GOVERNMENT OF INDIA

OFFICE OF THE DIRECTOR GENERAL OF CIVIL AVIATION

TECHNICAL CENTRE, OPP SAFDURJUNG AIRPORT, NEW DELHI

CIVIL AVIATION REQUIREMENTS

SECTION 2 - AIRWORTHINESS
SERIES 'D' PART II
1st JANUARY, 1985 EFFECTIVE: FORTHWITH

Subject : Aircraft Maintenance Programme and their approval.

1. APPLICABILITY :

Aircraft Rule 60(2) authorizes DGCA to specify standard of maintenance of

aircraft, aircraft component and item of equipment. This series of CAR lays down
detailed compliance standard of maintenance. The requirements of CAR are
applicable to airlines and non-scheduled operators as well as private operators.

2. DEFINITION :

Airworthiness :

The continuing capability of the aircraft to perform in a satisfactory manner the flight
operations for which it was designed.

Maintenance :

The action or a set of actions including inspection,servicing and determination of

condition required to achieve a desired out-come which restores an aircraft part,
equipment in serviceable condition.

Overhaul:

Overhaul means stripping a unit and restoring it to its original design performance
level after replacing/reworking parts to a given standard.

Damage Tolerant :

An item is to be judged damage tolerant if it can sustain damage and the remaining
structure can withstand reasonable load without structural failure or excessive
structural deformation when the damage is detected. This includes damage due to
fatigue, accidental damage and damage due to environmental factors.

Structural Significant item :

A structural detail, structural element or structural assembly is judged significant because of

the reduction in aircraft residual strength or loss of structural functions which are subsequent to
its failures.

th
Revision 2, 18 August, 2005 1
CIVIL AVIATION REQUIREMENTS SECTION 2-AIRWORTHINESS
SERIES 'D' PART II 1ST JANUARY, 1985

Hard Time:

This is a failure preventive process in which deterioration of an item is

limited to an acceptable level by the maintenance actions, which are
carried out at periods, related to time in service (e.g. calendar time,
number of cycles, number of landings). The prescribed actions normally
include servicing and such other actions as overhaul, partial overhaul,
replacement in accordance with instructions in the relevant manuals, so
that the item concerned (e.g. system, component, portions of structure) is
either replaced or restored to such a condition that it can be released for a
further specified period.

On Condition:

This is also a failure preventive process but one in which the item is
inspected or tested, at specific periods, to an appropriate standard in order
to determine whether it can continue in service (such an inspection or test
may reveal a need for servicing actions). The fundamental purpose of On-
Condition is to remove an item before its failure in service. It is not a
philosophy of 'fit' until failure or 'fit and forget it'.

Condition Monitoring:

This is not a preventive process, having neither Hard Time nor On-
Condition elements, but one in which information on items gained from
operational experience is collected, analyzed and interpreted on a
continuing basis as a means of implementing corrective procedure.

3. Purpose:

It is essential for the continued airworthiness of aircraft/aircraft systems

that there be an efficient maintenance program applicable to each aircraft.
With the change of size, complexity and high performance of aircraft and
also with improved design techniques it is essential that a more
knowledgeable approach is made to the control of maintenance. The
earlier concept of stripping and overhauling of all aircraft components,
items of equipment to ensure the airworthiness is no longer justified
considering improved design techniques, redundancy in the system, high
degree of built-in reliability and cost involved in carrying out overhaul as
airlines have to fly aircraft not only safely but also economically.

4. Primary Maintenance Process:

It has been recognized by the

various airworthiness authorities that the airworthiness of
aircraft and safety of its operation can be very well maintained by three

Revision 2, 18th August, 2005 2

CIVIL AVIATION REQUIREMENTS SECTION 2-AIRWORTHINESS
SERIES 'D' PART II 1 ST JANUARY, 1985

following processes:-

(a) Hard Time Maintenance Process: This process recognizes that the component
or the part has got direct relationship between reliability and the age and also
its failure on the aircraft may have direct effect on the safety. Failure rate and
premature removal could be very well analyzed to establish that the
components/parts have been failing after reaching particular hours of
operation at which it is most desirable and efficient to remove the component
from the aircraft and carry out overhaul rather than let it fail on the aircraft. The
process is called the failure preventive maintenance process. This process is
suitable for operators with very small fleet of aircraft, low utilization and smaller
in size where system redundancy and modern sophistication has not been built
in the design stage and the operator may not have a large support organization
of Quality Control/record keeping.

