Industrial aviation management by batdelger

Industrial Aviation Management

Martin Hinsch

Industrial Aviation Management A Primer in European Design, Production and Maintenance Organisations

Dr. Martin Hinsch AeroImpulse Hamburg Germany mh@aeroimpulse.com

ISBN 978-3-662-54739-7 ISBN 978-3-662-54740-3 (eBook) https://doi.org/10.1007/978-3-662-54740-3 Library of Congress Control Number: 2018948166 © Springer-Verlag GmbH Germany, part of Springer Nature 2019 Translation from the German Language edition: Industrielles Luftfahrtmanagement by Martin Hinsch, 3rd ed., Copyright © Springer-Verlag GmbH 2017 This work is subject to copyright. All rights are reserved by the Publisher, whether the whole or part of the material is concerned, specifically the rights of translation, reprinting, reuse of illustrations, recitation, broadcasting, reproduction on microfilms or in any other physical way, and transmission or information storage and retrieval, electronic adaptation, computer software, or by similar or dissimilar methodology now known or hereafter developed. The use of general descriptive names, registered names, trademarks, service marks, etc. in this publication does not imply, even in the absence of a specific statement, that such names are exempt from the relevant protective laws and regulations and therefore free for general use. The publisher, the authors and the editors are safe to assume that the advice and information in this book are believed to be true and accurate at the date of publication. Neither the publisher nor the authors or the editors give a warranty, express or implied, with respect to the material contained herein or for any errors or omissions that may have been made. Printed on acid-free paper This Springer imprint is published by the registered company Springer-Verlag GmbH, DE part of Springer Nature. The registered company address is: Heidelberger Platz 3, 14197 Berlin, Germany

Preface

Design, production and maintenance of aeronautical products are characterised by above-average process complexity. Extensive requirements of European and American aviation legislation as well as numerous industry standards must be fulfilled. These aspects need to be taken into account in the organisational structures and implementation in everyday operations. This can only be achieved in the context of a structured and comprehensible QM system and a process organisation, where responsibilities are clearly allocated. This book therefore focuses on the requirements, functioning principles and organisational structures aeronautical organisations are challenged with. I wrote the first (German) edition of this textbook in 2009/2010, since a comprehensive overview of design, production and maintenance of aeronautical products had not been available in summarised form. After the bookâ&#x20AC;&#x2122;s great success on the German-language market, I decided to publish an international edition. My goal is to provide a basic textbook that facilitates adequate understanding of organisational and legal interrelations across the aeronautical sector in Europe. Accordingly I have written this book to be both used for scientific study and non-university education. My intention was to formulate and structure the text in a way that allows practical people with little aeronautical expertise and without long training to use this book as a simple tool. Core characteristic, after all, is its consistent practice-orientation. Finally I would like to point out that, in some cases, industry-specific terms might not have yet been generally accepted throughout the entire aviation industry. The content of this book might hence not entirely correspond with individual experience or expertise provided by other sources. I want to express my sincere gratitude to all the friends, former colleagues and executives of numerous organisations, who have aided me in preparing this text. With their suggestions and comments, they have contributed to the printing and thus to the success of this book. I would like to express my special gratitude to some of my former Lufthansa Technik colleagues: Senior Auditor Dirk Maue-Laute for providing advice on almost all chapters, Susanne Huemer for having comprehensively supported me as an expert on the Part 21J content as well as Sven Pawliska for his advice on the complex field of maintenance management. I would as well like to express my thanks to Adrian Martins for his comments on the EASA regulations. Summer 2018

Martin Hinsch v

Contents

1 Introduction. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 1 2 Authorities and Official Organisations. . . . . . . . . . . . . . . . . . . . . . . . . . . 2.1 European Aviation Safety Agency (EASA). . . . . . . . . . . . . . . . . . . . . 2.2 National Aviation Safety Authorities in the EASA Area. . . . . . . . . . . 2.3 International Civil Aviation Organization (ICAO). . . . . . . . . . . . . . . . 2.4 Federal Aviation Administration (FAA). . . . . . . . . . . . . . . . . . . . . . . .

5 5 8 9 10

3 Regulations and Approvals. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.1 EASA Regulations. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.1.1 EASA Regulatory Structure. . . . . . . . . . . . . . . . . . . . . . . . . . . 3.1.2 EASA Part 21J – Design. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.1.3 Part 21G – Production. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.1.4 Part 145 – Maintenance. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.1.5 Part M – Continuing Airworthiness. . . . . . . . . . . . . . . . . . . . . 3.2 European Aviation Standards of the EN 9100 Series . . . . . . . . . . . . . 3.3 Introduction to the FAA Legislation . . . . . . . . . . . . . . . . . . . . . . . . . . 3.3.1 FAA Regulations. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 3.3.2 FAA Approvals . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . References. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

11 11 11 16 23 28 33 36 41 41 42 45

4 Design. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4.1 Basic Design Organisation Requirements. . . . . . . . . . . . . . . . . . . . . . 4.2 Essential Design Organisational Structures. . . . . . . . . . . . . . . . . . . . . 4.2.1 Design Assurance System. . . . . . . . . . . . . . . . . . . . . . . . . . . . 4.2.2 Type-Certification . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4.2.3 Office of Airworthiness. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4.3 Specification of Design Projects . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4.3.1 Definition and Tasks. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4.3.2 Formal Design Specification Requirements. . . . . . . . . . . . . . . 4.3.3 Content and Structure of Design Specifications . . . . . . . . . . . 4.4 Production, Maintenance & Operating Documents. . . . . . . . . . . . . . . 4.4.1 Production Documents (Approved Design Data) . . . . . . . . . . 4.4.2 Operating and Maintenance Documentation. . . . . . . . . . . . . . 4.4.3 Verification and Release. . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

47 47 49 49 51 53 55 55 56 57 62 62 64 64 vii

viii Contents

4.5 Design Classification. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4.6 Design Certification Process (Major) . . . . . . . . . . . . . . . . . . . . . . . . . 4.6.1 Certification Programme. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4.6.2 Safety Assessment. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4.6.3 Showing of Compliance. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4.6.4 Type Investigation. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4.6.5 Type-Certification . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4.7 Management Basics of Major Design Projects. . . . . . . . . . . . . . . . . . 4.7.1 Tasks and Characteristics of Design Management . . . . . . . . . 4.7.2 Project Preparation. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4.7.3 Project Flow. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4.7.4 Project Structures. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4.8 Minor Design Changes . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4.9 Repairs . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4.10 Component Development . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4.10.1 Specification of Parts . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4.10.2 Construction of Components. . . . . . . . . . . . . . . . . . . . . . . . . . 4.10.3 Qualification and Approval of Parts. . . . . . . . . . . . . . . . . . . . . 4.11 ETSO Parts. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 4.12 PMA Parts. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . References. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

65 68 68 71 76 81 82 85 85 88 89 92 95 96 99 100 102 104 106 107 108

5 Maintenance Management. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5.1 Tasks and Objectives of Maintenance Management. . . . . . . . . . . . . . 5.2 Maintenance Programmes. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5.2.1 Necessity of Maintenance Programmes. . . . . . . . . . . . . . . . . . 5.2.2 From MRB Report to Maintenance Programme. . . . . . . . . . . 5.2.3 Structure and Contents of Maintenance Programmes. . . . . . . 5.2.4 Life Cycle Monitoring and Status Reporting. . . . . . . . . . . . . . 5.3 Reliability Management. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 5.3.1 Purpose and Objectives of Reliability Management. . . . . . . . 5.3.2 Components of a Reliability Programme. . . . . . . . . . . . . . . . . 5.4 Notifications by Authorities and Manufacturers . . . . . . . . . . . . . . . . . 5.4.1 Airworthiness Directives (ADs). . . . . . . . . . . . . . . . . . . . . . . . 5.4.2 Manufacturer Notifications . . . . . . . . . . . . . . . . . . . . . . . . . . . References. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

111 111 113 113 114 119 123 124 124 126 130 130 134 135

6 Aviation Production Management. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6.1 Production and Maintenance Planning . . . . . . . . . . . . . . . . . . . . . . . . 6.2 Job Cards. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6.3 Technical Document Management . . . . . . . . . . . . . . . . . . . . . . . . . . . 6.4 TOP Requirements. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6.4.1 Technical Requirements. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6.4.2 Organisational Requirements. . . . . . . . . . . . . . . . . . . . . . . . . . 6.4.3 Personnel Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

137 137 138 142 146 147 148 149

Contents ix

6.5 Infrastructure, Work Environment and Equipment . . . . . . . . . . . . . . . 149 6.5.1 Infrastructure and Work Environment. . . . . . . . . . . . . . . . . . . 149 6.5.2 Equipment. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 150 6.6 Release Certificates and Conformity Statements . . . . . . . . . . . . . . . . 151 6.6.1 Purpose and Procedure of Release and Conformity Certificates �� 151 6.6.2 Types of Release Certificates. . . . . . . . . . . . . . . . . . . . . . . . . . 153 References. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 157 7 Production. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 159 7.1 Fundamentals of Production of Aviation Products, Parts and Appliances �� 159 7.2 Quality Management Systems in Production. . . . . . . . . . . . . . . . . . . . 162 7.2.1 Fundamental Quality Requirements and Approval Requirements �� 162 7.2.2 Independent Control and Quality Assurance System . . . . . . . 164 7.2.3 Function of Independent Quality Assurance. . . . . . . . . . . . . . 166 7.2.4 Quality Systems of Suppliers Without Part 21G Approval. . . 166 7.3 Part and Component Production as Well as System Integration. . . . . 167 7.3.1 Production Planning and Control. . . . . . . . . . . . . . . . . . . . . . . 168 7.3.2 Product Quality Assurance and Acceptance . . . . . . . . . . . . . . 172 7.4 Aircraft Production . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 174 7.4.1 Assembly of Shells and Fuselage Segments. . . . . . . . . . . . . . 174 7.4.2 Assembly of Wings and Tail Units . . . . . . . . . . . . . . . . . . . . . 178 7.4.3 Final Assembly Line (FAL). . . . . . . . . . . . . . . . . . . . . . . . . . . 178 7.4.4 Ground and Flight Testing. . . . . . . . . . . . . . . . . . . . . . . . . . . . 180 7.4.5 Aircraft Handover . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 181 7.5 VIP Aircraft Completion. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 181 7.5.1 Market Structure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 181 7.5.2 Design, Manufacturing and Installation of a VIP Cabin. . . . . 184 7.6 Archiving Production Records. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 187 References. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 188 8 Maintenance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8.1 Aircraft Maintenance Basics. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8.1.1 Definitions for Maintenance . . . . . . . . . . . . . . . . . . . . . . . . . . 8.1.2 Characteristics of Aircraft Maintenance . . . . . . . . . . . . . . . . . 8.1.3 Quality Requirements and Approval Requirements. . . . . . . . 8.2 Line Maintenance Versus Base Maintenance. . . . . . . . . . . . . . . . . . . . 8.3 Scheduled Versus Unscheduled Maintenance. . . . . . . . . . . . . . . . . . . 8.3.1 Scheduled Maintenance. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8.3.2 Unscheduled Maintenance. . . . . . . . . . . . . . . . . . . . . . . . . . . . 8.4 Setup of a Maintenance Organisation . . . . . . . . . . . . . . . . . . . . . . . . . 8.5 Production Planning in Maintenance. . . . . . . . . . . . . . . . . . . . . . . . . . 8.6 Production Controlling in Maintenance. . . . . . . . . . . . . . . . . . . . . . . .

189 189 189 190 191 193 194 194 195 196 198 199

x Contents

8.7 Line Maintenance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8.7.1 Line Maintenance Setup . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8.7.2 Line Maintenance Procedures – Terminal. . . . . . . . . . . . . . . . 8.7.3 Line Maintenance Procedures – Ramp and Hangar . . . . . . . . 8.8 Base Maintenance . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8.8.1 Base Maintenance Characteristics. . . . . . . . . . . . . . . . . . . . . . 8.8.2 Base Maintenance Layovers . . . . . . . . . . . . . . . . . . . . . . . . . . 8.9 Component Maintenance. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 8.9.1 Typical Maintenance Workshop Structure. . . . . . . . . . . . . . . . 8.9.2 Component Maintenance Procedures . . . . . . . . . . . . . . . . . . . 8.10 Engine and Propeller Maintenance . . . . . . . . . . . . . . . . . . . . . . . . . . . 8.11 Archiving Maintenance Records. . . . . . . . . . . . . . . . . . . . . . . . . . . . . References. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

201 201 203 205 208 208 209 213 213 214 217 219 220

9 Material and Service Supply. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 221 9.1 Selection and Monitoring of Suppliers . . . . . . . . . . . . . . . . . . . . . . . . 222 9.1.1 Selection of Suppliers . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 222 9.1.2 Supplier Evaluation and Release. . . . . . . . . . . . . . . . . . . . . . . 223 9.1.3 Supplier Monitoring. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 225 9.2 Material Control and Handling . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 226 9.2.1 Material Tracking (Traceability). . . . . . . . . . . . . . . . . . . . . . . 226 9.2.2 Acceptance of Goods. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 229 9.2.3 Stock Keeping. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 234 9.2.4 Material Handling . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 236 9.2.5 Nonconforming Products. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 239 9.2.6 Suspected Unapproved Parts and Counterfeit Parts. . . . . . . . . 240 9.3 Subcontracting. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 243 9.3.1 Preparation and Monitoring of Subcontracting. . . . . . . . . . . . 243 9.3.2 Subcontracting in the Context of the Extended Work Bench. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 247 9.3.3 Subcontracting to Approved Aeronautical Organisations (Part 21G/Part 145) �� 250 9.3.4 Specifics of Subcontracting Design Services. . . . . . . . . . . . . . 251 9.3.5 Specifics for Procuring External Staff. . . . . . . . . . . . . . . . . . . 252 References. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 254 10 Personnel. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 257 10.1 General Staff Qualification Requirements. . . . . . . . . . . . . . . . . . . . . . 257 10.2 Qualification of Production Staff. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 260 10.2.1 Production and Maintenance Staff Without Release Authorisation �� 260 10.2.2 Certifying Production Staff as per Part 21G . . . . . . . . . . . . . . 261 10.2.3 Certifying Maintenance Staff in Production According to Part 145 �� 264

Contents xi

10.3 Qualification of Administrative Staff. . . . . . . . . . . . . . . . . . . . . . . . . . 266 10.3.1 Qualification Requirements for Executive Staff . . . . . . . . . . . 266 10.3.2 Qualification Requirements of Operational Administrative Staff in Production and Maintenance �� 267 10.4 Specific Characteristics of Design Staff Qualification According to Part 21J �� 268 10.5 Special Staff Qualifications and Authorisations . . . . . . . . . . . . . . . . . 269 10.6 Human Factors. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 270 10.7 Continuation Training . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 272 References. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 273 11 Quality and Safety Management. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11.1 Quality Management Systems. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11.1.1 Quality Management Basics . . . . . . . . . . . . . . . . . . . . . . . . . . 11.1.2 Purpose and Objectives of Quality Management Systems . . . 11.1.3 Documentation of a Quality Management System . . . . . . . . . 11.2 Safety/Risk Management Systems. . . . . . . . . . . . . . . . . . . . . . . . . . . . 11.2.1 Safety and Risk Management Basics. . . . . . . . . . . . . . . . . . . . 11.2.2 Organisational Framework. . . . . . . . . . . . . . . . . . . . . . . . . . . . 11.2.3 Risk Management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11.2.4 Safety and Risk Monitoring. . . . . . . . . . . . . . . . . . . . . . . . . . . 11.2.5 Promoting Safety Expertise and Culture. . . . . . . . . . . . . . . . . 11.3 Auditing. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11.3.1 Auditing Types. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11.3.2 Internal Auditing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11.3.3 External Auditing . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11.4 Occurrence Reporting Systems. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 11.5 Authority Liaison. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . References. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

