AIRCRAFT RELIABILITY CONTROL PROGRAM MANAGEMENT – SOFTWARE CENTRIC

International Conference on Management and Information Systems

September 22-24, 2013

Aircraft Reliability Control Program Management – Software Centric Approach Syam S Jagathyraj V.P [email protected] [email protected] Cochin University of Science & Technology Reliability control is a continuous process and is an essential part of continuing Airworthiness Management of aircraft. An aircraft is a platform where airframe, engines, multiple components and many functional systems are integrated to achieve the intended design objective of safe flight. The different stakeholders who contribute to the overall safety & reliability in aviation include design agency/aircraft manufacturer, manufacturers of engines and components, operators, suppliers, MRO agencies providing deeper level maintenance support and of course, the aviation regulatory authorities responsible for the regulatory oversight of the different agencies mentioned herein. This paper presents an effective Reliability Control Program management. Keywords: Airworthiness, Reliability Control Program, Aircraft Reliability, Reliability Program Management

1. Objective of Reliability Control Program The objective of Reliability Control Program is to exercise reliability control for aircraft, engines, aircraft components and systems fitted on-board each aircraft operated by an aircraft operator within acceptable levels of airworthiness, reliability and with due emphasis on economics. Reliability Control Program is an event reporting system based on performance values or alert values. The program provides a system of –  Data collection and analysis of the reliability of aircraft systems & components.  Assessing the effectiveness of maintenance program on a continuous basis. Reliability Control Program supplements the Aircraft Maintenance Program (AMP) for maintaining aircraft in a continuous state of airworthiness. The Aircraft Maintenance Program ensures that the required maintenance tasks are performed on an aircraft at appropriate thresholds & intervals to prevent deterioration or to restore and improve the aircraft's inherent level of reliability. Maintenance program utilize among others, the three recognized maintenance processes: Hard Time (HT) maintenance, On Condition (OC) maintenance and Condition Monitoring (CM). Hard Time Maintenance: This is a preventive maintenance process, in which known deterioration of an item is limited to an acceptable level by the maintenance actions which are carried out at periods related to time in service of an aircraft (e.g., number of flight hours, number of landings, calendar time in days, moths, years etc.). The prescribed maintenance actions normally include servicing and such other actions as overhaul, partial overhaul, replacement of life limited components etc. in accordance with the instructions in relevant maintenance manuals, so that the item concerned (e.g. system, component, certain portion of aircraft structure) is either replaced or restored to such a condition that it can be released for service for a further specified period. On Condition Maintenance: This is also a preventive maintenance process, but one in which an item is inspected or tested, at specified thresholds & intervals, to an appropriate standard in order to determine whether it can continue in service. It is possible that such an inspection or test may reveal a need for servicing actions or replacement of an item. The fundamental purpose of On-Condition maintenance is to remove an item before its failure in service. On-Condition maintenance is not a philosophy of "fit until failure" or "fit and forget it". Condition Monitoring: This is not a preventative process, having neither Hard Time nor On-Condition elements, but one in which information on items gained from operational experience is collected, analyzed and interpreted on a continuing basis as a means of implementing corrective procedures. For example, oil consumption of engines, engine running parameters like RPM (revolutions per minute), oil pressure, oil temperature, turbine temperature etc. are monitored on a daily basis for any exceedance or adverse trends of any of the engine parameters. The monitoring & analysis of engine running parameters is called Engine Condition Trend Monitoring (ECTM). The end objective of ECTM is to rectify any defect or to remove an engine from the aircraft based on this trend analysis, before any in-flight shutdown (IFSD) of the engine. ISBN 978-81-924713-4-1

313



If aircraft system reliability remains at predetermined acceptable levels, no special maintenance or engineering action is required. Other than the preventive maintenance requirements laid down in the Aircraft Maintenance Program (AMP). Similarly, the aircraft components that are condition monitored are allowed to operate in service with no specific overhaul time, subject to continued monitoring. If a system reliability or monitored performance parameter of components exceeds unacceptable levels (alert levels or performance standards), appropriate maintenance or replacement actions are required to restore the aircraft system and/or component to an acceptable level of reliability. Such additional maintenance actions driven by Reliability Control Program are accomplished by way of issuance of “non-routine” work orders. These reliability control related maintenance actions are in addition to the scheduled maintenance actions & defect rectification undertaken on an aircraft. Items (components or systems) can be moved from one maintenance check interval to another if it leads to a reliability or maintenance cost improvement. An evaluation must be proposed to the Reliability Control Board, which can approve it or submit it to the National Airworthiness Authority, if required. In general, reducing the maintenance check interval is done by the aircraft manufacturer based on the recommendations of the Maintenance Review Board, through periodical revisions of Maintenance Planning Document (MPD). However, the aircraft operators are permitted to increase the maintenance check interval or introduce an additional inhouse maintenance task, based on the recommendations of the Reliability Control Board and/or the National Aviation Authority of the aircraft operator. This paper is based on a study conducted at one of the airline operators based in India with their 2 years of flying and maintenance data. However, for confidentiality reasons, output of the analysis is not included in the paper.

2. Process Workflow 2.1 General Flow Chart The following chart shows the main actors involved in the Reliability Control Program of an aircraft operator and their interfaces. Figure 1: Main Actors in the Reliability Control Program (Source: Author)

ISBN 978-81-924713-4-1

314



2.2 Main Actors The main actors of the reliability control program are:  Reliability Control Board (RCB)  Continuing Airworthiness Management Department  Maintenance Department  Quality Assurance Department  Flight Crew Reliability Control Board has overall responsibility for an effective Reliability Control Program and to take necessary actions to achieve the objectives defined in the program. Continuing Airworthiness Management Department collate aircraft operational data, carry out data analysis to identify the root cause of failures, propose remedial measures and ensures implementation of corrective measures, as decided by the Reliability Control Board of the aircraft operator.

