal Aviation Regulations, Parts 121 or 127. a. Its primary objective is to provide guidance for development of programs using reliability techniques. It expresses Federal Aviation Administration practice with regard to control programs utilizing these techniques. b. This circular encompasses the information and criteria contained in its predecessor, AC 120-17, Handbook for Maintenance Control by Reliability Methods. It combines this with information and criteria for the conditionmonitoring process, formerly published in FAA Handbook 8310.4A. The Airline/ Manufacturer Maintenance Program Planning Document - MSG-2, which establishes the criteria for classifying maintenance processes, is included as Appendix 1. AUTHORITY• The basis for federal regulation of aircraft maintenance is in section 601(a) (3) of the Federal Aviation Act of 1958. For air carriers and commercial operators subject to FAR Parts 121 or 127, this authority is exercised through Federal Aviation Regulations, sections 121.25(b)(6), 121.45(b)(6), and 127 13(b)(7), which require that operations specifications contain time limitations, or standards for determining time limitations, for airframes, engines, propellers, rotors, appliances, and emergency equipment. 3• BACKGROUND• 2• The first generation of formal air carrier maintenance programs was based on the belief that each functional part of a transport aircraft needed periodic disassembly inspection. Time limitations were established for servicing, checks and inspections, and the entire aircraft was periodically disassembled, overhauled, and reassembled in an effort to maintain the This was the origin of the first primary maintenance process discussed in this publication and referred to as "Hard-Time." b. As the industry grew, matured, and adopted more complex aircraft, literal application of the "Hard-Time" primary maintenance process became obsolete. The industry came to realize that each component and part did not require scheduled overhaul on a fixed time basis, and a second primary maintenance process evolved, referred to as "On-Condition." It is assigned to components on which a determination of continued airworthiness can be made by visual inspection, measurements, tests or other means without disassembly, inspection or overhaul. Chap 1 Par 1 Page 1 ### Page 5 (OCR) c. Federal Aviation Administration (FAA) control of these programs was accomplished by individual approval of the hard-time or on-condition check periods for the aircraft, engines, and components. The procedures used to adjust these periods were awkward and ourdensome, often inhibiting logical adjustment. lo alleviate this situation, the FAA worked with the airlines to develop more responsive methods of controlling maintenance without sacrificing safety or FAA regulatory responsibility. This method of control was oriented toward mechanical performance rather than to predicting failure wear out points, as was the case in the previous methods. The new method was entitled "reliability control" because its major emphasis was toward maintaining failure rates below a predetermined value; i.e., an acceptable level of reliability d. The analytical nature of reliability control disclosed and emphasized the existence of components and systems that did not respond to the hardtime or on-condition processes. This led to a third process whereby no services or inspections are scheduled to determine integrity or serviceability. However, the mechanical performance is monitored and analyzed, but limits or mandatory action are not prescribed. This process is entitled "Condition-Monitoring•" 40-12. RESERVED• Chap 1 Page 2 (thru 12) Par 3 ### Page 6 (OCR) CHAPTER 2. RELIABILITY CONTROL FUNDAMENTALS 13• GENERAL• a. It is intended that characteristics of each operator, i.e., philosophy, consideration of operational and environmental factors, recordkeeping systems, etc., be reilected in his own program. The extent and scope oi each operator's application of reliability control is defined in his reliability program document. b. There are four general categories of an operator's maintenance program. (1) Systems/components. (2) Powerplants/components. (3) Aircraft/engine checks and inspections. (4) Structural inspection/overhaul. All four may be controlled by a composite program, or each may be handled individually. The program can encompass a select group of items from a category without affecting other controls for the remaining items of that category. for example, the basic engine might be maintained by a program that does not include its accessories. The accessories could be on another program or they could be under traditional operations specifications control. d. Statistical analysis is most effective in its application to systems and components because the occurrence of failures can be readily reduced to meaningful statistics. When alert rates are used in the analysis, graphic charts (or equivalent displays) show areas in need of corrective action. Conversely, statistical analysis of inspection findings or other abnormalities related to aircraft/engine check and inspection periods requires judgmental analysis. Therefore, programs encompassing aircraft/engine check or inspection intervals might consider numerical indicators, but sampling inspection and discrepancy analysis would be of more benefit. PRIMARY MAINTENANCE PROCESSES. The three primary maintenance processes utilized by maintenance programs are (1) hard-time, (2) on-condition, and (3) condition-monitoring. a. Following are general descriptions of the three maintenance Each program should include specific definitions of the processes it uses and how they are applied. Refer to appendix 1 (MSG-2) and Advisory Circular 121-1A for further definition of maintenance processes. Chap 2 Par 13 Page 13 ### Page 7 (OCR) (1) Hard-Time (HT). This is a preventive primary maintenance process. It requires that an appliance or part be periodically overhauled in accordance with the carrier's maintenance manual or that it be removed from service. (2) In-Condition (OC). This is a preventive primary maintenance process. It requires that an appliance or part be periodically inspected or checked against some appropriate physical standard to determine whether it can contime in service. The purpose of the standard is to remove the unit from service before failure during normal operation occurs. (3) Condition-Monitoring (CM). This is a maintenance process for items that have neither "Hard-Time" nor "On-Condition" maintenance as their primary maintenance process. CM is accomplished by appropriate means available to an operator for finding and solving problem areas. The detalled requirements for the condition-monitoring process are included as appendix 1 to this circular. b. Complex (multicell) units may be subject to control by two or even all three of the primary processes. The predominant process will determine its classification. For example, the B-747 Modular Package - Stabilizer Control has CM assigned as its primary maintenance process by the MRB report, but a leakage check, which is a conventional O task, is also specified. c. The basic engine has characteristics that involve all three primary maintenance processes. (1) Programs that control engine major overhaul intervals consider the engine as a hard-time unit. The overhaul standards are specified by overhaul manuals or other publications that do not identify individual processes as such. (2) Programs controlling shop maintenance to a "conditional" standard (restoration, etc.,) may classity the engine as on-condition or as condition-monitoring depending on the characteristics of the program. The applicable maintenance processes and their intervals should be designated in (or referenced by) the program document. MSG-2 (ref: appendix 1), discusses the analysis method for assigning maintenance processes. This method was used in the maintenance review board activity for the engines of the widebodied jets. This analytical method, in conjunction with service experience, can be applied to earlier engines. 