Appendix 1 2•506 If the answer to question (d) is Yes, there is a function required of this engine component that is not evident to the flight crew when the component fails. Some scheduled task may be necessary to assure a reasonably high probability that this function is available when required.
NOID: Tasks resulting from a Yes answer to question (d) may be part of either the Hard Time limitation or the On Condition maintenance program.
20507 It is expected that the answer to question (e) is always Yes for structural engine components, but that their expected lile is very long relative to the usual engine inspection periods. If tasks defined by questions (a through (d) are inadequate to control wear or deterioration of engine components, additional tasks should be listed here. NOTE: Tasks resulting from a Yes answer to question
(e) are part of either the Hard Time limitation or the On Condition maintenance program.
2.5.8 Engine components for which no scheduled tasks are selected are included in Condition Monitoring.
20509 The questions in Figure 1 are intended to determine maintenance tasks having potential effectiveness for possible inclusion in a scheduled maintenance program. However, it is probable that many of these 'potentially" beneficial scheduled tasks would not be "desirable" even though such tasks could improve reliability. This might be true when operating safety is not affected by failure or the cost of the scheduled maintenance task is greater than the value of such resulting benefits as reduced incidence of component premature removal, reduced incidence of departure delays, Additional diagrams are used to assess the "desirability" of those scheduled maintenance actions which have potential effectiveness. This is accomplished by Figures 2 and 3 of Addendum 1.
2.5.10 Figure 2 selects those tasks which must be done because of operating safety or hidden function considerations.
Figure 3 selects those tasks which should be done because of economic considerations.
2.5.11 Figure 2 assesses tasks listed against the Yes answers of questions c and d in Figure 1, and selects those tasks which must be done.
2.5.12 For the operating safety question, at least one task must be listed for each failure mode having a Yes answer to question c of Figure 1. An explanation should be given for any question c tasks not selected.
Appendix 1 For the hidden function question, normally at least one task must be listed for each hidden function having a Yes answer to Figure 1, question d. If a task is not selected, as permitted by Addendum 3, an explanation must be provided.
205014 Figure 3 assesses tasks listed against the Yes answer in Figure 1, questions (b) and (e) and selects those tasks which should be done because of economic considerations.
2.5.15 A key question in Figure 3 is the first, 'Does real and applicable data show desirability of scheduled task?"
A "Yes" answer is appropriate if there is:
(1) Prior knowledge from other aircraft that the scheduled maintenance tasks had substantial evidence of being truly effective and economically worthwhile, and The system/component configurations of the old and new airplanes are sufficiently similar to conclude that the task will be equally effective for the new airplane.
The question "Does failure prevent dispatch" refers to whether the item will be on the Minimum Equipment List (MEL).
The answer to question (b) is expected to always be Yes for engine components that cause engine failure.
The question Is elapsed time for correction of failure > 0.5 Hr. refers to whether corrective action can be accomplished without a delay during a normal transit stop.
2.5.18 When a task "requires evaluation" it is important that the frequency of the failure and the cost of carrying out the task are taken into consideration.
205019 Engine tasks are included in the Threshold Sampling maintenance program. This program is described below.
The Threshold Sampling maintenance program is intended to recognize the On Condition design characteristics of modern Turbo-Jet engines, while sampling to control reliability.
This program uses repetitive sampling to determine:
(1) The condition of engine components.
(2) The advisability for continued operation to the next sampling limit, and
(3) The next sampling limit, threshold, or sampling band.
Appendix 1
2.5.21 Initial sampling thresholds are based on:
(1) The design of the engine under study, the results of developnental testing, and prior service experience.
(2) The results of previous engine programs.
(3) The fact that samples are available from engines removed for all causes at virtually all ages. This means that knowledge of the conditions of engines is available over the complete continuum of time from start of operation to the highest time experienced, and
(4) The fact that most engine design problems become apparent and can be controlled well within any established limits or thresholds.
205022 The Threshold Sampling program establishes the initial sampling threshold. Operators are subsequently responsible for:
(1) Evaluating the samples obtained from the initial threshold
(2) Determining the next sampling threshold, and
(3) Determining the number to be sampled at the next threshold.