3. Software Centric Approach & RCP Database The amount of data to be collected from various sources is quite high and in many cases some sort of datacleansing process need to be carried out to validate and filter the data. A database and software centric approach is necessary to maintain all required data for the Reliability Control Program. We call this database Reliability Control Program database or simply, RCP database. The quality of data entered in the RCP database is an important ingredient for the effectiveness of data retrieval and analysis. Therefore it is important to identify each source of information and to ensure that accurate data are timely captured in the database. Information given must be detailed enough for easier interpretation and future analysis. For example, after flying one sector and landing the aircraft in the destination, the pilot would have reported/entered a defect in the aircraft Technical Log Page (TLP) corresponding to the sector flown. Such reports/defects reported by the pilots are called PIREPS (Pilot Reports). PIREPS are among the most significant sources of information, since they are a direct indication of aircraft reliability as experienced by the flight crew. There are many occasions, where the pilots enter very vague or insufficient information about a defect. For instance, a PIREP may state only "Pack Fault" indication. Such insufficient information not only makes the defect identification, troubleshooting and defect rectification process difficult & time consuming, but also provides insufficient information for the aircraft operator's reliability management team. Ideally, the pilot should have entered/reported specific details of the defect and also phase of flight at which the defect occurred. The correct description of the PIREP could have been “Pack Fault indication observed during cruise with Pack 1 operating”. Though this is the ideal way to report a PIREP, there are many occasions where the PIREP contains insufficient information. Similarly, the reports/defects entered in the TLP by the maintenance team are called MIREPS (Maintenance Reports). 3.1 Data Sources 3.1.1 PIREPs & MIREPs The information typically provided in PIREP or MIREP may include the following data.  Date  Aircraft identification (tail number/registration)  Flight number  Station  Flight phase  4 digit ATA chapter code (See notes below)  PIREP/MIREP description  Action/Rectification (with the name & license number of the maintenance personnel who performed it) There are entries made in the TLP for the purpose of information only (e.g., Cat II landing performed, Nil defects, Work order number so and so carried out etc.). These entries should not be counted as a PIREP or MIREP in the RCP database. (Notes: ATA stands for Air Transport Association of America. ATA publishes specifications such as ATA Spec 100, used by aviation manufacturers, airlines and suppliers in the maintenance and repair of their respective products. It provides the industry-wide standard for aircraft systems numbering, often referred to as ATA system or ATA chapter numbers.) 3.1.2 Operational Interruptions (Delays & Cancellations) Many Operational interruptions do occur during the day to day flying operations. Operational interruptions are caused mainly due to delays, cancellations, incidents and accidents. ISBN 978-81-924713-4-1

315



Monitoring of different types of delays & cancellations occurring during the day to day operations is very important for scheduled operators (i.e., airlines). Analysis of these delays and cancellations occurring on a daily basis at various stations of an airline's operating network reveals the drawbacks or performance inefficiencies of the airline organization. Also, the delays or cancellations caused due to defects on aircraft are vital inputs to assess the reliability standards of an airline. In fact, the delays beyond a particular duration (say, 15 minutes from the scheduled departure time) or cancellations occurred are reportable to the aviation regulatory authority on a periodical basis. The delays may occur due to one or more of the reasons like delay due to defects on aircraft (technical delay), delay due to operational restrictions like ATC clearance delay, delay, due to bad weather en-route or at the destination, delay due to other reasons like late arrival of flight crew, delay due to late boarding of passengers (commercial delay), delay due to late arrival of the incoming aircraft etc. International Air Transport Association (IATA) follows a universally standardized “delay code”, to classify the type of delay. The “delay severity” is the duration of the delay suffered. Technical delays are significant for Reliability Control Program management. The information provided in a delay report typically includes the following data.  Date  Aircraft identification (tail number/registration)  Flight Number  Station  Scheduled departure time  Delay duration  Delay code / type of delay (e.g., Technical delay, Delay due to weather, Incoming aircraft delay etc.)  Reason for delay  PIREP or MIREP (if technical delay) 3.1.3 Technical Incidents Aircraft incident is an event which could have led to an accident. Aircraft accident is an incident in which there is loss of life or serious injury to personnel or in which there are major damages to aircraft or to other property. An incident could be an air incident or ground incident. Similarly, an accident could be either an air accident or ground accident. An air incident could result in the aircraft returning to the originating station (i.e., air turn back) or in the flight crew diverting the aircraft to a nearer airfield (i.e., diversion) as a precautionary measure. An incident occurring on an aircraft after the flight crew enters an aircraft with an intention to fly is also categorized as air incident. For example, an incident could occur on an aircraft while starting the engine or may be while the taxiing the aircraft to runway. In such cases, the aircraft will return back to ramp and this is called “ground turn backs” or “return to ramp”. Ground incidents or accidents are those which occur on an aircraft when the aircraft is parked on ground or while being towed on ground. In case of an incident or accident, the brief circumstance & details of the incidents or accidents are entered in the TLP. After entry of the details of the incidents or accidents in the TLP by the pilot, a maintenance person submits a detailed report on the incident or accident (occurrence report). The Flight safety department may carry out a preliminary investigation on the cause of the incident or accident, after which a detailed report is sent by the aircraft operator to the national aviation authority. All incidents or accidents may not be due to defects on the aircraft. The Technical Incident monitoring is important in order to identify potential problems affecting airworthiness and safety of operations. Some of the incidents which are caused by defects on aircraft are given below  Malfunction of an aircraft system or component, leading to aborted take-off or air turn back or diversion  Malfunction of an aircraft system or component in flight, leading to an emergency procedure or operational limitations during flight, except MEL (Minimum Equipments List – described later in the paper) coverage  Failure of the landing gear to extend or retract or uncontrolled movement of the landing gear gears and landing gear bay doors  Loss of the wheel brake system  Tire burst  Loss of more than one electrical power generation system or hydraulic power system  Flight handling degradation, vibration, buffeting  Failure of more than one attitude, airspeed, or altitude indicating instrument  Failure of emergency systems  In-flight engine flame out or shutdown  Significant primary structural failure or damage or corrosion noticed on aircraft  Structural damage caused by engine or APU (Auxiliary Power Unit) failure on ground or in-flight ISBN 978-81-924713-4-1 316