(b) On Condition: On condition maintenance concept was later on developed where

the components deterioration or determination in reliability could be measured or
properly assessed without stripping the component by physical measurement,
benchcheck, internal leak rate checks, and the operator has to justify and
substantiate necessary data and support either from the manufacturers or from his
own operational data analysis with the particular components performance that
failure resistance could be detected by in situ maintenance for functional check and
establish a performance standard after which the component will be removed
and again brought to its original performance level and released for service for
specified period.

(c) Condition Monitoring: Condition Monitoring components have no overall control

and are operated to failure. No maintenance task is required to evaluate condition,
life expectancy or reliability degradation to replace the item before it fails. Neither
'Hard Time' nor 'On Condition' standards can control the reliability or failure rate
of CM items. Replacement of CM items is an UNSCHEDULED maintenance
action.

Note : Notwithstanding the above, the definitions given by the manufacturer shall prevail
over those given in this CAR.

5. Approval of the System :

An operator depending on his capability, staff and other support organization

should apply to the Regional Airworthiness Office for approval of his
Maintenance Program. He can select either of the above three maintenance
programs or a combination of these processes as the primary means of controlling the
maintenance activities thereby leading to effective airworthiness

3
CIVIL AVIATION REQUIREMENTS SECTION 2-AIRWORTHINESS
SERIES 'D' PART II 1 ST JANUARY, 1985

control. Manufacturer's recommendation will be the main guiding

factor. Multi Cell components can have all the three
processes applied to e.g. an engine having a number of
components (cells) some of which may be time limited
(discs etc.), the others may be depending on the ON
Condition for example deterioration of engine power and
checked by Condition Run and some on 'On Condition
Monitoring' concept.

6. Monitoring of the Approved Maintenance Process :

The maintenance process approved for an operator will have

to be monitored continuously for its result and changes
implemented arising out of this monitoring. Monitoring is
basically based on statistical analysis of various
performance parameters.

(1) Pilots' Report :

Occurrence of malfunction in flight are recorded in the

Technical Log by the Flight Crew for each flight. Pilots
also record various instrument data for monitoring the
condition of the engine and airframe. The engine
performance can be very well monitored by the inflight crew
monitoring of instruments. These monitorings indicate long
term trend and are very useful in recognizing impending
failure/deterioration. The Pilots' report etc. are
calculated as rate per 1000 hours of operation or as a
number of per 100 departures. The operator has to establish
an Alert level based on experience of initial operation and
it can be continuously up-dated by means of what is called
Rolling average either quarterly or six monthly.

(2) Engine Inflight Shut-Down :

Engine Inflight Shut-Down may result in removal of the

engine for further overhaul or repair. Analysis of the
causes and the failure give lot of information on the
method of operation and the standard of engine overhaul, the
basic design of the engine. Feed-back from strip report
will be very much beneficial for enhancing the reliability
of Power Plant.

(3) Aircraft Mechanical Delay and cancellation of services.

Performance of the operator or an airlines organization is

very well judged by the mechanical delays to scheduled
services and also by the cancellations. All delays of more
than 15 mts. as per the present approved practice are to be
reported and the operator support system (Quality Control
System) has to assess cause and take corrective action. The
delays are classified and assessed ATA systemwise and
dispatch reliability calculated.

4
CIVIL AVIATION REQUIREMENTS SECTION 2-AIRWORTHINESS
SERIES 'D' PART II 1 ST JANUARY, 1985

(4) Components Unscheduled Removals or Premature Removals:

This is another factor which would help the operator to

assess the condition of the component maintenance behaviour
after proper investigation of confirmed failures. Such
components are to be investigated by the operators
reliability control section and necessary corrective action
taken.

7. Statistical Reliability Measurement :

The various data collected are reduced to 1000 per hrs. of

operation or thousands of flight hours and numerical rate
derived. The pilots reports as well as the confirmed
failures are to be taken as complementary to each other as
sometimes unscheduled removal of components may not be a
confirmed failure.

8. Reliability Alert Level :

The Reliability Alert level for the purpose of establishing

the performance standard control level or an upper limit may
be established based on the operators experience initially
over two to three years of operation depending on fleet
size and utilization and then to be continuously up-dated on
the experience gained and corrective action taken. There
are several methods of calculating an alert level and any of
the established methods of statistical analysis may be used.
Appendix (II) details one such method.

