ACNO:12&17A DATE:March 27,

1978

ADVISORY

I--..,

a;....L.

.-r-.*Lc

._.

MATNTFNANCF CQ$J-ROI RFI IAgll ITY MFTtjODS RY

DEPARTMENT OFTRANSPORTATION
FEDERAL AVIATION ADMINISTRATION

Initiated

by:

Al%-230

4 OF TQb.. 8 %PA 2 LF 0 B c

AC no: IIATI:

l20-17A
3/27/78

SAotd b0B %rrs

ADVISORY CIRCULAR

DEPARTMENT OF TRANSPORTATION
FEDERAL AVIATION ADMINISTRATION SUBJECT: MAINTENANCE CONlROLBYREUX3ILITYMEXHODS
1. PuFmSE. Ihis circular provides information and guidance material which may be used to design or develop maintenance control programs utilizing reliability control methods. 2. cANmumoN. canceled.
3.

Advisory Circular 12047, dated December31, 1964, is

REFERENCES. !this circular is appropriate for guidark of certificate holders who operate aircraft in accordance with Federal Aviation Regulations, Parts 121 and 127.

A: A. FERRARESE 'Acting Director i/Flight Standards Service

Initiated

by:

AR%230

3/27/78

AC 120~17A TABLEOFCONTENTS Page No.

CHApTEFl INTRODUCTION. 1. 1. Purpose. 2. Authority. 3. Background. 4.-12. RESERVED. FUNDWENTALS. CHAPTEE RELIABILJYYCONTROL 2. General. 13. 14. Primary Maintenance Bocesses. Control Systems. 15. Reliability h-24. RESEWED. cHAm PROGRAM ADMINISTRATION. General. 26. Reliability Program Document. 27.-34. RE9FW'ED.
25.

1 1 1 1 2 13 13 13
14 19 25 25 25 26

3.

CHAPTER PROGRAM 4. APPROVAL. 35. Initial Approval. 36. Revision Approval. IaTlmuNCEPROGRAM APPxzJDlx1. AIRLINE/MANUFACTURERMA PLANNINGIXXUMEW-MSG-2 (26 pages)

Page iii

AC 120~17A

&

CHAPTER 1.

INTROIUCTICN

1. PURPOGE.This publication provides information on the application of reliability control methods as an integral part of an approved aircraft maintenance program for operators subject to the provisions of Federal Aviation Regulations,Parts 121 or 127. a. Its primarv objective is to provide guidance for development of programs using reliability techniques. It expresses Federal Aviation AcSnistration practice with regard to control programs utilizing these techniques. b. This circular encompasses the information and criteria contained in its predecessor, AC l2&17, Handbookfor Maintenance Control by Reliability Methods. It combines this with information and criteria for the conditionmonitoring procesg formerly wblished in FAAHandbook8310.&A. The Airline/ Manufacturer Maintenance Program Planning Document- MSG-2, which establishes the criteria for classifying maintenance processes,is included as Appendix 1. 2. AUTHORITY. The basis for federal regulation of aircraft maintenance is in section 601(a)(3) of the Federal Aviation Act of 1958. For air carriers and commercial operators subject to FARParts 121 or 12'7, this authority is exercised through Federal Aviation Regulations, sections 121.25(b)(6), 121.45(b) (61, and 127,13(b)(7), which require that operations specifications for contain time limitations, .or standards for determining time limitations, overhauls, parts retirement, inspections, replacements, and checks of airframes, engines, propellers, rotors, appliances, and emergency equipment. 3. BACKGRCUND.

a. The first generation of formal air carrier maintenance programs was based on the belief that each functional part of a transport aircraft needed Time limitations were established for periodic disassembly inspection. servicing, checks and inspections, and the entire aircraft was periodically disassembled, overhauled, and reassembled in an effort to maintain the highest level of safety. This was the origin of the first primary maintenance process discussed in this publication and referred to as llHard-Time.l' b. As the industm grew, matured, and adopted more complex aircraft, literal application of the "Hard-Time" primary maintenance process became obsolete. The industry cameto realize that each component and part did not require scheduled overhaul on a fixed time basis, and a second primary maintenance process evolved, referred to as qlC&Condition.lt It is assigned to components on which a determination of continued airworthiness can be made by visual inspection, measurements, tests or other meanswithout disassembly, inspection or overhaul.

hii3

Chap 1 Par 1

Page 1

AC 12G17A

3/27/78
i

C. Federal Aviation Administration (FAA) control of these programs was accomplished by dndividual approval of the hard-time or on-condition check periods for the aircraft, engdnes, and components. The procedures used to adjust these periods were awkward and burdensome, often inhibiting logical adjustment. To alleviate this situation, the FAAworked with the airlines to develop more responsive methods of controlling maintenance without sa(3r rificing safety or FAAregulatory responsibility. This method of control was oriented toward mechanical performance rather than to predi&.ng failure wear out points, as was the case in the previous methods. The new method was entitled Veliability control" because its major emphasis was toward maintaining failure rates below a predetermined value; i.e., an acceptable level of reliability. d. The snalvticalnature of reliabiUty control disclosed and emphasized the existence of componentssnd systems that did not respond to the hardtime or on-condition processes. This led to a third process whereby no services or inspections are scheduled to determine integrity or serviceability. However, the mechanical performance is monitored and analyzed, but limits or mandatory action are not prescribed. This process is entitled Vondition-Monitoring,"
4.-12.

RESERVH).

Page 2 (thru 12)

Chap 1 par3

Ac 12047~
cHAPTER2. RELIABlLCTYCCNTRClG FUNDAMENTALS 13. GEKERAL. a. It is intended that characteristics of each operator, i.e., philosophy, consideration of operational and environmental factors, recordkeeping systems, etc., be reflected in his own program. The extent and scope of each operator's application of reliability control is defined in his reliability program document. b. progr~* There are four general categories of an operator's (1) (2) Systems/components. Power@ants/components. Aircraft/engine Structural checks and inspections. maintenance

(3)
(4)

inspection/overhaul.

c. All four may be controlled by a composite program, or each may be handled individually. The program can encompassa select group of items from a category without affecting other controls for the remaining items of that category. For example, the basic engine might be maintained by a program that does not include its accessories. The accessories could be on another program or they could be under traditional operations specifications control. d. Statistical analvsis is most effective in its application to systems and componentsbecause the occurrence of failures can be readily reduced to meaningful statistics. Whenalert rates are used in the analysis, graphic charts (or equivalent displays) show areas in need of corrective action. Conversely, statistical analysis of inspection findings or other abnormalities related to aircraft/engine check and inspection periods requires judgmental analysis. Therefore, programs encompassingaircraft/engine check or inspection intervals might consider numerical indicators, but sampling inspection and discrepancy analysis would be of more benefit. L!+. PRIMARYMAINTlQ?ANCE PROCESSES. three primary maintenance processes The utilized by maintenance programs are (1) hard-time, (2) on-condition, and (3) condition-monitoring. a. Following are general descriptions of the three maintenance processes. Each program should include specific definitions of the processes it uses and how they are applied. Refer to appendix 1 (MSG-2) and Advisory Circularl21-lA for further definition of maintenance processes.

