Aging Aircraft Evaluation of the Airbus A320 Rudder Control System

航空

游客，如果您要查看本帖隐藏内容请回复

航空

DOT/FAA/AR-07/65
Air Traffic Organization
Operations Planning
Office of Aviation Research
and Development
Washington, DC 20591
Aging Aircraft Evaluation of the Airbus A320 Rudder Control System
March 2008
Final Report
This document is available to the U.S. public
through the National Technical Information
Service (NTIS), Springfield, Virginia 22161.
U.S. Department of Transportation
Federal Aviation Administration
NOTICE
This document is disseminated under the sponsorship of the U.S. Department of Transportation in the interest of information exchange. The United States Government assumes no liability for the contents or use thereof. The United States Government does not endorse products or manufacturers. Trade or manufacturer's names appear herein solely because they are considered essential to the objective of this report. This document does not constitute FAA certification policy. Consult your local FAA aircraft certification office as to its use.
This report is available at the Federal Aviation Administration William J. Hughes Technical Center's Full-Text Technical Reports page: actlibrary.tc.faa.gov in Adobe Acrobat portable document format (PDF).
Report Documentation Page
1. Report No.
DOT/FAA/AR-07/65
2. Government Accession No.
3. Recipient's Catalog No.
4. Title and Subtitle
AGING AIRCRAFT EVALUATION OF THE AIRBUS A320 RUDDER CONTROL SYSTEM
5. Report Date
March 2008
6. Performing Organization Code
7. Author(s)
Iyiin A. Chang, Joseph DiMambro, Paul W. Werner, and Jeffrey G. Blanchette
8. Performing Organization Report No.
9. Performing Organization Name and Address
Telemetry and Data Systems
Sandia National Laboratories
Albuquerque, New Mexico 87185-0986
10. Work Unit No. (TRAIS)
11. Contract or Grant No.
DE-AC04-94AL85000
12. Sponsoring Agency Name and Address
U.S. Department of Transportation
Federal Aviation Administration
Air Traffic Organization Operations Planning
Office of Aviation Research and Development
Washington, DC 20591
13. Type of Report and Period Covered
Final Report
14. Sponsoring Agency Code
ANM-100
15. Supplementary Notes
The Federal Aviation Administration Airport and Aircraft Safety R&D Division COTR was Robert McGuire.
16. Abstract
The study summarized in this document focused on the rudder system of the Airbus A320 family (A318, A319, A320, and A321) and included a review of the system description and a safety/reliability analysis. Of particular interest were recommendations for aging, infrequently maintained, or uninspectable parts, and parts that may have latent problems. The study found that the failure probabilities evaluated fell reasonably within the regulatory requirements. However, it also found varying degrees of dependence in the designs of redundant paths. Few corrosion issues were identified. The refurbished parts evaluated in this study had similar failure modes as original parts but had significantly shorter product lives than the original units.
17. Key Words
Control systems, Rudder, Actuators, Refurbished, Risk analysis
18. Distribution Statement
This document is available to the U.S. public through the National Technical Information Service (NTIS), Springfield, Virginia 22161.
19. Security Classif. (of this report)
Unclassified
20. Security Classif. (of this page)
Unclassified
21. No. of Pages
34
22. Price
Form DOT F 1700.7 (8-72) Reproduction of completed page authorized
ACKNOWLEDGEMENTS
The authors would like to thank Mr. Dieter Meese at Airbus Industries for coordinating efforts among Airbus, the original equipment manufacturers, and Sandia National Laboratories. Also, without the firm commitment of Mr. Meese’s management team (Laurent Alegre, Patrick Glapa, Albert Urdiroz, and Alberto Grande), it would not have been possible to achieve this level of integration and produce results in a timely manner.
Many thanks go to Ms. Barb Meloche and Ms. Katherine McFadden for their diligent work on data issues, integrations, and database management and to the staff at the Federal Aviation Administration (FAA) National Aviation Safety Data Analysis Center who retrieved the data from the Airclaims databases. Special thanks also go to Ms. Nancy Lies for technical editing. The guidance and funding support from Mr. Bob McGuire and Mr. Robert Jones of the FAA are greatly appreciated. Mark Allen and Dick Perry of Sandia National Laboratories provided mentorship and direction to the entire project and made the work enjoyable.
iii/iv
TABLE OF CONTENTS
Page
EXECUTIVE SUMMARY xi
1. INTRODUCTION 1
2. SCOPE AND SAFETY PHILOSOPHY 2
3. METHODOLOGY 4
3.1 Study Framework 4
3.2 Review of Regulatory Requirements and Maintenance Planning Documents 6
3.2.1 Code of Federal Regulations and Joint Aviation Regulation Regulatory Requirements 6
3.2.2 Maintenance Practices 6
3.3 Review of Design Requirements, System/Assembly/Unit Drawings, Aircraft Maintenance Manuals, and Component Maintenance Manuals 6
3.4 Review of Initial Assessment at Certification 6
3.5 Review of In-Service Data 7
3.5.1 The A320 Aircraft Fleet Information 7
3.5.2 Repair Data From Original Equipment Manufacturers 7
3.5.3 Airclaims Database/FAA National Aviation Safety Data Analysis Center 8
3.6 Graphical Presentations of Life Data 8
3.7 Analysis of Risk 9
3.7.1 Overview of the Life Cycle Approach 9
3.7.2 Models, Diagnostics, and Challenges 12
4. RESULTS 14
4.1 Risk Analysis 14
4.2 Hazard Assessment Tables 14
v
5. GENERAL DISCUSSION AND ISSUES 16
5.1 Performance Dependent on Design Complexity 16
5.2 Dependence Between Redundant Paths 16
5.3 Soft Failures 16
5.4 Zero Time Assumption Challenged on Refurbished Assemblies 17
5.5 Aging Issues 17
5.6 Bearing Wear 17
5.7 Corrosion Issues 18
5.8 Optimal Maintenance Intervals 18
5.9 Minimum Performance Differences Among Operators 18
5.10 Functional Checks 18
6. SUMMARY 18
6.1 Society of Automotive Engineers Standards 18
6.2 Future Safety Assessment at Certification 19
6.3 Validation Once in Life of Fleet 19
6.4 Data Quality and Limitations of Study 20
6.5 Preventative Use and/or Regulatory Compliance 20
6.6 Future Opportunities 20
7. CONCLUSIONS 21
8. RECOMMENDATIONS 21
9. REFERENCES 22
10. RELATED DOCUMENTS 22 vi
LIST OF FIGURES
Figure Page
1 The A320 Family Rudder Control System and Critical Components 3
2 Heinrich Pyramid 4
3 Study Process Framework 5
4 A Typical Illustration of Units Removed as a Function of Time 8
5 Cumulative Probability Function 10
6 Cumulative Probability—Quantile Display 10
7 Probability Density Function 11
8 Hazard/Removal Function 12
vii
viii
LIST OF TABLES
Table Page
1 Regulatory Risk Thresholds 6
2 The AFU Hazard Assessment Table 15
3 System Hazard Assessment (Partial) 15
LIST OF ACRONYMS
AC Advisory Circular
AD Airworthiness Directive and/or Accidental Damage
AFU Artificial Feel Unit
AMM Aircraft Maintenance Manuals
ARP Aerospace Recommended Practice
CCA Common Cause Analysis
CFR Code of Federal Regulation
CMM Component Maintenance Manual
FAA Federal Aviation Administration
FMEA Failure Modes and Effects Analysis
FMES Failure Modes and Effects Summary
FTA Fault Tree Analysis
HA Hazard Assessment
JAR Joint Aviation Regulation
LRU Line Replacement Unit
MPD Maintenance Planning Document
MSG Maintenance Steering Group or Materiel Safety Group
NASDAC National Aviation Safety Data Analysis Center
OEM Original Equipment Manufacturer
SAE Society of Automotive Engineers
SB Service Bulletin