9. The Programme Document :

The operator will have to document the programme for the

guidance of all the personnel involved for satisfactory
implementation. It will also include the method of
establishing alert value, the method of data collection,
publishing various documents for the guidance of others
bringing out the various charts and graphs to indicate the
trend.

The Airworthiness Officers would carry out checks to ensure

that the programme is implemented in the spirit. Any
deviation observed by them would be brought to the notice of
Quality Control Manager for corrective action.

Regular evaluation and assessment by operator's higher

authorities of the reliability programme must be done at
frequent intervals to detect the fault in the system. The
programme will have to be reflected in the Maintenance
System Manual of the operator. It will clearly indicate the
alert values or upper control limit which require a
maintenance action. The operators reliability monitoring
unit under the Quality Control Manager will review the
various Pilots Reports, premature removed components,
investigation reports, confirmed failures, defects noticed

5
CIVIL AVIATION REQUIREMENTS SECTION 2-AIRWORTHINESS
SERIES 'D' PART II 1 ST JANUARY, 1985
by the AMEs on ground and take necessary corrective action
after establishing the monthly rate in light of the alert
established for the components.

After gaining experience and after demonstrating to the

Regional Airworthiness Offices the particular component or
item be shifted from one type of programme to the other.
The criteria for fixing whether the component would be on
Hard Time, On-Condition or Condition Monitoring concept will
have to follow the logic decision tree given in the Appendix
(ii) to this CAR (MSG 2 Logics). When the operator wishes
to change a component from one type of maintenance to
another he will produce necessary statistics to demonstrate
and justify the same. Manufacturers' recommendation would
also be a guide in this regard. The operator will also
produce the failure rate removal etc. in graphical form for
the purpose of quick assessment. Whenever alert value
exceeds, Q.C.M. would initiate necessary corrective action
in this connection. However, wherever the failure rate
remains below an approved alert level the operator can
adjust the life of component. Alert value will be
established for each operator by taking the mean
failure/defect removal rates and adding to it two or three
standard deviations to have a realistic confidence level and
scatter.

10. The Structural Inspection Programme :

Pressurised transport aircraft require regular assessment of

their structure which degrade in strength due to fatigue,
corrosion and accidental damages received during the
maintenance. The operator should have a regular programme
for assessing the condition of the aircraft structure. The
operator has to identify the significant structural items
(SSIs) and devise a means of regular inspection of these
items. Initially for older aircraft, manufacturers would
issue a document called 'Supplemental Structural Inspection
Documents'. This document contains significant structural
items, method of inspection and required corrective action.
The documents when issued for an aircraft will be declared
mandatory for continued airworthiness of the aircraft.
There should also be a regular corrosion prevention
schedule included in the operators' Maintenance System
Manual in respect of the particular aircraft mentioning the
type of inspection and various prevention methods utilised
for the purpose. It may be mentioned that aircraft had
been designed and their strength had been assessed without
considering impact of corrosion. Corrosion degrades
strength considerably to the extent that catastrophic
failure may occur.

Particular areas such as wingtanks, lavatory galley, bilge

areas, require greater attention. Similarly aircraft used
for insecticide spray requires much greater attention in
this regard. MSG 2 Decision logic given in Appendix (II)

6
CIVIL AVIATION REQUIREMENTS SECTION 2-AIRWORTHINESS
SERIES 'D' PART II 1 ST JANUARY, 1985

equally applies to structure.

11. Aircraft Engine Analysis Method :

The method of determining contents of the power plants scheduled maintenance

programme is similar to the programme of other components. The operator has to
identify:

a. The system and their significant items.

b. Their functions, failure modes and failure effects.
c. Define Scheduled Maintenance task having potential
d. maintenance leading to better reliability.
e. Assess the desirability of schedule of those task
f. having potential effectiveness.
g. Determine initial sampling threshold.

11.1 Inflight Shut-down :

Premature removal rate and engine instrument monitoring by crew are the methods
which can easily give the condition of the engine operation. Mechanical parameters like
engine oil analysis programme, oil consumption etc. are also methods available for the
purpose.

12. Programme Document :

Once the maintenance programme is approved, the same shall be reflected in the
Operator's Quality Control manual. The details of the programme such as inspection
schedule, COSL, special inspection schedules, etc. should be reflected in the Operators
Maintenance System Manual. It shall be the duty of QC Manager to ensure that all
concerned personnel are made familiar with the contents of the manuals and ensure its
compliance.