205023 Threshold Sampling is normally accomplished by inspecting the parts or systems of engines that are removed and accessible in the shop. These engines provide samples over a full range of ages without waiting for the threshold to be reached. The results of inspecting these samples are used to determine the future program. When samples are not available from engines that are in the shop, scheduled samples or in situ inspections may be required.
206 Program Development Administration. Regulatory Authority participation is encouraged as early and as thoroughly as possible in all phases of working group activity. It is recognized that the Regulatory Authority will later be asked to approve the proposed program resulting from these efforts. Therefore, the Regulatory Authority participation must necessarily be restricted to technical participation, contributing their own knowledge, and observing the activities of the working group. Regulatory Authority approva ol working group recommendations is not implied by the participation of Regulatory Authority members in working group sessions. The following activity phases will apply.
Appendix 1 Phase I. Steering Group general familiarization training.
Phase II. (a) Working Group or Working Activity Training.
*(b) Preparation of first draft Significant Items List. (Ref. 2.7.1) *(c) Establish functions and failure modes applicable to the Significant Items.
(a) Preparation of Figures 1 thru 5 decision diagram replies and supporting data for each system and significant item.
Phase III. (a) Evaluation of manufacturer's technical data and recommended tasks by the Working Groups' airline personnel and meeting with manufacturer to make necessary revisions and prepare task recommendations.
(b) Development of task frequency recommendations.
(This phase is meant to follow Phase III. a).
NOTE: A Steering Group member should participate in all Phase III activity.
Phase IV. Presentation to Steering Group (meeting with each Working Group or Activity Chairman).
Phase V. Preparation and presentation of the Steering Group's proposal to the Regulatory Authority.
2•7 Supporting Technical Data. The following supporting technical data will be provided in printed form, together with adequate crossreferences on the records of replies to the decision diagrams.
Maintenance Significant Items List. This list will include by ATA System, the name, quantity per airplane, prime manuracturer part number, vendor name and part number for each item considered by the Working Group/Activity to require individual analysis.
20702 Significant Items Data.
(a) Description of each significant item and its function(s).
(b) Listing of its failure mode(s) and effects.
* Steering Committee audits are required for these steps before proceeding.
Appendix 1
(c) Expected failure rate.
(a) Hidden functions.
(e) Need to be on M.E.I.
(I) Redundancy (may be unit, system or system management).
(g) Potential indications of reduced failure resistance.
20703 System Data.
(a) Description of each system and its function(s).
(0) Listing of any failure modes and effects not considered in item data.
(c) Hidden functions not considered in item data.
Appendix 1
GLOSSARY Inherent Level of Reliability and Safety - That level which is built into the unit and therefore inherent in its design. This is the highest level of reliability and safety that can be expected from a unit, system, or aircraft. To achieve higher levels of reliability generally requires modification or redesign.
Maintenance Significant Items - Those maintenance items that are judged by the manufacturer to be relatively the most important from a safety or reliability standpoint, or from an economic standpoint.
Structural Significant Items - Those local areas of primary structure which are judged by the manufacturer to be relatively the most important from a fatigue or corrosion vulnerability standpoint or from a failure effects standpoint.
Operational Reliability - The ability to perform the required functions within acceptable operational standards for the time period specified.
Effective Incipient Failure Detection - That maintenance action which will reliably detect incipient failures if they exist. That is, detect the pending failure of a unit or system before that system fails. For example, detection of turbine blade cracks prior to blade failure.
Real and Applicable Data - Those data about real, operating hardware that is similar enough to the hardware under discussion to be applicable to the design of maintenance programs for the current hardware.
Reduction in Failure Resistance - The deterioration of inherent (design) levels of reliability. As failure resistance reduces, failures increase;
resulting in lower reliability. If reduction in failure can be detected, maintenance can be performed prior to the point where reliability is adversely affected.
Function - The characteristic actions of units, systems and aircraft.
Failure Modes - The ways in which units, systems and aircraft deteriorate can be considered to have failed.
Potential Effectiveness - Capable of being effective (maintenance action) to some degree.