Chap 2 Par 13

Page 13

Ac 12s17A

3/27/78

(1) Hard-Time (HT). This is a preventive primary maintenance process. It requires that an appliance or part be periodically overhauled in accordance with the carrier's maintenance manual or that it be removed from service. (2) C&Condition (CC). This is a preventive primary maintenance process. It requires that an appliance or part be periodically inspected or checked against some appropriate physical standard to determine whether it can continue in service. The purpose of the standard is to remove the unit from service before failure during normal operation occurs. (3) Condition-Monitoring (CMl. This is a maintenance process for items that have neither "Hard-Time" nor "Cn-Conditionl' maintenance as their primary maintenance process. CMis accomplished by appropriate means available to an operator for finding and solving problem areas. The detailed requirements for the condition-monitoring process are included as appendix 1 to this circular. b. Comnlex (multicell) units may be subject to control by two or even all three of the primary processes. The predominant process will determine its classification. For example, the B-747 Modular Package- Stabilizer Control has CM assigned as its primary maintenance process by the MRRreport, but a leakage check, which is a conventional CC task, is also specified. C. The basic engine has characteristics maintenance processes. that involve all three primary

(1) Programs that control engine major overhaul intervals consider The overhaul standards are specified by the engine as a hard-time unit. overhaul manuals or other publications that do not identify individual processes as such. 2) Programs controlling shop maintenance to a "conditional" standard t restoration, etc.,) may classify the engine as on-condition or as conditionlnonitoring depending on the characteristics of the program. The applicable maintenance processes and their intervals should be designated in appendix l), discusses (or referenced by) the program document. MSG2 (ref: the analysis method for assigning maintenance processes. This method was used in the maintenance review board activity for the engines of the widebodied jets. This analytical method, in conjunction with service experience, can be applied to earlier engines. 15. RELIAEUITY CCNTRQl SYSTEMS. 'cal systems used in reliability control are: (1) data collection, ""p" data analysis, (3) corrective action, (2 (4) performance standards, (5) data display and report, (6) maintenance The intent interval adjustment and process change, and (7) program revision. of this section is not to provide a rigid specification but rather to explain the purpose of the systems which the operator can use as a framework for his particular program. The following paragraphs discuss these systems: Chap 2 par UC

Page UC

3/27/W Lib

AC 120-17A

a. Data collection system. This system should include a specific flow of information, identity of data sources, and procedures for transmission of data, including use of forms, computer runs, etc. Responsibilities within the operator's organization must be established for each step of data development and processing. Typical sources of performance information are as follows, however, it is not implied that all of these sources need be included in the program nor does this listing prohibit the use of other sources of information:

(1) Pilot reports.

In-flight

engine performance data.

(3) (4)

Mechanical interruptions/delays. mine shutdowns.

(5) Unscheduled removals. (6) ConfLtmed failures.

Bench checks. Shop findings. Sampling inspections. Inspection writeups. Service difficulty reports (MRR).

(9) (10) (11)

b. Data analysis svstem. Data analysis is the process of evaluating mechanical performance data to identify characteristics indicating a need for program adjustment, revision of maintenance practices, hardware improvement (modification), etc. The initial step in analysis is the comparison of the data to a standard representing acceptable performance. The standard may be a running average, tabulations of removal rates for past periods, graphs, charts, or any means of depicting a Yxxm~~~ (1) Programs incorporating statistical performance standards (alert tyoe programs~ Reliability programs developed under Advisory Circular 120-17 and earlier criteria utilize parameters for reliability analysis such as delays per 100 departures for an aircraft system. They incorporate performance standards as described in paragraph (d) of this section. These standards define acceptable performance. Whencomparedwith a running graphical or tabular display of current performance they depict trends as The system performance data is usually well as show out-f-limits conditions. reinforced by component removal or confirmed failure data. The conditionmonitoring process can be readily accormnodated this type program. by Chap 2 Par 15 Page 15

AC 120-17A

3/27/78

(2) proarams usinn other analysis standards (nonalert type p?Wzrams). Data that is compiled to assist in the day-to-day operation of the maintenance program may be effectively used as a basis for continuous mechanical performance analysis. Mechanical interruption summaries, flight log review, engine monitoring reports, incident reports, engine and component analysis reports are examples of the types of information suitable for this monitoring method. For this arrangement to be effective, the number and range of inputs must be sufficient to provide a basis for analysis equivalent to the statistical standard programs. The operator's organization must have the capability of summarizing the data to arrive at meaningful conclusions. Also, actuarial analysis should be periodically conducted to ensure that current process classifications are correct.
(3) Summary. The objective of data analysis is to (1) recognize the need for corrective action, (2) establish what corrective action is needed, and (3) determine the effectiveness of that action.

C. Corrective action system. The actions to be taken are a reflection of the analysis and should be positive enough to effectively restore performance to an acceptable level within a reasonable time. The system must include notification to the organizational element responsible for taking the action. The system should provide periodic feedback until such time as performance has reached an acceptable level. The mechanics of the corrective action system normally encompassmethods that have been established for the overall maintenance program such as work forms, special inspection procedures, engineering orders, technical standards, etc. Special provisions should be included for critical failures; i.e., failures in which loss of the function or secondary effects of the failure impair the airworthiness of the aircraft. performance standards system. A performance measurement d. Statistical expressed numerically in terms of system or componentfailures, pilot reports, delays or someother event (bracketed by hours of aircraft operation, number of landings, operating cycles, or other exposure measurement) serves as the basis for the standard. The development of control limits or alert values is usually based on accepted statistical methods such as standard deviation or the poisson distribution. However, some applications use the average or base line method. The standard should be adjustable with reference to the operator's experience and should reflect seasonal and environmental considerations. The program should include procedures for periodic review of, and either upward or downwardadjustment of,the standards as indicated. It should also include monitoring procedures for new aircraft until sufficient operating experience is available for computing performance standards. e. Data displayandreport system.

(1) Operators with programs incorporating statistical performance standards (alert type programs) should develop a monthly report, with appropriate data displays, summarizing the previous month's activity. The report should cover all aircraft systems controlled by the program in sufficient depth to enable the FAAand other recipients of the report to evaluate the Page 16 Chap 2 Par 15

3/27/78 &

AC 120-17A

effectiveness of the total maintenance program. It should highlight systems which have exceeded the established performance standards and discuss what action has been taken or planned. The report should explain changes which have been made or are planned in the aircraft maintenance program, including changes in maintenance and inspection intervals and changes from one maintenance process to another. It should discuss continuing over-alert conditions carried forward from previous reports and should report the progress of corrective action programs. (2) Programs using other analytical standards (nonalert type programs) should consolidate or summarize significant reports used in controlling their program to provide for evaluation of its effectiveness. These reports may be in the form of computer printouts, summaries, or any intelligible form. A typical program of this type reports the following information: (a) Mechanical Interruption (b) Mechanical Reliability assignment. Sumnary (MIS). Reports (MRR).

(c) Listing of all maintenance process and interval (Master specification) (d) Weekly update to letter (e) (f) Daily Repetitive (c) above. (by aircraft).

Item Listing

Monthly ComponentPremature Removal Report (includes Monthlylhgine Quarterly wine wine ShutdownandRemovalReport. Reliability Analysis Report.

removal rate). (g) (h) (i)

Threshold Adjustment Report. changes

(j) Worksheets for maintenance process and interval (not provided to FAA, but FAA approves process changes).

f. Maintenance interval adjustment and process change system. A major characteristic of reliability control programs is they afford the operator a formal meansof adjusting maintenance/inspection/overhaul intervals without This does not relieve the operator or FAAof their priorFAAapproval. responsibility for the effects of the program on safety. Procedures for adjusting maintenance intervals should be included in the program. (1) Maintenance interval adjustments should not interfere with an ongoing corrective action. Special procedures for escalating systems or componentswhose current performance exceeds control limits should be provided. k Chap 2 Par 15 Page 17

AC 120-17A

3/V/78 6 are

Typical considerations for adjusting hard-time and on-condition intervals as follows; however, it is not implied that all of these factors be considered-for each case:

(b) (c) (d) (e)

Actuarial

studies.