False or true warnings of fire, smoke or toxic fumes

The information typically provided in an incident “occurrence report” includes the following data  Date  Aircraft identification (tail number/registration)  Flight number  Station  Phase of flight when incident occurred  Type of incident (e.g., diversion, air turn back, ground turn back, ground incident etc.)  Description of incident and associated details like the extent of damage (if any)  Name & license number of the flight crew or maintenance person involved in the incident  Action taken / defect rectification details 3.1.4 In-Flight Shutdowns (IFSD) In-flight shutdown (IFSD) of an engine is an incident. In-flight shutdown of an engine is also referred to as “engine flame out”. It is possible that IFSD of an engine occurs on its own (un-commanded) or the pilot may decide to shutdown an engine as a precautionary measure, on account of any abnormal observations like engine oil pressure dropping below the acceptable limits or excessive vibrations experienced from engine or abnormal sound emanating from engine or engine turbine temperature increasing beyond the acceptable limits or random fluctuations in engine speed or even due to a fire warning from the engine. Flight crew reports of engine shutdowns include details of the engine indicator readings and symptoms prior to shutdown. IFSD rates provide an overall measure of propulsion system reliability. IFSDs are reported through incident “occurrence report”. The information provided in IFSD “occurrence report” includes the following data:  Date  Aircraft identification (tail number/registration)  Engine identification (Serial number)  Flight number  Phase of flight when IFSD occurred  IFSD description (including indications and symptoms before shutdown)  Name & license number of the flight crew involved in IFSD  Action/rectification 3.1.5 Aircraft Flying Details The details pertaining to each sector flown by an aircraft are captured from the corresponding sector log page in an aircraft Technical Log book. Aircraft Technical Log book is always carried in the cockpit of an aircraft. The aircraft flying details collated from the sector log page (TLP) includes the following data.  Date  Aircraft identification (tail number/registration)  Flight Number  Sector details (Take off station & landing station)  Aircraft block hours  Flight time / time in air  Flight cycle/landings  Type of flight (Revenue flight, ferry flight, training flight etc.) 3.1.6 Component Removals An aircraft is essentially a platform where multiple aircraft components (including engines) and various systems (e.g., electrical system, fuel system, hydraulic system, pneumatic system etc.) are integrated on the airframe to operate with optimal performance & reliability to achieve the intended functions for safe flight. Majority of the aircraft components are designed as self contained modules, which are generally referred to in the aviation industry as “Line Replaceable Units” (LRUs) or sometimes, as “Rotables”. Thus, when a defect is encountered on an aircraft, the aircraft operator's maintenance team carry out defect investigation with a view to identify the component or a group of components and/or the aircraft system to which the cause of the defect can be attributed. In a vast majority of the cases, the defect is rectified by replacement of the defective component or components. This essentially means that, the aviation industry generally follows a “repair by replacement” philosophy for rectification of defects noticed on an aircraft. Thus, the number of aircraft components removed from an aircraft and those fitted in lieu as part of the defect rectification process on a day to day basis are very ISBN 978-81-924713-4-1