Routine Flight Crew Monitoring - That monitoring that is inherent in normally operating the aircraft. For example, the pre-flight check list, or the normal operation of the aircraft and its components. Does not include monitoring of "back-up" equipment that is normally not tested as a part oi a normal flight.
Failure Effects - The consequence of failure.
AIRLINE MAINTENANCE PROGRAM DEVELOPMENT MSG 2 DECISION DIAGRAM 3/27/78 FIGURE I FIGURE 2 FIGURE 3
WHICH TASKS CAN BE DONE WHICH TASKS MUST BE DONE WHICH TASKS SHOULD BE DONE QUESTIONS a, b, & c APPLY TO EACH FAILURE MODE QUESTION I APPLIES TO c TASKS QUESTION A, B, & C'APPLY TO b AND e TASKS
OF ITEM QUESTION d APPLIES TO EACH FUNCTION OF ITEM QUESTION II APPLIES TO d TASKS QUESTION • APPLIES TO ITEM AS A WHOLE IS REDUCTION IN FAILURE RESISTANCE DETECTABLE BY ROUTINE FLIGHT OF IN-FLIGHT MONITORING LIST OF MEANS Figures 1. 2. AND 3.
CREW MONITORING ?
YES NO - IN- SITU MICE IS REDUCTION IN FAILURE RESISTANCE DETECTABLE BY TASKS REF. TO RESISTANCE (CHECK, LIST ALL POTENTIAL REDUCT IN FAILURE MSG 2 DECISION DIAGRAM ADDENDUM 1 OR UNIT TEST ? INSPECT, SERVICE, ES. ETC.J.
NO
WHICH OF THE TASKS RE ADVERSE EFFECT ON DOES FAILURE MODE HAVE A DIRECT LIST ALL POTENTIAL TASKS REF. TO OPERATING SAFETY FERRING TO OPERATING SAFETY MUST BE DONE ? AT LEAST ONE TASK MUST BE DONE, EXPLAIN ANY c OPERATING SAFETY ? IS THE FUNCTION HIDDEN FROM THE VIEWPOINT OF THE FLIGHT CREW ? YES YESİ NO - (TOTAL TIME LIMITS ETC. I CHECK, INSPECT. LIST ALL POTENTIAL TASKS REF. TO HIDDEN FUNCTION (CHECK, INSPECT, FERRING TO HIDDEN FUNCTION MUST BE DONE ? AT LEAST ONE TASK MUST BE DONE EXCEPT AS PERL WHICH OF THE TASKS RE- TASKS NOT SELECTED. DATA SHOW DOES REAL AND APPLICABLE SCHEDULED TASK - DESIRABILITY OF YES-- PREVENT DISPATCH ? DOES FAILURE IS ELAPSED TIME FOR CORRECTION OF FAILURE > 0.5 HOUR ? DISPOSITION OF TASK PROGRAM RELATIVE TO • INCLUDE NOE MITTED BY APP. 3 -EVALUATION REQUIRES Appendix 1 AC 120-17A YES!
IS THERE AN AD - VERSE RELATIONSHIP PERIODIC NO -NO- •I OMIT
BETWEEN AGE AND OVERHAUL YES 'NO IOMIT NO -
AIRLINE MAINTENANCE PROGRAM DEVELOPMENT Appendix 1 AC 120-17A
STRUCTURE ANALYSIS METHOD AN INDICATION OF THE FATIGUE RESISTANCE OF THE ITEM RELATIVE TO THE FATIGUE RELATIVE TO THE FATIGUE FIGURE 4. STRUCTURE ANALYSIS METHOD
DESIGN GOAL FOR THE OVERALL AIRPLANE
FATIGUE
RESTANCE DESIGN GOAL SMALL MARGIN ABOVE! FAIR MARGIN ABOVE DESIGN GOAL CONSIDERABLE MARGIN HIGH MARGIN ABOVE ABOVE DESIGN GOAL DESIGN GOAL
CORROSION AND INDICATION OF THE RELATIVE CORROSION RESISTANCE OF THE ITEM CONSIDERING RESISTANCE BOTH EXPOSURE AND PROTECTION.