275 276 276 277 280 287 287 288 290 295 296 297 298 299 303 305 309 310

Annex. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 311 Index �� 341

Table of Figures

Fig. 2.1 Fig. 3.1 Fig. 3.2 Fig. 3.3 Fig. 3.4 Fig. 3.5 Fig. 3.6 Fig. 3.7 Fig. 4.1 Fig. 4.2 Fig. 4.3 Fig. 4.4 Fig. 4.5 Fig. 4.6 Fig. 4.7 Fig. 4.8 Fig. 4.9 Fig. 4.10 Fig. 4.11 Fig. 4.12 Fig. 4.13 Fig. 4.14 Fig. 4.15 Fig. 4.16 Fig. 5.1 Fig. 5.2 Fig. 5.3 Fig. 5.4 Fig. 5.5 Fig. 5.6

EASA member states. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 6 EASA basic regulatory structure. . . . . . . . . . . . . . . . . . . . . . . . . . . 13 Structure of EASA regulations relevant for this book. . . . . . . . . . . 14 Structure CS-25 – large aircraft. . . . . . . . . . . . . . . . . . . . . . . . . . . . 21 Substantial certification specifications in the EASA region . . . . . . 22 Sample PO/DO arrangement. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 26 Basic structure of the partnership for safety plan . . . . . . . . . . . . . . 43 FAA roadmap to certification . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44 Design assurance procedure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50 Exemplary structure of a design organisation. . . . . . . . . . . . . . . . . 52 Certification/approval forms . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53 Compliance matrix (example). . . . . . . . . . . . . . . . . . . . . . . . . . . . . 58 Significant operating and maintenance documentation. . . . . . . . . . 65 Context between approval type and classification. . . . . . . . . . . . . . 66 References for a major vs. minor classification (GM 21A.91). . . . 67 Rough structure of the safety assessment process. . . . . . . . . . . . . . 68 Interdependencies investigation programme, substantiation data and compliance document. . . . . . . . . . . . . . . . . . . . . . . . . . . . 80 Supplementing type-certification documentation . . . . . . . . . . . . . . 83 Exemplary basic structure of a project flow . . . . . . . . . . . . . . . . . . 86 Matrix project organisation. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 93 Pure project organisation. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 94 Approval paths for repairs. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 99 Procedural component design base structure. . . . . . . . . . . . . . . . . . 101 Component qualification and approval procedure. . . . . . . . . . . . . . 106 Determining maintenance tasks in the framework of an MRB Report. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 115 Deriving the MRB Report. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 117 The path from MRB Report to the maintenance event . . . . . . . . . . 119 Reliability management tool m/reliability of Lufthansa Technik AG for a sample fleet. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 129 Airworthiness Directives Publishing Tool of the EASA. . . . . . . . . 132 Airworthiness Directive (AD) of the EASA (abbreviated for demonstration purposes) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 133 xiii

xiv

Fig. 6.1 Fig. 6.2 Fig. 6.3 Fig. 6.4 Fig. 6.5 Fig. 7.1 Fig. 7.2 Fig. 7.3 Fig. 7.4 Fig. 7.5 Fig. 7.6 Fig. 7.7 Fig. 7.8 Fig. 7.9 Fig. 8.1 Fig. 8.2 Fig. 8.3 Fig. 9.1 Fig. 9.2 Fig. 9.3 Fig. 9.4 Fig. 9.5 Fig. 10.1 Fig. 10.2 Fig. 10.3 Fig. 10.4 Fig. 10.5 Fig. 11.1 Fig. 11.2 Fig. 11.3 Fig. 11.4 Fig. 11.5 Fig. 11.6 Fig. 11.7 Fig. 11.8

Table of Figures

SWISS maintenance job card (from AMOS system) . . . . . . . . . . . 139 TOP requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 147 European release and conformity certificates . . . . . . . . . . . . . . . . . 154 Conformity statement after aircraft production (EASA form 52) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 155 Release certificate EASA form 1 (for parts & components). . . . . . 156 Supply chain in production (exemplary structure) . . . . . . . . . . . . . 161 Documentation elements of an independent quality system in production. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 164 Production flow primarily from the perspective of production planning and control. . . . . . . . . . . . . . . . . . . . . . . . . . . 169 Production procedures in aircraft production . . . . . . . . . . . . . . . . . 171 Basic production steps in aircraft series production . . . . . . . . . . . . 175 Fuselage integrated in dock. (© Airbus 2011). . . . . . . . . . . . . . . . . 176 Equipment assembly. (© Airbus 2011). . . . . . . . . . . . . . . . . . . . . . 177 FAL with the Airbus A320-Familie. (© Airbus 2011). . . . . . . . . . . 179 Boeing Business Jet, © Lufthansa Technik 2012 . . . . . . . . . . . . . . 183 Process steps in unscheduled maintenance. . . . . . . . . . . . . . . . . . . 196 Typical structure of a maintenance organisation. . . . . . . . . . . . . . . 197 Fundamental engine maintenance procedure. . . . . . . . . . . . . . . . . . 217 Certificate attached to supplied raw material. . . . . . . . . . . . . . . . . . 229 Tag for unserviceable material. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 238 Permissible and inadequate methods of scrapping aircraft material. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 240 Possible reasons for rejection of material or parts. . . . . . . . . . . . . . 242 Alternatives in subcontracting. . . . . . . . . . . . . . . . . . . . . . . . . . . . . 246 Basic sample structure of a detailed qualification concept. . . . . . . 258 Qualification opportunities in production. . . . . . . . . . . . . . . . . . . . 262 Minimum scope of information to be recorded by certifying staff. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 263 Training requirements for certifying production vs. maintenance staff. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 264 Dirty Dozen. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 271 Main elements of an EN 9100 and ISO 9001-based QM system. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 278 Main elements of an EN 9100 and ISO 9001-based QM system. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 279 Structural organisation of a QM documentation. . . . . . . . . . . . . . . 281 Structure of Lufthansa Technik’s process-based QM system IQ MOVE. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 285 Safety management pillars. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 288 Risk & safety management as continuous process . . . . . . . . . . . . . 290 Risk matrix (following EASA AMC 25.1309, except last column) . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 293 Risk matrix from an economic viewpoint. . . . . . . . . . . . . . . . . . . . 294

Table of Figures xv

Fig. 11.9 Fig. 11.10 Fig. 11.11 Fig. 11.12 Fig. 11.13

Ishikawa or fishbone diagram (generic representation). . . . . . . . . . 295 Audit types. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 306 Overview of the EN 9100 standard series audit process. . . . . . . . . 307 Occurrence reporting process steps. . . . . . . . . . . . . . . . . . . . . . . . . 308 Input mask of an occurrence reporting (example). . . . . . . . . . . . . . 308

Table of Tables

Table 3.1 Subparts of the EASA Part 21 (implementing rule Initial Airworthiness). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17 Table 3.2 Sections of the EASA Part 21, Subpart J. . . . . . . . . . . . . . . . . . . . . 18 Table 3.3 Overview of EASA certification specifications. . . . . . . . . . . . . . . . 20 Table 3.4 Paragraphs of Part 21, Subpart G (production). . . . . . . . . . . . . . . . 24 Table 3.5 Paragraphs of Part 145 (maintenance). . . . . . . . . . . . . . . . . . . . . . . 30 Table 3.6 Overview of Part M subparts. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 34 Table 3.7 Comparing EASA and FAA Subparts of Part 21. . . . . . . . . . . . . . . 42 Table 4.1 DAL classification (FAA AC 25.1309-1A, S. 4, incl. DAL E as per AMJ 25.1309). . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 71 Table 4.2 Means of Compliance Codes. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 77 Table 5.1 Example of a basic structure for life cycle monitoring. . . . . . . . . . 124 Table 8.1 Comparison of different line and base maintenance checks for wide bodies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 194 Table 9.1 Example presentation of an assessment matrix for selection of a supplier. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 223 Table 9.2 Exemplary basic structure for clustering supplier performance . . . 227 Table 11.1 Quality expectations of stakeholders. . . . . . . . . . . . . . . . . . . . . . . . 277 Table 11.2 Objectives of a quality documentation . . . . . . . . . . . . . . . . . . . . . . 282

xvii

Table of Abbreviations

4 F Form, Fit, Function, Fatigue AC Advisory Circular AC Aircraft ACARS Aircraft Communications Addressing and Reporting System ACJ Advisory Circular Joint ACJ Airbus Corporate Jet AD Airworthiness Directive AECMA European Association of Aerospace Industries ALI Airworthiness Limitation Items (Airbus) AMC Acceptable Means of Compliance AML Aircraft Maintenance Licence AMM Aircraft Maintenance Manual AMOC Alternative Method of Compliance AOG Aircraft On Ground APIS Approved Production Inspection Systems APU Auxiliary Power Unit ATA Air Transport Association of America ATP Acceptance Test Procedure AWL Airworthiness Limitation Items (Boeing) BASA Bilateral Safety Agreements BBJ Boeing Business Jet CAM Customer Acceptance Manual CAT Category (AML Licence Types A, B, C) CDR Critical Design Review CMM Component Maintenance Manual CMR Certification Maintenance Requirements CNC Computerized Numerical Control CoC Certificate of Conformity CPI FAA and Industry Guide to Product Certification CRS Certificate of Release to Service CS Certification Specification (EASA construction regulations) DDP Declaration of Design & Performance DO Design Organisation (21J Design Organisation) DOE Design Organisation Exposition xix

EASA EASA Form 1 EM EMI EN EO ERP ETA ETOPS ETSO EU FAA FAI FAL FAR FMEA FMECA FTA GM ICAO IEC IPA IPC IR ISC ISO ITCM JAA JAR LBA LEP LLP LMCC MAREPS MC MCC MEL MoC MOE MPD MOPS MPS MRB MRO MS

Table of Abbreviations

European Aviation Safety Agency EASA Release Certificate Engine Manual Electromagnetic Interference European Norm Engineering Order Emergency Response Plan Event Tree Analysis Extended (Range Twin-Engine) Operations European Technical Standard Order European Union Federal Aviation Administration First Article Inspection Final Assembly Line Federal Aviation Regulations Failure Mode and Effect Analysis Failure Mode Effects and Critically Analysis Fault Tree Analysis Guidance Material International Civil Aviation Organization International Electrotechnical Commission Implementation Procedures of Airworthiness Illustrated Parts Catalogue (EASA) Implementing Rule Industry Steering Committee International Organisation for Standardisation Initial Technical Coordination Meeting Joint Aviation Authorities Joint Aviation Requirements Federal German Aviation Authority List of Effective Pages Life Limited Parts Line-Maintenance Control Center Maintenance Reports Means/Methods of Compliance Maintenance Control Center Minimum Equipment List Means/Methods of Compliance Maintenance Organisation Exposition Maintenance Planning Document Minimum Operational Performance Standards Manufacturing Procedure Specification Maintenance Review Board Maintenance Repair & Overhaul Maintenance Schedule

Table of Abbreviations xxi

MSG Maintenance Steering Group NAA National Aviation Authority NDT Non-Destructive Testing OEM Original Equipment Manufacturer PDR Preliminary Design Review PIREPS Pilot Reports PMA Parts Manufacturer Approvals PO Production Organisation (Part 21G) POE Production Organisation Exposition PPS Production Planning and Controlling PSCP Project Specific Certification Plan PSP Partnership for Safety Plan QEC Kit Quick Engine Change Kit QM Quality Management QTP Qualification Test Plan QTR Qualification Test Report RTCA Radio Technical Commission for Aeronautics SAR Search and Rescue SB Service Bulletin SIB Safety Information Bulletin SL Service Letter SMS Safety Management System Spec. Specification SPM Standard Practices Manual SRM Structure Repair Manual STC Supplemental Type-certificate TAC Technical Acceptance TC Type-certificate TCCA Transport Canada Civil Aviation Directorate TOP Technical, Operational, Personnel (Requirements) TOT Transfer of Title TSO Technical Standard Order UPN Unapproved Parts Notification WDM Wiring Diagram Manual

Introduction

This book is dedicated to a topic that has so far hardly received any attention in literature: aeronautical organisations. This term summarises EASA approved organisations that design, produce or maintain aviation products. This text outlines in detail, how the setup and processes of these organisations must be structured to, above all, comply with the standards of the European Aviation Safety Agency (EASA). In addition to that, aeronautical organisations that do not hold EASA approvals, but have obtained an EN 9100 certification, are portrayed here as well. In order to create benefits for practical application, the connection between the applicable regulations and the daily routine is outlined at all times. After the following chapter introduces the relevant aviation authorities and official organisations, Chap. 3 is then dedicated to an introduction to the regulations and approval structures applicable to aeronautical organisations, thus facilitating a basic understanding of aviation legislation. The focus is on the EASA Part 21J (Design),1 Part 21G (Production) and Part 145 (Maintenance). Furthermore, this chapter grants insight into the European aviation standards of the EN 9100 series. At the end Chap. 3 a short introduction to the aviation legislation of the USA is given. Chapter 4 focuses on the design of aviation products. The text is therefore closely oriented on officially determined certification process. Emphasis is hereby put on the creation of specifications, design classification, safety assessment and the showing of compliance, as well as the type-certification process. Beyond that, this chapter highlights the characteristics of minor designs changes as well as that of repairs approvals and component development. Eventually the specific features of ETSO and PMA parts are presented in Sects. 4.11 and 4.12. Chapter 5 is dedicated to maintenance management. This comprises all engineering activities that are required to maintain airworthiness over the entire life cycle of 1 When Part 21, 145 or M are referred to in the following, this applies to European legislation. The wording “EASA Part XY” is used occasionally, especially in contrast to the US regulations of the same name. This wording has been widely used; However, it is not entirely correct in terms of legal formalities, since the Implementing Rules are EU and not EASA regulations.