15. RELTABILIIY CONTROL SYSTEMS. Typical systems used in reliability control are: (1) data collection, (2) data analysis, (3) corrective action, (4) performance standards, (5) data display and report, (6) maintenance interval adjustment and process change, and (7) program revision. The intent of this section is not to provide a rigid specification but rather to explain the purpose of the systems which the operator can use as a framework for his particular program. The following paragraphs discuss these systems: Chap 2 Page 14 Par 14 ### Page 8 (OCR) a. Data collection system. This system should include a specific flow of information, identity of data sources, and procedures for transmission of data, including use of forms, computer runs, etc. Responsibilities within the operator's organization must be established for each step of data development and processing. Typical sources of performance information are as follows, however, it is not implied that all of these sources need be included in the program nor does this listing prohibit the use of other sources of information: (1) Pilot reports. (2) In-flight engine performance data. (3) Mechanical interruptions/delays. (4) Engine shutdowns. (5) Unscheduled removals. (6) Confirmed failures. (7) Functional checks. (8) Bench checks. (9) Shop findings. (10) Sampling inspections. (11) Inspection writeups. (12) Service difficulty reports (MRR). b. Data analysis system. Data analysis is the process of evaluating mechanical performance data to identify characteristics indicating a need for program adjustment, revision of maintenance practices, hardware improvement (modification), etc. The initial step in analysis is the comparison of the data to a standard representing acceptable periormance. The standard may be a running average, tabulations of removal rates for past periods, graphs, charts, or any means of depicting a "norm." Programs incorporating statistical performance standards alert type programs). Reliability programs developed under Advisory Circular 120-17 and earlier criteria utilize parameters for reliability analysis such as delays per 100 departures for an aircraft system. They incorporate performance standards as described in paragraph (d) of this section. These standards define acceptable performance. When compared with a running graphical or tabular display of current performance they depict trends as well as show out-of-limits conditions. The system performance data is usually reinforced by component removal or confirmed failure data. The conditionmonitoring process can be readily accommodated by this type program. Chap 2 Par 15 Page 15 ### Page 9 (OCR) (2) Programs using other analysis standards (nonalert type programs). Data that is compiled to assist in the day-to-day operation of the maintenance program may be effectively used as a basis for continuous mechanical performance analysis. Mechanical interruption summaries, flight log review, engine monitoring reports, incident reports, engine and component analysis reports are examples of the types of information suitable for this monitoring method. For this arrangement to be effective, the number and range of inputs must be sufficient to provide a basis for analysis equivalent to the statistical standard programs. The operator's organization must have the capability of summarizing the data to arrive at meaningful conclusions. Also, actuarial analysis should be periodically conducted to ensure that current process classifications are correct. (3) Summary. The objective of data analysis is to (1) recognize the need for corrective action, (2) establish what corrective action is needed, and (3) determine the effectiveness of that action. c. Corrective action system. The actions to be taken are a reflection of the analysis and should be positive enough to effectively restore performance to an acceptable level within a reasonable time. The system must include notification to the organizational element responsible for taking the action. The system should provide periodic feedback until such time as performance has reached an acceptable level. The mechanics of the corrective action system normally encompass methods that have been established for the overall maintenance program such as work forms, special inspection procedures, engineering orders, technical standards, etc. Special provisions should be included for critical failures; i.e., failures in which loss of the functior or secondary effects of the failure impair the airworthiness of the aircraft. d. Statistical performance standards system. A performance measurement expressed numerically in terms of system or component failures, pilot reports, delays or some other event (bracketed by hours of aircraft operation, number of landings, operating cycles, or other exposure measurement) serves as the basis for the standard. The development of control limits or alert values is usually based on accepted statistical methods such as standard deviation or the poisson distribution. However, some appiications use the average or base line method. The standard should be adjustable with reference to the operator's experience and should reflect seasonal and environmental considerations. The program should include procedures for periodic review of, and either upward or downward adjustment of, the standards as indicated. It should also include monitoring procedures for new aircraft until sufficient operating experience is available for computing performance standards. e • Data display and report system. (1) Operators with programs incorporating statistical performance priate data displays, summarizing the previous month's activity. The report Chap 2 Page 16 Par 15 ### Page 10 (OCR) effectiveness of the total maintenance program. It should highlight systems which have exceeded the established performance standards and discuss what action has been taken or planned. The report should explain changes which have been made or are planned in the aircraft maintenance program, including changes in maintenance and inspection intervals and changes from one maintenance process to another. It should discuss continuing over-alert conditions carried forward from previous reports and should report the progress of corrective action programs. (2) Programs using other analytical standards (nonalert type programs) should consolidate or summarize significant reports used in controlling their program to provide for evaluation of its effectiveness. These reports may be in the form of computer printouts, summaries, or any intelligible form. A typical program of this type reports the following information: (a) Mechanical Interruption Summary (MIS). (b) Mechanical Reliability Reports (MRR). (c) Listing of all maintenance process and interval assignment. (Master specification) (d) Weekly update to letter (c) above. (e) Daily Repetitive Item Listing (by aircraft). (f) Monthly Component Premature Removal Report (includes removal rate). (g) Monthly Engine Shutdown and Removal Report. (h) Quarterly Engine Reliability Analysis Report. (1) Engine Threshold Adjustment Report. (J) Worksheets for maintenance process and interval changes (not provided to FAA, but FAA approves process changes). f. Maintenance interval adjustment and process change system. A major characteristic of reliability control programs is they afford the operator a formal means of adjusting maintenance/inspection/overhaul intervals without prior FAA approval. This does not relieve the operator or FAA of their responsibility for the effects of the program on safety. Procedures for adjusting maintenance intervals should be included in the program. (1) Maintenance interval adjustments should not interfere with an ongoing corrective action. Special procedures for escalating systems or components whose current performance exceeds control limits should be provided. Chap 2 Par 15 Page 17 ### Page 11 (OCR) Typical considerations for adjusting hard-time and on-condition intervals are as follows; however, it is not implied that all of these factors be considered for each case: (a) Sampling. (b) Actuarial studies. (c) Unit performance. (d) Inspector or shop findings. (e) Pilot reports Methods for adjusting aircraft/engine check intervals should be included if the program controls these intervals and sampling criteria should be specified. (2) The system should include procedures for initial classification of maintenance processes (HT - OC - CM) and for changes from one process to another. It should also include authority and procedures for changing maintenance specifications and related documents to reflect the interval adjustment or primary process change. g. Program revision system. The program should include a procedure for revision which is compatible with FAA approvals discussed in chapter 4 of this circular. The procedure should identify organizational elements involved in the revision process and their authority. The program areas requiring formal FAA approval include any changes to the program that involve: (1) Procedures relating to reliability measurement/performance standards. (2) Data collection system. (3) Data analysis methods and application to the total maintenance program. (4) Process changes: (a) For programs incorporating statistical performance standards (alert type programs) procedures for transferring components of systems from one primary maintenance process to another. (b) For programs using other analysis standards (nonalert type programs) changing systems or components from one primary maintenance process to another. (5) Adding or deleting components/systems. Chap 2 Page 18 Par 15 ### Page 12 (OCR) (6) Adding or deleting aircraft types. (7) All procedural and organizational changes concerning administration of the program. **16.-24. RESERVED.