317



high. And, typically an airline will have many different types of aircraft and with multiple aircraft registrations under each of the aircraft type. Thus, the number of components getting removed and fitted on different aircraft in the fleet of an aircraft operator is remarkably high. The information provided regarding component removals include the following data.  Date  Aircraft tail number  Work order or sector log page (TLP) reference  Component location  Component removed details (Part number & serial number of the component removed)  Fitted component details (Part number & serial Number of the component fitted, in lieu)  Airframe hours/cycles at removal  Component hours since new (Also called as “Time Since New (TSN))  Component cycles since new (Also called as “Cycles Since New (CSN))  Component hours since overhaul (Also called as “Time Since Overhaul (TSO))  Component cycles since overhaul (Also called as “Cycles Since Overhaul (CSO))  Component hours since check/calibration etc. (Also called as “Time Since Check (TSC))  Component cycles since check/calibration etc. (Also called as “Cycles Since Check (CSC))  Reason for removal (Scheduled/unscheduled/robbing/loan return) 3.1.7 Component Confirmed Failures The line maintenance facility will not have any specific test benches or specialized test equipment to ascertain whether a particular component being removed from the aircraft is actually defective or not. Most of the unscheduled removals happen in a line maintenance environment based on the fault code displayed in the “Built in Test Equipment” (BITE) available as part of the aircraft system. All aircraft systems are not provided with a BITE facility. Moreover, more often than not, the fault code displayed on BITE or in the trouble shooting manual of the aircraft need not exactly pin point a faulty component. This can lead to removal of components as “suspected defective”. After the rectification of the reported defect, the serviceability of the aircraft system is assessed by system functional check on the aircraft itself or through ground running of an engine or engines or through a maintenance test flight, based on the criticality of the defect and also based on the test environment required to assess the aircraft serviceability. For example, a defect reported in the air conditioning system of an aircraft is reassessed for its serviceability after the defect rectification, by ground running an engine or both engines, as the case may be. Similarly, a defect reported in VHF (Very High Frequency) communication system can be rectified by replacement of Transmitter-Receiver and the functional check of the VHF system can be carried out on ground to assess serviceability of the system. There are occasions when a defect recurs repeatedly despite replacing the suspected component or components. Such defects are called “Repetitive Defects”. An aircraft operator is required to establish a system to monitor & track the repetitive defects occurring on different aircraft in the fleet. Generally, during the course of rectification of a repetitive defect, many components may get removed from the aircraft as part of the rectification process. There are occasions that the real cause of the repetitive defect could have been an intermittent loose connection in one of the wiring connectors in the aircraft system and one or more of the components removed may not be really defective. The defective components removed from different aircraft are sent to component repair stations, which are approved by regulatory authority, to undertake such repair or overhaul. The component repair station could be an in-house facility or it could be an organization external to the aircraft operator. There could be occasions that a component which was suspected to be faulty was found serviceable during the course of repair. Such cases are referred to in the aviation industry as “No Fault Found” (NFF) cases. With the exception of self-evident cases, where a component failure is confirmed, other cases of unscheduled removals are followed by a workshop report, in which the reported defect is confirmed or denied by the approved repair station to where the component was sent by the aircraft operator for repair. However, engines and major assemblies like landing gears, APUs, propellers etc. are always provided with a shop visit report, indicating the condition of these major assemblies during the inspection in the repair station and also indicating the details of repair, overhaul work carried out in the shop and also listing out the modifications (Service Bulletins & Airworthiness Directives) carried out on these assemblies/components during the shop visit. Trouble shooting process carried out by the aircraft operator is validated by assuring that the Mean Time Between Unscheduled Removal (MTBUR) rate experienced by the aircraft operator for a particular component and the Mean Time Between Failure (MTBF) rate laid down for that component do not differ by more than a factor of 2 or 3. If this factor is exceeded, then trouble shooting procedure followed should be reassessed and corrective action is required to be initiated, where needed. ISBN 978-81-924713-4-1

318



The information provided includes the following data.  Date  Part number of the component  Serial number of the component  Detailed shop findings, with "No Fault Found" remarks, where applicable 3.1.8 Aircraft Deferred Defects (ADD) Some of the defects reported on an aircraft (PIREP or MIREP) need not be rectified immediately. In such cases, the aircraft can be released for flying with those defects deferred for rectification at a later occasion. The deferment action is regulated and such deferment is valid for a laid down duration only, say for 24 hours or for 72 hours or 7 days etc, as the case may be. The list of those defects which can be deferred and the time limit by which the deferred defects are to be rectified are laid down in the “Minimum Equipment List” (MEL) document of an aircraft type. MEL is approved by the National Aviation Authority. Some of the deferred defects or MEL items would need additional maintenance action and/or added precautionary measures from the part of pilot or even may impose operational restriction on an aircraft. MEL document is prepared by an aircraft operator, based on the Master Minimum Equipment List (MMEL) document issued by aircraft manufacturer for an aircraft type. Thus, an Aircraft Deferred Defect (ADD) is an inoperable system or component, which does not require an immediate corrective action according to MEL, and may therefore be deferred for rectification within the laid down time limit, as per the approved MEL. The monitoring of ADDs results in launching corrective actions in terms of additional spares provisioning, review of aircraft operating schedule, wherein adequate time is made available for defect rectification during transit of aircraft, additional manpower etc. The information related to the ADDs includes the following data.  Date  Aircraft identification (tail number/registration)  Flight number  Description of the defect & reason for deferral  MEL reference 3.2 Data Extraction / Data Sharing All data from the data sources mentioned in the previous section may not be fed directly to the RCP database. This is because of the fact that almost all airlines already have systems to capture some of these data. For example, the aircraft operator may be using a Flight Operations software in which Aircraft Flying Details (Section 3.1.5) are already captured. So, based on the level of automation in other areas, part of the data may be already available in other software systems. If that is the case, “data extraction programs” are suggested to extract whatever data available in other systems to the RCP database on a periodic basis. Also, there is a possibility to build the RCP database as part of an existing software system such as Aircraft Engineering Maintenance software so that RCP database will become an extension to an existing system. This way, data can be shared between RCP database and other databases and a fully integrated system can be built by combining closely related functions like engineering maintenance, quality control and reliability analysis. 3.3 Data Processing and Performance Measurement 3.3.1 Monitored Parameters The parameters which are considered or monitored for performance measurement, as part of a Reliability Control Program are given below. PIREPS/MIREPS: Defects reported in TLP are computed per 100 Revenue Take off, in general and by ATA chapter. ATA chapter is a universally standardized representation of different aircraft systems. For example, ATA Chapter 21 deals with Air conditioning system, ATA chapter 28 deals with Fuel system, ATA chapter 32 deals with Landing gear etc. Operational Interruptions: Aircraft Operational Interruptions due to technical reasons are computed per 100 Revenue Take off, in general and by ATA chapter. Component Removals and Failures: Confirmed component failure rate are computed by Flight Hours or by component running hours (MTBUR, MTBF), or by cycles. Engine and APU: IFSDs and unscheduled removals of engines and APU (computed per 1000 Flight Hours or per 1000 Engine/APU running hours) provide a direct measurement of power plant reliability. Unscheduled ISBN 978-81-924713-4-1