Unit performance. Inspector or shop findings. Pilot reports

Methods for adjusting aircraft/engine check intervals should be included if the program controls these intervals and sampling criteria should be specified. (2) The system should include procedures for initial classification of maintenance processes (HT - OC - CM) and for changes from one process to another. It should also include authority and procedures for changing maintenance specifications and related documents to reflect the interval adjustment or primary process change. & Program revision system. The program should include a procedure for revision which is compatible with FAA approvals discussed in chapter 4 of this circular. The procedure should identify organizational elements involved in the revision process and their authority. The program areas requiring formal FAAapproval include any changes to the program that involve: (1) standards. (2) (3) PJJW=m* (4) Pmcess changes: Procedures relating Data collection to reliability measurement/performance c

system. to the total maintenance

Data analysis methods and application

(a) For programs incorporating statistical performance standards (alert type programs) procedures for transferring componentsor systems from one primary maintenance prxess to another. (b) For programs using other analysis standards (nonalert type programs) changing systems or componentsfrom one primary maintenance process to another. (5) Adding or deleting components/systems. Chap 2 Par 15

Page 18

kk

3/27/W (6) (7) administration 16.-24. Adding or deleting aircraft types.

AC 120-17A

All pmcedual and organizational of the pmgram.

changes concerning

mmmm.

Chap 2 Par 15

Page 19 (thru

2.4)

3/T/78

AC 120-17A

CHAPTW 3.
25. G3BERAL.

PFUERAMAIKtNIS!CRA'l'ION

a. Administration of reliability programs (as discussed in this circular) requires a specific organizational structure within the operator's mainteParticipants should be drawn from appropriate elements nance organization. of the organization and should be authorized to act on behalf of their or his designee should participate elements. The highest maintenance official in the administration of the program. He should serve as the final authority for major activities and for pgram changes requiring FAA approval. b. The makeup of the administration moup may vary considerably from one ooerator to another. It may have a technical board that analyzes performance d;?teriorations and shop fin-dings to make determinations that may be acted on by an administrative board. The two boards can be combined if this better Theboardtype of administration serves the needs of the particular operator. should entail meetings scheduled for some specified interval and should provide for assembling a board at any time a decision is needed. c. In lieu of a formal board, operators with sufficient organizational capability which should include a strong engineering function may administer their program by assigning appropriate responsibilities to each organizational for operation of the proelement. In this type arrangement, responsibility gram should be assigned to-a specific element of the operator's organization. d. Pmcedures for operating each of the systems described in chapter 2 of this nublication are essential to the success of the program. These pmcedures should be incorporated in appropriate sections of the operator's manualsystem. This will provide each organizational element, and individuals therein, instructions as to their part in the program. Forms should be used, as necessary, to facilitate and document recurring transactions that involve several elements such as (1) changes from one maintenance process to another, (2) analysis of substandard system or componentmechanical performance, (3) shop disassembly analysis for condition-monitoring purposes or overhaul frequency adjustment, etc., and (4) sampling inspection for aircraft check or inspection adjustment.
26.

RELIABILITY m
a.

lXUMlW.

describing the application

The operator should develop a document of reliability control methods.

This document should include at least the following: (1) (2)

General description Organizational Description

of the program. duties and responsibilities. systems.

structure,

of the individual

Par 25

Chap 3

Page 25

AC 120-17A

3/w/78

(4) Derivation of performance standards (if used).

(6)

Copy and explanation of all forms peculiar to the system. of revisions to the document.

(7) Revision control and certification

b. The document should describe the workings of all systems in sufficient detail to provide for proper operation of the program. It should include in detail how the three maintenance processes are applied. The document should describe the monthly report and any other reports-relative to the program, and include samples of these reports with instructions for their use. The organizational element(s) responsible for publishing reports should be identified and the distribution should be stated. Copies of pertinent reports should be provided to FAA. cm The document should also include definitions of significant terms used in the program with particular emphasis on definitions of the three maintenance processes.

27.-3.4.. RESERVED.

Page 26 (thru 34)

par 26

map3

3/27/78

AC:120-1711 CHAPTER 4. PROGRAMAPPROVAL

35. INITIAL APPROVAL,. Form 1014, Operatkns Specifications, FAA (OMB 04-ROO75) is used for initial approval of reliability programs,, This form, along with the program document and related data should be submitted to the FAA district office assigned responsibility for that operator. Guidance on the preparation of FAAForm 1014 is available from the FAA district office. Approval will be certified in the program document in addition to the operations specifications. RWISION APPROTTAL. Revisions requiring formal approval (ref: chapter 2, paragraph 15.g. of this circular) will be subject to the same consideration as initial approval. The mechanics of the approval certification will be as defined in the document. If the revision concerns items listed in the operations specifications, the effected page(s) will be amendedto reflect the revision.
36.

Chap 4 Par 35

Page 35

3/27/78

AC 120-17A Appendix 1

AIRLINE/MANUFACTURERMAINTENANCE PLANNINGDWMENT PROGRAM -MSG2 (Prepared byt R & M Subcommittee, Air Transport Association) (Date: March 25, 1970) 1.0 GENERAzl 1.1 Introduction. Airline and manufacturer experience in developing scheduled maintenance programs for new aircraft has shown that more efficient programs can be developed through the use of logical decision processes. In July, 1968 representatives of various airlines developed Handbook#MSG-1, "Maintenance Evaluation and Program Development,I1 which included decision logic and interairline/manufacturer procedures for developing a maintenance program for the new Boeing 747 airplane. Subsequently, it was decided that experience gained on this project should be applied to update the decision logic and to delete certain 747 detail procedural information so that a universal document could be made applicable for later new type aircraft. This has been done and has resulted in this document, #BG-2. It is the objective of this document to present a means Wiective. for developing a maintenance program which will be acceptable to the Regulatory Authorities, the Operators, and the Manufacturers. The maintenance program data will be developed by coordination with specialists from the operators, manufacturers, and when feasible, the regulatory authority of the country of manufacture. Specifically it is the objective of this document to outline the general organization and decision processes for determining the essential scheduled maintenance requirements for new airplanes. Historically, the initial scheduled maintenance program has been specified in Maintenance Review Hoard Documents. This document is intended to facilitate the development of initial scheduled maintenance programs. The remaining maintenance, that is nonscheduled or nonroutine maintenance, is directed by the findings of the scheduled maintenance program and the normal operation of the aircraft. The remainin g maintenance consists of maintenance actions to correct discrepancies noted during scheduled maintenance tasks, nonscheduled maintenance, normal operation, or condition monitoring.

1.2

1.3 1.4

ScoDe. The scope of this document shall encompassthe maintenance program for the entire airplane. Qtxanization. The organization to carry out the maintenance program development pertinent to a specific type aircraft shall be staffed by representatives of the Airline Operators purchasing the equipment, the Prime Manufacturers of the airframe and powerplant and when feasible the Regulatory Authority.

Page1

AC 120-17A Appendix1 1.4.1

3/27/% The management the maintenance program development of activities shall be accomplished by a Steering Group composedof membersfrom a representative number of Operators and a representative of the Prime Airframe and of Rngine Manufacturers. It shall be the responsibility this group to establish policy, direct the activities of Working Groups or other working activity, carry out liaison with the manufacturer and other operators, prepare the finsl program recommendations and represent the operators in contacts with the Regulatory Authority. A number of Working Groups, consisting of specialist representatives from the participating Operators, the Prime Manufacturer, and when feasible the Regulatory Authority, may be constituted. The Steering Group, alternatively, may arrange some other means for obtaining the detailed technical information necessary to develop recommendations for maintenance programs in each area. Irrespective of the organization of the working activity, it must provide written technical data that support its recommendations to the Steering Group. After approval by the Steering Group, these analyses and recommendations shall be consolidated into a final report for presentation to the Regulatory Authority.

