2 Chapter Development of Maintenance Programs —_ Introduction ‘The maintenance programs currently in use in commercial aviation were devel- ‘oped by the industry using two basic approaches: the process-oriented approach and the task-oriented approach. The differences in these two methods are twofold: (a) the attitude toward maintenance actions and (b) the manner in which maintenance actions are determined and assigned to components and sys tems. Although the commercial aviation industry has recently gone to the task- oriented approach for the most recent airplane models, there are many older airplanes still in service whose maintenance programs were developed by the process-oriented approach. In recent years, McDonnell-Douglas (now part of Boeing) and Boeing have developed new task-oriented maintenance programs for some of these older model aircraft. The operators can purchase these new programs from the manufacturer. ‘The process-oriented approach to maintenance uses three primary mainte- nance processes to accomplish the scheduled maintenance actions. These processes are called hard time (HT), on-condition (OC), and condition monitor- ing (CM). The hard time and on-condition processes are used for components or systems that, respectively, have definite life limits or detectable wear out peri- ods. These are the items in categories A, B, and C discussed in Chap. 1 and illus- trated in Table 1-1. The condition monitoring process is used to monitor systems and components that cannot utilize either the HT or OC processes, These CM items are operated to failure and failure rates are tracked to aid in failure pre- diction or failure prevention efforts. These are the “operate to failure” items in categories D, E, and F of Table 1-1. ‘The task-oriented approach to maintenance uses predetermined maintenance tasks to avoid in-service failures. Equipment redundancies are sometimes used 616 Fundamentals of Maintenance to allow in-service failures to occur without adversely etenhine ay a ore ation. A reliability program is usually employed (similar to, ot olaborelg than, the OM process) for those components or systems whose 1 UY Tt not predictable and for those that have no scheduled mat ‘ Reliability is discussed in Chap. 19. . Both oft these maintenance eilseeeies _the process oriented and ee task oriented—are discussed in general below along with the basic ies 10K ‘ a erating the program. How the maintenance tasks and task intervals are deter mined will be discussed in detail in later sections. ‘The Maintenance Steering Group (MSG) Approach ‘The Boeing Company started the modern approach to maintenance program development in 1968 with the Bocing 747 airplane, then the largest commer. cial airplane. It was the start of a new era in aviation, the era of the “jumbo jets” and the company felt that this new era should begin with a more sophisticated approach to maintenance program development. They organized teams of rep- resentatives from the Boeing Company's design and maintenance program groups along with representatives from the suppliers and the airlines who were interested in buying the airplane. The FAA was also included to insure that reg- ulatory requirements were properly addressed. The process used involved six industry working groups ([WGs): (a) struc- tures; (b) mechanical systems; (c) engine and auxiliary power plant (APU); (d) electrical and avionics systems; (e) flight controls and hydraulics; and (f) zonal. Each group addressed their specific systems in the same way to develop an idequate initial maintenance program. Armed with information on system oper- ation, maintenance significant items (MSIs) and their associated functions, fail. ure modes, failure effects, and failure causes, the group analyzed each i using a logic tree to determine requirements, Tee, oa ‘This approach to maintenance program development was called a “bi approach because it looked at the:s Development of Maintenance Programs’ ~ 17 TABLE 2-4 MSG-2 Process Steps Step number for System/comp Structure agi Analysis activity 1 1 Identify the systems and their significant items 1 Identify significant structural items Identify their functions, failure modes, and failure reliability 2 Identify failure modes and failure effects 2 Identify their functions, failure modes, and failure effects: 3 3 Define scheduled maintenance tasks having potential effectiveness relative to the control of ‘operational reliability 3 ‘Assess the potential effectiveness of scheduled inspections of structure 4 4 Assess the desirability of scheduling those tasks having potential effectiveness Assess the desirability of thove inspections of structure ‘ which do have potential effectiveness Determine that initial sampling thresholds were appropriate Sounce: Airline/Manufacturer Maintenance Program Document MSG-2: R&M Subcommittee, Air Transport Association; March 25, 1970. Step 1, identify the maintenance or structure items requiring analysis. Step 