1 Introduction

an aircraft. A substantial part of this chapter focuses on the purpose, structure and derivation of maintenance programmes. The description of reliability management that is used to monitor and assess the reliability of an aircraft and its components during operation forms another highlight of Chap. 5. The last part of this chapter focuses on publications, in particular those of aviation authorities and OEMs, on Airworthiness Directives (ADs) and Service Bulletins (SBs). Chapter 6 presents common basic elements of aeronautical production and maintenance. After an introduction to work planning and job card preparation, the management of technical documents is brought up for discussion. The necessary technical, organisational and personnel requirements (TOP) for production and maintenance as required by aviation legislation are portrayed in this chapter as well. The last subchapter is dedicated to the release and conformity certificates for production and maintenance, applicable in the EASA area. Based on a general introduction, Chap. 7 focuses on production and provides a detailed overview of quality management systems used in aeronautical production organisations, explicitly taking into account the integration of suppliers. The main part of the chapter is dedicated to the component production and the aircraft assembly processes. The following chapter focuses on the characteristics of VIP and business aircraft production. Following production, aircraft maintenance is examined in detail in Chap. 8. At the beginning the structure and function of maintenance organisations will be discussed. The focus then shifts to characteristics of line maintenance and base maintenance. On the/a basis of an ideal-typical procedure, both types of maintenance are hereby outlined in detail. In separate subchapters, specific features of component and engine maintenance are additionally clarified. In the course of Chap. 8, all substantial terms of the aircraft maintenance such as line and base maintenance, routine and non-routine maintenance, deferral of defects and aircraft releases are successively outlined. Chapter 9 is dedicated to material supply and the provision of services. Procurement is of considerable importance as aeronautical organisations externally procure a high proportion of the products they use. Besides raw materials, operating material and standard parts, the text is also concentrating in particular on components and modules. C orresponding to the actual process flow, the selection, assessment and release of suppliers is first looked into, before the text turns to continuous supplier monitoring. A second focus of this chapter is the internal material flow, from incoming goods, inventory and internal transport, all the way to the installation. Material labelling and traceability as well as handling of non-conforming products are also brought up for discussion. The text then focuses on suspected unapproved and counterfeit parts. Subcontracting and external service provision forms a third key area. Aeronautical specifics and the two types of outsourcing possible in line with aviation legislation are portrayed in depth at the end of the chapter. Chapter 10 is dedicated to staff qualification in industrial aviation management, outlining both the staff in production and maintenance for normal blue-collar workers as well as the qualification of certifying staff. This is followed by looking at

1 Introduction 3

quality requirements for administrative and executive staff. In the last two subchapters human factors and their limitations as well as general and specific continuation training issues are brought up for discussion. Chapter 11 eventually outlines quality and safety management basics in aeronautical organisations, starting with an in-depth description of tasks, structures and objectives of quality management systems. This is followed by a detailed presentation of documentation requirements. Subsequently, the safety and risk management basics are brought up for discussion. Another focus is auditing, whereby the different audit types, the audit process and external auditing is looked into. As another monitoring instrument, occurrence reporting systems are outlined. The book and its last chapter conclude with a representation of substantial authority liaison tasks.

Authorities and Official Organisations

Authorities and official organisations that determine and supervise the legal framework of aeronautical organisations are presented in this chapter. With their actions, these institutions considerably influence the fundamental operational structure of the organisations that this book focuses on. First of all the European Air Safety Agency EASA will be introduced and its tasks explained. This step is followed by a detailed representation of Europe’s national aviation bodies in general. In this context, the substantial differences and the distribution of tasks between the EASA and national aviation authorities are outlined. Sect. 2.3 focuses on the UN’s aviation organisation, the ICAO. With the definition of global standards, ICAO sets the basic framework for the entire aviation industry and to that extent also influences aeronautical organisations. In the fourth subchapter, the US American aviation authority FAA, is presented, as its decisions often influence European aeronautical organisations as well.

2.1

European Aviation Safety Agency (EASA)

The European Aviation Safety Agency (EASA) is the European Union’s supervisory aviation authority. EASA was established by the European Parliament and European Council resolutions in 2002 to ensure uniform safety and environmental protection levels within the civil aviation sector. After the legal basis of this authority (Agency) had been established with (EC) Directive 1592/2002 (Official Journal L 240 of 7 September 2002) of the European Parliament and Council of 15 July 2002, EASA commenced operations on 28 September 2003 and has been fully operational since 2006 with about 600 employees. Since then, EASA regulations have been the legal standard across the European Union. They have legislative character and are to be directly applied in all European member states. The EASA currently consists of 32 states. In addition to EU countries, Switzerland, Liechtenstein, Norway and Iceland are associated EASA

2 Authorities and Official Organisations

members as well (see Fig. 2.1). The Agency’s head office is located in Cologne, Germany. For the fulfilment of the task, EASA is provided with a Management Board. Its function is to define the objectives and priorities of the Agency, to approve the budget and to supervise its processes. The board is constituted of EASA member state and European Commission representatives. The Agency’s tasks comprise advising the European Commission with specialised expertise on flight safety and international aviation harmonisation as well as on

Fig. 2.1 EASA member states

2.1 European Aviation Safety Agency (EASA) 7

the development and determination of uniform safety and environmental-protection regulations for civil aviation. In detail, the EASA is responsible for: • consulting the EU Commission on legislative processes, implementation of regulations issued by the international aviation organisation ICAO into European legislation in the form of rules and directives as well as by developing own regulations, • collection and analysis of data to improve flight safety with the objective of ensuring a uniform protection level of citizens as well as facilitating free transportation of goods and passengers across the EU, • defining the legal framework for airlines and aeronautical organisations. The EASA issues approvals to organisations within the sectors of design, production, maintenance and continuing airworthiness. It is furthermore responsible for the publication of implementation recommendations as well as for the definition of (technical) Certification Specifications (CS), • guidance and monitoring of member states and industrial players regarding the implementation of regulations, • certification of aviation products and approvals for non-European airlines to create and uphold a uniform safety level across all EASA member states. In performing these tasks, the agency is assisted by the national aviation authorities (NAAs), for instance, in the fields of operational monitoring, data collection or legal advice. Furthermore, responsibilities for aviation safety remain, at least in part, with the national aviation authorities, e.g. when granting permissions for production and maintenance organisations according to Part 21G and Part 145. Prior to EASA’s formation, activities to harmonise safety regulations had already been initiated in Europe. In 1970, various European civil aviation authorities joined forces, forming the Joint Aviation Authorities (JAA). Once EASA had been established and commenced its work, it gradually took over JAA’s responsibilities, so that the JAA was dissolved in 2009. The Joint Aviation Authorities hereby did not function as a regulatory body, but rather constituted a union of national aviation authorities. With the Joint Aviation Requirements (JAR), the JAA defined extensive regulations that were implemented and monitored by the national aviation authorities. However, different national interpretations of aviation safety proved problematic for the harmonization. To make matters worse, a regulation could only be declared generally binding across the JAA area, if all members agreed accordingly. In the course of their harmonisation activities, the JAA countries strongly followed US-American regulations, so that the regulations developed by JAA and mostly adapted by EASA today are characterised by a high level of similarity to those of the American aviation authority (FAA).

2 Authorities and Official Organisations

2.2

National Aviation Safety Authorities in the EASA Area

Every EASA member state has its own national aviation safety authority. These are, for instance, the • • • •

Direction générale de l’Aviation civile (DGAC) in France, Luftfahrt-Bundesamt (LBA) in Germany, Ente Nazionale per l’Aviazione Civile (ENAC) in Italy, Civil Aviation Authority (CAA) in Great Britain.

The national aviation bodies are responsible for civil aviation tasks in their respective states. The authorities are usually under federal supervision of the national ministries of transportation. The authorities’ main tasks comprise technical auditing and approval activities, the implementation of new regulations as well as the management of the search and rescue services. Within the sector of industrial aviation management, the national aviation authorities are generally in charge of: • approval and monitoring of maintenance, production and training organisations as well as of continuing airworthiness organisations on behalf of the Agency,1 • approval and monitoring of national design, production and maintenance organisations, • verification and approval of maintenance programmes as well as the publication of airworthiness directives, • approval, monitoring, examination as well as partially also training of certifying staff of production and maintenance organisations, • participation in the development of legislative proposals. National aviation authorities furthermore supervise national airlines and other aircraft operators. In this context the authorities partly take over the following tasks in cooperation with the Agency or the national air traffic control services: • certification and monitoring of airlines and/or aircraft operators, • aircraft registration of civil aircraft (e.g. for aircraft (A/C), helicopters, balloons and airships), • administration of central aviation data bases, e.g. the aircraft register, • issuing entry or flyover permissions for airlines outside of the EASA area as well as issuing airline permission and permissions for intra-community air traffic. To ensure uniform safety levels in European air traffic, national aviation authorities furthermore supervise foreign airlines on national airports. This is carried out on the

According to EASA Part 21/J, the responsibility for approval and monitoring of design organisations lies with EASA and not with the national aviation authorities.

2.3 International Civil Aviation Organization (ICAO) 9

basis of samples, which focus on flight and technical safety checks among non-European charter airlines. NAAs can withdraw entry or flyover permissions from airlines that do not meet the required standards. This always happens in close coordination with the Agency to ensure uniform solutions in the EASA area (black lists, i.e. lists of airlines for which an operating ban was issued in the European Union).

2.3

International Civil Aviation Organization (ICAO)

The International Civil Aviation Organization (ICAO) is the United Nations’ sub-organisation responsible for civil air traffic. Its key task is the standardisation and regulation of civil aviation with the aim of ensuring safe and efficient air traffic. The ICAO was founded on the basis of the convention on international civil aviation (Chicago Convention on International Civil Aviation) in 1944 and officially commenced its operation in 1947. The organisation has its registered office in Montréal (Canada). The ICAO currently has about 190 member states. The ICAO provides fundamental minimum standards on all fields of civil aviation. This comprises, for instance, standards regarding personnel qualification, abbreviations and definitions, technology and design, infrastructure, mapping or radio traffic. The regulations specified by the ICAO can have both the character of a binding minimum standard or of non-binding recommendations. The national aviation authorities are subsequently responsible for the implementation of these regulations. Common practice hereby is that these guidelines merely form the basis of a far more detailed aviation legislation on the national level. The binding and recommending results of the standardisation activities issued are currently outlined in 18 annexes. The sections relevant for industrial aviation management are: Annex 1: Personnel Licensing: In this appendix the basic personnel qualification requirements regarding training, qualification, advanced training and appointment issues are formulated. This is supported by the basic aim that airworthiness and safety of flight operation can only be ensured by sufficiently trained personnel. … Annex 6: Operation on Aircraft: From the perspective of industrial aviation management this annex contains requirements for design and maintenance stakeholders, e.g. with regard to flight characteristics, operational restrictions, characteristics of components and equipment (e.g. within the areas of navigation, communication, safety) as well as requirements regarding maintenance and aircraft documentation. … Annex 8: Airworthiness of Aircraft: In this annex the technical and process- related minimum requirements and standards regarding the design and certification of aircrafts, engines as well as of parts and appliances are defined. Furthermore, basic procedures for the release to service of aircraft after

2 Authorities and Official Organisations

maintenance are specified. ICAO annex 8 furthermore regulates basic rules for the exchange of information between the stakeholders involved in the design and maintenance and the countries concerned by the operation. … Annex 16: Environmental Protection: This section is dedicated to noise limits for aircraft, engine and auxiliary power units (APUs). Emissions thresholds are defined as well. The annexes not specified here are not directly connected to industrial aviation management and, among other things, deal with international traffic regulations (Annex 2), aviation maps (4), measurement units for in-flight and ground use (5), issuing the so-called ICAO codes for airports and aircraft types (7), Search & Rescue (SAR) issues (12) or aircraft accident and incident investigations (13).

2.4

Federal Aviation Administration (FAA)

The Federal Aviation Administration (FAA) is the US aviation authority and thus the US-American equivalent to EASA and to the European national aviation authorities. The first aviation institutions were formed in the United States in as early as the 1920s. However, the FAA was established in 1958, after a series of severe aviation accidents occurred. The authority has its registered office in Washington D.C. and is subordinate to the US-American Department of Transportation. The FAA’s key task lies in the definition and monitoring of the legal framework to ensure safe and efficient air traffic. FAA and EASA are thus very similar in their range of tasks. This book sometimes makes reference to the FAA because its decisions often have direct influence on the European aviation industry. Reciprocally the EASA as well affects developments in the US-American aviation industry. The mutual interdependence is a result of their close interlinking, caused by an extensive exchange of goods and services. EASA and FAA have therefore attempted to advance the mutual acknowledgment of procedures and regulations for years. Recent activities have manifested, e.g., in the BASA-agreement (Sect. 3.3.1) in the high similarity of Certification Specifications or in the mutual acknowledgment of interpretation material with regard to aviation legislation.

Regulations and Approvals

The basis of almost all technical aviation activities is provided by legal and normative regulations. Being aware of these requirements is an important precondition, allowing readers to develop a comprehensive understanding of the structure and procedures of aeronautical organisations. EASA regulations are initially outlined in Sect. 3.1. After a presentation of the fundamental structure, focus in Sects. 3.1.2–3.1.4 shifts towards the European Directives on Design (EASA Part 21J), Production (EASA Part 21G) and Maintenance (EASA Part 145) of aviation products as well as on Continuing Airworthiness (Part M). To create an understanding of the interaction between maintenance organisations and aircraft operators for the continuing airworthiness, the EASA Part M is briefly outlined as well. All important legal texts are presented and outlined in compressed and summarised form. To ensure that the fundamental requirements of the numerous suppliers not approved by aviation authorities are also taken into account in this book, the European Standard of the EN 9100 series is presented in Sect. 3.2. Chap. 3 closes with an introductory presentation of US-American regulations, as they significantly influence the aviation activities in the EASA area as well.

3.1

EASA Regulations

3.1.1 EASA Regulatory Structure EASA has issued regulations that provide a uniform and safe framework with regard to design, production, maintenance and operation of aviation products within its area of responsibility. Compliance with these standards must be ensured by all organisations active in the respective range of activities. EASA’s regulatory elements relevant for this book essentially consist of three regulations. These underwent the legislations decision-making process of the European Union as Executive Decisions and thus have legal character. Other than in the case © Springer-Verlag GmbH Germany, part of Springer Nature 2019 M. Hinsch, Industrial Aviation Management, https://doi.org/10.1007/978-3-662-54740-3_3

3 Regulations and Approvals

of most EU resolutions, changes to these regulations directly apply to all member states, without approval of the individual states’ parliaments being required. The EASA regulations for aeronautical organisations are characterised by a multi-level structure and, in line with Fig. 3.1, differentiate between Basic Regulations and two subordinated Implementing Rules. The Basic Regulation defines the structure of the regulatory framework in terms of application scope, objectives and terminology.1 The basic regulations furthermore determine EASA’s general structure as an authority. The Implementing Rules are of greater detail and directly define requirements and procedures within the respective technical field to aviation authorities and aeronautical organisations. The three Implementing Rules (relevant for industrial aviation management) are listed below: • Implementing rule Initial Airworthiness to issue airworthiness and environmental certifications for aircraft, associated products, parts and appliances as well as for the approval of design and production organisations, • Implementing rule Continuing Airworthiness for aircraft, associated products, parts and appliances and issuing approvals for organisations and persons performing these activities. • Implementing rule on Additional Airworthiness Specifications comprises a series of safety-relevant specifications with regard to the production, primarily, of large aircraft. This regulation hence does not contain any organisational rules, instead contains detailed technical specifications (Certification Specifications). Therefore, and due to its minor scale, it is not taken into further account herein. The two essential Implementing Rules of Initial and of Continuing Airworthiness are subdivided into parts, sections and subparts. While the sections specify the competencies, the parts and subparts determine the contextual focus of the legal texts specified therein. The sections are each subdivided into categories A and B. While A sections determine requirements for organisations, the B sections exclusively lay down procedures relevant for EASA and the national aviation authorities (NAA). From the view of aeronautical organisations, the respective A sections are thus exclusively of relevance when looking at the Implementing Rules (IR). The Parts and Subparts categories define the focus with regard to their technical or organisational content, that is usually recognisable from the respective titles. Figure 3.2 presents the essential structure of the EASA regulations relevant in this book. In the following, the focus lies on the IR Initial Airworthiness with Part 21 as well as on the IR Continuing Airworthiness with Part 145 and Part M. In these two parts, all organisation approvals relevant for this book are outlined.