CAR Series 'D' Part II Issue III, is hereby canceled.

Sd/-
(N. Ramesh)
Deputy Director General of Civil Aviation
for Director General of Civil Aviation

th
Revision 1, 15 Oct., 2001
7
CIVIL AVIATION REQUIREMENTS SECTION 2-AIRWORTHINESS
SERIES 'D' PART II 1 ST JANUARY, 1985
APPENDIX - 1

1. A decision tree diagram (figure 1 of Addendum 1)

facilitates the definition of scheduled maintenance tasks
having potential effectiveness. There are five key
questions.

NOTE: Questions (a), (b) and (c) must be answered for

each failure mode, question (d) for each function, and
question (e) for the item as a whole.

(a) Is reduction in failure resistance detectable by

routine flight crew monitoring?
(b) Is reduction in failure resistance detectable by in
situ maintenance or unit test?
(c) Does failure mode have a direct adverse effect upon
operating safety? (See Addendum 3).
(d) Is the function hidden from the view point of the
flight crew? (See Addendum 3).
(e) Is there an adverse relationship between age and
reliability?

2. Each question should be answered in isolation, e.g., in

question (c) all tasks which prevent direct adverse effects
on operating safety must be listed. This may result in the
same task being listed for more than one question.

3. If the answer to question (a) is Yes, this means there are

methods available through monitoring of the normal in-flight
instrumentation to detect incipient conditions before
undesirable system effects occur. A Yes answer does not
require a maintenance task. If the answer is NO, there is
no in-flight monitoring which can detect reduction in
failure resistance. This question is meant to refer to the
flight crews' ability to detect deteriorating calibration or
systems operation before a failure occurs.

Note:- Tasks resulting from in-flight monitoring are part

of nonscheduled maintenance.

4. If the answer to question (b) is Yes, it means there is a

maintenance task, not requiring item disassembly, that has
potential effectiveness in detecting incipient conditions
before undesirable system effects occur. Tasks may include
inspection, servicing, testing, etc.

Note:- Tasks resulting from a Yes answer to question (b)

are part of the On Condition maintenance programme.

5. If the answer to question (c) is Yes, this failure mode has

a direct adverse effect on operating safety. It is
necessary to examine the mechanism of failure and identify
the single cells or simple assemblies where the failure
initiates. Specific total time, total flight cycle, time
since overhaul and cycle since overhaul limitations may be

8
CIVIL AVIATION REQUIREMENTS SECTION 2-AIRWORTHINESS
SERIES 'D' PART II 1 ST JANUARY, 1985
assigned these single cells or simple assemblies and the
probability of operational failures will be minimized.
Examples of these actions are turbine engine disc limits,
airplane flap link life limits, etc. In many cases, these
limits must be based upon manufacturers development testing.
Fortunately, there is only a small number of failure modes
which have a direct, adverse effect on operating safety.
This results from the fact that failure mode analysis are
conducted throughout the process of flight equipment design.
In most cases, it is possible after identification of such a
failure mode to make design changes (redundancy,
incorporation of protective devices, etc.) which eliminate
its direct adverse effect upon operating safety. If no
potentially effective task exists, then the deficiency in
design must be referred back to the manufacturer. The term
"direct adverse effect upon operating safety" is explained
in Addendum 2.

Note:- Tasks resulting from a Yes answer to question (c)

are part of either the Hard Time limitation maintenance
programme or the On Condition maintenance programme.

6. Refer to Addendum 3 for explanation of question (d). If the

answer to question (d) is Yes, periodic ground test or shop
test may be required if there is no other way of ensuring
that there is a high probability of the hidden function
being available when required. The frequencies of these
tests are associated with failure consequences and
anticipated failure probability. A component can not be
considered to have a hidden function which is evident to
the flight crew during normal operations. In this case, the
answer must be NO.

Note:- Task resulting from a Yes answer to question (d)

may be part of either the Hard Time limitation or the On-
Condition maintenance programme.

7. If the answer to question (e) is Yes, periodic overhaul may

be an effective way of controlling reliability. Whether or
not a fixed overhaul time limit will indeed be effective can
be determined only by actuarial analysis of operating
experience.

Note:- Tasks resulting from a Yes answer to question (e)

are part of the Hard Time limitation maintenance program.