(INCL. STRESS CORROSION) LEAST MARGIN OF RESISTANCE RESISTANCE FAIR MARGIN OF CONSIDERABLE MARGIN OF RESISTANCE HIGHEST MARGIN OF RESISTANCE AND INDICATION OF THE RELATIVE ABILITY OF THE MATERIAL USED TO RESIST PROPAGATION TO BE EXECUTED FOR EACH THIS PORTION OF CHART ADDENDUM 1 CRACK OF CRACKS. ITEM WHICH HAS BEEN
PROPAGATION DESIGNATED AS &STRUC- RESISTANCE LEAST MARGIN OF FAIR MARGIN OF CONSIDERABLE MARGIN HIGHEST MARGIN OF TURALLY SIGNIFICANT"
RESISTANCE RESISTANCE OF RESISTANCE RESISTANCE (HI HEAT TREAT STEEL) (7000 SERIES ALUM) (TITANIUM) (2000 SERIES ALUM.)
DEGREE OF AN INDICATION OF THE DEGREE TO WHICH THE ITEM IS BACKED UP BY REDUNDANT STRUCTURE.
REDUNDANCY
SMALL HIGH
FATIGUE WILL THE LOADS APPLIED TO THE ITEM IN THE FULL SCALE FATIGUE TEST PROPERLY REPRESENT TEST RATING, LOADS PREDICTED FOR SERVICE USAGE? NO YES OVERALL A RATING WHICH CONSIDERS ALL THE ABOVE RATINGS AND COMBINES THEM BY IUDGEMENT THIS RATING NO. IS
RATING INTO A SINGLE OVERALL RATING WHICH REPRESENTS A RELATIVE LEVEL OF THE STRUCTURAL ASSIGNED TO ALL OTHER NUMBER INTEGRITY OF THE ITEM. PRIMARY AND SECONDARY (R) STRUCTURE WHICH IS NOT
STRUCTURALLY SIGNIFICANT 2 4 5 3/27/78
STRUCTURE DETECTABILITY EVALUATION AIRLINE MAINTENANCE PROGRAM DEVELOPMENT 3/27/78
THIS CHART CONVERTS OVERALL RATING (R) TO INTERNAL & EXTERNAL CLASS NUMBERS INTERNAL EX. CLASS EX. CLASS FIGURE 5. STRUCTURE DETECTABILITY EVALUATION CLASS NO. NO. NO.
IF>10 ABOVE GROUND IF 10CABOVE GROUND
IN NON FUEL AREA OR IN FUEL AREA
STRUCTURALLY SIGNIFICANT ITEMS (EX) EXTERNAL ITEMS NONE R+1 (IN) INTERNAL ITEMS : ADDENDUM 1
• HIGH PROBABILTY OF EXTERNAL DETECTABILITY OF ITEM'S CONDITION BY FUEL LEAK OR VISUAL CONDITION OF ADJACENT EXTERNAL ITEM R+1
• LOW PROBABILITY OF DITTO R
• NO EXTERNAL DETECTABILITY OF ITEM'S CONDITION SINCE
NO ADIACENT ITEMS ARE VISIBLE EXTERNALLY R NONE NONE
ALL OTHER PRIMARY OR SECONDARY STRUCTURAL ITEMS WHICH ARE NOT STRUCT. SIGNIFICANT (EX) EXTERNAL ITEMS NONE 5 Page 23 EXTERNAL MEANS THERE IS VISUAL (IN) INTERNAL ITEMS INTERNAL MEANS THERE IS VISUAL 5 • • WHERE VISUAL ACCESSIBILTY NONE NONE Appendix 1 AC 120-17A
ACCESSIBILITY WITHOUT DETACHING ANY ACCESSIBILITY ONLY BY DETACHING EXISTS SIMPLY BY REMOVAL OF AN PARTS (INCL. ACCESS PANELS | FROM REMOVABLE PARTS OR BY RADIOCRAPHIC ACCESS PLATE AND NO ADDITIONAL
THE AIRPLANE, AND INCLUDES CONTROL MEANS DETACHMENT OF PARTS IS NECESSARY
SURFACE DEFLECTION AS REQUIRED TO GAIN VISUAL ACCESS
Appendix 1 ADDENDUM 2 The following elaborates on the term &direct and adverse effect on operating safety."