1.4.2

2.0

DEVELOPMENT OPMAINTEXANCE PROGRAMS 2.1 Program Reouirement. It is necessary to develop a maintenance program for each new type of airplane prior to its introduction into airline service. 2.1.1 The primary purpose of this document is to develop a proposal to assist the Regulatory Authority to establish an initial maintenance program for new types of airplanes. The purpose of this program is to maintain the inherent design levels of operating safety.* This program becomes the basis for the first issue of each airline's Operations Specifications-Maintenance to govern its initial maintenance policy. These are subject, upon application by individual airlines, to revisions which may be unique to those airlines as operating experience is accumulated. It is desirable, (a) (b) (c) therefore, to define in some'detail: maintenance program, maintenance program, and maintenance program

2.1.2

The objectives of an efficient The content of an efficient

* See Glossary. Page 2

The process by which an efficient can be developed.

_$

3/27/V

AC 120-17A Appendix 1 2.1.3 The Objectives of an efficient are: (a) airline maintenance program

To prevent deterioration of the inherent design levels of reliability and operating safety of the aircraft, and To accomplish this protection costs. at the minimumpractical

(b) 2.1.4

These objectives recognize that maintenance programs, as such, cannot correct deficiencies in the inherent design levels of flight equipment reliability. The maintenance rvro~ can only prevent deterioration of such inherent If the inherent levels are found to be unsatisfacto;, engineering action is necessary to obtain improvement. The maintenance program itself tasks: (a) consists of two types of

2.1.5

A group of scheduled tasks to be accomplished at The objective of these tasks specified intervals. is to prevent deterioration of the inherent design levels of aircraft reliability, and A group of nonscheduled tasks which results (i) (ii) (iii) from:

(b)

The scheduled tasks accosnplished at specified intervals, Reports of malfunctions the flight crew), or Condition-Monitoring. (usually originated by

The objective of these nonscheduled tasks is to restore the equipment to its inherent level of reliability. 2.1.5.1 This document describes procedures for developing the scheduled maintenance program. Nonscheduled maintenance results from scheduled tasks, normal operation or condition monitoring.

2.1.6

Maintenance programs generally include one or more of the following primary maintenance processes: Hard--TimeLimit: A maximum interval for performing maintenance tasks. These intervals usually apply to overhaul, but also apply to total life of parts or units.

Page 3

AC 120-17A Appendix1

3/27/W J ch Condition: Repetitive inspections, or tests to determine the condition of units or systems or portions of structure (Ref.: FAAAdvisory Circular Ul-1). Condition, Monitorinq: For items that have neither hard time l&nits nor on condition maintenance as their primary maintenance process. Condition monitoring is accomplished by appropriate means available to an operator for finding and resolving problem areas. These means range from notices of unususl problems to special analysis of unit performance. No specific monitoring system is implied for any given unit (Ref.: FAAProcedures 8310.4, paragraph 3033). This document results in scheduled tasks that fit the hard time limit or on condition maintenance programs or, where no tasks are specified, the item is included in condition monitoring.

2.2 Scheduled Maintenance Bxxram Content The tasks in a scheduled maintenance program may include: (a) (b) (c) (d) (e) 2.2.1 Servicing Inspection Testing C ibration P R&iLacement An efficient program is one which schedules only those tasks necessary to meet the stated objectives. It does not schedule additional tasks which will increase maintenance costs without a corresponding increase in reliability protection. The development of a scheduled maintenance program requires a very large number of decisions pertaining to: (a) (b) (c) Which individual How frequently tasks are necessary, these tasks should be scheduled,

2.2.2

What facilities are required to enable these tasks to be accomplished,

Page 4

I
3/27/B AC 120-17A Appendix1 (d) (e) Where these facilities should be located, and

Which tasks should be accomplished concurrently in the interests of economy.

2.3 A&craft Svstem/Comnonent Analysis Method. The method for determining the content of the scheduled maintenance pro am for systems and components (parts's and b of Paragraph 2.2.2 r uses decision diagrams. These diagrams are the basis of an evaluatory process applied to each system and its significant items using technical data mvided (Ref. 2.7). Principelly, the evaluations are based on the systemsV and items' functions and failure modes. The purpose is to: (a) (b) (c) Identify the systems and their functions*, significant items*.

Identify their reliability*.

failure

modes*, and failure

Define scheduled maintenance tasks having potential effectiveness* relative to the control of operational reliability*. Assess the desirability of scheduling those tasks having potential effectiveness. It should be noted that there is a difference between V'otential'1 effectiveness of a task versus the 9fdesirabilitytV of including this task in the scheduled maintenance program. The approach taken in the following procedure is to plot a path whereby a final judgment can be madeas to whether those potentially effective tasks are worthy of inclusion in an initial maintenance program for a new airplane. There are three decision diagrams provided (Addendum I, Figures 1 through 3). Figure 1 is used to determine scheduled maintenance tasks having potential effectiveness relative to the control of operational reliability. This determines tasks which can be done. Figures 2 and 3 are used to assess the desirability of scheduUng those tasks having potential effectiveness. Mgure 2 tasks must be done to prevent direct adverse effects on operr?& safety and to assure availability of hidden functions. Figure 3 tasks should be done for economic value.

(d) 2.3.1

2.3.2

* See Glossary.
Page 5

AC 120-17A Appendix1 2.3.3 The total analysis process is shown diagramaticslly See Addendum for details. I Figure2 (Questions I & II)

3127178

below.

Figure11 Figure (Questions a,b,c,d,e) a

Figure Figure 3 (Questions A, B & C)

B C

These tasks have potential effectiveness & can be done. -

These tasks must These tasks should be done to p=nt be done for economic direct adverse value. effects on operating safety & assure availability of hidden functions.

2.3.4

The following guidelines encourage consideration of failure consequencesand the potential effectiveness of scheduled maintenance tasks. In those cases where failure consequences are purely economic, the guidelines lead to consideration of both the cost of the scheduled maintenance and the value of the benefits which will result from the task.

Page 6

3/27/m 2.3.5

AC 120-17A Appendix 1 A decision tree diagram (Figure 1 of Addendum facilitates 1) the definition of scheduled maintenance tasks having potential effectiveness. There are five key questions. Note: Questions (a), (b), and (c) must be answered for each failure mode, question (d) for each function, and question (e) for the item as a whole. Is reduction in failure resistance* routine flight crew monitoring*? detectable by

(a) (b) (c) (d) (e) 2.3.6

Is reduction in failure resistance detectable by in situ maintenance or unit test? Does failure mode have a direct adverse effect upon operating safety? (See Addendum 2.) Is the function hidden from the viewpoint of the flight crew? (See Addendum 3.) Is there an adverse relationship reliability? between age and

Each question should be answered in isolation, e.g., in question (c) all tasks which prevent direct adverse effects on operatingsafety must be listed. This may result in the sametask being listed for more than one question. If the answer to question (a) is Yes, this meansthere are methods available through monitoring of the normal in-flight instrumentation to detect incipient conditions before undesirable system effects occur. A Yes answerxnot require a maintenance task. If the answer is No, there is no in-flight monitoring which can detect reduction in failure resistance. This question is meant to refer to the flight crews' ability to detect deteriorating calibration or systems operation before a failure occurs. NOTE: Tasks resulting from in-flight monitoring are part of nonscheduled maintenance. If the answer to question (b) is Yes, it meansthere is a maintenance task, not requiring item disassembly, that has potential effectiveness in detecting incipient conditions* before undesirable system effects occura Tasks may include inspection, servicing, testing, etc. NOTE: Tasks resulting from a Yes answer to question (b) are part of the Ch Condition maintenance mgram.

2.3.7

2.3.8

* See Glossary.