2, identify the functions and failure modes associated with the item and the effect of a failure : Step 3, identify those tasks which may have potential effectiveness. Step 4, assess the applicability of those tasks and select those deemed nec- essary. - Step 5, for structures only, evaluate initial sampling thresholds. ‘The process flow diagram in the MSG-2 document is too complex to repeat here, especiallly since the MSG-2 process is no longer used. It is important, however, to understand how the maintenance processes were assigned to the tasks selected. Figure 2-1 is a simplified diagram of that process. Briefly, if failure of the unit is safety related (block 1) and there is a maintenance check available to detect a reduction in failure resistance (block 4), then the item in question is iden- tified as on-condition. If no such check is available, then the item is classified as hard time. The student can follow the logic of Fig. 2-1 for the other conditions. Once the maintenance action was determined, it was necessary to define how often such maintenance should be done. Available data on failure rates, removal rates, etc. of the item were then used to determine how often the maintenance should be performed. 4* Fundamentals of Maintenance ‘241. Simplified MSG-2 flow chart. riented Maintenance Process-oriented maintenance programs are developed for aviation using deci- "sion logic procedures developed by the Air Transport Association of America _ (ATA). The MSG-2 process is a bottom up approach whereby each unit (system, — ponent, or appliance) on the aircraft is analyzed and assigned to one of the maintenance processes, HT, OC, or CM. 3 neral, hard time means the removal of an item at a predetermined inter- usually specified in either so many flight hours or so many flight cycles. [1 hard time interval may be incalendar time, On ere micn, a be checked at specified intervals (in hours, eycles, or ts remaining serviceability, ion monit lure rates, removal rates, ete. to detail.Development of Maintenance Programs #9 (restored), or discarded before exceeding the specified interval. The hard time interval may be specified by calendar time, by engine or airplane cheek inter val (engine change, “C” check, etc.), by landing or operating cycles, by flight hours, by block hours, by specified flights (over water, terminating, etc.), or n conjunction with another process (OC for instance) ‘When HTT is specified, the component will be removed from the vehicle and overhauled, restored, or discarded, whichever is appropriate. This will be done before the component has exceeded the specified time interval. The component overhaul or restoration will restore the component to a condition that will give reasonable assurance of satisfactory operation until the next scheduled removal. Ideally, hard time would be applied to a component that always fails at X hours of operation. This component would then be replaced at the last scheduled main tenance period prior to the accumulation of X hours; thus the operator would get maximum hours out of the component and the component would never fail in service (ideally). Hard time is also applied to items having a direct adverse effect on safety and items subject to reliability degradation with age but having no possible main- tonance check for that condition. The former components, as we will see later, tare not eligible for condition monitoring because of the safety issue. The latter components, such as rubber products, do not lend themselves to any periodic check for condition; i.e., there is no OC check to determine how much servicea. bility is remaining. ‘As an example, structural inspection, landing gear overhaul, and replacement of life-limited engine parts are all controlled by hard time. Frequently, mechan- jcal linkages and actuators, hydraulic pumps and motors, electric motors and gen erators, and similar items subject to a definite wear-out cycle will also be identified as hard time. For items having clearly defined wear-out periods, hard time is probably the most economical process. However, these items can also be OC or CM, depending on the operator, as long as they are not safety related. The on-condition (OC) process ‘On-condition is a failure preventive process that requires that the item be peri- odically inspected or tested against some appropriate physical standard (wear or deterioration limits) to determine whether or not the item can continue in service. After failing an OC check, the component must be overhauled or restored to the extent of at least replacing out-of-tolerance parts. Overhaul or repair must restore the unit to a condition that will give reasonable assurance of sat- isfactory operation for at least one additional OC check interval. If the item’ cannot be overhauled or restored, or if it cannot be restored to a condition where it can operate one more OC check period, then it should be discarded. On-condition must be