8. It has been found that overall measures of reliability of

complex components, such as the premature removal rate,
usually are not functions of the age of these components.
In most cases, therefore, the answer to question (e) is No.
In this event, scheduled overhaul cannot improve operating
reliability. Engineering action is the only means of
improving reliability. These components should be operated,
therefore, without scheduled overhaul.

9
CIVIL AVIATION REQUIREMENTS SECTION 2-AIRWORTHINESS
SERIES 'D' PART II 1 ST JANUARY, 1985
Note:- Systems or items which require no scheduled tasks
are included in condition monitoring.

9. The preceding paragraph is contrary to the common belief

that each component has an unique requirement for scheduled
maintenance in order to protect its inherent level of
reliability. The validity of this belief was first
challenged by actuarial analysis of the life histories of
various components. More recently, the correctness of the
preceding paragraph has been overwhelmingly demonstrated by
the massive operational experience of many airlines with
many different types of components covered by Reliability
Programmes complying with FAA Advisory Circular 120-17.

10. It is possible to change the answers to the five questions

in the decision diagram by improved technology. It is
hoped that Aircraft Integrated Data Systems (AIDS), for
example, will reliably indicate reduced resistance to
various modes of failure of many components during normal
airline operations. If this is determined to be possible
many "NO" answers to questions (a) and (b) will become "YES"
answers. Answers may also be changed by various development
in the field of nondestructive test technique, built-in test
equipment, etc.

11. The questions in Figure 1 are intended to determine

maintenance tasks having potential effectiveness for
possible inclusion in a scheduled maintenance program.
However, it is probable that many of these "potentially"
beneficial scheduled tasks would not be "desirable" even
though such tasks could improve reliability. This might be
true when operating safety is not affected by failure or the
cost of the scheduled maintenance task is greater than the
value of such resulting benefits as reduced incidence of
component premature removal, reduced incidence of departure
delays, etc. Additional diagrams are used to assess the
"desirability" of those scheduled maintenance actions which
have potential effectiveness. This is accomplished by
Figures 2 and 3 of Addendum 1.

12. Figure 2 selects those tasks which must be done because of

operating safety or hidden function considerations. Figure
3 selects those tasks which should be done because of
economic considerations.

13. Figure 2 assesses tasks listed against the Yes answer of

questions c and d in Figure 1, and selects those tasks which
must be done.

14. For the operating safety question, at least one task must be
listed for each failure mode having a yes answer to question
of Figure 1. An explanation should be given for any
question tasks not selected.

15. For hidden function question, normally at least one task

10
CIVIL AVIATION REQUIREMENTS SECTION 2-AIRWORTHINESS
SERIES 'D' PART II 1 ST JANUARY, 1985
must be listed for each hidden function having a yes answer
to Figure 1, question. If a task is not selected, as
permitted by addendum 3, an explanation must be provided.

16. Figure 3 assesses tasks listed against the Yes answer in

Figure 1, questions (b) and (e) and select those tasks which
should be done because of economic considerations.

17. A key question in Figure 3 is the first, "Does real and

applicable data show desirability of scheduled task?" A
"Yes" answer is appropriate if there is:

(1) Prior knowledge from other aircraft that the scheduled

maintenance tasks had substantial evidence of being
truly effective and economically worthwhile, and

(2) The system component configuration of the old and new

airplanes are sufficiently similar to conclude that the
task will be equally effective for the new airplane.

18. The question "Does failure prevent dispatch?" refers to

whether the item will be on the Minimum equipment list
(MEL).

19. The question "Is elapsed time for correction of failure >
0.5 hr.? refers to whether corrective action can be
accomplished without a delay during a normal transit stop.

20. When a task "requires evaluation" it is important that the

frequency of the failure and the cost of carrying out the
task are taken into consideration.

11
CIVIL AVIATION REQUIREMENTS SECTION 2-AIRWORTHINESS
SERIES 'D' PART II 1 ST JANUARY, 1985

12
CIVIL AVIATION REQUIREMENTS SECTION 2-AIRWORTHINESS
SERIES 'D' PART II 1 ST JANUARY, 1985

ADDENDUM 2

The following elaborates on the term "direct and adverse effect

on operating safety."