See EASA Basic Regulation no. 216/2008

Fig. 3.1 EASA basic regulatory structure

&RQWLQXLQJ DLUZRUWKLQHVV

$GGLWLRQDO DLUZRUWKLQHVV VSHFLILFDWLRQV

,QLWLDO DLUZRUWKLQHVV

5HOHYDQW IRU LQGXVWULDO DYLDWLRQ PDQDJHPHQW

$HURGURPHV $'5

$LU 7UDIILF 0DQDJHPHQW $LU 1DYLJDWLRQ 6HUYLFHV $70 $16 $LU 7UDIILF &RQWUROOHUV $7&2

6WDQGDUGLVHG (XURSHDQ 5XOHV RI WKH $LU 6(5$

$LUVSDFH 8VDJH 5HTXLUHPHQWV $85

$LU RSHUDWLRQ

7KLUG &RXQWU\ 2SHUDWRUV 7&2

$LU 7UDIILF &RQWUROOHUV $7&2

$LU FUHZ

,PSOHPHQWLQJ UXOHV

%DVLF UHJXODWLRQ

3.1 EASA Regulations 13

3DUW

6HFWLRQ $

6HFWLRQ %

Â« DQDORJRXV WR VHFWLRQ $

3URFHGXUHV IRU FRPSHWHQW DXWKRULWLHV

6XESDUW - 'HVLJQ

6XESDUW * 3URGXFWLRQ

6XESDUW $ % & Â«

7HFKQLFDO UHTXLUHPHQWV

&HUWLILFDWLRQ VSHFLILFDWLRQ

,PSOHPHQWLQJ UXOH LQLWLDO DLUZRUWKLQHVV

Fig.Â 3.2â&#x20AC;&#x192; Structure of EASA regulations relevant for this book

Â«

%DVLF UHJXODWLRQ

3DUW &HUWLI\LQJ VWDII

3DUW 7 $QQH[ 9 WR 3DUW 0

Â« HDFK ZLWK WKHLU RZQ VHFWLRQV $ IRU DSSURYHG RUJDQLVDWLRQV % IRU DXWKRULWLHV

3DUW 0DLQWHQDQFH WUDLQLQJ RUJDQLVDWLRQ

3DUW 0DLQWHQDQFH RUJDQLVDWLRQV

3DUW 0 &RQWLQXLQJ DLUZRUWKLQHVV

,PSOHPHQWLQJ UXOH FRQWLQXLQJ DLUZRUWKLQHVV

Â«

14 3â&#x20AC;&#x192; Regulations and Approvals

3.1 EASA Regulations 15

They comprise: • • • •

Design organisations, EASA Part 21, Subpart J, Production organisations, EASA Part 21, Subpart G, Maintenance organisations, EASA Part 145, CAMOs (Continuing Airworthiness Management Organisations), EASA Part M.

Most parts/subparts additionally contain annexes that define form requirements (e.g. in the form of sample certificates) or special features (e.g. performance instructions). The parts/subparts do not have exactly the same structure and sometimes differ considerably in the level of detail. While the regulations of EASA Part 21J (Design) are comparatively superficially regulated, the Part 145 (Maintenance) is characterised by a high level of detail. The EASA regulations are supplemented by regulation interpretations. Hereby, Guidance Material (GM) and Acceptable Means of Compliance (AMC)2 are differentiated. This interpretation material – in contrast to the Implementing Rules – is not issued by the European Union, but directly by EASA. The Guidance Material and the Acceptable Means of Compliance are formally non-binding and have recommendation character only. However, when strictly adhering to GM and AMC standards, organisations can be certain that their actions are in compliance with the respective requirements. Thus, in daily business the interpretation material consequently has more or less binding character in practice, hence the term “Soft Laws” in EASA jargon. Since deviations from the recommendations of the GM or the AMC are theoretically possible, but in practice must be based on very solid, individual argumentation of individual EASA regulations, exceptions are rather unusual. AMC and Guidance Material for instance are available only for a third to half of all EASA regulations. A clear content-related distinction between Guidance Material and Acceptable Means of Compliance is not always simple. In principle, the GMs are rather characterised by their explanatory nature and provide further information, however, without direct implementation references. In contrast to that, the AMC provide direct implementation recommendations, whose applications ensure conformity with the regulation. AMC are quantitatively more comprehensive than the Guidance Material. The following chapters provide an overview of the Subparts 21J (design) and 21G (manufacturing), Part 145 (maintenance) and Part M (continuing airworthiness). These are elements of the Implementing Rules of Initial and Continuing Airworthiness that are affiliated with a regulatory approval.

While the legal texts (Implementing Rules including parts and subparts) are available in all languages spoken across the EU member states, GM and AMC are exclusively available in English.

See DFS (2013), DFS (2013a).

16 ▶▶

3 Regulations and Approvals

Aeronautical Organisations with National Approval Besides official aeronautical organisations with EASA approval, there are comparable national pendants3; i.e. design, production, maintenance organisations and CAMOs, where the sole responsibility remains with national aviation authorities. The legal basis is hereby not provided by EASA’s Implementing Rules on Initial or Continuing Airworthiness, but by national legislation. These national organisation approvals are applied to design, production and maintenance of historical aircraft and non-military special mission aircraft that are, e.g., used for research and testing purposes. However, national approval for aeronautical organisations is granted only, if design data were already approved according to national legislation (exception – design organisations). In daily operation, the distinction between EU and nationally approved organisations plays a minor role only, as national legislation directly refers to the applicable EASA regulations (e.g., EASA Part 21). However, nationally approved organisations also must be able to document and apply separate manuals (e.g. DOE, POE, MOE) and form sheets. Beyond that, national-approved organisations are also monitored separately, even if they additionally hold a corresponding EU approval.

3.1.2 EASA Part 21J – Design As per EASA definition, design organisations are all organisations that design aeronautical products, parts or appliances and/or that define changes or repair procedures. In order to perform such activities, organisations must have proven their capabilities and received an approval from the responsibly aviation authority. The requirements of these so-called design organisations are determined in the Implementing Rule Initial Airworthiness Part 21 Subpart J (in short: Part 21J).4 Supplementing requirements are provided by associated AMCs and Guidance Material. Design organisations are officially supervised by EASA. The key activities of design organisations comprise: • preparing design documents for aviation products as well as developing repair design procedures, • identifying, allocating and interpreting Certification Specifications and legal environmental requirements, • classify changes to type-certification, • showing compliance that the design meets the safety and airworthiness requirements of the Certification Specifications,

See IR Initial Airworthiness Part 21 – 21A.231 et seq.

3.1 EASA Regulations 17

• preparing operating and maintenance instructions (operating and maintenance manuals), • preparing and requesting official design certificate approvals for major changes and approving minor changes.5 Based on the above mentioned activities, EASA issues airworthiness certificates (type-certificates and supplemental type-certificates) as well as component and appliance approvals. EASA also approves repair procedures (Table 3.1). As a usable result, design organisations generate Approved Design Data as well as Approved Maintenance Data. Design organisations must hereby ensure the airworthiness or safety of their products via a comprehensive quality assurance and monitoring system. This system must be set out in procedural and process descriptions and is to be applied in everyday business. In principle, approved Part 21J organisations are entitled to subcontract design services to organisations without own EASA approval (outsourcing). With respect to aviation legislation the responsibility for the quality of services executed by the third-party provider, however, always remains with the approved design organisation. Those activities of third-party providers are thus performed under the approval of the design organisation assigning the service. In this case, the 21J organisation must ensure that the applicable standards are also applied by the respective service provider. Contracted organisations therefore have to be closely monitored. Table 3.1 Subparts of the EASA Part 21 (implementing rule Initial Airworthiness)

Subparts

Content of Part 21

General Provisions

Type-certificates and Restricted Type-certificates

Changes to Type-certificates and restricted Type-certificates

Supplemental Type-certificates

Production without production organisation approval

Production organisation approval

Certificates of airworthiness and restricted certificates of airworthiness

Noise certificates

Design organisation approval

Parts and appliances

Repairs

European technical standard order authorisations (ETSO)

Permit to fly

Identification of products, parts and appliances

Design organisations are also referred to as 21/J organisations.

3 Regulations and Approvals

While Table 3.2 lists all subpart paragraphs, only the content of the paragraphs required for daily operation is summarised in the following:6 Design Assurance Systems – 21A.239 Design organisations must use sustainable systems to monitor and control designs and changes. It has to be ensured in particular that the relevant regulations are complied with. Furthermore, design organisations must have structures and resources in place, allowing them to verify full compliance with Certification Specifications (so-called independent checking function of showing of compliance). The underlying operational systems and procedures must undergo regular reviews (in the form of audits). Data – 21A.243 Design organisations must have a handbook (quality manual) that outlines organisational procedures and structuring, facilities as well as activities and the scope of approval. This handbook must also contain information on the qualification of executive personnel and all staff members influencing airworthiness and environmental protection issues. This document must furthermore outline, how compliance with aviation legislation is ensured, when services are provided by subcontracted third parties. Table 3.2 Sections of the EASA Part 21, Subpart J

Section

Title/content

21.A.231

Scope

21.A.233

Eligibility

21.A.234

Application

21.A.235

Issue of design organisation approval

21.A.239

Design assurance systems

21.A.243

Data

21.A.245

Approval requirements

21.A.247

Changes in design assurance system

21.A.249

Transferability

21.A.251

Terms of approval

21.A.253

Changes to the terms of approval

21.A.257

Investigations

21.A.258

Findings

21.A.259

Duration and continued validity

21.A.263

Privileges

21.A.265

Obligations of the holder

The complete original text of Implementing Rule Initial Airworthiness Part 21J is available in the appendix to this book.

3.1 EASA Regulations 19

Approval Requirements – 21A.245 Activities may only be provided by design organisations, if sufficiently qualified personnel is available, when such staff was authorised to perform the respective work and if the required facilities are available. Beyond that, it is explicitly postulated that information is exchanged between different departments and external providers in a sustainable and coordinated manner. Changes in Design Assurance Systems – 21A.247 Major changes with regard to quality assurance systems require EASA approval. The organisation must hereby verify that after an organisational change it is still able to comply with all approval requirements. Transferability – 21A. 249 As a rule, the acknowledgment as approved design organisation is not transferable to other organisations or locations; e.g. by sale or endowment. Terms of Approval – 21A.251 and 21A.253 Defining and listing type and scope of approved design activities in the design organisation handbook is mandatory. Changes to the terms of approval require EASA approval. Privileges – 21A.263 Certified design organisations are entitled to perform design activities to the extent of their approval. They can categorize design classifications and approve changes that are classified as minor by themselves. Furthermore, design organisations are entitled to approve major repairs, if they hold the type-certification. Operational design information and instructions can equally be issued by 21J organisations. Obligations of the Holder – 21.A265 Besides maintaining a design organisation handbook that is to be used as a fundamental guideline throughout the organisation, an approved 21J organisation must ensure that design data comply with relevant regulations and do not pose any safety risks. Approved design organisations are furthermore under obligation to provide all design documents, that are not classified as “minor” to EASA for approval, if requested. Failures, Malfunctions and Defects – 21.A.3A Not Subpart J, but main section A, additionally requires that design organisations must have a system in place to record, check and analyse information on failures, malfunctions, defects, or other occurrences with regard to their own products or the related design documentation. Should events have led to an unsafe condition, they must be reported to the EASA within a maximum period of 72 hours.

3 Regulations and Approvals

Excursion: Certification Specifications Certification Specifications (CS) detail the approval requirements with regard to aircraft design on a technical level. They specify the condition of products and at the same time determine or provide references on how airworthiness is to be shown. These specifications are exclusively available in English language. The EASA Certification Specifications are subdivided into product groups specified in Table 3.3. Every individual Certification Specifications is broken down into two so-called books. While Book 1 specifies the actual certification specifications, Book 2 contains associated application references (Acceptable Means of Compliances – AMCs) that have more or less binding character (soft-law). Book 1 is divided into subparts and appendixes. Book 2 is based on this structure, see Fig. 3.3, as well. Table 3.3 Overview of EASA certification specifications Section

Title/content

AMC-20

General Acceptable Means of Compliance for Airworthiness of Products, Parts and Appliances

CS-22

Sailplanes & Powered Sailplanes

CS-23

Normal, Utility, Aerobatic & Commuter Aeroplanes

CS-25

Large Aeroplanes

CS-26

Additional airworthiness specifications for operations

CS-27

Small Rotorcraft

CS-29

Large Rotorcraft

CS-31

Balloons

CS-34

Aircraft Engine Emissions and Fuel Venting

CS-36

Aircraft Noise

CS-APU

Auxiliary Power Units

CS-E

Engines

CS-ETSO

European Technical Standard Orders

CS-LSA

Light Sport Aeroplanes

CS-P

Propellers

CS-SIM

Simulator Data

CS-STAN

Standard Changes and Standard Repairs

CS-VLA

Very Light Aeroplanes

CS-VLR

Very Light Rotorcraft

CS-MMEL

Master Minimum Equipment List

CS-GEN-MMEL

Generic Master Minimum Equipment List

CS-CCD

Cabin Crew Data

CS-FCD

Flight Crew Data

3.1 EASA Regulations 21

&HUWLILFDWLRQ 6SHFLILFDWLRQ &6

%RRN 5HJXODWLRQV

%RRN ,QWHUSUHWDWLRQV $0&

6XESDUW $ ± *HQHUDO 6XESDUW % ± )OLJKW 6XESDUW & ± 6WUXFWXUH 6XESDUW ' ± 'HVLJQ &RQVWUXFWLRQ

$FFRUGLQJ WR VXESDUW VWUXFWXUH %RRN

6XESDUW ( ± 3RZHUSODQW 6XESDUW ) ± (TXLSPHQW 6XESDUW * ± 2SHUDWLQJ OLPLWDWLRQV DQG LQIRUPDWLRQV 6XESDUW + ± (OHFWULFDO ZLULQJ LQWHUFRQQHFWLRQ V\VWHPV 6XESDUW - ± $38 ,QVWDOODWLRQ

Fig. 3.3 Structure CS-25 – large aircraft

For new type-certificates, the Certification Specifications valid on the day of application are to be applied. For design changes on existing types, organisations can resort to those certification specification, which the type-certification was based on, unless the nature of the change is not significant.7 Since EASA has only been established in 2003, the CS were for the first time extensively and practically applied to a large aircraft in the context of the A350 and/or B787 approvals. The Joint Aviation Regulations (JAR) dating back to the JAA period and the US Certification Specifications, the Federal Aviation Regulations (FAR), are thus additionally relevant for the EASA region (see Fig. 3.4). The JARs are to be applied to this day, for instance, when an Airbus aircraft type that was granted its