Page 7

AC UO-1'j'A Appendix1 2.3.9

3/n/78 If the answer to question (c) is Yes, this failure modehas a direct, adverse effect'on oper&ing safety. It is necessary to examin the mechanismof failure and identify e the single cells or simple assembljies where the failure initiates. Specific total time, totdflightcycle, time since overhaul and cycle since overhaul limitations may be assigned these single cells or simple assemblies and the. probability of operational failures wiU be minimized. Examples of these actions are turbine engine disc limits, airplane flap link life limits, etc. In many cases, these limits must be based upon manufacturer's development testing. Fortunately, there is only a small number of failure modes which have a direct, adverse effect on operasafety. This results from the fact that failure mode analyses are conducted throughout the process of flight equipment design. In most cases, it is possible after identification of such a failure mode to make design changes (redundancy, incor poration of protective devices, etc.) which eliminate its direct adverse effect upon operating safety. If no potentially effective task exists, then the deficiency in design must be referred back to the manufacturer. The term Virect adverse effect upon operating safety" is explained in Addendum NOJ!E: Tasks resulting from a Yes answer 2. to question (c) are part of either the Hard-Time limitation maintenance program or the Ch~Condition maintenance program. Refer to Addendum for explanation of question (d). If the 3 answer to question (d) is Yes, periodic ground test or shop tests may be required if there is no other way of ensuring that there is a high probability of the hidden function being available when required. The frequemies of these tests are associated with failure consequencesand anticipated failure probability. A canponent cannot be considered to have a hidden function if failure of that function results in a system malfunction which is evident to the flight crew during normal operations. In this case, the answer must be No. NOJ!E: Tasks resulting frwn a Yes answer to question (d) may be part of either the Hard-Time limitation or the &-Condition maintenance program. If the answer to question (e) is Yes, periodic overhaul may be an effective way of controlling reliability. Whether or not a fixed overhaul time limit will indeed be effective can be determined only by actuarial analysis of operating experience. NCJTE: Tasks resulting from a Yes answer to question (e) are part of the Hard.Time limitation maintename program. *

2.3.10

2.3.ll

Page 8

AC 120-17A
Appendix1

2.3.12

It has been found that overall measures of reliability of complex canponents, such as the premature removal rate, usually are not functions of the age of these components. In most cases, therefore, the answer to question (e) is No. In this event, scheduled overhaul cannot imlffove operating reliability. Engineering action is the only means of improving reliability. These components should be operated, therefore, without scheduled overhaul. NOTE: Syskxns or items which require no scheduled tasks are included in Condition-Monitoring. The preceding paragraph is contrary to the common belief that each componenthas an unique requirement for scheduled maintenance in order to protect its inherent level of reliability. Thevalidity of this belief was first challenged by actuarial analyses of the life histories of various components. More recently, the correctness of the preceding paragraph has been overwhelmingly demonstrated by the massive operational experience of many airlines with marq different types of components covered by Reliability Programs com@yLngwithFAAAdvisoryCircular

2.3.13

120-17.
2.3.U

It is possible to change the answers to the five questions in the decision diagram by improved technolo . It is hoped that Aircraft Integrated Data Systems r AIDS), for example, will reliably indicate reduced resistance to various modesof failure of many components during normal airline operations. If this is determined to be possible, many "No" answers to questions (a) and (b) x&U become 'cYesl*answers. Answers may also be changed by various developments in the field of nondestructive test techniques, built-in test equipment, etc. The questions in Qure 1 are intended to determine maintenance tasks having potential effectiveness for possible inclusion in a scheduled maintenance program. However, it is probable that many of these ~*potentialQP* beneficial scheduled tasks would not be *Uesirable" even though such tasks could improve reliability. This mightbetrue when operating safety is not affected by failure or the cost of the scheduled maintenance task is greater than the value of such resulting benefits as reduced incidence of componentpremature removal, reduced incidence of departure delays, etc. Additional diagrams are used to assess the Wesirabilityl~ of those scheduled maintenance actions which have potential effectiveness. This is accomplished by Figures 2 and 3 of Addendum 1.

2.3.15

AC l2047A Appendix1 2.3.16

3/27/7% Figure 2 selects those tasks which must be done because of operating safety or hidden function considerations. Figure 3 selects those tasks which should be done because of economic considerations. Figure 2 assesses tasks listed against the Yes answers of questions c and d in Figure 1, and selects those tasks which must be done. For the operating safety question, at least one task must be listed for each failure mode having a Yes answer to question c of Figure 1. An explanation should be given for any question c tasks not selected. For the hidden function question, normally at least one task must be listed for each hidden function having a Yes answer to figure 1, question d. If a task is not selected, as permitted by Addendum an explanation must be provided. 3, Figure 3 assesses tasks listed against the Yes answer in Figure 1, questions b and e and select those tasks which should be done because of economic considerations. A.key question in Figure 3 is the first, "Does real and applicable data* show desirability of scheduled task?" a "Yes" answer is appropriate if there is: (1) Prior knowledge from other aircraft that the scheduled maintenance tasks had substantial evidence of being truly effective and economically worthwhile, The system/component configurations of the old and. new airplanes are sufficiently similar to conclude that the task will be equally effective for the new airplane.

2.3.17

2.3.18

2.3.19

2.3.20

2.3.21

(2)

2.3.22

The question Woes failure prevent dispatch" refers to whether the item will be on the MinimumFquipnent List (MEL). The question "Is elapsed time for correction of failure TO.5 Hr." refers to whether corrective action can be accomplished without a delay during a normal transit stop. Whena task "requires evaluation" it is important that the frequency of the failure and the cost of carrying out the task are taken into consideration.

2.3.23

2.3.24

* See Glossary. Page10

3/27/W 2.4

AC 120-17A Appendix1 Aircraft Structure Analysis Method. The method for determining the content of the scheduled maintenance program for structure is: (a) (b) (c) (d) 2&l Identify Identify the significant their failure structural items.* effects.

modes and failure effectiveness

Assess the potential structure.

of scheduled inspections of which

Assess the desirability of those inspections of structure do have potential effectiveness.

The static structure will be treated as hereafter described. Additionally, the mechanical elements of structural components, such as doors, emergency tits, and flight control surfaces will be treated individually by the processes described in Section 2.3. The decision tree diagram, Figure 1 of Addendum faciu1, t&es the definition of scheduled inspections of structure having potential effectiveness. There are five key questions. (a) (b) (c) (d) (e) Is reduction in failure resistance detectable by routine flight crew monitoring? Is reduction in failure resistance detectable by in situ maintenance or unit test? Does failure mode have a direct operating safety? adverse effect upon

2.4.2

Is the function hidden from the viewpoint of the flight crew? Is there an adverse relationship reliability? between age and

2.4.3

The answer to question (a) is normally No. However, if in-flight instrumentation is developed which permits detection of incipient structural failures then the answer should be Yes. If the answer to question (b) is Yes, there are methods available to detect incipient conditions before undesirable conditions occur. It would be expected that all redundant acternal andinternal structure wouldbeinthis cate ry. NOTE: Tasks resulting from a Yes answer to question 7b) are part of the Structural Inspection program. This program is an On-Condition program.