SNL Sandia National Laboratories
SSA System Safety Analyses
VSS Microsoft® Visual SourceSafe®
ix/x
EXECUTIVE SUMMARY
This project was initiated due to safety concerns that arose from the TWA Flight 800 accident in 1996. In the years after the accident, the Federal Aviation Administration (FAA) Aging Aircraft Program and its advisory committee, the Aging Transport Systems Rulemaking Advisory Committee, expanded their evaluations of aging to include nonstructural wiring and flight control systems. It was decided that potential generic problems with those systems should be identified and addressed at the industry level. In 2002, Sandia National Laboratories (SNL) was tasked to evaluate two mechanical systems as sample studies: the Boeing 757 Elevator System and the Airbus A320 Rudder Control System. This report focuses on the evaluation of the aging Airbus A320 Rudder Control System.
The ultimate objectives of the program are (1) to identify and bring generic issues of nonstructural mechanical systems to industry attention, (2) to evaluate whether the existing design and maintenance philosophy at initial certification remains valid as the system ages, and (3) to evaluate the health of commercial aircraft as they approach their design service goal. This study was the first to demonstrate this process by examining maintenance intervals, fail-safe designs, and failure probabilities.
Collaborative efforts came from the FAA, Airbus, and their vendors. They provided required documents and in-service data to allow SNL reviews of (1) regulatory requirements, (2) system descriptions, (3) initial safety assessment at certification, and (4) in-service data. SNL also conducted a risk analysis. A full life-cycle approach used in-service data from 1988 to 2003. The analysis included graphical presentations and model fitting (e.g., a bathtub Weibull model) of the data. The study focused on major and procurable parts of the rudder control system for which repair histories were obtainable.
xi/xii
1.
INTRODUCTION.
As part of the Aging Transport Systems Rulemaking Advisory Committee’s efforts that began after the TWA Flight 800 accident in 1996, it was determined that generic problems of aging aircraft fleets should be identified, brought to the attention of industry, and researched. Generic issues included aging, wiring, corrosion, and the design concept of dual-load paths for continuous airworthiness.
The Federal Aviation Administration (FAA) Aging Aircraft Program expanded its research to include nonstructural components, wiring, and mechanical systems to evaluate the health of commercial aircraft as they aged and approached their design service goal. The program was intended to evaluate whether the existing design and maintenance philosophy at certification remained valid as mechanical systems aged. The study summarized in this report focuses on the rudder system of the Airbus A320 family (A318, A319, A320, and A321) and included a review of the system description and a safety/reliability analysis. Of particular interest were recommendations for aging, infrequently maintained, or uninspectable parts, and parts that may have latent failures.
As of June 2003, a total of 558 A318s, A319s, A320s, and A321s had been in service in the U.S. as commercial carriers. The oldest of the four models, the A320s, entered service in April 1988. The A321 entered service in April 1994, the A319 in April 1996, and the A318 in April 1999.
This study followed the safety principles of the FAA Title 14 Code of Federal Regulations (CFR) Part 25 design standards (see Advisory Circular (AC) 25.1309-1A) [1]. The FAA requires that any single failure during a flight, and any combination of failures not shown to be extremely improbable, should not prevent continued safe flight and landing. The FAA consequently describes two design principles: (1) having redundancy or backup systems to enable continued functioning after any failure(s), and (2) having independence of systems, components, and elements so that any failure does not cause the failure of another system, component, or element essential to continue safe flight and landing.
Following these design principles of desired redundancy and independence, this evaluation was carried out in two steps: (1) product life at the component level (single path) was estimated and (2) the probabilities of certain failures (single and backup paths), potentially related to safety, were estimated. Based on the results, optimal maintenance intervals were suggested or recommended. A life-data analysis approach was used to analyze operational data. The operational data were requested primarily for major and procurable components from the aircraft manufacturer (Airbus) and component original equipment manufacturers (OEM). Due to time constraints, other operational data from the maintenance, repair, and overhaul shops and the carriers were not pursued. 1
2
2.
SCOPE AND SAFETY PHILOSOPHY.
This study reviewed the rudder control system, excluding the rudder surface. It focused on the major and procurable parts of the rudder control system when the repair history was obtainable from Airbus and the OEMs. The reviews gave an understanding of the interfacing systems. Figure 1 depicts the rudder control system design and identifies the specific components that were evaluated. Repair histories of other subassemblies and component parts were only maintained by operators and were not pursued.
As tasked, this study focused on the wear and tear and aging of the components and related safety issues. It did not focus on acute onsets of failures that were sudden with little or no progression or aging. Human interactions were part of this study if they affected the wear and tear and had a progression. Sudden human errors and weather impacts that caused high consequences were not part of this study. These issues and consequences should be covered in a separate reporting and lessons learned process.
This evaluation stressed the safety philosophy of the Heinrich pyramid (figure 2) [2], especially the preventative aspect, which posits that for every accident or event, there is a higher number of incidents and an even higher number of unreported occurrences. These incidents, or unreported occurrences, are problems of the same nature. They may be less severe or in the same progression. Through proper assessment and maintenance, they can be reduced to a minimum, thereby reducing the number of accidents or events. Accidents and incidents are rare. In many cases, the threats are unknown. Therefore, it is critical to identify precursors and to examine failure progression so that preventative measures can be taken to preclude future accidents.
3
Figure 1. The A320 Family Rudder Control System and Critical Components
Figure 2. Heinrich Pyramid
3.
METHODOLOGY.
3.1 STUDY FRAMEWORK.
The overall framework that guided this study is shown in figure 3. Key players included the FAA, Airbus, and their OEMs (see left side of figure 3) who provided necessary documents for a four-step process and a final evaluation. This four-step process included reviewing requirements, background information, initial assessments, and in-service data and is described in sections 3.2, 3.3, 3.4, and 3.5. The final evaluation produced hazard assessment tables and included life cycle risk analysis. Examples of hazard assessment tables are presented in section 4. Graphical presentations of the in-service data and risk analyses are described in sections 3.6 and 3.7.