See IR Initial Airworthiness Part 21 – 21A.101. A change is automatically rated significant, if the general configuration or construction principles were changed (e.g. when using a different type of engine or in case of significant changes to the aircraft structure, e.g. installation of an additional cargo door), or if assumptions applied during type-certification no longer apply (e.g. additional approval for flights under icing conditions). 7

3â&#x20AC;&#x192; Regulations and Approvals

&HUWLILFDWLRQ 6SHFLILFDWLRQ

($6$

-$$

)$$

&HUWLILFDWLRQ 6SHFLILFDWLRQ &6

-RLQW $YLDWLRQ 5HTXLUHPHQWV -$5

)HGHUDO $YLDWLRQ 5HJXODWLRQ )$5

H J $

$SSOLFDWLRQ IRU ($6$ 7\SH &HUWLILFDWH EHIRUH

H J $ IDPLO\ $

$SSOLFDWLRQ IRU $ & W\SHV EHIRUH SXEOLVKLQJ RI -$5 -RLQW $YLDWLRQ 5HTXLUHPHQWV

$SSOLFDWLRQ IRU ($6$ 7\SH &HUWLILFDWH DIWHU

IRU VXEVWDQFLDO FKDQJHV RI H[LVWLQJ 7&V

H J $ $

Fig.Â 3.4â&#x20AC;&#x192; Substantial certification specifications in the EASA region

first type-certification prior to 2003 undergoes design changes. The FARs are also applied in Europe when it comes to design changes or repair procedures with regard to aircraft types prior to the first issue of JAR 25 (e.g. Airbus A300, A310).8 As far as FAR or JAR regulations are applicable, it is important to take into account that, in some cases, the latest Certification Specifications must be complied with in order to ensure conformity with current European regulations. The certification specifications of EASA, JAA and FAA are similar in structure and in many areas are of high similarity as well. However, the terms used for the interpretation material are deviating. While EASA refers to them as Acceptable Means of Compliance (AMC), the JAR list them as Advisory Circular Joint (ACJ) and Advisory Material Joint. In the FAA region they are referred to as Advisory Circular (AC) and separated from the basic regulations. Not every EASA Certification Specification comes with corresponding AMCs. In these cases it makes sense and has become general practice to use the FAAâ&#x20AC;&#x2122;s matching AC when interpreting the regulation as there usually are no AMCs for certification specifications, where ACs were already issued (and vice versa). In addition to the Certification Specifications, there are other official requirements to be complied with in order to be granted an airworthiness and/or operating approval besides to the type-certificate. These operational standards are to be formally demonstrated by the aircraft operator and are not part of the type-certification.

As a rule, EASA applies its own Certification Specifications in the type-certification of third country operators and only in justified exceptional cases, applies the certification specifications of the approving aviation authority. For example, when there are no own corresponding specifications.

3.1 EASA Regulations 23

It is however, necessary to already take these regulations (e.g. EU OPS) into account in the design phase to facilitate later certification for the organisation.9

3.1.3 Part 21G – Production Aeronautical production comprises all activities directly affiliated with producing aircraft, engines as well as parts and appliances. Only officially approved organisations are permitted to produce and/or release aviation products with an EASA Form 52 (aircraft) or an EASA Form 1 (parts and appliances). The requirements of these so-called production organisations are defined by the EASA Implementing Rule Initial Airworthiness in Part 21 Subpart G (in short: Part 21G).10 Similar to Subpart J, there is supplementing interpretation material (AMC and/or Guidance Material) for the production sector as well. The organisation must have demonstrated to the authority its production capability. Thus, an EASA approval must be available and production activities must be covered by the scope of approval. Production in the sense of Part 21G may only be performed on basis of approved design data. Production organisations are therefore not permitted to design and subsequently produce aviation products “on their own”. A production organisation, as a rule, may not perform any maintenance services on own components, as such activities require additional approval as maintenance organisation according to EASA Part 145. The operational responsibility for production organisations, in contrast to design organisations, does not lie with EASA, but with the national aviation authorities. Table 3.4 provides an overview of all paragraphs of Subpart G. The most important provisions of the Part 21 Subpart G are summarised in the following:11 Quality System – 21A.139 Production organisations must demonstrate the existence of a sustainable and effective quality system. The system must ensure that compliance with and suitability of internal regulations and procedures are verified by independent audits. In addition to that it must contain a feedback loop to executive staff and the accountable manager. Exposition – 21A.143 Production organisations must have a Production Organisation Exposition (POE) in place, where the organisation is characterised with its quality system, substantial procedures, personnel resources, operational facilities, structure and scope of

Other examples of such specifications are JAR OPS1 and JAR-26 or Part M in Europe, as well as FAR Part 91 and FAR Part 121 in the FAA region. 10 See IR Initial Airworthiness Part 21 – 21A.131 et seq. 11 The complete original text of Implementing Rule Initial Airworthiness Part 21G is available in the appendix to this book. 9

24 Table 3.4 Paragraphs of Part 21, Subpart G (production)

3 Regulations and Approvals Section

Title/content

21.A.131

Scope

21.A.133

Eligibility

21.A.134

Application

21.A.135

Issue of production organisation approval

21.A.139

Quality system

21.A.143

Exposition

21.A.145

Approval requirements

21.A.147

Changes to the approved production organisation

21.A.148

Changes of location

21.A.149

Transferability

21.A.151

Terms of approval

21.A.153

Changes to the terms of approval

21.A.157

Investigations

21.A.158

Findings

21.A.159

Duration and continued validity

21.A.163

Privileges

21.A.165

Obligations of the holder

activities and approval. Procedures with regard to changes to the organisational structure must be determined as well. Furthermore, information on obligations and tasks of executive personnel is to be provided in such an exposition. The management and the certifying staff entitled to issue release certificates as well as third party providers assigned are hereby to be listed by name. The POE has the character of a contract with the aviation authority, with which the organisation commits itself to compliance with the rules set out therein. Approval Requirements – 21A.145 The organisation is to appoint an accountable manager in charge of all legal aspects, who must have access to sufficient organisational, personnel and technical resources required for production.12 Beyond that, production is permissible only, if approved data published by the responsible design organisation are fully and correctly available throughout the organisation at its current revision status.

EASA or the national authorities explicitly distinguish between CEO and Accountable Manager. This can be the same person – but it is not absolutely necessary. Basic tasks and requirements of the Accountable Manager are described in GM 21.A.145 (c) (1).

3.1 EASA Regulations 25

The organisation must define responsibilities on all operational levels and disclose the name of the respective manager. It must hereby be ensured that staff are qualified according to their areas of responsibility and assigned tasks. Stricter requirements are explicitly applicable to certifying staff with release authorisation. Terms of Approval – 21A.151 and 21A.153 It is mandatory to define type and scope of production (products or product categories), to list them in the production organisation exposition and to acquire official approval. Changes with regard to the scope of approval require approval of the responsible national aviation authority. Privileges – 21A.163 Approved production organisations are entitled to produce aircraft, as well as parts and appliances in the context of their approval and to provide them with an official release certificate (EASA Form 1). As far as production organisations are (officially) approved for production of entire aircraft, they may issue airworthiness certificates for these. When it comes to fresh-from-the-factory aircraft that have not yet been delivered, manufacturers are furthermore permitted to perform and release maintenance measures for such aircraft. Obligations of the Holder – 21A.165 Approved production organisations are under obligation to maintain a Production Organisation Exposition (POE) and to apply the requirements specified therein to operational practice. In addition to that, the organisation must ensure that all products fully comply with the approved design data released by the responsible Part 21J design organisation. All work accomplished is to be recorded and to be archived after conclusion. The production organisation must hereby ensure that supplier and subcontractor data are stored on a long-term basis. Furthermore, an occurrence reporting system must be established that records and evaluates occurrences that could put airworthiness at risk. The system must ensure that these occurrences are communicated, if required, both to the responsible design organisation as well as to the aviation authorities in charge. Co-ordination Between Design and Production – 21A.4 Neither allocated to Subpart J nor G, but directly from main section A, is a requirement for cooperation between design and production organisations. This cooperation must take place in an orderly and documented manner, fixed in a joint document. In practice, the agreement between the design and production organisation is referred to as a PO/DO arrangement (production organisation/design organisation). The Objective of such an agreement is to ensure the products’ continuing airworthiness. It must be ensured that not only the initially issued design data of the Part 21J organisation are transferred to the production organisation. It must be specified as well, how later changes are applied to the product. It also has to be determined how the information flow is ensured, irrespective of the actual value chain process. Only if experiences and know-how from production and operation

3 Regulations and Approvals

monitoring are recorded via a structured feedback system, deficiencies or improvement potentials can comprehensively be integrated into future design activities. A PO/DO example presented by EASA is illustrated in Fig. 3.5. However, organisations can also choose own, deviating written agreements.

Fig. 3.5 Sample PO/DO arrangement13

AMC No. 2-21A.133 (b) and (c) 12

3.1 EASA Regulations 27 ▶▶

Case Study: Our Approval Path as EASA 21G Production Organisation The Starting point of our approval efforts as a 21G production organisation was the cooperation with a large customer in the aviation industry. After we had already produced components for cabin modifications without own approval in the context of an extended workbench, we were requested to attain an EASA 21G approval. This is how our customer intended to avoid production quality audits with intermediate surveillance in our workshops, limit costs for provided material and eventually reduce quality assurance costs. For us the advantage was to become more attractive for other potential customers. Since we had already gathered aviation experience at that time, in particular through the support on part of our customer, this issue also suggested itself. Before we contacted our national aviation authority (German LBA) for the first time, we initiated the 21G project internally and first designated a responsible quality manager (and at the same, time project manager) and had him trained and appointed. In parallel, the accountable manager was determined and staff that would later be entitled to issue product releases selected. When we initiated the 21G project our design engineers and technicians had already worked for customer projects on-site with the responsible 21J design organisation for quite some time. So they had already gathered aviation industry expertise within the sector of documentation requirements, design standards or technical connection techniques. In turn, we received the instruction certificate for standard procedures in industrial aviation parts production from our customer that later would be of importance for the aviation authorities. The quality manager created the first POE draft (21G Production Organisation Exposition) aided by an external consultant. Based on this solid preparation, we then contacted the national aviation authority that transferred us to a branch office and requested that we send our completed initial application (EASA form 50 and form 4) and POE draft there. In the initial discussion, we were informed about process, costs and important requirements as well as assigned an LBA auditor. Consequently, we adjusted the POE in line with the new findings and developed the necessary procedures and other quality documentation. Requirements we had so far never been confronted with were particularly challenging (structure of the audit system, assessment of suppliers, calibration, and traceability). An aviation consultant hereby contributed important support. After a couple of months we sent the entire documentation (POE, procedural procedures, instructions, organisational charts, forms, operational layout, check lists, etc.) to the aviation authority for examination. We then received correction requirements that could be met after several iterations. The LBA then carried out a one-day pre-audit in which a comparison was made between the current operational status and the existing

3 Regulations and Approvals

specification documentation. This resulted in additional adaptation to meet the requirements. These could, however, be met within a few weeks and were finally followed by the main audit in the course of which two aviation authority auditors examined the organisation and the documentation with regard to EASA conformity for a period of two days. Approximately two dozen minor and major audit findings were hereby identified. We were, however, able to fully eliminate them within a threemonth period, so that the 21G approval document certificate could finally be presented on our premises about two months later, approximately five months after the main audit. The total process duration amounted to about 2 years. Lots of time was lost due to the aviation authorities’ long feedback loops, as they – in their own terms – face high workload and can only resort to a limited number of staff. Although we could demonstrate some pre-existing aviation experience thanks to our activities as subcontractor, the involvement of an experienced aviation consultant was an indispensable measure. As a newcomer to the industry it is nearly impossible to attain an Part 21G approval without expert support. Not only is aviation industry expertise missing, but there is also a lack of know-how for the interpretation and operational implementation of legal requirements. We also had to develop an understanding of the approach and auditing style (in the sense of an operational aviation safety culture) of our auditor.

3.1.4 Part 145 – Maintenance Maintenance organisations in the sense of EASA are all organisations that maintain aviation products, parts or appliances subject to approved maintenance data. These activities can comprise overhaul, exchange, repair, inspections or changes (modifications) to aircraft, engines and components. To perform maintenance measures, the respective organisation must have proven adequate capabilities and obtained EASA approval. The requirements of maintenance organisations are defined by the EASA Implementing Rule Continuing Airworthiness in Part 145.14 There is supplementing interpretation material (AMC and Guidance Material) for this EASA Part as well. Some elements are similar to the EASA Part 21G requirements for production organisations, although the EASA Part 145 is characterised by a much higher degree of detail. Maintenance organisations may only perform activities on basis of approved maintenance data of the respective Part 21 J design organisation. Approved maintenance data are, e.g., Aircraft Maintenance Manual (AMM), Component Maintenance Manual (CMM), Engine Manual (EM) or Structure Repair

See IR Continuing Airworthiness Part 145 – 145.A.10 et seq.

3.1 EASA Regulations 29

Manual (SRM). In addition to that, there are several dozen other specific maintenance manuals, where type, scope and implementation of the maintenance measures are specified. The manuals always focus on one specific aircraft type and are mostly available in the English language only. Maintenance may only be performed within the scope of approval requested by the organisation and set by the NAA. Here, three basic maintenance scopes are differentiated that determine the fundamental orientation of a 145-organisation: • A rating (Aircraft rating): Entitles to perform maintenance on aircraft. This scope of approval also comprises aircraft components (including engines and Auxiliary Power Units), if they are in installed on wing or in the aircraft (APU).15 • B rating (Engine rating): Entitles to perform maintenance on disassembled engines and Auxiliary Power Units (APUs) as well as on directly related aircraft components. • C rating (Component rating): Entitles to perform maintenance on disassembled aircraft components (except on entire engines and APUs).16 In addition to that, there is a D rating that entitles the holder to perform non-destructive testing (NDT). This approval is not required for jobs with direct context to own A, B or C rating orders. A D rating must be shown only, if NDT work is implemented and released as separate order (for another organisations). In the following, the most important requirements of the Part 145 are summarised (Table 3.5):17 Scope – 145.A.20 The organisation is only entitled to perform maintenance work to the extent approved by the respective national authority. The scope of approval is to be specified in the Maintenance Organisation Exposition (MOE, see 145.A70). Facility Requirements – 145.A.25 The organisation must ensure that adequate facilities (offices, hangars and backshops) are available. This comprises the availability of suitable storage capacities for components, equipment and material as well as for tools. A so-called controlled work environment (cleanliness, lighting, noise, humidity, temperature) must be ensured.