During the design process considerable attention is given to

system and component failure effect analysis to ensure that
failures that result in loss of function do not immediately
jeopardize operating safety. In many cases, redundancy can
cause the consequences of a first failure to be benign. In
other cases, protective devices serve this purpose. Although
it may not be possible to continue to dispatch the airplane
without correcting the failure and although it may indeed be
desirable to make an unscheduled landing after failure, the
failure cannot be considered to have an immediate adverse
effect upon operating safety. The inclusion of the word
direct in the phrase "direct and adverse effect on operating
safety" means an effect which results from a specific
failure mode occurring by itself and not in combination with
other possible failure modes.

Certification requirements ensure that a transport category

aircraft has very few failure modes which have a direct
effect on operating safety.

---

13
CIVIL AVIATION REQUIREMENTS SECTION 2-AIRWORTHINESS
SERIES 'D' PART II 1 ST JANUARY, 1985

ADDENDUM 3

EXPLANATION OF HIDDEN FUNCTIONS

A component is considered to have a "hidden function" if either

of the following exists:

1. The component has a function which is normally active

whenever the system is used, but there is no indication to
the flight crew when that function ceases to perform.

2. The component has a function which is normally in active and

there is no prior indication to the flight crew that the
function will not perform when called upon. The demand for
active performance will usually follow another failure and
the demand may be activated automatically or manually.

Examples of components possessing hidden functions exist in

a bleed air system. A bleed air temperature controller
normally controls the bleed air temperature to a maximum of
400 degree F. In addition, there is a pylon shutoff valve
which incorporates a secondary temperature control, should
the temperature exceed 400 degree F. A duct overheat switch
is set to warn the flight crew of a temperature above 480
degree F, in which event they can shut off the air supply
from the engine by actuating the pylon shutoff valve switch.
There is no duct temperature indicator.

The bleed air temperature controller has a hidden active

function of controlling the air temperature. Since there is
a secondary temperature control in the pylon valve and since
there is no duct temperature indicator, the flight crew has
no indication of when the temperature control function
ceases to be performed by the temperature controller. Also,
the flight crew has no indication prior to its being called
into use that the secondary temperature control function of
the pylon valve will perform. Therefore, the pylon valve
has hidden inactive function. For similar reason, the duct
overheat warning system has a hidden inactive function. And
the pylon valve has a hidden inactive function(manual
shutoff) since at no time in normal use does the flight crew
have to manually close the valve.

The hidden function definition includes reference to "no

indications to the flight crew" of performance of that
function. If there are indications to the flight crew, the
function is evident (unhidden). However, to qualify as an
evident function, these indications must be obvious to the
flight crew during their normal duties, without special
monitoring (bear in mind, however, that special monitoring
is encouraged as a part of the maintenance program to make
hidden functions in to evident ones).

It is recognised that, in the performance of their normal

duties, the flight crews operate some systems full time,

14
CIVIL AVIATION REQUIREMENTS SECTION 2-AIRWORTHINESS
SERIES 'D' PART II 1 ST JANUARY, 1985
others once or twice per flight, and others less frequently.
All of these duties, providing they are done at some
reasonable frequency, qualify as "normal". It means, for
example, that although an anti-icing system is not used
every flight it is used with sufficient frequency to quality
as a "normal" duty. Therefore, the anti-icing system can be
said to have an evident (unhidden) function from a flight
crew's standpoint. On the other hand, certain "emergency"
operations which are done at very infrequent periods (less
than once per month) such as emergency gear extension, fuel
dump actuation, etc., cannot be considered to be
sufficiently frequent to warrant classification as evident
(unhidden) functions.

The analysis method requires that all hidden functions have

some form of scheduled maintenance applied to them.
However, in those cases where it may be difficult to check
the operation of hidden functions, it is acceptable to
assess the operating safety effects of combined failures of
the hidden function with a second failure which brings the
hidden function failure to the attention of the flight crew.
In the event the combined failures do not produce a direct
adverse effect on operating safety, than the decision
whether to apply maintenance to check the pertinent hidden
function becomes an economic decision to the considered by
Figure 3 of Addendum 1.

Note also, in some cases, it is acceptable to accomplish

hidden function checks of removable components during
unscheduled shop visits, providing the component has atleast
one other function which when failed is known to the flight
crew and which causes the unit to be sent to the shop.
Also, the hidden function failure mode should have an
estimated reliability well in excess of the total
reliability of the other functions that are evident to the
flight crew.
---

15
CIVIL AVIATION REQUIREMENTS SECTION 2-AIRWORTHINESS
SERIES 'D' PART II 1 ST JANUARY, 1985
APPENDIX - 2

ESTABLISHING ALERT LEVELS

(a) Alert Levels should, where possible, be based on the number

of events which have occurred during a representative period
of safe operation of the aircraft fleet. They should be
updated periodically to reflect operating experience,
product improvement, changes in procedures, etc.