** hap • Page 19 (thru 24) ### Page 13 (OCR) **CHAPTER 3. PROGRAM AIMINISTRATION** 25. GENERAL• Administration of reliability programs (as discussed in this circular) requires a specific organizational structure within the operator's maintenance organization. Participants should be drawn from appropriate elements of the organization and should be authorized to act on behalf of their elements. The highest maintenance official or his designee should participate in the administration of the program. He should serve as the final authority for major activities and for program changes requiring FAA approval. b. The makeup of the administration group may vary considerably from one operator to another. It may have a technical board that analyzes performance deteriorations and shop findings to make determinations that may be acted on by an administrative board. The two boards can be combined if this better serves the needs of the particular operator. The board type of administration should entail meetings scheduled for some specified interval and should c. In lieu of a formal board, operators with sufficient organizational capability which should include a strong engineering function may administer their program by assigning appropriate responsibilities to each organizational element. In this type arrangement, responsibility for operation of the program should be assigned to a specific element of the operator's organization. Procedures for operating each of the systems described in chapter 2 of this publication are essential to the success of the program. These procedures should be incorporated in appropriate sections of the operator's manual system. This will provide each organizational element, and individuals therein, instructions as to their part in the program. Forms should be used, as necessary, to facilitate and document recurring transactions that involve several elements such as (1) changes from one maintenance process to another, (2) analysis of substandard system or component mechanical performance, (3) shop disassembly analysis for condition-monitoring purposes or overhau frequency adjustment, etc., and (4) sampling inspection for aircraft check or inspection adjustment. 26. RELIABILITY PROGRAM DOCUMENT. The operator should develop a document describing the application of reliability control methods. a. This document should include at least the following: (1) General description of the program. (2) Organizational structure, duties and responsibilities. (3) Description of the individual systems. Chap 3 Par 25 Page 25 ### Page 14 (OCR) (4) Derivation of performance standards (if used). (5) Changes to the program including designation of changes requiring FAA approval. (6) Copy and explanation of all forms peculiar to the system. (7) Revision control and certification of revisions to the document. b. The document should describe the workings of all systems in sufficient detail to provide for proper operation of the program. It should include in detail how the three maintenance processes are applied. The document should describe the monthly report and any other reports relative to the program, and include samples of these reports with instructions for their use. organizational element (s) responsible for publishing reports should be identified and the distribution should be stated. Copies of pertinent reports should be provided to FAA. C. The document should also include definitions of significant terms used in the program with particular emphasis on definitions of the three maintenance processes. **27.-34. RESERVED.** Chap : Page 26 (thru 34) Par 26 ### Page 15 (OCR) CHAPTER 4. PROGRAM APPROVAL INITIAL APPROVAL. FAA Form 1014, Operations Specifications, (OMB 04-R0075) is used for initial approval of reliability programs. This form, along with the program document and related data should be submitted to the FAA district office assigned responsibility for that operator. Guidance on the preparation of FAA Form 1014 is available from the FAA district office. Approval will be certified in the program docunent in addition to the operations specifications. 36. REVISION APPROVAL. Revisions requiring formal approval (ref: chapter 2, paragraph 15.g. of this circular) will be subject to the same consideration as initial approval. The mechanics of the approval certification will be as defined in the document. If the revision concerns items listed in the operations specifications, the effected page(s) will be amended to reflect the revision. hap - Dar 35 Page 35 ### Page 16 (OCR) Appendix 1 AIRLINE/MANUFACTURER MAINTENANCE PROGRAM PLANNING DOCUMENT - MSG-2 (Prepared by: R & M Subcommittee, Air Transport Association) (Date: March 25, 1970) 1.O GENERAL Introduction. Airline and manufacturer experience in developing scheduled maintenance programs for new aircraft has shown that more efficient programs can be developed through the use of logical decision processes. In July, 1968 representatives oi various airlines developed Handbook #MSG-1, "Maintenance Evaluation and Program Development,' which included decision logic and interairline/manufacturer procedures for developing a maintenance decided that experience gained on this project should be applied to update the decision logic and to delete certain 747 detail procedural information so that a universal document could be made applicable for later new type aircraft. This has been done and has resulted in this document, #MSG-2. Objective. It is the objective of this document to present a means for developing a maintenance program which will be acceptable to the Regulatory Authorities, the Operators, and the Manufacturers. The maintenance program data will be developed by coordination with specialists from the operators, manufacturers, and when feasible, the regulatory authority of the country of manufacture. Specifically it is the objective of this document to outline the general organization and decision processes for determining the essential scheduled maintenance requirements for new airplanes. Historically, the initial scheduled maintenance program has been specified in Maintenance Review Board Documents. This document is intended to facilitate the development of initial scheduled maintenance programs. The remaining maintenance, that is nonscheduled or nonroutine maintenance, is directed by the findings of the scheduled maintenance program and the normal operation of the aircraft. The remaining maintenance consists of maintenance actions to correct discrepancies noted during scheduled maintenance tasks, nonscheduled maintenance, normal operation, or condition monitoring. 1•3 Scope. The scope of this document shall encompass the maintenance program for the entire airplane. 1•4 Organization. The organization to carry out the maintenance program development pertinent to a specific type aircraft shall be staffed by representatives of the Airline Operators purchasing the equipment, the Prime Manufacturers of the airframe and powerplant and when feasible the Regulatory Authority. ### Page 17 (OCR) Appendix l 10401 The management of the maintenance program development activities shall be accomplished by a Steering Group composed of members from a representative number of Operators and a representative of the Prime Airframe and Engine Manufacturers. It shall be the responsibility of this group to establish policy, direct the activities of Working Groups or other working activity, carry out liaison with the manufacturer and other operators, prepare the final program recommendations and represent the operators in contacts with the Regulatory Authority. 1.4.2 A number of Working Groups, consisting of specialist representatives from the participating Operators, the Prime Manufacturer, and when feasible the Regulatory Authority, may be constituted. The Steering Group, alternatively, may arrange some other means for obtaining the detailed technical information necessary to develop recommendations for maintenance programs in each area. Irrespective of the organization of the working activity, it must provide written technical data that support its recommendations to the Steering Group. After approval by the Steering Group, these analyses and recommendations shall be consolidated into a final report for presentation to the Regulatory Authority. 200 DEVELOPMENT OF MAINTENANCE PROGRAMS 201 Program Requirement. It is necessary to develop a maintenance program for each new type of airplane prior to its introduction into airline service. 20101 The primary purpose of this document is to develop a proposal to assist the Regulatory Authority to establish an initial maintenance program for new types of airplanes. The purpose of this program is to maintain the inherent design ievels of operating safety.* This program becomes the basis for the first issue of each airline's Operations Specifications-Maintenance to govern its initial maintenance policy. These are subject, upon application by individual airlines, to revisions which may be unique to those airlines as operating experience is accumulated. 