4
5
Figure 3. Study Process Framework
CFRs,
ACs,
MPDs,
ADs,
MSG-3s,
CMMs, AMMs, FTAs, FMESs, HAs, SSAs, SBs, Technical letters, Other documents
Repair records,
Fleet data,
Airclaims database
Vendors, Airbus, FAA
Hazard Assessment Tables
Conclusions
Life Data/Risk Analysis
(1) Optimal maintenance
(2) Sound redundancy
(3) Low failure probabilities
4. In-Service Data (1988-2003)
3. Safety Review of Initial Assessment at Certification
2. Background
1. Requirements
Review FTAs, FMESs, HAs, SSAs, MSG-3s
3.2 REVIEW OF REGULATORY REQUIREMENTS AND MAINTENANCE PLANNING DOCUMENTS.
3.2.1 Code of Federal Regulations and Joint Aviation Regulation Regulatory Requirements.
Risk thresholds were defined as thresholds beyond which preventive measures should be taken. Depending on the consequence of the failure type, the CFR [1] and Joint Aviation Regulation (JAR) [3] have mandated that the probability of failure be kept below 10-3, 10-5, 10-7, and 10-9 per flying hour for each of the hazard categories, respectively, minor, major, hazardous, and catastrophic. The hazard categories were classified according to the consequence of failure and used in this study as the risk thresholds (see table 1).
Table 1. Regulatory Risk Thresholds
CFR Qualitative Probability Terms
Probable
Improbable
Extreme Improbable
JAR qualitative probability terms
Frequent
Reasonably probable
Remote
Extremely remote
Extremely improbable
JAR effect category
Minor
Major
Hazardous
Catastrophic
CFR and JAR qualitative probability ranges
10-3
10-5
10-4
10-7
10-9
3.2.2 Maintenance Practices.
Copies of the Maintenance Review Board reports and Maintenance Planning Documents (MPD) were obtained and reviewed. The recommended maintenance requirements and intervals were also reviewed.
3.3 REVIEW OF DESIGN REQUIREMENTS, SYSTEM/ASSEMBLY/UNIT DRAWINGS, AIRCRAFT MAINTENANCE MANUALS, AND COMPONENT MAINTENANCE MANUALS.
The reviewed documents provided the background for understanding the inner workings of the units and interrelationships of the units, subsystems, and interfacing systems. Their removal, installation, functional checks and inspections, and adjustment procedures were documented in the Aircraft Maintenance Manuals (AMM). Unit operation, testing, repair, and cleaning procedures were documented in Component Maintenance Manuals (CMM).
3.4 REVIEW OF INITIAL ASSESSMENT AT CERTIFICATION.
Failure modes and effects summaries (FMES), fault tree analyses (FTA), hazard assessments (HA), and cascading analyses/system safety analyses (SSA) provided by Airbus were reviewed. These provided insight into the designers’ logic for determining failure modes and effects. Anticipated failure modes were identified in FMES and used as a benchmark for documentation of repairs. Unanticipated failure modes or effects could generate service bulletins (SB), special technical letters, and perhaps, Airworthiness Directives (AD). Those documents were obtained
6
and reviewed. HAs, SSAs, and FTAs were associated with subsystem and system-level assessments in which potential safety issues between units and interfacing systems were addressed and probabilities were propagated. A dedicated common mode analysis was not reported for the rudder mechanical control, presumably due to the newness of the assessment tool at the time of the A320 design. Additionally, airlines and manufacturers had developed the maintenance steering group (MSG)-3 logical decision processes to guide scheduled maintenance, and these were also reviewed. Required, recommended, and improved or upgraded practices were noted.
3.5 REVIEW OF IN-SERVICE DATA.
Two Microsoft® products were used to manage the file and data processes. Microsoft Visual SourceSafe® (VSS) [4] was used to allow version/iteration control and documentation of the processes. VSS backs up any file when changes are made and allows recovery of an old version at any time. Files were shared and available to team members. Microsoft Access® [5] was used to develop a repository database to allow data mining and coding, reviews, and queries. Data received was stored in Access data tables. Queries then were written to retrieve data in the format needed for risk analysis. Data sources are described in the following sections.
3.5.1 The A320 Aircraft Fleet Information.
Airbus provided the A320 aircraft-related information as well as records of installation of major parts and serial numbers on each aircraft under investigation. Fleet information included aircraft model, serial number, registration, air date/delivery date, ownership/operator, and cumulative flight hours and cycles. On each aircraft, component information included part and serial numbers. These data files, provided by Airbus, were processed and organized in the database where availability of cumulative information was noteworthy. It provided a tracking history of aircraft-specific age, calendar time, usage, flight hours, cycles, and change of ownership, which were essential for the life cycle analysis. These records also formed the aircraft and component populations of the study.
3.5.2 Repair Data From Original Equipment Manufacturers.
The other primary data owners were the OEMs. Airbus and Sandia National Laboratories worked with the OEMs to retrieve the repair data residing with them and their authorized repair shops. During repair, parts removed from service were routinely logged by aircraft model, air carrier, removal date, and part service cycles and hours, and tested for performance and functionality. Repair data obtained from the OEMs were linked in the database with the aircraft on which the parts were installed. The data were also reviewed and coded with the diagnosed reason for removal. Over time, the analysis tracked increasing trends in removal of parts, as well as dominant removal events, signs of aging, and clustered removal patterns. Differences among operators, manufacturers, and design upgrades were also noted.
The reasons for returned parts by operators and repair shop findings and diagnoses were reviewed and categorized for use in the analysis. Emphasis was placed on part removals and reasons for removal that occurred in sequence, in clusters, or in dominant manners. This
7
extensive review provided an understanding of how the components failed as well as information on prioritizing maintenance actions.
3.5.3 Airclaims Database/FAA National Aviation Safety Data Analysis Center.
Airclaims is an international aviation insurance underwriter whose database contains comprehensive historical data on over 50,000 registered aircraft, including hours and cycles. The FAA National Aviation Safety Data Analysis Center (NASDAC) regularly acquires data from Airclaims and performs queries upon request.
One significant feature of this life cycle approach was its ability to track time and usage. In this study, flight hours and cycles fields were essential, but sometimes incomplete. The limitation was resolved by determining if the removals were the first replacements since the initial installations. In these instances, accumulated flight hours and cycles for the components were the same as the accumulated flight hours and cycles for the aircraft. Precise flight hours and cycles to date were not always available, but the quarterly data were available from the Airclaims database.
3.6 GRAPHICAL PRESENTATIONS OF LIFE DATA.