However, the component or engine may also be dis-/assembled in the A rating category, if explicitly specified in the maintenance documentation (for example, for better accessibility). See IR Continuing Airworthiness Part 145 Annex II (4) 16 Exception in installed condition: see Implementing Rule Continuing Airworthiness Part M Appendix IV, 6 17 The complete original text of Implementing Rule Initial Airworthiness Part 145 is available in the appendix to this book. 15

30 Table 3.5 Paragraphs of Part 145 (maintenance)

3 Regulations and Approvals Section/paragraph

Title/content

145.A.10

Scope

145.A.15

Application

145.A.20

Terms of approval

145.A.25

Facility requirements

145.A.30

Staff Personnel requirements

145.A.35

Certifying staff and support staff

145.A.36

Records of airworthiness review staff

145.A.40

Equipment, tools and material

145.A.42

Acceptance of components

145.A.45

Maintenance data

145.A.47

Production planning

145.A.48

Performance of maintenance

145.A.50

Certification of maintenance

145.A.55

Maintenance records

145.A.60

Occurrence reporting

145.A.65

Safety & quality policy, maintenance procedures & quality system

145.A.70

Maintenance organisation exposition

145.A.75

Privileges of the organisation

145.A.80

Limitations on the organisation

145.A.85

Changes to the organisation

145.A.90

Continued validity

145.A.95

Findings

Personnel Requirements Incl. Certifying and Support Staff According to Categories B1 and B2 Certifying and Support Staff – 145A.30 and 145A.35 The organisation and its staff must be both quantitatively and qualitatively capable of performing the requested maintenance work. This not only comprises sufficient staff for planning and execution, but also for monitoring and quality assurance as well as personnel for non-destructive testing. Furthermore, a supervised qualification system must be available to this group and staff records must be kept. The scope of the necessary certifying (releasing) staff depends on the scope of approval. Details on certifying staff requirements are laid down in EASA Part 66. In addition to that, executive staff must be appointed and a responsible operations manager (accountable manager) must be designated for general supervision of the organisation. This person is to be supported by a quality manager.

3.1 EASA Regulations 31 ▶▶

EASA Part 66 and EASA Part 147 Part 66 specifies the requirements for certifying maintenance staff (with exception of the C rating for components). Part 66 provides details on the scope of authorisation, the necessary experience and expertise for the issue and renewal of personnel release authorisations (licences), as well as on their scope and application procedures. Part 66 also defines that the theoretical training for certifying maintenance staff may only be carried out by authorised training organisations. Only Part 147 organisations are allowed to carry out basic training as well as (aircraft) type rating training, perform appropriate tests and examinations on behalf of the relevant national aviation authority and issue the corresponding certificates for certifying staff. In all important EASA-countries, there are a large number of well-known training providers and sometimes also state-run vocational schools that hold such authorisation.

Equipment, Tools, Material – 145.A.40 A maintenance organisation must have the necessary equipment, tools and materials to perform the approved scope of work. These must normally be permanently available. It must be ensured that the operational equipment and tools are regularly checked and calibrated. Acceptance of Components – 145.A.42 All materials and components within the operational material cycle must be classified and labelled. The mandatory distinction categories hereby are: • • • • •

Components in satisfyingly, serviceable condition, Unserviceable, but reparable components, Parts that can no longer be used e.g. life limited parts (scrap), Standard parts, Raw materials and expendables.

Maintenance Data – 145.A.45 All work must be performed on the basis of approved maintenance data. The maintenance documentation generally comprises regulatory requirements, design data of the design approval holder as well as specific customer requirements. These requirements may only be deviated from, if the party that issued the respective data, approved such deviation. In addition to that, a system must be available that captures incorrect, incomplete or imprecise maintenance data and ensures that such information is communicated to the issuing party. Paragraph 145.A.45, at the same time, outlines the requirements with regard to a mandatory job card system, ensuring structured execution and monitoring of maintenance activities. Production Planning – 145.A.47 The organisation must have an appropriate system for planning, controlling and monitoring of operational resources (staff, tools and equipment, material as well as

3 Regulations and Approvals

documentation) available. When it comes to personnel planning, human factors in particular are to be taken into account. Performance of Maintenance – 145.A.48 Maintenance processes must comprise final control inspection procedures and measures, in particular foreign object damage (FOD) when it comes to tools as well as flaps/doors/panels. In addition to that, measures dealing with critical maintenance tasks must be taken. In this case, independent double inspections that must not only be proven for the aircraft itself, but also for engines and components. According to 145.A.48 (c), procedures for avoiding multiple errors must be established. This requirement primarily seeks to avoid that maintenance staff handle the same maintenance points on different systems. The responsibility for compliance with and the implementation of this requirement is primarily attributed to the department responsible for maintenance planning and job card preparation. Certificate of Maintenance – 145.A.50 The release of aircraft and components may only be certified after proper conclusion of maintenance tasks by qualified and authorised staff exclusively. An aircraft or a component may be released after incomplete maintenance in exceptional, clearly defined cases only. Maintenance Records – 145.A.55 All accomplished maintenance tasks must be documented in detail and archived for a period of at least three years. The original or a copy of every release certificate as well as corrections thereof including related documents are to be provided to the aircraft operator. Occurrence Reporting – 145.A.60 Each maintenance organisation must have an occurrence reporting system that records and evaluates incidents that endanger or could endanger flight safety.18 Such events must be communicated to the responsible authority as well as to the aircraft operator immediately, at least however, within a 72-hour period. Safety and Quality Policy, Maintenance Procedures and Quality System – 145.A.65 The organisation must have a documented quality and safety strategy in place that is to be implemented in form of a quality system. The system must, in particular, be capable of minimising potential risks of limited human performance and the risks of multiple errors and critical system errors caused by inattentiveness. The quality system must be evaluated by independent audits to sustainably ensure its effectiveness and compliance with the requirements defined in internal regulations and procedures in daily operation. The system must, at the same time, contain a feedback loop involving the executive staff, especially but not exclusively the accountable manager. 18

See also Sect. 11.4

3.1 EASA Regulations 33

Maintenance Organisation Exposition – 145.A.70 The maintenance organisation exposition (MOE) primarily is a summary description of the organisation, regarding responsibilities, organisational structure, resources used, and scope of approval as well as on the quality and safety strategy. Changes to these written operating standards require approval of the responsible national aviation authority. The MOE has the character of a contract with the aviation authority that puts the organisation under obligation to comply with the rules determined therein. Privileges of the Organisation – 145.A.75 Maintenance organisations are entitled to perform maintenance work at the locations designated according to the scope of approval and in exceptional cases to provide world-wide line maintenance. This also includes the release to service of aircraft and components after accomplished maintenance. In addition to that, certified maintenance organisations are entitled to subcontract work subject to their scope of approval within the legal framework.

3.1.5 Part M – Continuing Airworthiness Part M of the Implementing Rule Continuing Airworthiness defines which requirements are to be met by aircraft operators to sustainably ensure continuing airworthiness. Part M hereby forms the link between aircraft operator (e.g. an airline) and maintenance organisation. The necessary activities to ensure continuing airworthiness are to be managed and supervised by a separate organisation approved in line with aviation legislation, the so-called Continuing Airworthiness Management Organisation (CAMO).19 The legal requirements associated with this type of organisation are defined in Part M, Subpart G. In addition to the obligation of ensuring continuing airworthiness, a CAMO has the privilege of performing airworthiness reviews. This is important as these reviews form the basis for verification and renewal of airworthiness certificates (i. e. the operating licence). Continuing airworthiness requirements are detailed in nine Part M subparts with in total across 20+ pages (see Table 3.6). Guidance Material is not available for Part M; AMCs, however are. General Information – Subpart A Subpart A exclusively outlines the Part M scope of application, detailing continuing airworthiness measures, including maintenance as well as personnel requirements for staff or organisations dealing with continuing airworthiness issues.20 As a rule, aircraft operators or owners take over CAMO tasks themselves. However, CAMO functions can also be subcontracted to accordingly approved organisations. Such approved subcontractors performing CAMO tasks for third parties are referred to as CAMO + (Plus) organisations. 20 IR Continuing Airworthiness EASA Part M – M.A. 101 19

34 Tab. 3.6 Overview of Part M subparts

3 Regulations and Approvals

Subpart

Title/content

General Information

Accountability

Continuing Airworthiness

Maintenance Standards

Parts

Continuing Airworthiness Maintenance Organisation

Continuing Airworthiness Management Organisation

Certificate of Release to Service (CRS)

Airworthiness Review Certificate

Accountability – Subpart B In this subsection, the responsibilities under the Part-M are roughly determined. On the one hand, this includes technical and organizational responsibilities as well as personal or operational responsibility. Beyond that, Subpart B requires the establishment of an occurrence reporting for incidents that could put flight safety at risk. Continuing Airworthiness – Subpart C This subpart outlines the respective maintenance activities to ensure continuing airworthiness, e.g. regular inspections, maintenance measures as well as defect and damage rectification. Subpart C also regulates the preparation, updating and monitoring of maintenance programmes. Subpart C also provides detailed information on documentation requirements. Maintenance Standards – Subpart D Subpart D defines substantial requirements that must be met in the context of the aircraft maintenance. A CAMO must ensure that assigned maintenance organisations perform maintenance work exclusively on the basis of approved and currently valid maintenance data. Furthermore, the respective maintenance staff must be qualified for the tasks. Maintenance may only be performed in a suitable working environment (largely free from dirt and dust, protected against extreme weather, etc.) using predetermined approved tools and materials. The executing maintenance organisation must, at least also ensure proper rectification of defects compliant with Subpart D. Parts – Subpart E A CAMO must ensure that component maintenance is exclusively performed by organisations that are approved subject to Part 145 or Part M – Subpart F. Subpart E also outlines certification requirements that need to be met prior to any installation of components in an aircraft. Subpart E also requires the monitoring of life-limited and unserviceable parts.

3.1 EASA Regulations 35

Maintenance Organisation – Subpart F Subpart F exclusively applies to small aircraft that are not used for commercial purposes.21 Operators of such aircraft benefit from simplified maintenance requirements. Alternatively, having maintenance performed by an approved 145 organisation, it can be executed on the basis of the standards of this Subpart F. The appropriate maintenance requirements are similar to Part 145, however differing in terms of the (not necessary) quality system and the scope of line maintenance. Continuing Airworthiness Management Organisation – Subpart G Subpart G comprises requirement that apply to issuing and maintaining CAMO approvals. Basically it is referring to the other Subpart of EASA Part M and additionally determining further requirements with regard to organisational structure (organisation handbook, quality system, staff qualification, documentation, continuation and validity of approval, procedure in case of violations, etc.), similar to those of Part 145. Since performing airworthiness reviews is an important CAMO task, M.A. 710 specifies their purpose and provides a rough outline of scope as well as of substantial review requirements. Certificate of Release to Service (CRS) – Subpart H If an aircraft is released by an organisation that does not hold a Part 145 approval, the Subpart H determines the requirements to issue the certificate of release to service. Among other things, this subpart details technical requirements, the content of release certificates and minimum requirements with regard to certifying staff. Airworthiness Review Certificate – Subpart I Aircraft airworthiness reviews are to be performed on an annual basis. In addition to fundamental basic definitions with regard to the review, Subpart I contains information on violations as well as definitions on certificate validity. Continuing Airworthiness for Non-EASA Registered Aircraft – Part T Part-T determines how the airworthiness of aircraft that were approved outside the EASA area, but are temporarily used by an EASA region-based operator is demonstrated. Part-T aims at aircraft that are operated in the EASA area for a period of less than 7 months; and that are especially used in • wet lease or • dry lease contracts. Operators of such aircraft must ensure that all maintenance tasks have been properly performed by an approved maintenance organisation. However, aircraft governed by Part T are subject to special rules and do not have to fully meet all EASA requirements. However, operators have to document compliance with ICAO 21

See EASA (2008), p. 19

3 Regulations and Approvals

requirements. At the same time, they must obtain approval from the competent national aviation authority in the EASA area for each aircraft lease contract. The responsibility for the airworthiness of these aircraft is borne by the CAMO of the operator (airline) that takes out the lease in the EASA area. This operator has to extend its structures by a sub-organisation, a so-called CAMO-T. The essential task of this sub-structure is to ensure that the contracted maintenance organisation meets the applicable requirements of Part M Subpart E.

3.2

European Aviation Standards of the EN 9100 Series

Standardisation is a planned harmonisation of procedures, systems, terms or product characteristics to the benefit of a user group that is jointly performed by interested parties. Differentiations are hereby made between procedural standards (e.g. quality management according to ISO 9000) as well as technical (e.g. type of screw) and classificatory standards (e.g. country codes like .de, .com, .jpg). Elaboration, adoption and monitoring of standards is usually overseen by private, non-profit organisations.22 A substantial advantage of standardisation can be exploited in the quality assurance sector, where uniformly, accurately defined standards are created. This can be used as an audit basis, making quality measurable and thus comparable. In addition to that, identical framework and competitive conditions are created that facilitate the exchange of goods and services. Standards thus improve efficiency, as planning uncertainties as well as technical and financial adaptation obstacles can be avoided. Standards hereby, at the same time, support the elimination of non-tariff barriers. Most standards do not have mandatory character – at least from a formal legal perspective. Organisations cannot be forced to comply with a certain standard. Some standards nevertheless have greater impact than laws: Those, who fail to comply with them, are punished by the market. It is, for instance, not atypical that especially large multi-national companies across different industries only enter into supplier contracts, if the respective supplier recognises the appropriate standards and accepts them as binding. Among the most important standardisations world-wide are the ISO standards and within the sector of procedural standards, the ISO 9000 series. Their principle is: A quality system comprehensible for third parties is the best pre-condition to ensure appropriate quality levels. Written documentation of general and procedural structures thus is a focus area. The most important requirements of ISO 9001 hereby are:

Important standard setting non-profit organisations on a European level are the European Committee for Standardization (CEN) as well as the International Organisation for Standardisation (ISO) and the International Electrotechnical Commission (International Electronical Commission) on a world-wide level. These organisations are supported by professional associations that with their input provide specific expertise.