2.4.4

AC 120-17A Appendix 1
2.4.5

3/27/78

If the answer to question (c) is Yes, there is a failure mode which has a direct, adverse effect on operating safety for which there is no effective incipient failure detection method. It would be expected that nonredundant primary structure would be in this category. See Addendum for 2 explanation of Wrect adverse effect on operating safety." NOTE: Tasks resulting from a Yes answer to question (c) are part of the Hard Time limitation (ususlly total time or total cycle limits) maintenance program. If the answer to question (d) is Yes, there is a function required of this element of structure that is not regularly used during normal flight operations. Someinspection or test is therefore necessary to ensure that this function has a high probability of being available when required. Tail bumper structure and structure provided for wheelsuplanding are typical structural examples. NOTE: Tasks resulting from a Yes answer to question (d) are part of the Structural Inspection program. Structures would be expected to have a Yes answer to question (e) but only in a very long total time envelope. The tasks performed as a result of Yes answers to the other questions are capable of detecting deterioration prior to failure of these items. It is probable that some of these tVpotentially" beneficial scheduled inspections would not be desirable, even if such tasks would improve reliability. This might be true when airworthiness is not affected by failure and the cost of the scheduled inspection is greater than the value of the resulting benefits. Therefore, additional diagrams are used to assess the desirability of those scheduled tasks which have potential effectiveness. This is accomplished by Figures 2, 4, and 5 of Addendum 1. A No answer to all questions is unlikely for structure. If it occurs, the item is included in Condition Monitoring. Figure 2 selects those tasks that must be done because of operating safety or hidden function considerations. Figures 4 and 5 of Addendum establish internal and exter 1 nal class numbers for structural items. The class numbers take into account vulnerability to failure, consequencesof failure. The class numbers are to be used as guides for setting internal and external inspection frequencies. The items to be evaluated by Figures 4 and 5 are those termed "structurally significant.'~

2.4.6

2.4.7

2.4.8

2.4.9

2.4.10

L!+ll

Page12

AC 120-17A Appendix1 2.4.12 Each item is fLrst rated for each of five characteristics per Figure 4 (fatigue resistance, corrosion resistance, crack propagation resistance, degree of redundancy and fatigue test rating). Each item is then given an overall rating (R No.) per Figure 4 which considers all of the above ratings and combinesthemby judgment into a single overall rating (R No.) representing a relative level of structural integrity of the item. In general, the overall R No. for an item is equal to or less than the fatigue resistance or corrosion resistance rating for the item, whichever is lesser.

2.4.13

2.4.J.4 The internal and external class numbers for each item are then determined by reference to F'igure 5. Note that some items have both internal and external class numbers. This occurs for those internal itms which have someprobability of the internal item*s condition being evident by some external condition. In these cases the item as described is visible internally and the Ynternsl'P inspection specified refers to the item as described. The *lext,ernal'l inspection of this item refers to that portion of the external structure which is adjacent to the internal item and which may yield sane indication of the internal item's condition. Therefore, when an external inspection is specified for an internal item, it refers to the adjacent external structure and not the internal item itself. 2.5 Aircraft E&uzine Analysis Method. The method for determining the content of the scheduled engine maintenance program is: (a) (b) (c) Identify Identify the systems and their their dictions, significant items. effects.

failure

modes, snd failure

Define scheduledmainteuunce tasks having potential effectiveness relative to the control of operational reliability. Assess the desirability of scheduling those tasks having potential effectiveness. Determine initial sam@ing thresholds where appropriate. e&e item

(d) (e) 2.51

The engine as a whole and each significant, will be treated as described below.

Page 13

AC 12c-l7A Appendix 1 2.5.2

3/V/78

The decision tree diagram, Figure 1 of Addendum facili1, tates the definition of scheduled inspections having potential effectiveness. There are five key questions. NOTE: Questions (a), (b), and (c) must be answered for each fai%ure mode, question (d) for each function, and question (e) for the item as a whole. (a) (b) (c) (d) (e) Is reduction in failure resistance detectable by routine flight crew monitoring? Is reduction in failure resistance detectable by in situ maintenance or unit test? Does failure mode have a direct upon operating safety? adverse effect

Is the function hidden from the viewpoint of the flight crew? Is there an adverse relationship reliability? between age snd

2.5.3

If the answer to question (a) is Yes, there are methods available through monitoring the normal in-flight instrumentation (including computerized Flight Log Monitoring) to detect incipient conditions before undesirable system effects occur. A Yes answer does not require a maintenance task. If the answer is No, there is no in-flight monitoring which can detect reduction in failure resistance. NUJ!l3: Tasks resulting from in-flight monitoring are part of nonscheduled maintenance. If the answer to question (b) is Yes, there is a maintenance task, not requiring engine disassembly, that has potential effectiveness in detecting incipient conditions before undesirable system effects occur* Tasks may include inspection, servicing, testing, etc. NOJ!E: Tasks resulting from Yes answers to question (b) are part of the QI Condition maintenance program. If the answer to question (c) is Yes, this engine component has a failure mode with direct, adverse effect on operating safety. It is necessary to examine the mechanismof failure and identify the single cells or simple assemblies where the failure initiated. Specific total time, or total flight cycle, limitations may be assigned these components to NCTE: minimize the probability of operational failures. Tasks resulting from a Yes answer to question (c) are part of either the Hard Time limitation maintenance program or the Q1 Condition maintenance program.

2.5.4

2.5.5

Ac 120-17A

Appendix1 2.5.6 If the answer to question (d) is Yes, there is a function required of this engine component that is not evident to the flight crew when the component fails. Somescheduled task may be necessary to assure a reasonably high probability that this function is available when required. NOISE: Tasks resulting from a Yes answer to question (d) may be part, of either the Hard Time limitation or the Q1 Condition maintenance program. It is expected that the answer to question (e) is always Yes for structural engine components, but that their expected life is very long relative to the usual e * e inspection periods. If tasks defined by questions T a) through (d) are inadequate to control wear or deterioration of engine components, additional tasks should be listed here. NCTE: Tasks resulting from a Yes answer to question (e) are part of either the Hard Time limitation or the Q1 Condition maintenance program. lG@ne ccmponents for which no scheduled tasks are selected are included in Condition Monitoring. The questions in Figure 1 are intended to determine maintenance tasks having potential effectiveness for possible inclusion in a scheduled maintenance program. However, it is probable that many of these lVpotentially" beneficial scheduled tasks would not be "desirablefl even though such tasks could improve reliability. This might be true when operating safety is not affected by failure or the cost of the scheduled maintenance task is greater than the value of such resulting benefits as reduced incidence of component premature removal, reduced incidence of departure delays, etc. Additional diagrams are used to assess the "de&+ abilityt' of those scheduled maintenance actions which have potential effectiveness. This is accomplished by Figures 2 and 3 of Addendum 1. Figure 2 selects those tasks which must be done because of operating safety or hidden f'unctionxsiderations. Figure 3 selects those tasks which should be done because of economic considerations. figure 2 assesses tasks listed against the Yes answers of questions c and d in Figure 1, and selects those tasks which must be done. For the operating safety question, at least one task must be listed for each failure mode having a Yes answer to question c of Figure 1. An explanation should be given for any question c tasks not selected.

2.5,7

2.5.8 2.5.9

2.5.10

2.5.l.l

2.512

Page 15

AC 12C47A Appendix 1 2.5.13

3127178 For the hidden diction question, noxmally at least one task must be listed for each hidden function having a Yes answer to Figure 1, question d. If a task is not selected, as penitted by Addendum an explanation must be provided. 3, figure 3 assesses tasks listed against the Yes answer in E'igure 1, questions (b) and (e) and selects those tasks which should be done because of economic considerations. A key question in Figure 3 is the first, "Does real and amcable data show desirability of scheduled task?" A 9es" answer is appropriate if there is: (1) Prior knowledge fr9n other aircraft that the scheduled maintenance tasks had substantial evidence of being truly effective and economically worthwhile, and The system/component configurations of the old and new airplanes are sufficiently similar to conclude that the task will be equally effective for the new airplane.

2.5.U

2.5.15

(2)

2.5.16

The question "Does failure prevent dispatch" refers to whether the item wiU be on the Minimumwpnent List (MEL). The answer to quest* (b) is expected to always be Yes for engine componentsthat cause engine failure. The question "Is elapsed time for correction of failure 70.5 Hr." refers to whether corrective action can be accanplished without a delay during a normal transit stop. Whena task "requires evaluation'* it is important that the frequency of the failure and the cost of carrying out the task are.taken into consideration. Engine tasks are included in the Threshold Ssmpling maintenance program. This program is described below. The Threshold Sam&Sngmaintenance program is intended to recognize the ch Condition design characteristics of modern TurboJet engines, while sampling to control reliability. This program uses repetitive samfling to determine: (1) (2) (3) The conlition The advisability sampling l&nit, of m&t18 caqxments. for contFnued operation to the next snd threshold, or sampling ban&

2.5.17

2.5.18

2.5.19 2.5.x)

The nexL sampling limit,

1 Page16

3/27/78 2.521 Initial (1) (2) (3) sam@Mng thresholds are based on:

AC UC-17A Appendix 1

The design of the engine under study, the results of developmental testing, and prior service experience. The results of previous engine programs.