Graphical presentations of the life data were informative and often produced to facilitate an understanding of the removal patterns and failure trends. Figure 4 shows a typical illustration of the units removed as a function of time. The x axis shows the cumulative flight hours of the parts, as well as the aircraft. Part hours and removal times are shown in solid circles. Aircraft hours are shown from the baseline in a straight line (grey color). They are aligned to the left to allow examination and risk estimation of trends over time. An increased number of removals associated with older parts, or older aircraft, are potential indicators of aging-related performance. The y axis is the aircraft or the part serial number from the smallest number (oldest) to the largest number (youngest). Critical failure modes instead of removals can also be displayed using different symbols.
Figure 4. A Typical Illustration of Units Removed as a Function of Time 8
3.7 ANALYSIS OF RISK.
Data analysis was driven by the need to understand when, why, how often, and how many of the units needed service over time. If removal or failure patterns are understood, inspection intervals can be recommended. The analysis was carried out by examining these trends and, based on the trends, identifying any safety issues and proposing appropriate action.
This life cycle approach is quite extensive in the literature. Meeker and Escobar [6], Lawless [7], and Nelson [8] were among the references. The approach is summarized in section 3.7.1, and additional technical topics are discussed in section 3.7.2. Section 3.7.1 should be sufficient for most readers.
3.7.1 Overview of the Life Cycle Approach.
During a typical life cycle analysis, life and failure events of the parts are obtained. The life histories are aligned at baseline (see figure 4) and proportions of failure and removal are computed. They are computed by dividing the number of removals, di, by the number of working parts, ni, at each interval, i, which yields the probability of failing and removal,,at each interval from 1 to m. ipˆ
, 1,...,ˆiiidim (1)
If n is the total number of parts in the beginning of the study, then subsequent numbers of working parts are The intervals are flexible and may be small or large as long as they do not overlap. Using the individual probabilities at each interval, cumulative probabilities of surviving and no removals over time are computed. -1-1--iinndr=
(2) 1ˆˆ[1], 1,..., ()ijijpimSt=−==Π
Subsequently, cumulative probabilities of failing and removals are computed.
(3) ˆˆ()1(), 1,...,iiFtStim=−=
The computational steps described above result in a step function (figure 5, black curve) where the probability of failing increases over time from 0 to eventually 1. In the literature, an underlying probability distribution (a smooth mathematical function) is used for additional advantages (figure 5, blue curve). The advantages include being able to describe the removal patterns using a smooth curve with a few parameters and, most importantly, to project (in time) performance of the parts in the future. This approach is called the parametric approach. The choice of the best probability distribution is always determined by the model that best fits the data. Examples of probability distributions include normal distribution, log normal distribution, Weibull distribution, etc. Using a log normal distribution as an example, cumulative probability function with μ and σ as the parameters is
9
log()(;,)nortFtμμσσ−⎡⎤=Φ⎢⎥⎣⎦ (4)
where the log of time t has a normal distribution with mean μ, and variance σ2 and is the cumulative probability function for a standard normal distribution. The values of μ and σ2 are estimated from the data. norΦ00.20.40.60.8 010000200003000040000500006000070000Fraction FailingCumulative Flight Hours
file location:c:\splidauser\FinalRptFig1.sgr
Figure 5. Cumulative Probability Function
In practice, figure 5 can also be presented on a different scale. In this example, the x axis is time plotted on a log scale, and the y axis is the quantile of the distribution (see figure 6), because both the curve and the data should be along a straight line when the distribution function fits the data well. Figure 6 was often used for this diagnostic reason. In general, both figures 5 and 6 were used to project reliability statistics as products of age. Cumulative Flight Hours.0001.0005.001.002.005.01.02.05.1.2.3.4.5.6.7.8 500020000350005000065000Fraction Failing
file location: c:\splidauser\FinalRptFig3.sgr
Figure 6. Cumulative Probability—Quantile Display
10
To examine the product life distribution, the following density distribution function was used.
1log()(;,)nortfttμμσϕσσ−⎡⎤=⎢⎥⎣⎦ (5)
norφ is the probability density function for the standard normal distribution. Figure 7 shows the life distribution of the products; in this example, it is a bell-like shape distribution skewed to the right. As shown, most components had an average product life in the middle portion. Many experienced life spans longer than the mode. Median lifetime, for example, or any quantile of the distribution can be obtained. They are life predictions on when a certain percent of the unit will have failed. These predictions are critical in manufacturing a process for forecasting the needs for spares and repairs. 1000030000500007000090000110000Cumulative Flight Hours0.0e05.0e-61.0e-51.5e-52.0e-52.5e-53.0e-5Probability of Failing
file location:c:\splidauser\FinalRptFig2.sgr
Figure 7. Probability Density Function
Most importantly, to examine the instantaneous risk that the products were likely to fail or be removed, a hazard/removal curve was used.
(;,)(;,)()(;,)1(;,)ftfthtStFtμσμμσ==− (6)
It was proportional to, as in the next given time or age, the probability of failing. This function had a practical meaning because of its direct relationship with the manufacturing process and maintenance strategies. Using the same example, the hazard/removal curve is presented in figure 8. It was heavily used in the study. The curve in figure 8 can have many different shapes: it can be flat, indicating a random removal pattern, or it can be rising, indicating a wear-out phase. One commonly known shape is the bathtub shape, where infant mortality is observed on
11
the left-hand side, as a burn-in phase, and natural rising/aging is observed on the right-hand side, as a wear-out phase. Cumulative Flight Hours 0100002000030000400005000060000700000.0e02.0e-54.0e-56.0e-58.0e-51.0e-4Hazard Function
file location:c\splidauser\FinalRptFig4.sgr
Figure 8. Hazard/Removal Function
3.7.2 Models, Diagnostics, and Challenges.
The functions described in section 3.7.1 and mathematical techniques used to estimate μ and σ2 are called maximum likelihood optimization techniques. In real life, more practical and complicated situations arise.
For example, key contributing factors, such as different aircraft models, operators, designs, and upgrades, may affect the performance of the components and, thus, need to be investigated. In addition, the exact failure times, as described in equations 1, 2, and 3, are not always known. The failure times can be observed in four ways: (1) during routine maintenance (exact failure time uncertain to the left, left censored), (2) in service/pilot report (exact failure time), (3) between inspections (failure time uncertain within interval, interval censored), and (4) in future time (failure time uncertain to the right, right censored). It is necessary to choose the best model.