3.2 European Aviation Standards of the EN 9100 Series 37

• Knowledge of internal and external issues as well as of interested parties (stakeholders) • Leadership and commitment, taking into account quality policy principles and objectives, including the definition of responsibilities and competencies, • Establishment and maintenance of a process-oriented quality management system including knowledge and operational risk handling, • Staff qualification, operational knowledge, awareness and resource provision, including related documentation, • Identification and integration of customer requirements, • Planning and execution of design activities and product or service provision, • Selection, monitoring and control of suppliers as well as evaluation and examination of delivered products and services, • Process and product monitoring and measurement as well as analysis of collected data, • Measures of nonconformities correction and risk minimisation as well as continuous improvement. Achieving high customer satisfaction based on controlled organisational conditions is regarded as a holistic task that needs to integrate all core elements of the organisational value chain, from sales and design, procurement, production and assembly, all the way to maintenance. The ISO process standards are hereby process-oriented, facilitating traceability, comprehensibility, and ultimately their operational implementation. In terms of individual requirements, the ISO 9001 (and EN 9100 as well) remains mostly unspecific. System standards that determine what needs to be implemented at the end of the day, however, do not detail processes and work step design. No tools, instruments or implementation methods are predetermined, but output requirements are. Management system standards leave the detailed process organisation issues, i. e. the choice of means, at the organisation’s discretion. Standardized requirements to the supply chain have been in place in the aerospace industry for decades, however they are always based on the needs of the respective OEM. Worldwide standards have prevailed especially since the turn of the millennium. A clear indication thereof was the first publication of the three certifiable European aviation standards in the period between 2003 and 2005 as well as their substantial advancement in 2009 and 2016:23–25

The Aerospace and Defence Industries Association of Europe (AECMA) was hereby contracted by the European Committee for Standardisation (CEN) to prepare European standards for the aviation and space industry. 24 These standards are on par with SAE AS 9100 series (America) and JISQ 9100 (Japan/Asia) standards. 25 See EN 9100-2016, EN 9110-2016 and EN 9120-2016. In addition to that, there are other generally applicable, but not certifiable aviation standards that can aid the process organisation (e.g. EN 9102 First Article Inspection, EN 9200 Programme Management – Guideline for Project Management or EN 2898 Corrosion and heat-resisting steel rivets –Technical Specification). 23

3 Regulations and Approvals

• EN 9100 Aviation, Space and Defence Standard for Design, Production, Assembly and Maintenance, • EN 9110 Aviation, Space and Defence Standard for Maintenance Organisations, • EN 9120 Aviation, Space and Defence Standard for Distributors These standards are based on the ISO 9001 series and comprise specific requirements for the aerospace industry.26 Substantial amendments of EN 9100 compared to ISO 9001 are, e.g.: • • • • • • •

Configuration management, Product safety and handling counterfeit parts requirements, Dedicated handling of special processes and critical items, Detailed requirements for supplier monitoring and control Additional operational risk management requirements, Higher verification and validation requirements, Process measurement and tracking target achievement via the so-called PEAR forms.

Due to this extension, EN 9100 and EN 9110 in particular are, in part, highly similar to the EASA production and maintenance organisation regulations. The EN standards might not always be as detailed as the EASA requirements, however, the European aviation standards are subject to different focus. While the EASA regulations concentrate on safety relevant aspects of design, production and maintenance, the EN above all, takes the customer and process perspective into account. To this extent, it is not surprising that both the aircraft manufacturer and their 1-tier supplier, i.e. their direct first level supplier, as a rule demand an EN certification from their suppliers. With an EN 9100 certification, suppliers are held financially and organisationally responsible – even for documenting their quality capability, by regularly assigning approved certification bodies to audit and confirm their own EN standard conformity. At the same time, aviation suppliers are standardising their QM systems. Large-scale aeronautical companies additionally benefit from the advantage of cost reduction in the field of supplier monitoring when demanding such external certification. By dictating mandatory certification, the aviation industry, in particular, is outsourcing its supplier monitoring. The initial or re-certification serves as proof to the supplier’s client.27 In practice, a continuous increase in importance of aviation standards can be observed across the aeronautical industry and it is expected that this trend will continue in the next few years. The advantages of EN certifications might – at first sight – primarily apply to the aircraft manufacturer and their 1-tier supplier, however, subcontractors can benefit 26 The specific aerospace industry requirements are represented in bold and italics and can thus be clearly differentiated from the classical ISO 9001 series components. 27 Details on the EN certification audit are available in Sect. 11.3.3

3.2 European Aviation Standards of the EN 9100 Series 39

as well. Certified organisations usually have a higher level of process and quality awareness, as a standardised quality management system forces them to intensively deal with their customers’ operational processes and interfaces, supporting the organisation in clearly structuring the value chain and facilitating the identification of structural and procedural deficits. An ISO or an EN certification is also beneficial for the organisation when it seeks an EASA approval (esp. production and maintenance). In this case, they can already resort to a certified quality management system, that partly fulfils Parts 21 and 145 approval requirements. However, certification is not completely without disadvantages. A problematic issue to that extent is, that the certification does not apply to the product, but merely to the organisation’s structural and procedural setup, often without actually meeting the quality requirements of customers. To obtain certain quality levels for the products as well, many customers often demand own quality parameters exceeding these standards. A further weak point of formal quality systems among small and medium-sized organisations results from unnecessary bureaucratization. There is always a risk that slim pre-certification procedures based on verbal communication upon written transfer are exceedingly formalised by implementing a QM system based on the EN 9100. ▶▶

Four Questions for Timo J. Wolski,28 EN 9100 Standard Series Expert What are the factors that particularly determine the effectiveness of an EN 9100 quality management system? First, the focus is on efficient processes. However, this does not refer to theoretical definitions drawn up at a desk. It rather means workflows and interfaces that were developed together with operational stakeholders, which, in addition to the EN requirements, also take into account the organisation’s daily needs. From the beginning, it is important to ensure that the right employees are involved and that they also communicate with third parties, such as with customers or suppliers. An important success factor as well, is top managements quality awareness. With the attitude of the management stands and falls the effectiveness of an operational QM system. If the management is not interested in quality aspects, employees at operational level will not be either. However, convincing leadership is only one aspect of, not a prerequisite for successful quality management in HR. All stakeholders must be aware of their QM tasks and be comprehensively qualified. This sounds quite simple, but in practice it is one of the most critical success factors. For further information and to increase awareness, see also EN Sect. 7.3. Crucial is also a positive error culture. It is a characteristic of a good quality system to learn from deficiencies and handle

28 Timo J. Wolski is Head of Quality Management with SIEMENS eAircraft and Auditor for the EN 9100 standard series.

3â&#x20AC;&#x192; Regulations and Approvals

them systematically. It is also important how organisations consider the human factor to avoid incidents. What is the role of quality objectives? The development of a QM system must be continuously and systematically monitored. A consistently implemented system of quality objectives hereby plays an essential role regarding continuous improvement. Key Performance Indicators (KPIs) include collection method and data source, a responsible person, reporting type and frequency, and a response plan. A decisive success factor as well is consistency and sustainability. In the case of deviations, rigorous measures must be taken and tracked all the way to their effectiveness. Unfortunately, however, the company's practice is often characterised by considerable weaknesses, with the entire target system too often remaining in its infancy. Agile product design is on everyone's mind; how can such an approach be implemented under EN 9100 certification regime? Agile project development that involves planning and presentation of processes are subordinated to the actual design activity. Rather, the results and the autonomous processing of the work packages by the participating engineers are in focus. At first glance, this seems to be incompatible with the process-oriented approach and especially with the Plan-do-check-act (PDCA) approach required in the design phase. The classical waterfall approach (V-model) to product verification and validation, where product changes are laboriously mapped, is split into small iteration steps in the agile model, the so-called increments. In the design project plan the activities are divided into these iterations and small steps that can be interpreted as micro V models and integrated into the overall V model, allowing authorities and customers to translate them to their work environment. When defining iteration contents, i.Â e. the design planning, it is vital to define the necessary proof as a success criterion of the iteration phase and to evaluate the increment in the end. The process structure with planning, execution and role concept, required for agile project development, is anchored in the project management. The 2016 revision of EN 9100 series standards in Sect. 8.1.3 is primarily dedicated to product safety. What are the new requirements for certified organisations? With the revision of standards in 2016, organisations are encouraged to implement processes ensuring product safety, i.Â e. protection from hazards to life and property, over the entire life cycle. The activities hereby required may not be restricted to the design phase but must also be taken into account in the production processes as well as in future application. Concrete tools, are e.g. safety management applications according to SAE ARP 4761 or Poka Yoke in the design phase, process FMEAs in production as well as warnings or user instructions. By regulating the

3.3 Introduction to the FAA Legislation 41

handling of product safety aspects, the standard implements the goal of achieving higher consistency with legal safety requirements. Another advantage applies to the area of product liability. Systematic analyses of product safety facilitate the showing of compliance with regard to a reasonable 'state-of-the art technology in the event of incidents or failures. EN Sect. 8.1.3 can thus support release from organisational liability.

3.3

Introduction to the FAA Legislation

3.3.1 FAA Regulations The US legislation for the approval of aviation designs and production activities (FAR Part 21 – Certification Procedures for Products and Parts) is comparable to the EASA Part 21. Similar to the maintenance regulations of EASA Part 145, the FAA refers to the Federal Aviation Regulation for Repair Stations (FAR 145). The regulation structures in the USA and Europe, relevant for aeronautical organisations, are in general, subject to a high level of similarity. This mainly stems from the fact that when preparing the Joint Aviation Requirements (JAR), the Europeans often either simply adopted American structures or at least based their requirements on them. With this procedure, the European countries contributed to a harmonisation of regulations in the two dominating economic areas for the industrial aviation sector and hence substantially simplified the activities of the aeronautical industry. In addition, the harmonization and mutual recognition of certificates and approvals has been steadily expanded. (BASA agreements).29 Although the individual subparts have many identical or similar standards, there are nevertheless quite a few differences. The FAA area, for example, is not familiar with the design-organisational Subpart J, although the actual approval processes are performed in a similar way. Table 3.7 showcases similarities by example of EASA Part 21 and FAA Part 21. Structurally, the FAA rules differ from those of EASA due to the application of a pronounced delegation principle. Aeronautical organisations must have their design, production or maintenance activities monitored by designated FAA representatives.30 These representatives can be directly employed by the organisation or

The BASA Agreement facilitates the mutual recognition of aviation products traded cross-border between the US and the EU. In addition to that, the agreement aims at improving and promoting cooperation in all airworthiness matters. The Bilateral Airworthiness Safety Agreements (BASA) consist of a basic agreement and a number of supplementary agreements, in particular the Technical Implementation Procedures (TIP) and the Maintenance Annex Guide (MAG). These BASA TIP and BASA MAG agreements are directly relevant for organisations that design and/or import or export certified aviation products between and in the EU and the USA. 30 Designated Engineering Representatives (DER), Designated Manufacturing Inspection Representatives (DMIR), Designated Airworthiness Representatives (DIR) and Organisational Designated Airworthiness Representatives (ODAR) 29

3 Regulations and Approvals

Table 3.7 Comparing EASA and FAA Subparts of Part 21 Subparts 21

EASA

FAA

General Provisions

General

Type-certificates

Provisional Type-certificates

Changes to Type-certificates

Supplemental Type-certificate

Supplemental Type-certificates

Production Under Typecertificate Only

Production Under Type Certificate Only

Production Certificates

Airworthiness Certificates

Noise Protection Certificates

Provisional Airworthiness Certificates

Design Organisation Approval

Delegation Option Authorisation Procedures

Materials, Parts, Processes, Appliances

Approval of Materials, Parts, Processes, and Appliances

Export Airworthiness Approvals

Repairs

Designated Alteration Station Authorisation Procedures

Approval of Engines, Propellers, Materials, Parts, and Appliances: Import

ETSO Approval

Technical Standard Order Authorisations

Labelling products, materials and parts

work on a freelance basis. Although the representatives are paid by the organisations, they are regarded as FAA commissioners. Within the scope of their responsibility, they are in charge of approvals, releases or recommendations on behalf of the FAA. The FAA's primary task is to monitor the designated representatives, rather than the organisations.

3.3.2 FAA Approvals FAA Design Approvals Since the FAA is not familiar with EASA’s design-organisational structure, every natural person or legal entity can, in principle, request a Design Approval (“Any interested person may apply for a type-certificate.”)31 The quality requirements applicants face, are nevertheless comparable to EASA’s; however, the methodical approach differs. While EASA focuses on the organisational structure and process 31

FAA – Subpart B, FAR § 21.13.

3.3â&#x20AC;&#x192; Introduction to the FAA Legislation 43 Fig.Â 3.6â&#x20AC;&#x192; Basic structure of the partnership for safety plan32 3DUWQHUVKLS IRU VDIHW\ SODQ

0LOHVWRQH FRPPXQLFDWLRQ VWDQGDUGL]DWLRQ *HQHULF PHWULFV IRU PHDVXULQJ SURMHFW SURJUHVV 3URMHFWVSHFLILF FHUWLILFDWLRQ SURFHGXUHV H[SHFWDWLRQV

organisation, the FAA places emphasis on the execution of the individual design project. Applicants and authority hereby enter into agreements prior to beginning the design activities to determine design requirements and processes (similar to the European Certification Programme). In these agreements, referred to as Partnership for Safety Plan (PSP) and Project Specific Certification Plan (PSCP) specific design and certification processes are outlined. The essential structure of these plans is represented in Fig.Â 3.6. The legal requirements for the approval of designs are determined under FAR PartÂ 21 as well as in the Guidance Material Order 8110.4 (Type-certification). A summary of this design-oriented approval process is available in easily understandable form in the FAA and Industry Guide to Product Certification (CPI).33 The fundamental approach for acquiring a design certification is visualised in the so-called Roadmap to Certification in Fig.Â 3.7. FAA Production Approvals The FAA differentiates four kinds of approvals for production of products, parts and appliances: 1. Production Certificate (under FAA PartÂ 21 SubpartÂ G), 2. Approved Production Inspection System (under FAA PartÂ 21 SubpartÂ F), 3. Parts Manufacturer Approval (PMA), 4. Technical Standard Order Authorisation (TSO). The holder of a Production Certificate is entitled to produce aviation products with appropriate FAA approval. The associated airworthiness certifications are issued

32 33

Following the Federal Aviation Administration (Pub.), (2004), p.Â 3 Federal Aviation Administration (Pub.), (2004)

3 Regulations and Approvals

3RVW FHUWLILFDWLRQ SKDVH ,PSOHPHQWDWLRQ SKDVH 3ODQLQJ VKRZLQJ RI FRPSOLDQFH 'HILQLWLRQ RI DSSOLFDEOH DYLDWLRQ UHJXODWLRQ )$5

6SHFLILFDWLRQ RI GHVLJQ SURMHFW

Fig. 3.7 FAA roadmap to certification34

without individual examination on the basis of a type-certification. The production certificate is based on the regulations of the same name of FAR 21 Subpart G and is comparable to EASA Part 21G. An Approved Production Inspection System (APIS) is a limited production approval. In this context, the approval holder may issue products for own type-certifications. However, the precondition for the subsequent issue of a Certificate of Airworthiness at the end of the production process, is an FAA airworthiness audit for every individual product. Due to these and further restrictions, the APIS approval is primarily used by manufacturers with low production numbers. The production is governed by FAR 21 Subpart F Production under Type-certificate only and is comparable to the EASA Part 21F. While the two above-specified approval types are focused on the production of aircraft, engines or propellers, the Parts Manufacturer Approval (PMA) and the Technical Standard Order Authorisation (TSO) are approvals that aim at the

Similar to the Federal Aviation Administration (Pub.), (2004), p. 5

References 45

production of parts. This is, in particular, visible as approvals under FAR 21 Subparts G and F constitute organisation approvals, while PMA and TSO authorisations are approvals for the design and production of individually determined parts.35 FAA Maintenance Approvals For maintenance, the FAA issues approvals for repair stations according to FAA Part 145. Maintenance approvals are also granted to all commercial US operators via FAR 121. The mutual acknowledgment of maintenance approvals with many European countries has progressed to a considerable extent. A uniform treaty for the entire EASA region is, however, not yet in place. The major European maintenance organisations are thus usually recognised as FAA 145 repair stations as well. Maintenance implementation procedure specifies mutual acknowledgment of 145 stations between several European Countries and the USA.36 The additional requirements that a maintenance organisation must meet to obtain 145 FAA Approval are within reason. While US approvals for independent 145 repair stations in Europe are issued via the FAA, on-going organisational supervision is ensured via the European national aviation authorities.