2.1.2 It is desirable, therefore, to define in some detail: (a) The objectives of an efficient maintenance program, (b) The content of an efficient maintenance program, and (c) The process by which an efficient maintenance program can be developed. * See Glossary. ### Page 18 (OCR) Appendix 1 20103 The Objectives of an efficient airline maintenance program are: (a) To prevent deterioration of the inherent design levels of reliability and operating safety of the aircraft, (Б) To accomplish this protection at the minimum practical costs. These objectives recognize that maintenance programs, as such, cannot correct deficiencies in the inherent design levels of flight equipment reliability. The maintenance program can only prevent deterioration of such inherent levels. If the inherent levels are found to be unsatisfactory, engineering action is necessary to obtain improvement. 2.1.5 The maintenance program itself consists of two types of tasks: (a) A group of scheduled tasks to be accomplished at specified intervals. The objective of these tasks is to prevent deterioration of the inherent design levels of aircraft reliability, and (b) A group of nonscheduled tasks which results from: (i) The scheduled tasks accomplished at specified intervals, (ii) Reports of malfunctions (usually originated by the flight crew), or (iii) Condition Monitoring. The objective of these nonscheduled tasks is to restore the equipment to its inherent level of reliability. This document describes procedures for developing the scheduled maintenance program. Nonscheduled maintenance results from scheduled tasks, normal operation or condition monitoring. 2.1.6 Maintenance programs generally include one or more of the following primary maintenance processes: Hard Time Limit: A maximum interval for performing maintenance tasks. These intervals usually apply to overhaul, but also apply to total life of parts or units. ### Page 19 (OCR) Appendix 1 On Condition: Repetitive inspections, or tests to determine the condition of units or systems or portions of structure (Ref.: FAA Advisory Circular 121-1). Conditior Monitoring: For items that have neither hard time limits nor on condition maintenance as their primary maintenance process. Condition monitoring is accomplished by appropriate means available to an operator for finding and resolving problem areas. These means range from notices of unusual problems to special analysis of unit performance. No specific monitoring system is implied for any given unit (Ref.: FAA Procedures 8310.4, paragraph 3033). This document results in scheduled tasks that fit the hard time limit or on condition maintenance programs or, where no tasks are specified, the item is included in condition monitoring. 2.2 Scheduled Maintenance Program Content The tasks in a scheduled maintenance program may include: (a) Servicing (b) Inspection (c) Testing (a) Calibration (e) Replacement 2.2.1 An efficient program is one which schedules only those tasks necessary to meet the stated objectives. It does not schedule additional tasks which will increase maintenance costs without a corresponding increase in reliability protection. 2.2.2 The development of a scheduled maintenance program requires a very large number of decisions pertaining to: (a) Which individual tasks are necessary, (b) How frequently these tasks should be scheduled, (c) What facilities are required to enable these tasks to be accomplished, Page 4 ### Page 20 (OCR) Appendix 1 (d) Where these facilities should be located, and (e) Which tasks should be accomplished concurrently in the interests of economy. 2•3 Aircraft System Component Analysis Method. The method for determining the content of the scheduled maintenance program for systems and components (parts a and b of Paragraph 2.2.2) uses decision diagrams. These diagrams are the basis of an evaluatory process applied to each system and its significant items using technical data provided (Ref. 2.7). Principally, the evaluations are based on the systems' and items' functions and failure modes. The purpose is to: (a) Identify the systems and their significant items*. (b) Identify their functions*, failure modes*, and failure reliability*. (c) Define scheduled maintenance tasks having potential effectiveness* relative to the control of operational reliability*. (d) Assess the desirability of scheduling those tasks having potential effectiveness. It should be noted that there is a difference between "Potential" effectiveness of a task versus the "desirability" of including this task in the scheduled maintenance program. The approach taken in the following procedure is to plot a path whereby a final judgment can be made as to whether those potentially effective tasks are worthy of inclusion in an initial maintenance program for a new airplane. There are three decision diagrams provided (Addendum I, Figures 1 through 3). Figure 1 is used to determine scheduled maintenance tasks having potential effectiveness relative to the control of operational reliability. This determines tasks which can be done. Figures 2 and 3 are used to assess the desirability of scheduling those tasks having potential effectiveness. Figure 2 tasks must be done to prevent direct adverse effects on operating safety and to assure availability of hidden functions. Figure 3 tasks should be done for economic value. * See Glossary. ### Page 21 (OCR) Appendix l 2.3.3 The total analysis process is shown diagramatically below. See Addendum I for details. Figure 1 Figure 2 Figure 3 (Questions a,b,c,d, e) (Questions I & II) (Questions A, B & C) Flight Crew Tasks a · Tasks N Tasks T c DA B C Tasks d (Eval) S Tasks e These tasks have These tasks must These tasks should potential effec- be done to prevent be done for economic tiveness & can direct adverse value. be done. effects on operating safety & assure availability of hidden functions. 20304 The following guidelines encourage consideration of failure consequences and the potential effectiveness of scheduled maintenance tasks. In those cases where failure consequences are purely economic, the guidelines lead to consideration of both the cost of the scheduled maintenance and the value of the benefits which will result from the task. ### Page 22 (OCR) Appendix 1 20305 A decision tree diagram (Figure 1 of Addendum 1) facilitates the definition of scheduled maintenance tasks having potential effectiveness. There are five key questions. Note: Questions (a), (b), and (c) must be answered for each failure mode, question (d) for each function, and question (e) for the item as a whole. (a) Is reduction in failure resistance* detectable by routine flight crew monitoring*? (b) Is reduction in failure resistance detectable by in situ maintenance or unit test? (c) Does failure mode have a direct adverse effect upon operating safety? (See Addendum 2.) (a) Is the function hidden from the viewpoint of the flight crew? (See Addendum 3.) (e) Is there an adverse relationship between age and reliability? 2.306 Each question should be answered in isolation, e.g., in question (c) all tasks which prevent direct adverse effects on operating safety must be listed. This may result in the same task being listed for more than one question. If the answer to question (a) is Yes, this means there are methods available through monitoring of the normal in-flight instrumentation to detect incipient conditions before undesirable system effects occur. A Yes answer does not require a maintenance task. If the answer is No, there is no in-flight monitoring which can detect reduction in failure resistance. This question is meant to refer to the flight crews' ability to detect deteriorating calibration or systems operation before a failure occurs. NOTE: Tasks resulting from in-flight monitoring are part of nonscheduled 2.3.8 If the answer to question (b) is Yes, it means there is a maintenance task, not requiring item disassembly, that has potential effectiveness in detecting incipient conditions* before undesirable system effects occur. Tasks may include inspection, servicing, testing, etc. NOIE: Tasks resulting from a les answer to question (b) are part of the On Condition maintenance program. * See Glossary. ### Page 23 (OCR) Appendix l If the answer to question (c) is Yes, this failure mode has a direct, adverse effect on operating safety. It is necessary to examine the mechanism of failure and identify the single cells or simple assemblies where the failure initiates. Specific total time, total might cycle, time since overhaul and cycle since overhaul limitations may be assigned these single cells or simple assemblies and the. probability of operational failures will be minimized. Examples of these actions are turbine engine disc limits, airplane flap link life limits, etc. In many cases, these Limits must be based upon marufacturer's development testing. Fortunately, there is only a small number of failure modes which have a direct, adverse effect on operating