319



removal and IFSDs of engines and Auxiliary Power Units (APU) are constantly monitored to ensure that their rate does not exceed the established alert levels. Technical incidents (such as Air turn back, Diversions, Ground turn back, Ground incidents etc.) are also monitored and reviewed to determine any adverse trends of occurrence, so that corrective measures can be initiated. Aircraft Deferred Defect (ADD): The number of ADDs is monitored for each aircraft registration, in general and by ATA Chapter. 3.3.2 Monitoring, Statistical Evaluation Reliability performance monitoring is based on the follow-up of trends of the parameters monitored in the Reliability Control Program, in comparison to the “alert” levels established for those parameters. The purpose of such a system is to allow the monitoring of aircraft operation, to identify ineffective performance and to take appropriate measures in order to achieve acceptable performance. Alert levels are established using statistical methods, as explained later in this paper. When the rate of a monitored parameter exceeds the established alert level, an investigation will be carried out to determine the cause of the “alert level exceedance” and corrective action or actions will be worked out & implemented by the Reliability Control Board to restore the monitored criterion within the acceptable rate. When a new aircraft type is introduced in to an aircraft operator's fleet, sufficient operating data will not be available in the RCP database to establish the required alert levels for each of the above mentioned parameters to be monitored. In such cases, qualitative assessment of the performance of each aircraft registration under an aircraft type in the fleet will be resorted to as a method for performance measurement. Some aircraft operators would follow the practice of obtaining the alert levels established by another aircraft operator operating the same aircraft type in a similar operating environment, and use such alert levels towards performance measurement, till the RCP database gathers sufficient operating data over a period of operation of that aircraft type. 3.3.3 Alert Levels Settings The purpose of an Alert Level is to identify significant deviations from a previously acceptable standard of performance. The level should not be set too open that a major increase in the occurrence rate does not produce an alert, or too limiting that the normal rate and distribution of events result in spurious alerts. Any change in the alert level computation requires the approval of the Reliability Control Board. Computation Alert level of parameters described under “Monitored Parameters" in section 3.3.1 is computed based on the standard deviation. A 12-month history is used to calculate the alert level with the following mathematical model. (Transport Canada - Circulars) σ = √((∑(y – ỹ)2/n) where σ is the standard deviation y is the monthly rate ỹ is the monthly average rate for the last n months. That is, ỹ = ∑y / n Then, the alert interval value, a = ỹ ± k · σ where k is a constant called “alert factor”. The probability to have a spurious alert depends on k. k is usually set at 2. But for aircraft system with highly dispersed failure rate, k can be set at 3 in order to reduce the number of spurious alerts. It should be noted that either upward deviation or downward deviation is taken into consideration based on the type of value being monitored. When a new aircraft type is introduced in Reliability Control Program, qualitative assessment of its performance is used during the first 6 months of operation. Then, the first 6 months of operation will serve to calculate the Alert Level. After 12 months of operation, the normal 12 month history is used. In case of introduction of a new aircraft type to an aircraft operator's fleet, some aircraft operators would follow the practice of obtaining the alert levels established by another aircraft operator operating the same aircraft type in a similar operating environment, and use such alert levels towards performance measurement, till the aircraft operator gathers sufficient operating data over a period of operation of that aircraft type. So, the software system should have a facility to manually input alert levels in the RCP database for newly inducted aircraft. ISBN 978-81-924713-4-1

320



When an alert is generated, it will be reviewed to determine if a "true alert" has occurred before completing the detailed engineering analysis. Revision Alert Level value will be recalculated every month using the formula given in section 3.5.2. However, a more restrictive alert level value can be fixed, if necessary (e.g., when performance of the monitored parameter has improved to a level so that abnormal variations do not trigger any alert). An exceedance of the alert level has to be investigated and will be reviewed by the Reliability Control Board of the aircraft operator. Again, the software should have this provision to set more restrictive values for the alert levels and such changes must be authenticated by Reliability Control Board. 3.4 Maintenance Program Adjustment An aircraft operator must have an Approved Maintenance Program (AMP) for each type of aircraft operated by the aircraft operator. Each maintenance program must have a Reliability Control Program running alongside it. Maintenance program needs to be adjusted based on the observations and findings emanating from the Reliability Control Program (RCP). Reliability Control Program (RCP) serves as a support for  Changing task content of maintenance programs  Escalating/reducing task intervals  Transferring an item from one maintenance process to another one To substantiate an internal request from any of the different departments of an aircraft operator for changing maintenance programs, a complete analysis is required. This analysis is performed by the Continuing Airworthiness Management Department of the aircraft operator. Each proposed change is analyzed, both from a safety and an economical point of view. The objective of the study is to show that the change proposed to the Maintenance Program will not lead to an unacceptable deterioration in the levels of airworthiness and operational capability. In general, the goal is to optimize the existing maintenance program, wherein the inherent reliability of the aircraft and its equipment is exploited to maximum, thus providing a scenario that will lead to minimization of maintenance costs, without compromising safety & reliability. 3.4.1 Maintenance Program Task Change A complete analysis will be performed to substantiate the request for a task interval escalation. The analysis takes into consideration factors such as  Equipment and aircraft operating environment  Percentage of potential degradation attributable to FH, FC, Calendar time  FC/FH ratio and aircraft utilization  Effect of functional failure(s) on safety – safety critical or not  Impact on operating capability  Cost of repair/overhaul  Past performance  Shop reports  General reliability of associated and back-up systems If the analysis carried out by Reliability Control Board of the aircraft operator reveals a favorable case for the maintenance task interval escalation, then a report (including the analysis of all concerned items) recommended is forwarded to the National Aviation Authority for consideration and approval. The general policies followed to escalate an individual maintenance program task interval are discussed below.  For tasks where failure/deterioration is likely to be systematic (e.g., checks for environmental deterioration like corrosion), an evaluation of check findings from a representative sample (target is 20% of the fleet size) is taken to confirm acceptable performance. The sample must have utilized 90% of the task's current interval.  For tasks where failure/deterioration is likely to be random (e.g., operational/functional checks of systems or components), an evaluation of check findings from as large a sample as practicable will be taken (target for tasks with interval more frequent than C-check is to review findings from 3 aircraft (for non-safety critical tasks) and 5 aircraft (for safety critical tasks) over a one year period. For Ccheck and less frequent tasks, the maximum available data will be utilized). The samples used must have utilized 90% of the task's current interval.  For tasks involving aircraft components, the following course of action could be considered ISBN 978-81-924713-4-1