The fact th at samples are available from engines removed for all causes at virtually all ages. This meansthat knowledge of the conditions of engines is available over the complete continuum of time from start of operation to the highest time experienced, and The fact that most engine design problems become apparent and canbe controlledwellwithinany established limits or thresholds.

(4)

2.522

The Threshold Sampling program establishes the initial sampling threshold. Operators are subsequently responsible for: (1)
(2)

Evaluating the samples obtained from the ?I;nitial threshold. Determining the next ssmpling threshold, and

(3) 2.5.23

Determining the number to be sampled at the next threshold.

Threshold Sampling is normally accomplished by inspecting the parts or systems of engines that are removed snd accessible in the shop. These engines provide samples over a full range of ages without waiting for the threshold to be reached. The results of inspecting these samples are used to determine the future program. Whensamples are nQt available from engines that are in the shop, scheduled samples or in situ inspections may be required.

2.6 Program Develollnent Administration. RegulatoryAu$horityparticipation is encouraged as early snd as thoroughly as possible in all It is recognized that the phases of working group activity. Regulatory Authority will later be asked to approve the proposed program resulting from these efforts. Therefore, the Regulatory Authority participation must necessarily be restricted to technical participation, contributing their own knowledge, and observing the activities of the worki.ng group. Regulatory Authority approvel of working group recarmendations is not implied by the participation of Regulatory Authority membersin working group sessions. The following activity phases will apply.

Page 17

AC 120-1'7A Appendix 1
Phase I. Phase II. (4 *(b)

3/27/78 ,! Steering Group general familiarization

Preparation of first draft Significant List. (Ref. 2.7.1)

*e(c) Establish functions and failure to the Significant Items.

modes applicable

Cd) Preparation of Figures 1 thru 5 decision diagram replies and supporting data for each system and significant item. Phase III. (4 Evaluation of manufacturer's technical data and recommended tasks by the Working Groups' airline personnel and meeting with manufacturer to make necessary revisions and prepare task recommendations. Development of task frequency recommendations. (This phase is meant to follow Phase III. a).

(b)

NUTE: A Steering Group membershould participate in all Phase III activity. Phase IV. Phase V.
2.7

Presentation to Steering Group (meeting with each Working Group or Activity Chairman). Preparation and presentation of the Steering Group's proposal to the Regulatory Authority.

Supportinn

Technical Data. The following supporting technical data will be provided in printed form, together with adequate crossreferences on the records of replies to the decision diagrams. 2.7.1 Maintenance Significant Items List. This list will include by ATASystem, the name, quantity per sirplane, prime number for manufacturer psrt number, vendor name and each item considered by the Working Group Activity to p"" require individual analysis. Sipnificant (a) (b) Items Data. item and its f'unction(s).

2.7.2

Description of each significant Listing of its failure

mode(s) and effects.

* Steering Committee audits are required for these steps before proceeding. Page 18

AC 120-17A Appendix 1 (c) (d) (e) (f) (g) 2.7.3 Ekpected failure Hidden functions. Need to be on M.E.L. Redundancy(may be unit, Potential indications system or system management). resistance. rate.

of reduced failure

*stem Data. (a) (b) (c) Description of each system and its fUction(s). Listing of any failure in item data. Hidden fkvztions modes and effects not considered

not considered in item data.

Page19

AC 120-17A Appendix1 GLOSSARY Inherent Level of Reliability and Safety - That level which the unit and therefore inherent in its design. This is the of reliability and safety that can be expected from a unit, aircraft. To achieve higher levels of reliability generally modification or redesign.

3/27/78

is built into highest level system, or requires

Maintenance Significant Items - Those maintenance items that are judged by the manufacturer to be relatively the most important from a safety or reliability standpoint, or from an economic standpoint. Structural Significant Items - Those local areas of primary structure which are judged by the manufacturer to be relatively the most important from a fatigue or corrosion vulnerability standpoint or from a failure effects standpoint. Operational Reliability - The ability to perform the required functions within acceptable operational standards for the time period specified. Effective Incipient Failure Detection - That maintenance action which will reliably detect incipient failures if they exist. That is, detect the pending failure of a unit or system before that system fails. For example, detection of turbine blade cracks prior to blade failure. Real and Applicable Data - Those data about real, operating hardware that is similar enough to the hardware under discussion to be applicable to the design of maintenance programs for the current hardware. Reduction in Failure Resistance - The deterioration of inherent (design) levels of reliability. As failure resistance reduces, failures increase; resulting in lower reliability. If reduction in failure can be detected, maintenance can be performed prior to the point where reliability is adversely affected. Function - The characteristic actions of units, systems and aircraft. deteriorate

FailureModes - The ways in which units, can be considered to have failed. Potential Effectiveness to somedegree.

systems and aircraft

- Capable of being effective

(maintenance action)

Routine Flight Crew Monitoring - That monitoring that is inherent in normally operating the aircraft. For example, the pre-flight check list, or the normal operation of the aircraft and its components. Does not include monitoring of "back-up" equipnent that is normally not tested as a part of a normal flight. Failure Effects - The consequenceof failure. Page 20

k
AIRLINE MAINTENANCE PROGRAM DEVELOPMENT

e
DIAGRAM
FIGURE 3 BE DONE WHICH . GUESTION TASKS SHOULD A, 8, & C iAPPLY TO b AND e TASKS

MSG 2 DECISION
FIGURE WHICH L QUESTIONS 8, b, & c APPLY TO EACH FAILURE MODE OF ITEM OUESTION d APPLIES TO EACH FUNCTION OF ITEM QUESTION. APPLIES TOITEM AS A WHOLE ~QUESTION WESTION I APPLIES II APPLIES TO c TASKS TO d TASKS TASKS w I BE DONE WHICH FIGURE 2 TASKS .MUST BE DONE