safety. This results from the fact that failure mode analyses are conducted throughout the process of flight equipment design. In most cases, it is possible after identification of such a failure mode to make design changes (redundancy, incorporation of protective devices, etc.) which eliminate its direct adverse effect upon operating safety. If no potentially effective task exists, then the deficiency in design must be referred back to the manufacturer. The term "direct adverse effect upon operating safety" is explained in Addendum 2. NOTE: Tasks resulting from a Yes answer to question (c) are part of either the Hard Time limitation maintenance program or the On Condition maintenance program. Refer to Addendum 3 for explanation of question (d). If the answer to question (d) is Yes, periodic ground test or shop tests may be required if there is no other way of ensuring that there is a high probability of the hidden function being available when required. The frequencies of these tests are associated with failure consequences and anticipated failure probability. A component cannot be considered to have a hidden function if failure of that function results in a system malfunction which is evident to the flight crew during normal operations. In this case, the answer must be No. NOTE: Tasks resulting from a Yes answer to question (d) may be part of either the Hard Time limitation or the On-Condition maintenance program. 2.3.11 If the answer to question (e) is Yes, periodic overhaul may be an effective way of controlling reliability. Whether or not a fixed overhaul time limit will indeed be effective can be determined only by actuarial analysis of operating experience. NOI: Tasks resulting from a Yes answer to question (e) are part of the Hard Time limitation mainte nance program. ### Page 24 (OCR) Appendix 1 2.3012 It has been found that overall measures of reliability of complex components, such as the premature removal rate, usually are not functions of the age of these components. in most cases, thereiore, the answer to question (e) is No. In this event, scheduled overhaul cannot improve operating reliability. Engineering action is the only means of improving reliability. These components should be operated, therefore, without scheduled overhaul. NoIE: Systems or items which require no scheduled tasks are included in Condition Monitoring. The preceding paragraph is contrary to the common belief that each component has an unique requirement for scheduled maintenance in order to protect its inherent level of reliability. The validity of this belief was first challenged by actuarial analyses of the life histories of parting pograph has ee enth the ely detonate at the by the massive operational experience of many airlines with many different types of components covered by Reliability Programs complying with FAA Advisory Circular 120-17. It is possible to change the answers to the five questions in the decision diagram by improved technology. it is hoped that Aircraft Integrated Data Systems (AIDS), for example, will reliably indicate reduced resistance to various modes of failure of many components during normal airline operations. If this is determined to be possible, many "No" answers to questions (a) and (b) will become "Yes" answers. Answers may also be changed by various developments in the field of nondestructive test techniques, built-in test equipment, etc. The questions in Figure l are intended to determine maintenance tasks having potential effectiveness for possible inclusion in a scheduled maintenance program. However, it is probable that many of these "potentially" beneficial scheduled tasks would not be "desirable" even though such tasks could improve reliability. This might be true when operating safety is not affected by failure or the cost of the scheduled maintenance task is greater than the value of such resulting benefits as reduced incidence of component premature removal, reduced incidence of departure delays, etc. Additional diagrams are used to assess the "desirability" of those scheduled maintenance actions which have potential effectiveness. This is accomplished by Figures 2 and 3 of Addendum 1. ### Page 25 (OCR) Appendix 1 2.3.16 Figure 2 selects those tasks which must be done because of operating safety or hidden function considerations. Figure 3 selects those tasks which should be done because of economic considerations. 2.3.17 Figure 2 assesses tasks listed against the Yes answers of questions c and d in Figure 1, and selects those tasks which must be done. 2•3.18 For the operating safety question, at least one task must be listed for each failure mode having a Yes answer to question c of Figure 1. An explanation should be given for any question c tasks not selected. 2.3.19 For the hidden function question, normally at least one task must be listed for each hidden function having a Yes answer to Figure 1, question d. If a task is not selected, as permitted by Addendum 3, an explanation must be provided. 2.3.20 Figure 3 assesses tasks listed against the Yes answer in Figure 1, questions b and e and select those tasks which should be done because of economic considerations. A key question in Figure 3 is the first, ®Does real and applicable data* show desirability of scheduled task?" a "Yes" answer is appropriate if there is: Prior knowledge from other aircraft that the scheduled maintenance tasks had substantial evidence of being truly effective and economically worthwhile, (2) The system/component configurations of the old and new airplanes are sufficiently similar to conclude that the task will be equally effective for the new airplane. 2•3•22 The question "Does failure prevent dispatch" refers to whether the item will be on the Minimum Equipment List (MEL) • The question "iIs elapsed time for correction of failure >0.5 Hr. refers to whether corrective action can be accomplished without a delay during a normal transit stop. 2.3.24 When a task "requires evaluation" it is important that the frequency of the failure and the cost of carrying out the task are taken into consideration. * See Glossary. ### Page 26 (OCR) Appendix 1 204 Aircraft Structure Analysis Method. The method for determining the content of the scheduled maintenance program for structure is: (a) Identify the significant structural itens.* (b) Identify their failure modes and failure effects. (c) Assess the potential effectiveness of scheduled inspections of structure. (d) Assess the desirability of those inspections of structure which do have potential effectiveness. 2•4.1 The static structure will be treated as hereafter described. Additionally, the mechanical elements of structural components, such as doors, emergency exits, and flight control surfaces will be treated individually by the processes described in Section 2.3. The decision tree diagram, Figure 1 of Addendum 1, facilitates the definition of scheduled inspections of structure having potential effectiveness. There are five key questions. (a) Is reduction in failure resistance detectable by routine flight crew monitoring? (b) Is reduction in failure resistance detectable by in situ maintenance or unit test? (c) Does failure mode have a direct adverse effect upon operating safety? (d) Is the function hidden from the viewpoint of the flight crew? (e) Is there an adverse relationship between age and reliability? 2.4.3 The answer to question (a) is normally No. However, if in-flight instrumentation is developed which permits detection of incipient structural failures then the answer should be Yes. If the answer to question (b) is les, there are methods available to detect incipient conditions before undesirable conditions occur. It would be expected that all redundant external and internal structure would be in this category. VIE: Tasks resulting from a Yes answer to question (b) are part of the Structural Inspection program. This program is an On Condition program. ### Page 27 (OCR) Appendix 1 20405 If the answer to question (c) is Yes, there is a failure mode which has a direct, adverse effect on operating safety for which there is no effective incipient failure detection method. It would be expected that nonredundant primary structure would be in this category. See Addendum 2 for explanation of "direct adverse effect on operating safety." NOTE: Tasks resulting from a Yes answer to question (c) are part of the Hard Time limitation (usually total time or total cycle limits) maintenance program. 20406 If the answer to question (d) is Yes, there is a function required of this element of structure that is not regularly used during normal flight operations. Some inspection or test is therefore necessary to ensure that this function has a high probability of being available when required. Tail bumper structure and structure provided for wheelsup landing are typical structural examples. NOTE: Tasks resulting from a Yes answer to question (d) are part of the Structural Inspection program. 