restricted to components, equipment, or systems on which a determination of continued airworthiness may be made by measure- ments, tests, or other means without doing a tear-down inspection. These on-condition checks are to be performed within the time limits (intervals) pre- scribed for each OC check. On-condition determination of continued airworthiness_— oo Fundamentals of Maintenance limits which must ces and/or Wea ‘ed toleran' Is. See eaningful determi. must const her scheduled OC check mation regarding the nable assurance of its jtem is properly cat- is a “quantifying” check with specifi be set forth in the operator's maint ‘The periodically scheduled OC checks must c nation of suitability for continued opetalio” © itor Tataeval, If the check performed provides enough intr vndition and failure resistance of the item 1 giver ck period, the continued airworthiness during the next check period, the Mjintenance task— egorized as on-condition. If the check constitutes merely inati is not making a c i to determination—and 16 no” SENG ee ele mn, the item is, in fact, operating as a con- meaningful disclosure of actual conditio oper oe dition monitored item. It should be classified as CMand si 00 nae {t could even be classified as HT. A simple operational chi able requisite for the on-condition process. On-condition checks must measure aon salwate the wear andor deterioration condition of the item. s ‘The on-condition process also encompasses periodic collection of data that will reveal the physical condition of a component, system, oF engine. ‘Through analy- ere t ee divation, OC data must be ablo to ascertain continued airworthinesd a ina evrevioration of failure resistance and imminence of failure. On-condi- tae data must be directed to an individual component, system, or engine (by torial number), Tt is a priori (before the fact) failure data that can be used to seraaure decreasing life expectancy and/or predict failure imminence. Examples: BLOC checks are as follows: (a) tire tread and brake linings, (6) scheduled borescope inspections of engines, (c) engine oil analysis, and (d) in-flight engine Performance analy. engine cndion monitoring or ECM). In each of the above stated cases, one can measure degradati lished norms how much life or tenia detormine, roma fost of the commercial airplan eB casa cern ei open in United Sain a aay fests Gis ic ved on engine daa collected by on ECM aera Showing engine performance degradation, such as oil ay ECM program. Data borescope inspection results, trends in recorded 28 oil and fuel consumption, oil analysis, etc. are compared to standards to in-flight instrument readi bility and failure imminence. Engine data predict decreasing engine - indicate the need to remove engines RES they are failure preventive processes points Berens about the on-conditi on check can be i ilits tint the next OG chee ensure 3 » or if evaluation of the Process lure imminence, then the OCe Development of Maintenance Programs 21 to operational conditions and crew habits, but the wear indicator pin OC check will help attain near maximum usage out of each set of brakes 2. Control cables: Measure these for diameter, tension, and broken strands. 3. Linkages, control rods, pulleys, rollers tracks, jack screws, etc.: Measure these for wear, end or side play, or backlash. The condition monitoring (CM) process ‘The condition monitoring process is applied when neither the hard time nor the on-condition process can be applied. The CM process involves the monitoring of the failure rates, removals, ete. of individual components or systems that do not have a definite lifetime or a noticeable wear-out period. Condition monitoring is not a failure preventive process as are HT and OC. There are no maintenance tasks suitable for evaluating the life expectancy of the CM item and there is no requirement to replace the item before it fails. Neither time nor condition stan- dards can be used to control CM items because these components do not have. such attributes. Therefore, CM components are operated until failure occurs and replacement of CM items is an unscheduled maintenance action. Sifce CM items are operated to failure, the ATA states that these items must comply with the following conditions: 1. ACM item has no direct, adverse effect on safety when it fails; ie., the air- craft continues to fly to a safe landing. Generally, CM items have only this, indirect, nonadverse effect on safety due to system redundancy. 