321


 


evaluation of reliability status and corrective action programs, with a specific review of all Alert Notification reports issued in the last 12 months evaluation of shop findings relative to wear or deterioration versus operating hours/cycles/age, since last overhaul for 'hard time' components, or since the last check for 'on-condition" components in order to confirm acceptable performance

The genesis of some of the scheduled maintenance tasks on an aircraft can be traced back to the design stage of an aircraft type. For example, there could be cases of design limitations which were noticed & documented during the design, development & “type certification” stage of an aircraft type. The “type certification” itself would have been subject to ensuring periodical inspection of those areas or components on the aircraft on a periodical basis. Such certification conditions are ensured by inclusion of such maintenance or inspection requirements as maintenance tasks in MPD. Such maintenance tasks which are having traceability to the certification requirements are called as “Certification Maintenance Requirement” (CMR) tasks. CMR tasks are further classified as CMR* tasks and CMR** tasks. The task compliance interval of CMR* tasks (CMR one star tasks) should never be escalated. The task interval of CMR** tasks (CMR Two star tasks) could be escalated, but only after analysis and with specific permission of the aviation regulatory authority. The interval for “Letter checks” (e.g., A check, C check etc.) can also be considered for escalation based on an effective Reliability Control Program, much like the same manner explained above for escalation of interval of a maintenance task. 3.4.2 Interval Escalation Guidelines (Typical Procedure) The typical procedure followed by an aircraft operator for escalation of interval of a maintenance task or a “Letter check” existing in the maintenance program is given below. Step 1: Reliability program review  List problems which may be associated with scheduled maintenance  Analyze the maintenance task or multiple tasks in a Check, to determine if recommendation for interval escalation is feasible Step 2: Determine desired interval, based on following factors  Aircraft utilization  Aircraft availability for maintenance resources  Operating environment & climatic conditions  Findings or observations during previous checks  Number of checks performed previously  World-wide fleet experience for that aircraft type maintenance costs Step 3: Review program for exceptions and identify exceptions arising from  Airworthiness Limitation tasks – CMRs  ADs/CNs and National Requirements  SBs and other recommendations from manufacturer  Ageing aircraft maintenance requirements  Others (if any) Step 4: Obtain manufacturer's advice - airframe and engine manufacturers may be consulted for advice on number of checks to be performed to validate the inspection findings and also for ascertaining any exceptions known to the manufacturer(s). Step 5: Maintenance Program Task or Check findings - Findings from previous (consecutive) tasks/checks are listed, analyzed and the tasks or checks which have potential for interval escalation are identified. Step 6: Collate information - The background data such as the findings of the tasks/checks previously performed, fleet statistics, reliability statistics, exceptions and the result of analysis are collated and tabulated for the internal approval by the Reliability Control Board of the aircraft operator. Final approval for interval escalation of a maintenance task or check is accorded by the National Aviation Authority. Step 7: Substantiation - Once the task or check interval escalation has been implemented, the maintenance program and reliability monitoring system should be reviewed for adverse effects or trends, if any, which result from the interval escalation. 3.5 Special Sections There are a couple of areas where additional parameters have to be considered for specific analysis. From the airworthiness point of you, engines and auto-land systems require special attention. ISBN 978-81-924713-4-1