During the design process considerable attention is given to system and component failure effect analysis to ensure that failures that result in loss of function do not immediately jeopardize operating safety. In many cases, redundancy can cause the consequences of a first failure to be benign. In other cases, protective devices serve this purpose. Although it may not be possible to continue to dispatch the airplane without correcting the failure and although it may indeed be desirable to make an unscheduled landing after failure, the failure cannot be considered to have an immediate adverse effect upon operating safety. The inclusion of the word direct in the phrase 'direct adverse effect upon operating safety" means an effect which results from a specific failure mode occurring by itself and not in combination with Certification requirements ensure that a transport category aircraft has very few failure modes which have a direct adverse effect upon operating safety.
Appendix l ADDENDUM 3
EXPLANATION OF HIDDEN FUNCTIONS A component is considered to have a "hidden function" if either of the following exists:
1. The component has a function which is normally active whenever the system is used, but there is no indication to the flight crew when that function ceases to perform.
2. The component has a function which is normally inactive and there is no prior indication to the flight crew that the function will not perform when called upon. The demand for active performance will usually follow another failure and the demand may be activated automatically or manually.
Examples of components possessing hidden functions exist in a bleed air system. A bleed air temperature controller normally controls the bleed air temperature to a maximum of 400°F. In addition, there is a pylon shutoff valve which incorporates a secondary temperature control, should the temperature exceed 400°F. A duct overheat switch is set to warn the flight crew of a temperature above 480°F, in which event they can shut off the air supply from the engine by actuating the pylon shutoff valve switch. There is no duct temperature indicator.
The bleed air temperature controller has a hidden active function of controlling the air temperature. Since there is a secondary temperature control in the pylon valve and since there is no duct temperature indicator, the flight crew has no indication of when the temperature control function ceases to be performed by the temperature controller. Also, the flight crew has no indication prior to its being called into use that the secondary temperature control function of the pylon valve will perform. Therefore, the pylon valve has a hidden inactive function. For a similar reason, the duct overheat warning system has a hidden inactive function. And the pylon valve has a hidden inactive function (manual shutoff) since at no time in normal use does the flight crew have to manually close the valve.
The hidden function definition includes reference to ino indications to the flight crew" of performance of that function. If there are indications to the flight crew, the function is evident (unhidden). However, to qualify as an evident function, these indications must be obvious to the flight crew during their normal duties, without special monitoring (bear in mind, however, that special monitoring is encouraged as a part of the maintenance program to make hidden functions into evident ones).
It is recognized that, in the performance of their normal duties, the flight crews operate some systems full time, others once or twice per flight, and others less frequently. All of these duties, providing they are done at some reasonable frequency, qualify as "normal." It means, for example, that although an anti-icing system is not used every flight it is used with Page 25
Appendix 1 sufficient frequency to qualify as a "normal" duty. Therefore, the antiicing system can be said to have an evident (unhidden) function from a Ilight crew's standpoint. On the other hand, certain "emergency" operations which are done at very infrequent periods less than once per month) such as emergency gear extension, fuel dump actuation, etc., cannot be considered to be sufficiently frequent to warrant classification as evident (unhidden) functions.
The analysis method requires that all hidden functions have some form of scheduled maintenance applied to them. However, in those cases where it may be difficult to check the operation of hidden functions, it is acceptable to assess the operating safety effects of combined failures of the hidden function with a second failure which brings the hidden function failure to the attention of the flight crew. In the event the combined failures do not produce a direct adverse ellect on operating safety, then the decision whether to apply maintenance to check the pertinent hidden function becomes an economic decision to be considered by Figure 3 of Addendum 1.
Note also, in some cases, it is acceptable to accomplish hidden function checks of removable components during unscheduled shop visits, providing the component has at least one other function which when failed is known to the flight crew and which causes the unit to be sent to the shop. Also, the hidden function failure mode should have an estimated reliability well in excess of the total reliability of the other functions that are evident to the flight crew.
MU.S. GOVERNMENT PRINTING OFFICE: 1978-261-264/82 Page 26