20407 Structures would be expected to have a Yes answer to question (e) but only in a very long total time envelope. The tasks performed as a result of Yes answers to the other questions are capable of detecting deterioration prior to failure of these items. 20408 It is probable that some of these "potentially" beneficial scheduled inspections would not be desirable, even if such tasks would improve reliability. This might be true when airworthiness is not affected by failure and the cost of the scheduled inspection is greater than the value of the resulting benefits. Therefore, additional diagrams are used to assess the desirability of those scheduled tasks which have potential effectiveness. This is accomplished by Figures 2, 4, and 5 of Addendum 1. A No answer to all questions is unlikely for structure. If it occurs, the item is included in Condition Monitoring. 20409 Figure 2 selects those tasks that must be done because of operating safety or hidden function considerations. Figures 4 and 5 of Addendum 1 establish internal and external class numbers for structural items. The class numbers take into account vulnerability to failure, consequences of failure. The class numbers are to be used as guides for setting internal and external inspection frequencies. 204.11 The items to be evaluated by Figures 4 and 5 are those termed "structurally significant." ### Page 28 (OCR) Appendix l 2•4.12 Each item is first rated for each of five characteristics per Figure 4 (fatigue resistance, corrosion resistance, crack propagation resistance, degree of redundancy and fatigue test rating)• Each item is then given an overall rating (R No.) per Figure 4 which considers all of the above ratings and combines them by judgment into a single overall rating (R No.) representing a relative level of structural integrity of the item. In general, the overall R No. for an item is equal to or less than the fatigue resistance or corrosion resistance rating for the item, whichever is lesser. 204014 The internal and external class numbers for each item are then determined by reference to Figure 5. Note that some items have both internal and external class numbers. This occurs for those internal items which have some probability of the internal item's condition being evident by some external condition. In these cases the item as described is visible internally and the "internal" inspection specified refers to the item as described. The "external" inspection of this item refers to that portion of the external structure which is adjacent to the internal item and which may yield some indication of the internal item's condition. Therefore, when an external inspection is specified for an internal item, it refers to the adjacent external structure and not the internal item itself. 205 Aircraft Engine Analysis Method. The method for determining the content of the scheduled engine maintenance program is: (a) Identify the systems and their significant items. (b) Identify their functions, failure modes, and failure effects. (c) Define scheduled maintenance tasks having potential effectiveness relative to the control of operational reliability. (d) Assess the desirability of scheduling those tasks having potential effectiveness. (e) Determine initial sampling thresholds where appropriate. 20501 The engine as a whole and each significant engine item will be treated as described below. ### Page 29 (OCR) Appendix 1 20502 The decision tree diagram, Figure 1 of Addendum 1, facilitates the definition of scheduled inspections having potential effectiveness. There are five key questions. NOTE: Questions (a), (b), and (c) must be answered for each failure mode, question (d) for each function, and question (e) for the item as a whole. (a) Is reduction in failure resistance detectable by routine flight crew monitoring? (b) Is reduction in failure resistance detectable by in situ maintenance or unit test? (c) Does failure mode have a direct adverse effect upon operating safety? Is the function hidden from the viewpoint of the flight crew? (e) Is there an adverse relationship between age and reliability? 20503 If the answer to question (a) is Yes, there are methods available through monitoring the normal in-flight instrumentation (including computerized Flight Log Monitoring) to detect incipient conditions before undesirable system effects occur. A Yes answer does not require a maintenance task. If the answer is No, there is no in-flight monitoring which can detect reduction in failure resistance. NOTE: Tasks resulting from in-flight monitoring are part of If the answer to question (b) is Yes, there is a maintenance task, not requiring engine disassembly, that has potential effectiveness in detecting incipient conditions before undesirable system effects occur. Tasks may include inspection, servicing, testing, etc. NOIE: Tasks resulting from Yes answers to question (b) are part of the On Conditior maintenance program. If the answer to question (c) is Yes, this engine component has a failure mode with direct, adverse effect on operating safety. It is necessary to examine the mechanism of failure and identify the single cells or simple assemblies where the failure initiated. Specific total time, or total flight cycle, limitations may be assigned these components to minimize the probability of operational failures. NOIL: lasks resulting from a les answer to question (c) are part of either the Hard Time limitation maintenance program or the On Condition maintenance program. ### Page 30 (OCR) Appendix 1 2•506 If the answer to question (d) is Yes, there is a function required of this engine component that is not evident to the flight crew when the component fails. Some scheduled task may be necessary to assure a reasonably high probability that this function is available when required. NOID: Tasks resulting from a Yes answer to question (d) may be part of either the Hard Time limitation or the On Condition maintenance program. 20507 It is expected that the answer to question (e) is always Yes for structural engine components, but that their expected lile is very long relative to the usual engine inspection periods. If tasks defined by questions (a through (d) are inadequate to control wear or deterioration of engine components, additional tasks should be listed here. NOTE: Tasks resulting from a Yes answer to question (e) are part of either the Hard Time limitation or the On Condition maintenance program. 2.5.8 Engine components for which no scheduled tasks are selected are included in Condition Monitoring. 20509 The questions in Figure 1 are intended to determine maintenance tasks having potential effectiveness for possible inclusion in a scheduled maintenance program. However, it is probable that many of these 'potentially" beneficial scheduled tasks would not be "desirable" even though such tasks could improve reliability. This might be true when operating safety is not affected by failure or the cost of the scheduled maintenance task is greater than the value of such resulting benefits as reduced incidence of component premature removal, reduced incidence of departure delays, Additional diagrams are used to assess the "desirability" of those scheduled maintenance actions which have potential effectiveness. This is accomplished by Figures 2 and 3 of Addendum 1. 2.5.10 Figure 2 selects those tasks which must be done because of operating safety or hidden function considerations. Figure 3 selects those tasks which should be done because of economic considerations. 2.5.11 Figure 2 assesses tasks listed against the Yes answers of questions c and d in Figure 1, and selects those tasks which must be done. 2.5.12 For the operating safety question, at least one task must be listed for each failure mode having a Yes answer to question c of Figure 1. An explanation should be given for any question c tasks not selected. ### Page 31 (OCR) Appendix 1 For the hidden function question, normally at least one task must be listed for each hidden function having a Yes answer to Figure 1, question d. If a task is not selected, as permitted by Addendum 3, an explanation must be provided. 205014 Figure 3 assesses tasks listed against the Yes answer in Figure 1, questions (b) and (e) and selects those tasks which should be done because of economic considerations. 2.5.15 A key question in Figure 3 is the first, 'Does real and applicable data show desirability of scheduled task?" A "Yes" answer is appropriate if there is: (1) Prior knowledge from other aircraft that the scheduled maintenance tasks had substantial evidence of being truly effective and economically worthwhile, and The system/component configurations of the old and new airplanes are sufficiently similar to conclude that the task will be equally effective for the new airplane. The question "Does failure prevent dispatch" refers to whether the item will be on the Minimum Equipment List (MEL). The answer to question (b) is expected to always be Yes for engine components that cause engine failure. The question Is elapsed time for correction of failure > 0.5 Hr. refers to whether corrective action can be accomplished without a delay during a normal transit stop. 2.5.18 When a task "requires evaluation" it is important that the frequency of the failure and the cost of carrying out the task are taken into consideration. 