To resolve these issues, the methodology allowed key contributing factors to have separate sets of parameters (different μ’s and σ2’s), as shown in equation 7; failure time uncertainties to be described, as in equation 8; and a diagnostic tool, as described in equation 9. They are briefly discussed below.
The same example of a log normal distribution in time can be used, as shown in figure 7. Taking the log of time, μ is the mean and σ2 is the variance of a normal distribution. Log t is expressed as being affected by contributing factors, and they can be expressed in a linear relationship, as shown in equation 7. The contributing factors in this study were aircraft model (x1), operators 12
(x2) and others. μ is the explainable portion of the equation, and ε is the unexplainable/error/ residual portion. Since log t is distributed normally with mean μ and the varianceσ2, after removing μ, ε is distributed normally with mean 0 and the variance σ2. Index i=1,…,n is the units under evaluation.
()212log012..., ~0,iiiiiiitxxNμεβββεεσ=+=++++ (7)
Again, estimating the parameters μ, σ2, β0, β1, and β2 is achieved by using the maximum likelihood principle. The maximum likelihood is simply the probability of seeing the observed data as shown in equation 8. It finds a parameter set that most likely generated the observed data. The likelihood function for a combination of n independent units is
01201212111(,,,...,)(,,,...,;,,...)log()log()log() {}{log() {1}niinlidiiiiiiinornornoririiinorLLxxttttβββσβββσμμσσσμσ=−==−−⎡⎤⎡⎤⎡=ΦΦ−Φ⎢⎥⎢⎥⎢⎣⎦⎣⎦⎣−⎡⎤−Φ⎢⎥⎣⎦ΠΠ (8)
where ...22110+++=βββμxxiand li, di, and ri are indicator variables for left-censored, exact- or interval-censored, and right-censored observations. Similarly, the terms in the brackets are the probabilities of seeing the data for each unit, which could be left-censored, exact- or interval-censored, and right-censored. The parameters μ, σ2, β0, β1, and β2 are estimated by maximizing function (equation 8) and are denoted as .ˆ and ,ˆ,ˆ ,ˆ ,ˆ2102βββσμ
Diagnostic checking is a critical part of the modeling process. To ensure that the curve fits the data well, residuals are often computed and checked for patterns.
ˆlogˆ~(0,1)ˆiiiitNμεσ−=􀀅 (9)
The residuals can be obtained and plotted against a standard normal distribution or against the fitted values for check of nonlinearity.
In the statistical literature, maximum likelihood estimators give good statistical properties. Commercial software packages such as SAS, S-PLUS, and MINITAB are readily available. In this study, S-PLUS [9] was used. Readers are referred to the textbooks by Lehmann and Casella [10] and Pawitan [11].
13
4.
RESULTS.
4.1 RISK ANALYSIS.
The in-service data received varied in quality. Some records provided only the numbers of orders (to reflect maximum numbers of removals). Other records included detailed shop procedures and information on subpart replacements. In some cases, complete repair records for all years were provided. In other cases, several years of records were missing. In general, in areas where in-depth analysis was desired, more detailed data was available.
During the analysis, if exact failure estimations were not possible, a simple bounding approach was used. In other words, if a risk estimation of all failure modes was available, then the risk estimation of one specific failure mode was less than the overall risk. For the most part, this occurred for reliable components for which the number of failures was scarce. A simple bounding approach was quite adequate.
During the review of records, most critical failure modes were prioritized. For example, attention was given to symptoms of jamming for the servocontrol actuators. Attention was given to the loss of electrical signals for both channels of the travel limitation units, but not much attention was given to the loss of one channel. For the most part, most critical failure modes were recorded.
The results were organized to discuss how the designs of the units had been upgraded or modified since they were in service, followed by, how they had been routinely checked and maintained. If data allowed and analysis was needed, a full analysis included descriptive statistics on removal reasons, graphical presentations, and risk computations of the removals over time. The analyses compared removal times and inspection intervals. In addition, they examined single and multiple failure modes to check for failure-safe design within each unit and subsystem. Operator differences were also evaluated. Safety concerns, not necessarily confirmed, were investigated. The risks were propagated in a fault-tree model in a few cases. Performance of the original and refurbished parts was also compared. Refurbished parts were of interest because of their prevalent use as the fleet gets older.
4.2 HAZARD ASSESSMENT TABLES.
Unit and System Hazard Assessment tables were prepared with the results of the risk analyses. The Unit Hazard Assessment table included the following criteria from the original safety assessment at certification: individual failure modes, detection methods by crew, and maintenance intervals. The Unit Hazard Assessment table also included results of this study to enhance the initial safety assessment: estimated failure probability projected to the next 5 years and adequacy of the maintenance and recommendations. An example of the artificial feel units (AFU) is shown in table 2. Potential areas of elevated probabilities, if any, were highlighted and discussed.
14
Table 2. The AFU Hazard Assessment Table
Failure Mode
Detection by Crew
Hazard
Category
Scheduled
Maintenance
(if not detectable)
Failure Probability
Adequate
Maintenance
Intervals
Inner spring inoperative
May be undetectable
Major
14,000 flying hours
Inner spring disconnection
Pedal untimely movement
Major
Inner spring disengagement failure
Pedal high force
None
Autopilot override jamming
Jammed pedals
None
Artificial feel jamming
Jammed pedals
Minor
Trim drive disconnection
Loss of trim function
Minor a
Trim drive jamming
Rudder trim system
Minor a
Detectable
<1.2 X 10-7
Adequate
a Major with engine failure
The System Hazard Assessment table (table 3) included the following criteria summarized from the original safety assessment at certification: units or subsystem, failure condition, consequence, hazard classification, certification probability, and mitigating actions. The System Hazard Assessment table also included results from this study: failure probability per flight hour and remarks. Failure probabilities were compared with regulatory requirements for each hazard classification (i.e., minor, major, hazardous, and catastrophic). The results showed that the failure probabilities fell reasonably within the regulatory requirements.
Table 3. System Hazard Assessment Table (Partial)
Part or Subsystem
Failure Condition
Consequence
Hazard Classification
Certification Probability per Flying Hour
Mitigating Action(s)
In-Service Probability per Flying Hour
Remarks
Disconnected
No/limited mechanical control
Minimum
Extremely improbable
Use copilot pedals
Rudder pedal–pilot
Jammed
No mechanical control
Minimum
Extremely improbable
Use copilot pedals
Disconnected
No/limited mechanical control
Minimum
Extremely improbable
Use pilot pedals
Rudder pedal–copilot
Jammed
No mechanical control
Minimum
Extremely improbable
Use pilot pedals
Flight control cable
Jammed
No mechanical control from cockpit
Major
Extremely improbable
Autopilot and/or Trim
(insufficient for some landing conditions?)