k-----l

I
I

NO,..--UST ALL POTENTIAL TASKS REF.TO REDUCT INFAILURE RES,STANCE(CHECK, IN!3FECT,SERVICE, YE

IS REDUCTION IN FAILURE REh-- I ANCE. ifs DETECTABLE BY ,u PlTl .,&PC I,.- 31 I YI ww*.; OR UNIT TEST 7

~~~~-c---------------.-----s----s---.

J I~iZXBALLEAND -.-. -..-...

AIRLINE MAINTENANCE

PROGRAM DEVELOPMENT

STRUCTURE
1
FATIGUE RESTANCE AN INDICATION DESIGN GOAL SMALL MARGIN DESIGN GOAL AND INDICATION BOTH EXPOSURE LEAST MARGIN RESISTANCE AND INDICATION OF CRACKS. OF THE FATIGUE FOR THE OVERALL ABOVE

ANALVSIS
2
RESISTANCE AIRPLANE OF THE ITEM

METHOD
k
TO THE FATIGUE

3
RELATIVE

FAIR MARGIN ABOVE DESIGN

GOAL

ABOVE RESISTANCE

DESIGN

GOAL CONSIDERING HIGHEST MARGIN OF THIS PORTION OF CHART TO BE EXECUTED FOR EACH ITEM WHICH HAS BEEN DESIGNATED AS STRUCTURALLY SIGNIFICANT

CORRO ilON RESISTANCE (INCL. STRESS CORROSION)

OF THE RELATIVE AND PROTECTION. OF FAIR MARGIN

CORROSION OF

OF THE ITEM MARGIN

CONSIDERABLE OF RESISTANCE OF THE MATERIAL

OF

THE RELATIVE

ABILITY

USED

TO RESIST PROPAGATION

CRACK PROPAGATION IESISTANCE I IEGREE OF IEDUNDANCY

LEAST MARGIN OF RESISTANCE (HI HEAT TREAT STEEL) I AN INDICATION SMALL

FAIR MARGIN OF RESISTANCE r/DO0 SERIES ALUM) TO WHICH IN

CONSIDERABLE OF RESISTANCE I ITITANIUM) THE ITEM IS MCKED

AURGIN I

HIGHEST MARGIN OF RESISTANCE f2ooO SERIFS ALUM.) STRUCTURE. HIGH REPRESENT YES

OF THE DEGREE

UP BY REDUNDANT

I THE FULL I I THE ABOVE RATINGS AND COMBINES WHICH REPRESENTS A RELATIVE LEVEL SCALE FATIGUE

I TEST PROPERLY I I

:ATIGUE lEST RATING

WI11 THE LOADS LOADS PREDICTED , I NO

APPLIED TO THE ITEM FOR SERVICE USAGE? I -.

)VERALL IATING JUMBER

A RATING WHICH CONSIDERS All INTO A SINGLE OVERALL RATING INTEGRITY OF THE ITEM.

THEM BY IIJDGEMENT OF THE STRUCTURAL

THIS RATING NO. IS ASSIGNED TO ALL OTHER PRIMARY AND SECONDARY STRUCTURE WHICH IS NOT STRUCTURALLY SIGNIFICANT E

AIRLINE MAINTENANCE
THIS CHART CONVERTS OVERALL RATING

PROGRAM

DEVELOPMENT

STRUCTURE DETECTABILITY EVALUATION

6
CLASS NO. XX.

C
CLAgS NO.

WO ABOVE GROUNU if ,l OaBOVE GROUND IN NON FUEL AREA OR IN FUEL AREA

STRUCTURALLY ITEMS SlGNlFlCANT [EX) EXTERNAL ITEMS (IN]INTERNAL : ITEMS

NONE

R+l

HIGH PROBABlllYY OFEXTERNAL DEYECTABILIYY CONOlYlON OFIlENS BYWC1 LEAK VISUAL OR COlDlYION AOIACENT Of EXTERNAL lYEM LOW PROBABILITY OFDIYYO NOEXTERNAL OETECTABMYY CONBlYlON OFITEMS SlNCE NOAOIACENT ARE ITEMS VISIBLE EXTERHALLY

R+l R R

R R+ NONE

R+l

R+l NONE

F B

ALL OTHER PRIMARYSECONDARY OR STRUCTURAL ITEMS ARE STRUCT. WHICH NOT SIGNIFICANT [EX]EXTERNAL ITEMS [IN]INTERNAL ITEMS
EXTERNAL MEANS IS VISUAL THERE
ACCESSlBllllY WITHOUT DETACHING ANY PARTS [ML. ACCESS PANELSfROM 1 ME AIRPLANE, INCLUUES ARU CONTROL SURfACE OEflCCTlONREUUIREO AS

NONE 5,

5 NONE

5 NONE

INTERNAL

MEANS THERE VISUAL IS ACCESSIBMTY BYOETACHINC ONLY REMYAQE PARTS BY RAOIOCRAPHIC OR MANS

b WHERE VISUAL ACCESSIBILTY EXISTS SIMPLY REMOVAL AN BY OF ACCZSS A#0 NOADUIlIONALPLATE DETACHMENT Of PARTS NECESSARV IS TOGAIN VISUAL ACCESS

AC 120-l?'A

3/27/78

Appendix 1 ADDENlNM2 The following safety." elaborates on the term Wirect . and adverse effect on operating

During the design process considerable attention is given to system and component failure effect analysis to ensure that failures that result in loss of function do not immediately jeopardize operating safety. In many cases, redundancy can cause the consequencesof a first failure to be benign. In other cases, protective devices serve this purpose. Although it may not be possible to continue to dispatch the airplane without correcting the failure and although it may indeed be desirable to make an unscheduled landing after failure, the failure cannot be considered to have an immediate adverse effect upon operating safety. The inclusion of the word direct in the phrase Virect adverse effect upon operating safety" meansan effect which results from a specific failure modeoccurring by itself and not in combination with other possible failure modes. Certification requirements ensure that a transport category aircraft has very few failure modeswhich have a direct adverse effect upon operating safety.

3/27/V ADDE3IXJM3 MPLANATICN HIDDENFUNCTICNS OF A component is considered to have a "hidden functiorP following exists: 1. if

AC l20-17A Appendix1

either of the

The component has a function which is normally active whenever the system is used, but there is no indication to the flight crew when that function ceases to perform. The component has a function which is normally inactive and there is no prior indication to the flight crew that the function will not perform when calledupon. The demandfor active performance will usually follow another failure and the demandmay be activated automatically or manually.

2.

Examples of componentspossessing hidden functions exist in a bleed air system. A bleed sir temperature controller normally controls the bleed air temperature to a maximum @CF. In addition, there is a pylon shutoff of valve which incorporates a secondary temperature control, should the temperature exceed &COoF. A duct overheat switch is set to warn the flight crew of a temperature above @OF, in which event they can shut off the air supply from the engine by actuating the pylon shutoff valve switch. There is no duct temperature indicator. b The bleed air temperature controller has a hidden active function of controlling the air temperature. Since there is a secondary tempsrature control in the pylon valve and since there is no duct temperature indicator, the flight crew has no indication of when the temperature control function ceases to be performed by the temperature controller. Also, the flight crew has no indication prior to its being called into use that the secondary temperature control function of the pylon valve will perform. Therefore, the pylon valve has a hidden inactive function. For a similar reason, the duct overheat warning system has a hidden inactive function. And the pylon valve has a hidden inactive function (manual shutoff) since at no time in normal use does the flight crew have to manuelly close the valve. The hidden function definition includes reference to "no indications to the flight crew" of performance of that function. If there are indications to the flight crew, the function is evident (unhidden). However, to qualify as an evident function, these indications must be obvious to the flight crew during their normal duties, without special monitoring (bear in mind, however, that special monitoring is encouraged as a part of the maintenance program to make hidden functions into evident ones). It is recognized that, in the performance of their normal duties, the flight and crews operate some systems full time, others once or twice per flight, others less frequently. All of these duties, providing they are done at some reasonable frequency, qualify as "normal." It means, for example, that although an anti-icing system is not used every flight it is used with

Page 25

AC 120-17A Appendix 1

3/27/78

sufficient frequency to qualify as a %ormal" duty. Therefore, the antiicing system can be said to have an evident (unhidden) function from a QI the other hand, certain %nergency" operations flight crew's standpoint. which are done at very infrequent periods (less than once per month) such as emergency gear extension, fuel dump actuation, etc., cannot be considered to be sufficiently frequent to warrant classification as evident (unhidden) functions. The analysis method requires that all hidden functions have some form of scheduled maintenance applied to them. However, in those cases where it may be difficult to check the operation of hidden functions, it is acceptable to assess the operating safety effects of combined failures of the hidden function with a second failure which brings the hidden function failure to the attention of the flight crew. In the event the combined failures do not produce a direct adverse effect on operating safety, then the decision whether to apply maintenance to check the pertinent hidden function becomes an economic decision to be considered by Figure 3 of Addendum 1. Mote also, in somecases, it is acceptable to accomplish hidden function checks of removable components during unscheduled shop visits, providing the component has at least one other function which when failed is known to the flight crew and which causes the unit to be sent to the shop. Also, the hidden function failure mode should have an estimated reliability well in excess of the total reliability of the other functions that are evident to the flight crew.

3U.S.

GOVERNMENT

PRINTING

OFFICE:

1978-261-264182

Page 25