205019 Engine tasks are included in the Threshold Sampling maintenance program. This program is described below. The Threshold Sampling maintenance program is intended to recognize the On Condition design characteristics of modern Turbo-Jet engines, while sampling to control reliability. This program uses repetitive sampling to determine: (1) The condition of engine components. (2) The advisability for continued operation to the next sampling limit, and (3) The next sampling limit, threshold, or sampling band. ### Page 32 (OCR) Appendix 1 2.5.21 Initial sampling thresholds are based on: (1) The design of the engine under study, the results of developnental testing, and prior service experience. (2) The results of previous engine programs. (3) The fact that samples are available from engines removed for all causes at virtually all ages. This means that knowledge of the conditions of engines is available over the complete continuum of time from start of operation to the highest time experienced, and (4) The fact that most engine design problems become apparent and can be controlled well within any established limits or thresholds. 205022 The Threshold Sampling program establishes the initial sampling threshold. Operators are subsequently responsible for: (1) Evaluating the samples obtained from the initial threshold (2) Determining the next sampling threshold, and (3) Determining the number to be sampled at the next threshold. 205023 Threshold Sampling is normally accomplished by inspecting the parts or systems of engines that are removed and accessible in the shop. These engines provide samples over a full range of ages without waiting for the threshold to be reached. The results of inspecting these samples are used to determine the future program. When samples are not available from engines that are in the shop, scheduled samples or in situ inspections may be required. 206 Program Development Administration. Regulatory Authority participation is encouraged as early and as thoroughly as possible in all phases of working group activity. It is recognized that the Regulatory Authority will later be asked to approve the proposed program resulting from these efforts. Therefore, the Regulatory Authority participation must necessarily be restricted to technical participation, contributing their own knowledge, and observing the activities of the working group. Regulatory Authority approva ol working group recommendations is not implied by the participation of Regulatory Authority members in working group sessions. The following activity phases will apply. ### Page 33 (OCR) Appendix 1 Phase I. Steering Group general familiarization training. Phase II. (a) Working Group or Working Activity Training. *(b) Preparation of first draft Significant Items List. (Ref. 2.7.1) *(c) Establish functions and failure modes applicable to the Significant Items. (a) Preparation of Figures 1 thru 5 decision diagram replies and supporting data for each system and significant item. Phase III. (a) Evaluation of manufacturer's technical data and recommended tasks by the Working Groups' airline personnel and meeting with manufacturer to make necessary revisions and prepare task recommendations. (b) Development of task frequency recommendations. (This phase is meant to follow Phase III. a). NOTE: A Steering Group member should participate in all Phase III activity. Phase IV. Presentation to Steering Group (meeting with each Working Group or Activity Chairman). Phase V. Preparation and presentation of the Steering Group's proposal to the Regulatory Authority. 2•7 Supporting Technical Data. The following supporting technical data will be provided in printed form, together with adequate crossreferences on the records of replies to the decision diagrams. Maintenance Significant Items List. This list will include by ATA System, the name, quantity per airplane, prime manuracturer part number, vendor name and part number for each item considered by the Working Group/Activity to require individual analysis. 20702 Significant Items Data. (a) Description of each significant item and its function(s). (b) Listing of its failure mode(s) and effects. * Steering Committee audits are required for these steps before proceeding. ### Page 34 (OCR) Appendix 1 (c) Expected failure rate. (a) Hidden functions. (e) Need to be on M.E.I. (I) Redundancy (may be unit, system or system management). (g) Potential indications of reduced failure resistance. 20703 System Data. (a) Description of each system and its function(s). (0) Listing of any failure modes and effects not considered in item data. (c) Hidden functions not considered in item data. ### Page 35 (OCR) Appendix 1 GLOSSARY Inherent Level of Reliability and Safety - That level which is built into the unit and therefore inherent in its design. This is the highest level of reliability and safety that can be expected from a unit, system, or aircraft. To achieve higher levels of reliability generally requires modification or redesign. Maintenance Significant Items - Those maintenance items that are judged by the manufacturer to be relatively the most important from a safety or reliability standpoint, or from an economic standpoint. Structural Significant Items - Those local areas of primary structure which are judged by the manufacturer to be relatively the most important from a fatigue or corrosion vulnerability standpoint or from a failure effects standpoint. Operational Reliability - The ability to perform the required functions within acceptable operational standards for the time period specified. Effective Incipient Failure Detection - That maintenance action which will reliably detect incipient failures if they exist. That is, detect the pending failure of a unit or system before that system fails. For example, detection of turbine blade cracks prior to blade failure. Real and Applicable Data - Those data about real, operating hardware that is similar enough to the hardware under discussion to be applicable to the design of maintenance programs for the current hardware. Reduction in Failure Resistance - The deterioration of inherent (design) levels of reliability. As failure resistance reduces, failures increase; resulting in lower reliability. If reduction in failure can be detected, maintenance can be performed prior to the point where reliability is adversely affected. Function - The characteristic actions of units, systems and aircraft. Failure Modes - The ways in which units, systems and aircraft deteriorate can be considered to have failed. Potential Effectiveness - Capable of being effective (maintenance action) to some degree. Routine Flight Crew Monitoring - That monitoring that is inherent in normally operating the aircraft. For example, the pre-flight check list, or the normal operation of the aircraft and its components. Does not include monitoring of "back-up" equipment that is normally not tested as a part oi a normal flight. Failure Effects - The consequence of failure. ### Page 36 (OCR) AIRLINE MAINTENANCE PROGRAM DEVELOPMENT MSG 2 DECISION DIAGRAM 3/27/78 FIGURE I FIGURE 2 FIGURE 3 WHICH TASKS CAN BE DONE WHICH TASKS MUST BE DONE WHICH TASKS SHOULD BE DONE QUESTIONS a, b, & c APPLY TO EACH FAILURE MODE QUESTION I APPLIES TO c TASKS QUESTION A, B, & C'APPLY TO b AND e TASKS OF ITEM QUESTION d APPLIES TO EACH FUNCTION OF ITEM QUESTION II APPLIES TO d TASKS QUESTION • APPLIES TO ITEM AS A WHOLE IS REDUCTION IN FAILURE RESISTANCE DETECTABLE BY ROUTINE FLIGHT OF IN-FLIGHT MONITORING LIST OF MEANS Figures 1. 