322



3.5.1 Engine Condition & Trend Monitoring (ECTM) The aim of the Engine Condition and Trend Monitoring (ECTM) is to  Assess the engine performance and health of engines  Provide a “quick look” of engine parameters towards fault detection  Monitor any adverse trend in engine parameters towards early detection of an impending engine malfunction or failure  Reduce unscheduled maintenance  Monitor guarantees  Reduce the overhaul costs Modern day aircraft are fitted on-board with Flight Data Recorders (FDR) also known as “Black Box”. Various parameters related to aircraft flying conditions, like altitude, airspeed, outside air temperature and aircraft flying control positions like elevator, rudder, aileron positions etc. are recorded in the FDR in real time. Similarly, the parameters of all the engines are also recorded real time in the FDR. The Engine parameters are downloaded from FDR by the aircraft maintenance team on a daily basis and sent to the aircraft operator's Continuing Airworthiness Management Department for Engine Condition & Trend Monitoring (ECTM). Engine parameters corresponding to the “cruise” phase of flight are used for ECTM. Typically, the data/information retrieved from FDR for ECTM of each engine fitted on an aircraft shall include the following  Date and time  Aircraft registration  Engine serial number  Engine position  Altitude  Air speed (or Mach number)  Total air temperature  Engine pressure ratio (EPR)  Rotor speeds (N1 and N2)  Fuels flow  Oil temperature  Oil pressure  Vibration level (N1 and N2) Most of the airlines have a technical agreement with the engine manufacturers, wherein the ECTM data downloaded from the aircraft FDR can be input on a daily basis, by the aircraft operator in to the engine manufacturer's web portal dedicated for automated ECTM monitoring. The automated ECTM web portal is designed to notify the aircraft operator & the engine manufacturer with automatic alerts, based on the trend analysis of the parameters of the particular engine and also based on the exceedance of any parameter occurred on the engine. On receipt of such alerts, the aircraft operator is expected to analyze the cause of the alert and undertake suitable remedial actions or unscheduled maintenance of the engine. However, there are aircraft operators carrying out the ECTM with in-house expertise and facilities. Some of the latest aircraft have ACARS system (Airline Communications, Addressing and Reporting System) fitted on-board, with corresponding network of radio trans-receivers on ground. The ACARS capability enable aircraft to transmit the engine parameters directly from the aircraft through a data link, which in turn are made available to the ECTM monitoring web portal of the engine manufacturer. An effective Engine Condition & Trend monitoring program will greatly assist in managing and forecasting the likely unscheduled maintenance on engines and it should be part of the RCP database. 3.5.2 Auto-land System Reliability Auto-land system reliability is also monitored through Reliability Control Program. Auto-land system reliability is intended to ensure that the airborne electronic equipment (i.e., on-board avionic equipment) used for CAT II and CAT III operations continue to function at a level of safety and reliability, when landing in low visibility conditions. Quite often, aircraft are expected to approach for landing in poor visibility conditions and with different “Runway Visual Range”. The “Approach Category” for landing is classified as Category I {CAT I}, Category II {CAT II}, Category III A {CAT III A}, Category III B {CAT III B} and Category III C {CAT III C}, depending on the Runway Visual Range at the time of approach. The Runway Visual Range for CAT I approach is 550 meters, for CAT II approach is 300 meters, for CAT III A approach is 200 meters, for CAT III B approach is 75 meters and for CAT III C approach is “zero” visibility. As of 2012, CAT III C approach is not yet in operation anywhere in the world as it requires guidance to taxi in zero visibility as well. CAT II /CAT III operations are dependent on four elements in order to maintain the required level of safety: ISBN 978-81-924713-4-1 323





The aircraft must be approved for CAT II/CAT III operations with an automatic landing system, which provides automatic control of the aircraft during approach and landing  The airfield must be approved for CAT II/CAT III operations  Flight crew training  The airline Reliability Control Program serves to establish a specific maintenance program for the Auto land system. Reliability reporting, during the evaluation program and during line operations should be part of a continuous monitoring process. There should be an initial and recurrent training program for personnel performing maintenance work on CAT II and CAT III airborne systems and equipment. Also, any changes to maintenance procedures and practices which were established for CAT II / CAT III approval process should be transmitted to the Airworthiness Authorities before adoption. Maintenance Program The Maintenance Program requirements for the Auto-land System and its equipments are covered in the Maintenance Planning Document (MPD) issued by the aircraft manufacturer. The unscheduled maintenance tasks are carried out as per the procedure and test laid down in the relevant chapter of the Aircraft Maintenance Manual. In case any Auto-land system related defect is deferred on an aircraft registration, the operational capability of the aircraft will be limited / downgraded so as not to perform an auto land approach and the flight crew will be informed during flight dispatch process or before commencement of the flight about such a limitation. Aircraft which are certified for Auto-land will have to be maintained as per the maintenance program with certain additional tasks and also with the Auto-land components fitted in the system, which meet the Auto-land requirements. For example, an aircraft certified for Auto-land is fitted with an Instrument Landing System (ILS) Receiver Part number 9876-1, which is an Auto-land significant component part number. Due to a defect in the ILS Receiver and due to non-availability of the spare item, the aircraft was fitted with another Non-auto-land significant ILS Receiver, with an alternate Part Number 7654. In such case, the aircraft can be released for flying, but is to be downgraded for Auto-land capability. Continuous Monitoring Once authorized to operate its fleet for CAT II or CAT III precision approaches, in-service experience must be collected, monitored and reported by the aircraft operator periodically. The in-service experience collected will include the following details  Total number of CAT II or CAT III approaches carried out, by aircraft type, where the airborne CAT II or CAT III equipment was utilized to make satisfactory approaches as per the applicable CAT II or CAT II minima.  Total number of unsatisfactory approaches by airfield and by aircraft registration and one or more of the following reasons for each of the unsatisfactory approach  Airborne equipment faults  Ground facility difficulties  Missed approaches due to ATC instructions  Other reasons The continuous monitoring should permit the detection of any decrease in the level of safety before it becomes hazardous. In case of any adverse trend, investigation will be initiated to understand causes and to take suitable remedial actions for airborne system reliability improvement and/or for effecting changes to maintenance procedures. So, this too, must be part of the RCP database.

4. Conclusion A comprehensive study is conducted to suggest all the aspects to be considered when preparing and running a Reliability Control Program for aircraft. In order to manage the program effectively, a software centric approach is suggested. All data requirements are identified and a database (RCP database) is suggested. Details of the analysis are provided and action-plans for using the output of the analysis are discussed – maintenance program task change and international escalation procedure. Also, 2 areas, engines and auto-land system, that require specific analysis are identified and data parameters are discussed.

5. Bibliography 1. 2.

Charlotte Adams (2009). Understanding MSG-3. Aviation Today, July 1, 2009. Air Transport Association of America, (1970), Airline/Manufacturer Maintenance Program Development-MSG-2.

ISBN 978-81-924713-4-1

324


3. 4. 5. 6. 7. 8. 9. 10. 11. 12. 13. 14.

15. 16. 17. 18. 19. 20. 21. 22.

23. 24. 25. 26.

27.

28.

29. 30.

31. 32. 33.