2. ACM item must not have any “hidden function” (.e., a malfunction that is not evident to the crew) whose failure may have a direct adverse effect on safety. However, if there is a hidden function and the availability or opera- tion of that hidden function is verified by a scheduled operational test or other nonmeasurement test made by the flight crew or maintenance crew, CM. can still be used. 3. ACM item must be included in the operator's condition monitoring or relia- bility program; that is, there must be some sort of data collection and analy- sis for those items for maintenance to get a better understanding of the nature of failure for those components or systems. In addition to the above ATA stipulations, CM items usually have no adverse relationship between age and reliability (1e., no predictable life expectancy). They exhibit a random failure pattern. ‘The most appropriate application of the condition monitoring process is to complex systems, such as avionics and electronics components, and to any other components or systems for which there is no way to predict failures. Typical * Airline/Manufacturer Maintenance Program Development—MSG-2; R&M Subcommittee of ATA, March 25, 1970. (Note: This document is no longer kept up to date by ATA.)22 Fundamentals of Maintenance components and systems suitable for CM include navigation and commun tions equipment, lights, instruments, and other items where test or replacement will not predict approaching failure nor result in improved life expectancy. In aviation, CM is frequently applied to components where failure has no serious effect on safety or airworthiness, due to redundancy, and to items not affecting airworthiness at all, such as coffee makers, lavatories, passenger entertain. ment systems, ete . Condition monitoring systems consist of data collection and data analysis procedures that will portray information upon which judgments relative to the safe condition of the vehicle can be made. A CM program includes those kinds of evaluation programs that utilize the disclosure capabilities of the airplane or its systems and components to the degree that such disclosure information can be used to make judgments relative to the continuing safe condition of the air- plane, its systems, engines, and components. Evaluation based on reports by flight crews, on-board data systems, and equipment for ground check of system performance may be used for CM actions. The basic elements of a CM program may include data on unscheduled removals, maintenance log entries, pilot reports, sampling inspections, mechanical reliability reports, shop findings, and other sources of maintenance data. These and other data may indicate a problem area and thus the need to investigate the matter (see Chap. 19). Condition monitoring, which is primarily a data collection and analysis pro- gram, can also be used on HT and OC components for verifying or adjusting the HT and OC intervals. For example, if a hard time item is removed just prior to its expiration date and overhaul activities reveal that little or nothing needs to be done to restore the component, then perhaps the HT interval can be extended. Likewise, if OC checks reveal little or no maintenance requirement or that the lifetime of the component is longer than originally expected, the OC check inter. val can be changed. However, without the collection of data over a period of time (several HT periods or OC intervals), there would not be any solid justification to change the intervals. By the same token, CM data collection may indicate that the HT or OC intervals need to be shortened for some components. The CM pro gram also provides data to indicate whether or not components are being imag. itored under the most appropriate process, ing mon- tor the component's condition with the on-condition process.e Development of Maintenance Programs 23, ‘The MSG-3 technique is a “top down” or “consequence of failure” approach whereby failure analysis is conducted at the highest manageable level of air- plane systems instead of at the component level as in MSG-2. The MSG-3 logic is used to identify suitable scheduled maintenance tasks to prevent failures and to maintain the inherent level of reliability of the system. There are three cate- gories of tasks developed by the MSG-3 approach: (a) airframe systems tasks, (6) structural item tasks, and (c) zonal tasks. Maintenance tasks for airframe systems Under the MSG-3 approach, eight maintenance tasks have been defined for airframe systems. These tasks are assigned in accordance with the decision analysis results and the specific requirements of the system, component, ete. under consideration. These eight tasks are listed and defined below: 1. Lubrication. An act of replenishing oil, grease, or other substances used for the purpose of maintaining the inherent design capabilities by reducing fric- tion and/or conducting away heat. 2. Servicing. An act of attending to basic needs of components and/or systems for the purpose of maintaining the inherent design capabilities. 3. Inspection. An examination of an item and comparison against a specific standard. 4. Functional check. A quantitative check to determine if each function of an item. performs within specified limits. This check may require use of additional equipment. 5. Operational check. A task to determine if an item is fulfilling its intended pur- pose. This is a failure-finding task and does not require quantitative toler- ances or any equipment other than the item itself. 