2. AND 3. CREW MONITORING ? YES NO - IN- SITU MICE IS REDUCTION IN FAILURE RESISTANCE DETECTABLE BY TASKS REF. TO RESISTANCE (CHECK, LIST ALL POTENTIAL REDUCT IN FAILURE MSG 2 DECISION DIAGRAM ADDENDUM 1 OR UNIT TEST ? INSPECT, SERVICE, ES. ETC.J. NO WHICH OF THE TASKS RE ADVERSE EFFECT ON DOES FAILURE MODE HAVE A DIRECT LIST ALL POTENTIAL TASKS REF. TO OPERATING SAFETY FERRING TO OPERATING SAFETY MUST BE DONE ? AT LEAST ONE TASK MUST BE DONE, EXPLAIN ANY c OPERATING SAFETY ? IS THE FUNCTION HIDDEN FROM THE VIEWPOINT OF THE FLIGHT CREW ? YES YESİ NO - (TOTAL TIME LIMITS ETC. I CHECK, INSPECT. LIST ALL POTENTIAL TASKS REF. TO HIDDEN FUNCTION (CHECK, INSPECT, FERRING TO HIDDEN FUNCTION MUST BE DONE ? AT LEAST ONE TASK MUST BE DONE EXCEPT AS PERL WHICH OF THE TASKS RE- TASKS NOT SELECTED. DATA SHOW DOES REAL AND APPLICABLE SCHEDULED TASK - DESIRABILITY OF YES-- PREVENT DISPATCH ? DOES FAILURE IS ELAPSED TIME FOR CORRECTION OF FAILURE > 0.5 HOUR ? DISPOSITION OF TASK PROGRAM RELATIVE TO • INCLUDE NOE MITTED BY APP. 3 -EVALUATION REQUIRES Appendix 1 AC 120-17A YES! IS THERE AN AD - VERSE RELATIONSHIP PERIODIC NO -NO- •I OMIT **BETWEEN AGE AND OVERHAUL YES 'NO IOMIT NO -** ### Page 37 (OCR) AIRLINE MAINTENANCE PROGRAM DEVELOPMENT Appendix 1 AC 120-17A STRUCTURE ANALYSIS METHOD AN INDICATION OF THE FATIGUE RESISTANCE OF THE ITEM RELATIVE TO THE FATIGUE RELATIVE TO THE FATIGUE FIGURE 4. STRUCTURE ANALYSIS METHOD **DESIGN GOAL FOR THE OVERALL AIRPLANE** **FATIGUE** RESTANCE DESIGN GOAL SMALL MARGIN ABOVE! FAIR MARGIN ABOVE DESIGN GOAL CONSIDERABLE MARGIN HIGH MARGIN ABOVE ABOVE DESIGN GOAL DESIGN GOAL CORROSION AND INDICATION OF THE RELATIVE CORROSION RESISTANCE OF THE ITEM CONSIDERING RESISTANCE BOTH EXPOSURE AND PROTECTION. (INCL. STRESS CORROSION) LEAST MARGIN OF RESISTANCE RESISTANCE FAIR MARGIN OF CONSIDERABLE MARGIN OF RESISTANCE HIGHEST MARGIN OF RESISTANCE AND INDICATION OF THE RELATIVE ABILITY OF THE MATERIAL USED TO RESIST PROPAGATION TO BE EXECUTED FOR EACH THIS PORTION OF CHART ADDENDUM 1 CRACK OF CRACKS. ITEM WHICH HAS BEEN PROPAGATION DESIGNATED AS &STRUC- RESISTANCE LEAST MARGIN OF FAIR MARGIN OF CONSIDERABLE MARGIN HIGHEST MARGIN OF TURALLY SIGNIFICANT" RESISTANCE RESISTANCE OF RESISTANCE RESISTANCE (HI HEAT TREAT STEEL) (7000 SERIES ALUM) (TITANIUM) (2000 SERIES ALUM.) DEGREE OF AN INDICATION OF THE DEGREE TO WHICH THE ITEM IS BACKED UP BY REDUNDANT STRUCTURE. **REDUNDANCY** **SMALL HIGH** FATIGUE WILL THE LOADS APPLIED TO THE ITEM IN THE FULL SCALE FATIGUE TEST PROPERLY REPRESENT TEST RATING, LOADS PREDICTED FOR SERVICE USAGE? NO YES OVERALL A RATING WHICH CONSIDERS ALL THE ABOVE RATINGS AND COMBINES THEM BY IUDGEMENT THIS RATING NO. IS RATING INTO A SINGLE OVERALL RATING WHICH REPRESENTS A RELATIVE LEVEL OF THE STRUCTURAL ASSIGNED TO ALL OTHER NUMBER INTEGRITY OF THE ITEM. PRIMARY AND SECONDARY (R) STRUCTURE WHICH IS NOT **STRUCTURALLY SIGNIFICANT 2 4 5 3/27/78** ### Page 38 (OCR) **STRUCTURE DETECTABILITY EVALUATION AIRLINE MAINTENANCE PROGRAM DEVELOPMENT 3/27/78** THIS CHART CONVERTS OVERALL RATING (R) TO INTERNAL & EXTERNAL CLASS NUMBERS INTERNAL EX. CLASS EX. CLASS FIGURE 5. STRUCTURE DETECTABILITY EVALUATION CLASS NO. NO. NO. IF>10 ABOVE GROUND IF 10CABOVE GROUND **IN NON FUEL AREA OR IN FUEL AREA** STRUCTURALLY SIGNIFICANT ITEMS (EX) EXTERNAL ITEMS NONE R+1 (IN) INTERNAL ITEMS : ADDENDUM 1 • HIGH PROBABILTY OF EXTERNAL DETECTABILITY OF ITEM'S CONDITION BY FUEL LEAK OR VISUAL CONDITION OF ADJACENT EXTERNAL ITEM R+1 • LOW PROBABILITY OF DITTO R • NO EXTERNAL DETECTABILITY OF ITEM'S CONDITION SINCE **NO ADIACENT ITEMS ARE VISIBLE EXTERNALLY R NONE NONE** ALL OTHER PRIMARY OR SECONDARY STRUCTURAL ITEMS WHICH ARE NOT STRUCT. SIGNIFICANT (EX) EXTERNAL ITEMS NONE 5 Page 23 EXTERNAL MEANS THERE IS VISUAL (IN) INTERNAL ITEMS INTERNAL MEANS THERE IS VISUAL 5 • • WHERE VISUAL ACCESSIBILTY NONE NONE Appendix 1 AC 120-17A ACCESSIBILITY WITHOUT DETACHING ANY ACCESSIBILITY ONLY BY DETACHING EXISTS SIMPLY BY REMOVAL OF AN PARTS (INCL. ACCESS PANELS | FROM REMOVABLE PARTS OR BY RADIOCRAPHIC ACCESS PLATE AND NO ADDITIONAL **THE AIRPLANE, AND INCLUDES CONTROL MEANS DETACHMENT OF PARTS IS NECESSARY** **SURFACE DEFLECTION AS REQUIRED TO GAIN VISUAL ACCESS** ### Page 39 (OCR) Appendix 1 ADDENDUM 2 The following elaborates on the term &direct and adverse effect on operating safety." During the design process considerable attention is given to system and component failure effect analysis to ensure that failures that result in loss of function do not immediately jeopardize operating safety. In many cases, redundancy can cause the consequences of a first failure to be benign. In other cases, protective devices serve this purpose. Although it may not be possible to continue to dispatch the airplane without correcting the failure and although it may indeed be desirable to make an unscheduled landing after failure, the failure cannot be considered to have an immediate adverse effect upon operating safety. The inclusion of the word direct in the phrase 'direct adverse effect upon operating safety" means an effect which results from a specific failure mode occurring by itself and not in combination with Certification requirements ensure that a transport category aircraft has very few failure modes which have a direct adverse effect upon operating safety. ### Page 40 (OCR) Appendix l ADDENDUM 3 EXPLANATION OF HIDDEN FUNCTIONS A component is considered to have a "hidden function" if either of the following exists: 1. The component has a function which is normally active whenever the system is used, but there is no indication to the flight crew when that function ceases to perform. 2. The component has a function which is normally inactive and there is no prior indication to the flight crew that the function will not perform when called upon. The demand for active performance will usually follow another failure and the demand may be activated automatically or manually. Examples of components possessing hidden functions exist in a bleed air system. A bleed air temperature controller normally controls the bleed air temperature to a maximum of 400°F. In addition, there is a pylon shutoff valve which incorporates a secondary temperature control, should the temperature exceed 400°F. A duct overheat switch is set to warn the flight crew of a temperature above 480°F, in which event they can shut off the air supply from the engine by actuating the pylon shutoff valve switch. There is no duct temperature indicator. The bleed air temperature controller has a hidden active function of controlling the air temperature. Since there is a secondary temperature control in the pylon valve and since there is no duct temperature indicator, the flight crew has no indication of when the temperature control function ceases to be performed by the temperature controller. Also, the flight crew has no indication prior to its being called into use that the secondary temperature control function of the pylon valve will perform. Therefore, the pylon valve has a hidden inactive function. For a similar reason, the duct overheat warning system has a hidden inactive function. And the pylon valve has a hidden inactive function (manual shutoff) since at no time in normal use does the flight crew have to manually close the valve. The hidden function definition includes reference to ino indications to the flight crew" of performance of that function. If there are indications to the flight crew, the function is evident (unhidden). However, to qualify as an evident function, these indications must be obvious to the flight crew during their normal duties, without special monitoring (bear in mind, however, that special monitoring is encouraged as a part of the maintenance program to make hidden functions into evident ones). It is recognized that, in the performance of their normal duties, the flight crews operate some systems full time, others once or twice per flight, and others less frequently. All of these duties, providing they are done at some reasonable frequency, qualify as "normal." It means, for example, that although an anti-icing system is not used every flight it is used with Page 25 ### Page 41 (OCR) Appendix 1 sufficient frequency to qualify as a "normal" duty. Therefore, the antiicing system can be said to have an evident (unhidden) function from a Ilight crew's standpoint. On the other hand, certain "emergency" operations which are done at very infrequent periods less than once per month) such as emergency gear extension, fuel dump actuation, etc., cannot be considered to be sufficiently frequent to warrant classification as evident (unhidden) functions. The analysis method requires that all hidden functions have some form of scheduled maintenance applied to them. However, in those cases where it may be difficult to check the operation of hidden functions, it is acceptable to assess the operating safety effects of combined failures of the hidden function with a second failure which brings the hidden function failure to the attention of the flight crew. In the event the combined failures do not produce a direct adverse ellect on operating safety, then the decision whether to apply maintenance to check the pertinent hidden function becomes an economic decision to be considered by Figure 3 of Addendum 1. Note also, in some cases, it is acceptable to accomplish hidden function checks of removable components during unscheduled shop visits, providing the component has at least one other function which when failed is known to the flight crew and which causes the unit to be sent to the shop. Also, the hidden function failure mode should have an estimated reliability well in excess of the total reliability of the other functions that are evident to the flight crew. MU.S. GOVERNMENT PRINTING OFFICE: 1978-261-264/82 Page 26 --- OpenAirDocs.org is an independent research project of [Contrail Labs](https://contraillabs.com/). It is not affiliated with the FAA or the NTSB. Source documents are U.S. government works in the public domain.