…
15
As discussed, because accidents and incidents were rare, potential progressions or events, even though less severe and unconfirmed, were observed and noted in the remarks column to provide insight and help set preventative safety priorities.
5.
GENERAL DISCUSSION AND ISSUES.
This section presents generic issues identified during the study.
5.1 PERFORMANCE DEPENDENT ON DESIGN COMPLEXITY.
Of the components reviewed, simple mechanical units were highly reliable. For each one evaluated, only a handful had been removed since they went into service.
Electromechanical, electrohydraulic, and mechanical/hydraulic components were more complex and intricate and, therefore, were less reliable. Components logically controlled by electronic boards and hydraulically powered components shared redundancy issues (discussed below). Their performance depended on vendor and parts upgrades. Upgrades sometimes changed the prominent failure modes and introduced new failure modes.
5.2 DEPENDENCE BETWEEN REDUNDANT PATHS.
Several reviews revealed varying degrees of dependence in the designs of redundant paths. For example, the backup motor, although not powered, could be subject to the same mechanical wear and tear by following the same mechanism as the active motor. Independent actuators powered by separate hydraulic systems sharing the same mechanical linkages could also suffer the same aging effects. Additionally, dependence could come from functioning under the same conditions (vibration, weather, etc.).
These cases were confirmed in the study. It was evident that working conditions and certain design-related dependencies were unavoidable. Common practice in the initial safety assessment should not generally assume complete independence. However, it often assumes that the loss of one redundancy would not affect the system or the aircraft. This study should complement the Common Mode Analysis of Society of Automotive Engineers (SAE) Aerospace Recommended Practice (ARP) 4761, “Guidelines and Methods for Conducting the Safety Assessment Process on Civil Airborne Systems and Equipment” [12], by estimating the probabilities of potential common component failures using actual in-service data. If any common component failures are determined to be safety-related, future assessment should address these issues.
5.3 SOFT FAILURES.
System descriptions also showed that hydraulically supplied components were often designed to serve as the active backup of other units in the same subsystem. As a group, they were designed to overcome loss of redundancy or failures of other units. The failure modes could be benign (e.g., internal hydraulic leak) or more critical (e.g., valve jamming).
This study found that the units could be functional but perform sluggishly. For example, they could have a combination of worn swivel bearings, out-of-tolerance control valves, and partial internal leakage and still pass the routine functional checks. This brought up the issue of
16
whether the units were able to overcome other failures and provide fail-safe load. The scope of existing functional checks might need to be expanded or changed to address component degradation that previously was not determined significant for continued airworthiness. Routine safety assessments assume optimal health as long as the systems and subsystems pass required functional checks. In the case of soft failures, sluggish performance, and similar issues, functional checks should be revisited.
5.4 ZERO TIME ASSUMPTION CHALLENGED ON REFURBISHED ASSEMBLIES.
A zero time condition was assumed for refurbished assemblies (the LRUs of this study). Although normally assumed for rebuilt engines, in this case, there was a question about whether the refurbished assemblies of the system could be considered as good as new. The refurbished assemblies evaluated in this study had significantly shorter product lives than the original units. This was observed for both hydraulically and electrically powered components. They had failure modes similar to those of their respective original components. In those cases where the same subcomponent part is the cause for removal and is replaced during successive repairs, the repair and acceptance process should be re-evaluated. In contrast, simple mechanical units were found to be extremely reliable. There has not been enough removals and refurbishments to evaluate the zero time assumption for those units.
5.5 AGING ISSUES.
Unlike an aircraft’s structure, mechanical components of a mechanical system are LRUs. They are subject to aging within their own units. Their performance, in general, has little or nothing to do with the age of the aircraft. Proper monitoring and optimal maintenance should result in a long-term healthy system. Aging effects were observed in all units evaluated; some effects were evident sooner than others. Electrical and hydraulic failures seemed to precede mechanical wear and corrosion. Electrical failures showed a random failure trend over time, while hydraulic and mechanical failures showed a wearing out failure trend.
5.6 BEARING WEAR.
Bearing wear was consistently prevalent across the evaluated components. Two failure indications, bearing free play and inefficient mechanical feedback, were often observed with the actual single failure mode of bearing wear, which was well addressed during the certification process.
Safety issues can arise under a common mode failure condition (see section 5.2) and if bearing maintenance intervals are not optimal. For example, excessive free play of the swivel bearings simultaneously in all of the servocontrol actuators can lead to oscillation or vibration of the aircraft rudder in flight. Bearing wear can also result in activation of the redundant path of the electronic boards and cause switchover to the backup channel, which might cause a discrepancy between motor input and transducer output. The prevalence of bearing wear reported on the OEM records indicated the importance of optimal maintenance intervals.
17
5.7 CORROSION ISSUES.
In repair records reviewed for all components, few corrosion issues were identified. There were a few water damage reports recorded in one of the major components, but only one report indicated significant corrosion of internal hardware. This particular component was removed for predominately electrical faults and corrosion was investigated, however, the corrosion only appeared once. Electrical failure was the driving risk factor. Other corrosion cases were found in the swivel bearings of the servocontrol actuators and, presumably, had increased the friction of the servocontrol actuation. Overall, components were often removed for failures such as electrical faults and hydraulic leakage, which were more prominent and preceded corrosion-related issues. Minor corrosion was repaired in the cases where it was observed. Corrosion prevention and control processes seemed to be under control at the time of evaluation. Determination of long-term effects will rely on continued monitoring. If future upgrades of electronic boards permit long-term reliability, corrosion issues may arise as a result.
5.8 OPTIMAL MAINTENANCE INTERVALS.
In a few instances, maintenance intervals were found to be more than optimal, but in other instances, they were less than optimal. Validation of current maintenance practices using in-service data may be beneficial.
5.9 MINIMUM PERFORMANCE DIFFERENCES AMONG OPERATORS.