6. Visual check. An observation to determine if an item is fulfilling its intended purpose. This is a failure-finding task and does not require quantitative tol- erances. 17, Restoration. That work necessary to return the item to a specific standard. Restoration may vary from cleaning the unit or replacing a single part up to and including a complete overhaul. ! 8, Discard. The removal from service of any item at a specified life limit. ! = *24 Fundamentals of Maintenance ay be time depen- climate or environment. Environmental deteriorations may dent. used by contact 2, Accidental damage. The physical deterioration ofan eae ab ae gr impact with an object or influence that is no! Part oe actureonte damage as a result of human error that occurred during ration of the vehicle, or performance of maintenance ecina cl jin 9, Fatigue damage. The initiation of a crack or cracks due to cyclic loading subsequent propagation of such cracks Inspection of airplane structures to determine if deterioration due to eS Be eieetarrel requires varying degrees of detail. The ‘MSG-3 process oead three types of structural inspection techniques as follows: 1. General visual inspection. A visual examination that will detect obvious, canatisfactory conditions or discrepancies. This type of inspection may require removal of fillets or opening or removal of access doors OF panels. Work stands and ladders may be required to facilitate access to some com- ponents. i 2, Detailed inspection. An intensive visual inspection of a specified detail, assem- ply, or installation. It is a search for evidence of irregularity using adequate Iighting and, where necessary, inspection aids such as mirrors, hand lenses, ote, Surface cleaning and detailed access procedures may also be required. 3, Special detailed inspection. An intensive examination of a specific location. It ig similar to the detailed inspection but with the addition of special tech- niques. This examination may require techniques such as nondestructive inspections (NDI) dye penetrant, high-powered magnification, magnetic par- ticle, eddy current, etc. (see Chap. 18 for details on these test methods.) The special detailed inspection may also require the disassembly of some units. Zonal maintenance tasks ‘The zonal maintenance program ensures that all systems, installations contained within a specified zone on sha gehislo sien weds surveillance to determine the security of installation and general conditior ‘The program packages a number of general visual inspection tasks, od "against items in the system’s maintenance program, into one o pense ieee tote: Ls 3x more zonal , MSG-2 process was modified in 1980 in a docume 5 ess. din, ent released by the Hebertation ot America” The document staisa ¢MGCeevaintae ‘ * Development Document; issued September 30, Program September 1993; March 2000; and March 2001 ifacturer Scheduled Maintenance Development, revision 2000. c ie.Development of Maintenance Programs ~ 25 a Eel sg | ese, | [roca ay ae I Evident Failures — (A) Hidden Failures — (B) ee Re Se Cor ty of Air Transport Association of America, Inc. ssion. Copyright © 2003 by Air Transport Association of America, Ine. All rights resevoed y Figure 22 MSG-3 — level 1 Reprinted with per constitute a fundamental departure from the previous version, but was built upon the existing framework of MSG-2 which had been validated by 10 years of reliable aircraft operation using thé maintenance programs based thereon.” The MSG-3 program adjusted the decision logic to provide more straightfor- ward and linear progression through the logic. The MSG-3 Process is a top- down approach or consequence of failure approach. In other words, how does the failure affect the operation? It does not matter whether a system, subsystem, or component fails or deteriorates. What matters is how the failure affects the aireraft operation. The failure is assigned one of two basic categories: safety and economic. Figure 2-2 is a simplified diagram of the first step in the MSG-3 logic process. * Each block in Fig. 2-2 is numbered. The numbers on the output block (6 through 9) are used later to identify the category ofthe failure (hidden, evident, safety, etc)."These numbers will be ret- erenced later in this discussion,26 Fundamentals of Maintenance 5G.3 approach may include e MSG-2 “fg similar to those of he MSG-3 approach is .e program. The flow chart dent to the flight crew or at are evident are further ‘The maintenance tasks resul hard time, on-condition, and condition MSG-2, but they are not referred to by those te more flexible in developing the overall maintenance of Fig. 2-2 is used to determine if the eT oat hidden from them (level I analysis). ‘Those failures or separated into safety related and operationally related with one elt int vere that are eqcnomic significance and those that are ot, 1 O°8s