Airbus Industry (2010), "Aircraft Condition Monitoring System (ACMS) Description and Operation ATA 31-36-00", in Airbus Industry, Toulouze, pp. unpublished document. Airbus Industry (2010), "Central Maintenance Computer (CMC) Description and Operation ATA 4513-00", in Airbus Industry, Toulouze, pp. unpublished document. Airbus Industry (2010), "Central maintenance system (CMS) - description and operation ATA 45-10-00", in A340 aircraft maintenance manual, Airbus Industry, Toulouse, pp. unpublished document. Airbus Industry (2010), "Central Maintenance System (CMS) Acquisition/Interface Description and Operation ATA 45-12-00", in Airbus Industry, Toulouze, pp. unpublished document. Airbus Industry (2010), "Central Maintenance System (CMS) Operational Use-Description and Operation ATA 45-11-00", in Airbus Industry, Toulouze, pp. unpublished document. Aircraft Commerce Journal (2006), "Aircraft owners's & Operator's Guide: A320 Family", [Online], no. Issue No. 44. Aslin, M. and Cole, L. (1988), "Central maintenance computer system - A bold step forward on the 747-400", AIAA/IEEE Digital Avionics Systems Conference, 8 th, San Jose, CA, pp. 324. ATA, I. a. I. (1992), Airline Industry Standard World Airlines Technical Glossary, Fourteenth Edition ed, ATA, IATA and ICCAIA, USA. Bengtsson, M. (2004), "Condition Based Maintenance Systems–An investigation of technical constituents and organizational aspects", Licentiate thesis, Mälardalen University, Eskilstuna, Sweden. Canadian Airworthiness Regulations (CAR) (2012), Part V – Airworthiness. Chiu, C., Chiu, N. H. and Hsu, C. I. (2004), "Intelligent aircraft maintenance support system using genetic algorithms and case-based reasoning", The International Journal of Advanced Manufacturing Technology, vol. 24, no. 5, pp. 440-446. Civil Aviation Department, Hong Kong, China (2011). Aircraft Maintenance Schedules and Programmes - Information and Guidance, CAD 452, Issue 2 December 2011. DGCA, India (2010). CAR-M Continuing Airworthiness Requirements, Revision 0, March 2, 2010. European Aviation Safety Agency (2012). Part-M, Revision August 2012. Federal Aviation Regulations, USA. FAR Part 121 SUBPART L (FAR 121-363, 365, 367, 368, 373), Amended in various years. European Aviation Safety Agency, Airworthiness Directives. (Issued in various years). Federal Aviation Administration, Airworthiness Directives. (Issued in various years). Kinnison, H. A. (2004), Aviation Maintenance Management, first ed, McGraw-Hill, USA. Kothamasu, R., Huang, S. H. and VerDuin, W. H. (2006), "System health monitoring and prognostics a review of current paradigms and practices", The International Journal of Advanced Manufacturing Technology, vol. 28, no. 9, pp. 1012-1024. Kumar, D., Crocker, J. and Knezevic, J. (1999), "Evolutionary maintenance for aircraft engines", Reliability and Maintainability Symposium, 1999. Proceedings. Annual, IEEE, pp. 62. Lufthansa. (1995), Training Manual on ATA Chapters 71-80 for CFM-56 5A Engine Frankfurt. Rao, B. K. N. (1996), Condition monitoring handbook, Elsevier, Oxford. Service Bulletins related to ATR-72-500, Beech Super King Air B-200, Hawker Sidley HS-125, Hawker 800XP, Hawker 900XP, HS125-800, Global Express 5000, Falcon 2000, Grand Caravan, Pilatus PC-12/45, Challenger 300, Cessna 525, Cessna CJ2-525A, Cessna Caravan, Premier 1A, Cessna CJ2+, various Boeing models, various Airbus models). Service Bulletins related to Bell 206 L, Bell 206L3, Bell 206B3, Bell 230, Bell 212, Bell 407, Bell 412 HP, Bell 429, Eurocopter EC-130, Agusta Westland AW109, Dauphin AS 365 N3, AS-355, AS 350, Ecureuil AS355F1). Syam, S., Jagathyraj, V. P. (2013). Airworthiness Monitoring of Aircraft - a Rule Based Approach to Task Management. In International Conference on Technology and Business Management, March 1820. Thurston, M. and Lebold, M. (2001), Standards developments for condition-based maintenance systems, Citeseer. Thurston, M. G. (2001), "An open standard for web-based condition-based maintenance systems", AUTOTESTCON Proceedings, 2001. IEEE Systems Readiness Technology Conference, IEEE, pp. 401. Transport Canada, Circulars (various). Transport Canada, Airworthiness Directives. (Issued in various years). Tsang, A. H. C. (1995), "Condition-based maintenance: tools and decision making", Journal of Quality in Maintenance Engineering, vol. 1, no. 3, pp. 3-17.

ISBN 978-81-924713-4-1

325



34. US Patent (2002). “Aircraft Maintenance Tracking System” (US Patent No. US 6,418,361 B2 dated 09 July 2002). 35. US Patent (2004). “Aircraft Maintenance Program Manager” (US Patent No. US 6,795,758 B2 dated 21 Sep 2004). 36. Wu, H., Liu, Y., Ding, Y. and Liu, J. (2004), "Methods to reduce direct maintenance costs for commercial aircraft", Aircraft Engineering and Aerospace Technology, vol. 76, no. 1, pp. 15-18.

ISBN 978-81-924713-4-1

326

AIRCRAFT RELIABILITY CONTROL PROGRAM MANAGEMENT – SOFTWARE CENTRIC

Recommend Documents