Among the major components investigated, the study found minimum performance differences among operators. The manufacturer’s original designs and maintenance requirements were key to performance of the system. Variations in operator functional check schedules did not seem to make a significant difference.
5.10 FUNCTIONAL CHECKS.
Functional and operational checks are performed for degradation or loss of functions. They are designed to detect failures when they occur or are about to occur. These checks are carried out at defined intervals of a certain number of flight hours, flight cycles, or calendar time. If well defined, these checks can detect progression to failures and eliminate loss of function; however, if they are not well defined, and the failures require immediate attention, the failures most likely will occur in the air. This was shown in one instance, despite frequent functional checks. Over time, check instructions and routines can be evaluated against removal and repair indications reported by the operators and, if necessary, the routines (instructions or schedules) can be revised.
6.
SUMMARY.
6.1 SOCIETY OF AUTOMOTIVE ENGINEERS STANDARDS.
A guiding document for safety assessment and aerospace recommended practice is SAE ARP 4761, “Guidelines and Methods for Conducting the Safety Assessment Process on Civil Airborne Systems and Equipment” [12]. It is primarily associated with showing compliance with CFR 25.1309. The processes and methods recommended in the document are commonly known
18
tools: function hazard assessments, SSA, FTAs, failure modes and effect analysis (FMEA), FMESs, etc. Additionally, common cause analysis (CCA) is provided as a tool to verify independence or to identify specific dependencies among functions, systems, or items. These tools are comprehensive and include process descriptions of the design and development cycle of the aircraft. They also include aircraft, system, and item design requirements and verifications, as well as safety objectives and implementations. Two areas relevant to this study are discussed below.
For those quantitative tools using probabilities (e.g., FTA and FMEA), SAE ARP 4761 states “Probability calculations for civil aircraft certifications are based on average probabilities. . . . For the purpose of these analyses, the failure rates are usually assumed to be constant over time and are estimates of mature failure rates after infant mortality and prior to wear-out. If wear-out or infant mortality is a consideration then other methods would need to be employed . . . . [O]ther distribution functions (e.g., Weibull) have to be applied . . . .” This agrees with the methodology of this study. Because this study was an aging study, infant mortality and wear-out phases were investigated and reported if present. Weibull distributions, along with other distributions, were the candidate models used in the study, and the best-fit model was chosen.
Regarding using failure rates and other quantitative numbers, the SAE ARP also states, “When (initially) developing a new aircraft, the average flight time is usually determined from the customer requirements for the aircraft. This is an assumed value. When modifying an existing aircraft, the actual average flight time, based on in-service data, could be used” [12]. This also agrees with the current study. When validating a fleet that has already been in service, customer requirements and assumed values at initial assessment should be updated using in-service data.
6.2 FUTURE SAFETY ASSESSMENT AT CERTIFICATION.
As the result of this study, the initial safety assessment at certification should be enhanced to address dependency and spare part issues. These are the two most significant generic issues identified thus far. A safety factor can be built into the process of FTA, FMEA, etc., for example, by using a 50 percent dependency factor or a 50 percent increase in removal rates as initial design requirements. Actual in-service performance can then be validated one time in the life of the fleet (see discussions in section 6.3). The safety factor can then be adjusted up or down, depending on performance or other similar designs and modifications.
The CCA described above is exactly designed for dependency issues and should be implemented. It includes a zonal safety analysis, particular risks analysis, and common mode analysis. It is mostly qualitative; however, results of this study complement the CCA by providing quantitative numbers, which help set priorities. Readers are referred to SAE ARP 4761 [12] for details of the procedures.
6.3 VALIDATION ONCE IN LIFE OF FLEET.
For an evaluation of aging, experience from this study suggests a one-time, in-service validation of the original safety assessment at certification, with revisits when there is a new design or upgrade or a new vendor. Validation times can vary depending on the component; however, the timing is quite challenging. An ideal time is when there is an adequate number of failure modes
19
or precursors of interest. Most commercial transport aircraft fleets should have enough failures for aging evaluations. As discussed earlier, the approach is intended to detect early progression or precursors to prevent aging-related problems. If the validation timing is off, problems can occur before the evaluation occurs. An investigation is then needed to understand the underlying mechanisms, severity, and need for preventative measures. Emphasis should be placed on areas of potential high consequence. Less emphasis should be placed on highly reliable components. Note, the frequency and timing of the validation may be different if the objective is different (e.g., for warranty evaluation or other economic reasons).
6.4 DATA QUALITY AND LIMITATIONS OF STUDY.
Despite the efforts of the study, it is important to discuss the limitations. In one respect, the approach used may have included unconfirmed occurrences and was, therefore, likely to be conservative. Conversely, records may have been missing, due to the use of multiple repair shops, company buyouts, and reorganizations, etc., and this may have resulted in underreporting. The study was also limited by the records provided.
Operators could have been key players in the study and should be included in future studies. Operators had removed and replaced certain components, including servocontrol cables and numerous single rods, and this removal data was not available for the study. Removal information on the cables, for example, could have allowed analysis into the risk of servocontrol input failure due to the cable unit.
6.5 PREVENTATIVE USE AND/OR REGULATORY COMPLIANCE.
This study likely included precursor events and unreported occurrences. These were problems of the same nature as those found in accidents, but most likely less severe or just in progression (see the Heinrich pyramid discussion in section 2). Examining all incidents, events, and occurrences has the advantage of being preventative, because the larger the number of occurrences, the higher the chances of one being severe. Identifying these high-occurrence areas helps set priorities for preventative measures.
Equally important, this approach has the potential to be used for regulatory compliance. However, it requires that accidents be distinguished from incidents, events, and unreported occurrences. It also would require a process of data collection and analysis that does not exist today and should involve interviews with the operators and flight crews. Finally, a complete understanding of degradation and failure progression mechanisms would be paramount.