(b) When establishing Alert Level based on operating experience

the normal period of operation taken is between two and
three years dependent on fleet size and utilisation. The
Alert Levels will usually be so calculated as to be
appropriate to events recorded in one-monthly or three-
monthly period of operation. Large fleets will generate
sufficient significant information much sooner than small
fleets.

(c) Where there is insufficient operating experience, or when a

programme for a new aircraft type is being established, the
following approaches may be used.

(i) For a new aircraft type during the first two years of
operation all malfunctions could be considered
significant and should be investigated, and although
Alert Levels may not be in use, programme data will
still be accumulated for future use.

(ii) To an established aircraft type with a new operator,

the experience of other operators may be utilised
until the new operator has himself accumulated a
sufficient period of his own experience.
Alternatively, experience gained from operation of a
similar aircraft model may be used.

(iii) A recent concept to be applied in setting Alert Levels

for the latest aircraft, aircraft designs, is to use
computed values based on the degree of system and
components in- service, expected reliability assumed in
the design of the aircraft. These computed values are
normally quoted in terms of Mean Time Between
Unscheduled Removal (MTBUR) of Mean Time Between
Failure (MTBF) for both individual components and
complete systems. Although these levels tend to be
theoretical, they are, of course, based on a
considerable amount of testing and environmental
engineering and design analysis. Being purely initial
predictions they should be replaced when sufficient
inservice experience has been accumulated.

(d) There are several recognised methods of calculating

Alert Levels, any one of which may be used provided
that the method chosen is fully defined in the

16
CIVIL AVIATION REQUIREMENTS SECTION 2-AIRWORTHINESS
SERIES 'D' PART II 1 ST JANUARY, 1985
operator's Programme documentation.

(e) Typical acceptable procedures for establishing Alert

Levels are described briefly in paragraphs (i) to (iii)
and some detailed examples of the methods of
calculation are shown in Appendix B. It will be seen
that the resultant Alert Levels can vary according to
the method of calculation, but this need not
necessarily be considered to be of significance.

(i) Pilots Report (Pireps) :

For the following example calculations, a minimum of twelve

months operating data has to be available and the resultant
Alert Level per 1,000 hours is:

Calculation 1.

The three-monthly running average Pirep rate per 1,000 hours

for each system (or sub-system) as in the Table of Example
1, is averaged over the sample operating period and is known
as the Mean; the Mean is multiplied by 1.30 to produce the
Level Alert for a given system. This is sometime known as
the '1.3 Mean' or '1.3x- method.

Calculation 2.

The mean, as in Calculation 1, plus the Standard deviation

of the 'Mean' (as illustrated in Appendix B-Example 1)

Calculation 3.

The mean, as in Calculation 1, plus the Standard deviation

of the 'Mean of the Means', plus 3 Standard Deviations of
the Mean (as illustrated in Appendix B-Example ).

(ii) Component Unscheduled Removals :

For the following example calculations, a minimum

period of seven quarters' (21 months') operating data
has to be available, and the resultant Alert Level rate
for the current quarter may be set in accordance with
any one of the following:

Calculation 4.

The mean of the individual quarterly Component Unscheduled

Removals' rates for the period of seven quarters, plus 2
standard deviations of the Mean.

Calculation 5.

The maximum acceptable number of 'Expected Component

Unscheduled Removals' in a given quarter, as calculated
using a statistical process in association with the Poisson

17
CIVIL AVIATION REQUIREMENTS SECTION 2-AIRWORTHINESS
SERIES 'D' PART II 1 ST JANUARY, 1985
Distribution of Cumulative Probabilities (as illustrated in
Appendix 3).

Calculation 6.

The Number of 'predicted Component Unscheduled Removals (or

failures)' in a given quarter, as determined by the Weilbull
or other suitable statistical method.

(iii) Component confirmed Failure:

The period of operating experience has to be as in (ii) and

the resultant Alert Level rate for the current quarter is
the 'corrected' means of the individual quarterly Component
Confirmed Failure rates for the period, plus 1 Standard
Deviation of the Mean ( as illustrated in Appendix B,
Example 4).

-- END --

18