ae aaa numbered 5, 6, and 7. The significance of these categories Will be addressi later. Those failures that are determined to be hidden from the crew are divided into safety related and nonsafety related items. These are designated as cate- gories 8 and 9, 7 A Figures 2-3 and 2-4 (level II analysis) are used to determine the maintenance tasks required to accommodate the functional failure. Although the questions fare similar, there is a slight difference in the way evident and hidden failures are addressed. Note that some of the flow lines in Figs. 2-3 and 2-4 are identi- fied as Cat 5 or Cat 8 only. This requires some explanation.e Development of Maintenance Programs 27 2 penton Check ca tony Somerton: cxttony EEE: Reso Ssiale hidden failures. (Courtesy of Air Transport Association of America, Inc. Figure 24 MSG-3 — level II analysis — ‘Transport Association of America, Inc. All rights reserved.) Raprinted with permission. Copyright© 2003 by Air ‘The first question in each chart, regarding lubrication or servicing, must be asked for all functional failures (categories 5 through 9). Regardless of the answer to this question (Yes or No) the analyst must ask the next question. For categories 6 and 7 in Fig. 2-3 and category 9 in Fig, 2-4, the questions are asked in sequence until a Yes answer is obtained. At that point the analysis stops. For categories 5 and & (safety related), however, all questions must be answered regardless of the Yes or No response to any of them. ‘The last block of Figs. 2-3 and 2-4 also requires some explanation. These flow charts are used for the development of a maintenance program for a new air- sraft or derivative. If progression through the chart ends up in this block for cat- egories 6, 7, and 9, then a redesign on the equipment involved may be considered by the design engineers. However, ifthe item is safety related—categories 5 or $_then a redesign is mandatory. Once the initial maintenance program is developed, the airline mechanies will use that program. Mechanics do not have the option of redesign unless that is indicated by the reliability program as dis- cussed in Chap. 19.28 Fundamentals of Maintenance tep explana. ‘The MSG-3 process can be best understood through & se an workiaa tion of what the working groups would do for a given analyst S87 Ft ott troup will receive information about the systems and componen’ Wir Ti respective groups: (a) the theory of operation; (b) a descrip' i \des of each oper- ofeach mode (if there is more than one mode); (c) the fellas se Be ational mode; and (d) any data available (actual or est rates, removal rates, etc. [such as mean time between failures or ong mean time between unscheduled removals (MTBUR) for repairable parts; mean time to removal (MT'TR) for nonrepairable parts] 5 If the system is the same as, or similar to, that used on an exi craft, the group members may only need refresher training on the operation on the failure modes. If the equipment is new, or has been extensively modified for the new model aircraft, the learning process may take a little more time. The airframe manufacturer is responsible for providing this training to the work- ing groups. The manufacturer is also responsible for furnishing any available performance and failure rate data to the working groups. Once the group assimilates this information, they begin to run through the logic diagrams, answering the questions appropriately, and determining the maintenance approach that best suits the problem. Each failure in each oper- ational mode is addressed. The working group first determines if the failure is hidden to the crew or is obvious (block 1 of Fig. 2-2). Then they determine whether or not the problem is safety related and, in the case of evident failures, whether or not it has operational impact. Next, they determine which mainte- nanee tasks should be applied using Figs. 2-3 and 2-4 (level II analysis), and finally, the group determines at what maintenance interval that task should be performed. This latter exercise makes use of the failure rate data as well as the experience of the working group members. isting model air- ation and ‘The Maintenance Program Documents ‘The result of the MSG-3 analysis constitutes the original maintenance progra for the new model aircraft and the program that is to be used by a new opera, tor of that model. The tasks selected in the MSG proce: i airframe manufacturer in an FAA approved document called Seen review board (MRB) report. This report contains the initial scheduled mainte. hance program for U.S. certificated operators. It is used by those operators to establish their own FAA approved maintenance program as identified by che, operations specifications (see Chap. 4). ae ‘The MRB report includes the systems and power plant maintenance pro- the structural inspection program, and the zonal inspecti¢ struc i ; ion contains aircraft zone diagrams, a glossary, and alist of abbreviations anal