6.6 FUTURE OPPORTUNITIES.
As shown, the data process used in this study could be enhanced by including operators and flight crews who could provide additional data and confirm occurrences. Additionally, more centralized, careful, and complete record keeping is encouraged at the repair shops. The methodology used in this study allows detection of aging, determination of optimal time for maintenance, and adjustment of maintenance priorities. The methodology is preventative and potentially can be used for regulatory compliance. It complements the safety assessment at certification and actually estimates in-service performance. It should be included in the suite of tools for future safety assessment.
20
7.
CONCLUSIONS.
The study found that the failure probabilities evaluated fell reasonably within the regulatory requirements.
•
Soft Failures: The hydraulic units could be functional, but perform sluggishly because several subparts of the same unit were out of tolerance at the same time. Routine functional checks might not detect sluggishness. Coupled with dependence, the ability of an individual, sluggish, hydraulic-powered unit to provide a fail-safe load when one or two other units failed was challenged. If this is determined to be a safety issue, future actions should be taken.
•
Minimum Corrosion: Few corrosion issues were identified. A few water-damage reports were recorded for one of the major components, but only one report indicated significant corrosion of internal hardware. Other corrosion cases were found in bearings and, presumably, had increased the friction of the function. Overall, components were often removed for more prominent failures, such as electrical faults and hydraulic leakage, before corrosion was detected. Minor corrosion was repaired in those cases. As time goes on, however, corrosion may arise in highly reliable units.
•
Restoration Process: The refurbished parts evaluated in this study had significantly shorter product lives than the original units. This was observed for both hydraulically and electrically powered components. Failure modes were similar, but were more likely to occur in refurbished parts. Review of the restoration processes is recommended. Maintenance needs may be different for refurbished parts.
•
Study Limitations: Time-failure probabilities often included unconfirmed occurrences and are, therefore, likely to be conservative. Interviews with operators could confirm these instances. On the other hand, records may have been incomplete due to the lack of centralized data keeping, which caused results to be underestimated. The study was limited by the records provided. Shop findings are essential for successful assessment; therefore, more careful and complete record keeping is encouraged.
8.
RECOMMENDATIONS.
One time in-service validation is recommended for every fleet, with revisits or revalidations when there is a new design/upgrade or a new vendor. Emphases should be placed on areas of potential high consequences.
The methodology used in this study allows detection of aging, helps determine the optimal time for maintenance actions, and assists with establishing maintenance priorities. It potentially can be used for regulatory compliance and should be included in the current suite of tools to allow in-service validation.
21
9.
REFERENCES.
1.
Federal Aviation Administration Advisory Circular, “System Design and Analysis,” AC 25.1309-1A, June 21, 1988.
2. Heinrich, H.W., Industrial Accident Prevention, McGraw Hill, New York, 1931.
3. Joint Aviation Regulation, “Equipment, Systems, and Installations,” JAR 25.1309.
4. Microsoft, Visual SourceSafe 6.0, 2002.
5. Microsoft, Access 2003.
6. Meeker, W.Q. and L.A. Escobar, Statistical Methods for Reliability Data, Wiley, New York, 1998.
7. Lawless, J.F., Statistical Models and Methods for Lifetime Data, 2nd Edition, Wiley, New York, 2002.
8. Nelson, W.B., Applied Life Data Analysis, Wiley, New York, 2003.
9. S-PLUS 7.0, Statistical Analysis, Graphics and Programming for Windows, Insightful Corporation, 2005.
10. Lehmann, E.L. and Casella, G., Theory of Point Estimation, Springer, 2nd Edition, 1998.
11. Pawitan, Y., In All Likelihood: Statistical Modeling and Inference Using Likelihood, Oxford University Press, 2001.
12. Society of Automotive Engineers “Guidelines and Methods for Conducting the Safety Assessment Process on Civil Airborne Systems and Equipment,” SAE ARP 4761.
10.
RELATED DOCUMENTS.
•
Airbus Industrie, “Aircraft Maintenance Manual,” Section 05-23 Zonal Inspection and complete sub-chapters 27-21 through 27-26, November 2001.
•
Airbus Industrie, “Component Maintenance Manual With Illustrated Parts List, Artificial Feel and Trim Unit,” CMM 27-23-41 Revision 15, August 1, 2001.
•
Airbus Industrie, “Component Maintenance Manual With Illustrated Parts List, Cable Quadrant,” CMM 27-21-46 Revision 5, February 1, 2000.
•
Airbus Industrie, “Component Maintenance Manual With Illustrated Parts List, Centering Spring Rod, Yaw Damper,” CMM 27-26-41 Revision 6, August 1, 2003.
22
•
Airbus Industrie, “Component Maintenance Manual With Illustrated Parts List, Pedal Position Adjuster,” CMM 27-21-43 Revision 24, August 1, 2001.
•
Airbus Industrie, “Component Maintenance Manual With Illustrated Parts List, Rudder Control Centering Rod,” CMM 27-21-48 Revision 8, November 1, 2001.
•
Airbus Industrie, “Component Maintenance Manual With Illustrated Parts List, Rudder Control Frame,” CMM 27-21-47 Revision 14, August 1, 2001.
•
Airbus Industrie, “Component Maintenance Manual With Illustrated Parts List, Spring Rod,” CMM 27-21-49, Revision 6, August 1, 2001.
•
Airbus Industrie, “FMES, Flight Controls,” Chapter 9, 10, and 11, various dates 1987-1988.
•
Airbus Industrie, “Illustrated Parts Catalog,” IPC 27-20 through 27-26, November 20, 2001.
•
Airbus Industrie, “Illustrated Parts Catalog,” IPC 29-12-05, Introduction pp. 19-21 and pp. 150-262, February 1, 2003.
•
Airbus Industrie, “MPD,” Flight Controls Section 3-27/2, pp. 1-4, May 1, 1995.
•
Airbus Industrie, “MPD,” Stabilizers and Tail Unit Section 6-ZL/300, November 30, 1999.
•
Airbus Industrie, “MSG3 Analysis,” MSI-Ref 27-21-00 Issue 2, February 4, 1987 and associated logic analysis data sheets with various dates.
•
Kollmorgen Artus, “Component Maintenance Manual With Illustrated Parts List, Travel Limitation Unit,” CMM 27-23-51 Revision 3, January 2000.
•
Liebherr-Aerospace Lindenberg GmbH, “Component Maintenance Manual With Illustrated Parts List, Rudder Servo Control,” CMM 27-21-01 Revision 8, February 28, 2001.
•
Ratier-Figeac, “Component Maintenance Manual With Illustrated Parts List for Cable Tension Regulator,” CMM 27-09-10 Revision 3, August 30, 1999.
•
SAGEM SA, Defence and Security Division, “Component Maintenance Manual With Illustrated Parts List, Rudder Trim Actuator,” CMM 27-22-51 Revision 3, March 15, 2001.
23
24
•
Sarma, Product Support Department, “Component Maintenance Manual With Illustrated Parts List, Transducer Unit,” CMM 27-92-16 Revision No. 2, January 31, 2001.
•
TRW Aeronautical Systems, “Component Maintenance Manual With Illustrated Parts List, Servo Control,” CMM 27-26-51 Revision 8, July 2001.

f214216709

什么内容的？

Lee999

学习下，谢谢！

kinran

谢楼主谢楼主

merrysonny

看看看看看看看看

duyliang

下来学习学习

谢谢楼主

chen8899cjx

A319/A320航线工作培训手册

bocome

好好学习天天上上