References ASD-STAN Standard: ASD-STAN prEN 9100-P4 – Quality Management Systems – Requirements for Aviation, Space and Defense Organisations. English version. prEN 9100:2016 (E), 2017 ASD-STAN Standard: ASD-STAN prEN-9110-P5 – Quality Maintenance Systems – Aerospace – Requirements for Maintenance Organisations. English version. 2017 ASD-STAN Standard: ASD-STAN prEN-9120-P5 Quality Management Systems – Requirements for Aviation, Space and Defence Distributors. English version. 2017 European Commission (EC): Commission Regulation laying down implementing rules for the airworthiness and environmental certification of aircraft and related products, parts and appliances, as well as for the certification of design and production organisations [Implementing Rule Initial Airworthiness]. No 748/2012 of 03/08/2012 European Commission: Commission Regulation (EC) on the continuing airworthiness of aircraft and aeronautical products, parts and appliances, and on the approval of organisations and personnel involved in these tasks [Implementing Rule Continuing Airworthiness]. No. 1321/2014, 2014 European Aviation Safety Agency – EASA: Acceptable Means of Compliance and Guidance Material to Commission Regulation (EC) to the Annexes to Regulation (EU) No 1321/2014 – Issue 2 [Implementing Rule Continuing Airworthiness]. ED Decision 2015/029/R. AMC/GM European Aviation Safety Agency – EASA: Acceptable Means of Compliance and Guidance Material to Part 21. Annex I to ED Decision 2012/020/R. Issue 2. Oct. 2012. European Aviation Safety Agency – EASA: Course Syllabus – Continuing Airworthiness Requirements (Commercial Air Transport) – Part-M (CAT). Revision 05.11.2008, 2008

At this point, however, a representation of the PMA and TSO components is dispensed with, since these are adequately outlined in Sects. 4.11 and 4.12. 36 See Government of the United States of America; Government of the Federal Republic of Germany (1997) 35

3â&#x20AC;&#x192; Regulations and Approvals

Federal Aviation Authority (Publ.): The FAA and Industry Guide to Product Certification. 2nd Ed., Washington, 2004 Government of the United States of America; Government of the Federal Republic of Germany: Maintenance Implementation Procedure. Agreement for the Promotion of Aviation Safety between the Government of the United States of America and the Government of the Federal Republic of Germany, Berlin, 1997

Design

The beginning of every product development project is defined by the design phase. The design of aviation products is subject to stringent legal requirements in terms of type design, design process and certification as well as with regard to the structure of the design organisations. This chapter initially outlines basic requirements with regard to organisational structure and design certification, before the design process is subsequently presented in detail. Design description and preparation of specification are additional topics, before the classification of design projects is addressed. This chapter is thereafter dedicated to the preparation of relevant design documentation and to the actual certification process. Focus areas hereby are safety assessment and showing of compliance, i. e. the demonstration that the design meets relevant technical Certification Specifications and environmental regulations. As large design projects require substantial control and monitoring efforts, an introduction into project management is furthermore part of this section. Subsequently, minor design projects are portrayed in Sect. 4.8 and repair designs in Sect. 4.9. Finally, the specific characteristics of component development and their certification are outlined. The last two subchapters are dedicated to ETSO and PMA parts.

4.1

Basic Design Organisation Requirements

The beginning of every product life cycle is defined by the design phase where a concept is transformed into a marketable product. After market launch, design activities again play a role when it comes to modification or major repairs of the original product and also in the context of continuous airworthiness. Design activities in the aeronautical sector are unique compared to other industrial sectors, as they are subject to an unusually high level of monitoring and surveillance by aviation

4 Design

authorities, respectively the EASA (Agency). Strict standards with regard to the product’s type design as well as to organisational structure and staff qualification are enforced to ensure that high attention is dedicated to safety and reliability in all phases of the design of aeronautical products. Aviation design activities under EU legislation may only be performed by organisations that have EASA approval according to EASA Part 21 Subpart J. To that extent, compliance with the approval requirements specified therein constitutes the starting point of any design project:1 • The organisation must demonstrate a quality system that generally manages and supervises the entire design organisation. A design assurance system must be used to manage and monitor all design activities (see Sect. 4.2.1). • The organisation must have sufficient resources including staff, in terms of quantity and qualification, allowing timely design task execution as planned. Staff members must therefore be familiar with both the (technical) Certifications Specification (CS) and environmental protection requirements. Moreover, employees must have expertise regarding state-of-the-art technical designs (see Sect. 10.4). • Resources including facilities and organisational equipment must allow staff members to execute work in line with airworthiness and environmental protection requirements. This not only includes design offices, but also comprises access to test laboratories for testing and production facilities for prototyping. • The organisational structure must enable unrestricted and effective cooperation between and within departments regarding airworthiness and environmental protection aspects. This might initially sound like an issue of course, for many largescale organisations, however, it sometimes causes difficulties in daily practice due to the high complexity of tasks, a high degree of division of labour as well as a high number of internal and external interfaces. The devil hereby is in the details.2 • The organisation must have a current design organisation exposition (or handbook) (DOE) in place, where structure and processes as well as responsibilities within the organisation are determined and outlined (see Sect. 11.1.3). The DOE must always be up-to-date. • Activities must be covered by the official scope of approval. Changes to the scope must be approved by the EASA (see 21A.253).

1 2

See IR Initial Airworthiness Part 21 – 21A.245 Detailed information available in GM No. 1 to 21A.245 (4)

4.2 Essential Design Organisational Structures 49

Prior to the initial approval as Part 21J design organisation, the Agency examines compliance with approval requirements in the form of audits.3 These are repeated in regular intervals to ensure that the organisation is also capable of maintaining approval requirements over the course of time. In these surveillance audits, compliance with legal and regulatory requirements is checked on a random basis. Prior to first approval and during operation, the risk is usually less that individual approval requirements are not met in total, but more so that they are not fully implemented or applied. Frequently occurring deficiencies are: • processes which are not properly defined/documented, • staff members who are insufficiently or incompletely familiar with documented processes, • individual staff members that do not have the required scope of authorisation.

4.2

Essential Design Organisational Structures

4.2.1 Design Assurance System One of most important approval requirements as an EASA approved design organisation, is the implementation of a design assurance system. This means that the company has a structure and process organization in place, which is capable of designing products and its changes effectively. This can only succeed, if processes are controlled, responsibilities determined and resources properly planned. To ensure uniform implementation among design organisations, EASA provides a rough structural and procedural framework for design assurance systems according to 21A.239 (see Fig. 4.1) that essentially comprises: • showing of compliance that design activities are performed in accordance with the applicable Certification Specifications and environmental protection requirements, • an independent checking function for the demonstration of compliance, • a comprehensive quality system. Showing of Compliance The Starting point for any design assurance process is the specification and/or the description of the planned design. Certification Specifications and environmental protection requirements applicable to a design, can only be identified if the design has been generally outlined and described. Based on this design description a certification programme can be derived. This shows how compliance will be

For a detailed explanation of the audit term, see Sect. 11.3

4â&#x20AC;&#x192;Design

&HUWLILFDWLRQ VSHFLILFDWLRQ DQG HQYLURQPHQWDO SURWHFWLRQ UHTXLUHPHQWV

(ODERUDWLRQ RI SURGXFW VSHFLILFDWLRQ

7\SH ,QYHVWLJWLRQ

'HILQLWLRQ RI FHUWLILFDWLRQ SURJUDP

$QDO\VLQJ WHVWLQJ

6KRZLQJ RI FRPSOLDQFH

9HULILFDWLRQ RI FRPSOLDQFH

'HFODUDWLRQ RI FRPSOLDQFH

0RQLWRULQJ WKURXJK GHVLJQ DVVXUDQFH V\VWHP

&UHDWLRQ RI GHVLJQ GRFXPHQWV

$FFHSWDQFH E\ ($6$

7\SH FHUWLILFDWLRQ 7& 67&

Fig.Â 4.1â&#x20AC;&#x192; Design assurance procedure4

demonstrated. Part of this certification programme is a compliance checklist, that lists all applicable requirements of the planned design.5 It is an important element of the certification programme and serves as the basis for the showing of compliance. Using tests, calculations, analysis or inspections, the verification process documents that design complies with applicable Certification Specifications and environmental protection requirements. Compliance Verification In addition to demonstrating compliance, a design assurance system also requires an independent control mechanism (independent checking function of showing of 4 5

Following GM No. 1 to 21A.239(a) 4 See AMC 21.A.20(b)

4.2 Essential Design Organisational Structures 51

compliance) according to 21A.239. In this verification step, technical contents of all compliance documents must be verified regarding compliance to certification specifications and completeness, correctness, plausibility etc. and then confirmed. This quality assurance step covers all compliance documents to be maintained according to the certification programmes (including test programmes and results). Only these double-checked compliance documents may serve as a basis for official certification of aviation products. Comprehensive Quality System In addition to design and type-certification, a design assurance system requires a comprehensive quality system (system monitoring)6 to ensure comprehensive, independent monitoring of documented procedures with regard to their compliance and effectiveness. Details on the type and scope of comprehensive system monitoring are not specified in detail in Part 21J. The organisation may hereby resort to an existing quality system already in place (e.g. EN 9100). A quality system that plays its part within the design organisational assurance system, must however: • continuously analyse the design organisation in general • ensure permanent monitoring and evaluation of the design process in particular Focus areas hereby are the availability of predefined (documented) procedures, as well as their implementation and effectiveness in daily business. While Fig. 4.1 presents the structure of a design assurance system, Fig. 4.2 outlines the typical distribution of key functions within this system.

4.2.2 Type-Certification Aircraft and engines may not be released as aeronautical products, even by approved design organisations, unless a series of requirements have been met.7 Their design and technical characteristics must be approved by the Agency. However, in today’s mostly quantity production-shaped aviation industry, this is not separately performed for each aircraft, engine or propeller.8 Type-certifications (TCs) are issued to aircraft and engine types or series. With the type-certification the Agency confirms that the design, operating and maintenance documents as well as operational data and characteristics of the respective type design, comply with Certification Specifications and environmental protection requirements as well as with any other nationally applicable standards.

See IR Initial Airworthiness Part 21 – 21A.239(a)(3) Type-certifications are not only issued for aircraft, but for engine or propeller types too 8 With the exception of individual certificates, e.g. for experimental flights 6 7

4 Design

$FFRXQWDEOH PDQDJHU

+HDG RI GHVLJQ

2IILFH RI DLUZRUWKLQHVV

)HHGEDFN DXGLW UHSRUW

'HVLJQ HQJLQHHULQJ

+HDG RI TXDOLW\ PDQDJHPHQW

,QVSHFWRU IRU SURWRW\SHV

$XGLWRUV

)OLJKW WHVW

Fig. 4.2 Exemplary structure of a design organisation

Across the European Union, type-certifications for civil aircraft are issued by EASA.9 After the initial registration, all subsequent changes, supplemental changes and major repairs have to be approved also. In this respect subsequent modifications regarding design or technical condition equally require official approval, attesting to the demonstration of compliance with the newly applicable regulations. Under defined circumstances, minor modifications with regard to the initial certificate, can be individually released by the organisations itself. Type-Certifications Design activities in the sense of Subpart 21J aim to obtain a type-certification, a change or a repair for aircrafts as well as for engines or propellers. The following approval forms are differentiated (see also Fig. 4.3): • Type-certificates – TC refer to the design of an aircraft or an engine. The scope of certification does not only cover individual aircraft or a specific engine, but all products of the same design (model series). • Changes of type-certificates refer to (additional) design changes on all aircraft or engines of a specific series or model. Such changes may only be requested by the holders of the (original) type-certificate. • Supplemental type-certificates – STC refer to changes on a type-certificate for an individual or a few specifics aircraft or engine(s). • Repair approvals can refer to a type-certificate, change or supplemental change. Depending on the form, a repair approval can thus apply to individual aircraft or to an entire series (type). 9

For exception see info box in Sect. 3.1.1

4.2 Essential Design Organisational Structures 53

7\SHV RI W\SH FHUWLILFDWLRQ

7\SH FHUWLILFDWLRQ 7&

&KDQJH RI W\SH FHUWLILFDWLRQ FKDQJH RI 7&

6XSSOHPHQWDO W\SH FHUWLILFDWLRQ 67&

5HSDLU DSSURYDO

5HTXLUHPHQWV 'HVLJQ RUJDQLVDWLRQV DFF WR 3DUW 6XESDUW RQO\ W\SH FHUWLILFDWH KROGHU

&DUULHG RXW E\« 3URGXFWLRQ RUJDQLVDWLRQ 6XESDUW * RU PDLQWHQDQFH RUJDQLVDWLRQ 3DUW

Fig. 4.3 Certification/approval forms

While certifications are obtained from a Part 21J design organisation after appropriate design activities, physical design implementation must be performed by a Part 21G Production organisation or a Part 145 maintenance organisation.

4.2.3 Office of Airworthiness According to the requirements of Subpart J, design organisations must have installed an Office of Airworthiness10 that is responsible for planning and executing the type-certification process as well as for certification-related matters of continuing airworthiness. In addition to that, the Office of Airworthiness serves as an interface between the design organisation and the responsible aviation authority with regard to all type-certification process issues. The Office of Airworthiness is responsible for: • preparation of the certification programme, • ensuring proper execution of the type investigation programme (showing of compliance), • approval of minor design changes and preparation of major design approvals, • supporting the responsible aviation authority, • ensuring continuous airworthiness regarding design activities and certification issues. 10

See GM No. 1 to 21A.239 (a) 3.1.1.

4 Design

Depending on the organisation’s scope of approval, airworthiness office staff must have sufficient expertise in all relevant aircraft trades, such as aircraft structure, systems, avionics, electrical and electronic systems, engines, cabin safety etc. Employees are, in particular, familiar with the Certification Specifications and environmental protection requirements. Preparation of the Type Investigation Programme At the beginning of the design activities, the Office of Airworthiness is responsible for the classification of the planned design as major or minor on the basis of a general description of the planned design. The Office of Airworthiness is subsequently in charge of creating and publishing the type investigation program (compliance checklist). Activities hereby focus on identification and interpretation of applicable Certification Specifications and environmental protection, additional airworthiness as well as special requirements. In the case of major design activities, this also includes coordination of the certification basis with the Agency. Ensuring Proper Implementation of the Type Investigation Programme The Office of Airworthiness is responsible for monitoring and proper execution of the entire type investigation process within the design organisation. The Office of Airworthiness hence also supports design organisation staff with regard to all certification process issues as advisory contact. Externally, the Office of Airworthiness serves as interface to the Agency. Among the Office’s tasks are defining standards for compliance documentation and ensuring continuous improvement of internal procedures and processes relevant for certification. Certification of Minor Design Changes and Preparation of Major Design approvals The final certification activities are almost exclusively performed by the Office of Airworthiness. In the case of minor design changes, the Office of Airworthiness issues certifications (if included in the organisation’s scope of approval); in the case of design activities classified as major, the Office of Airworthiness releases the documents for showing demonstration. Subsequently it provides requested documentation to the Agency and applies for the type-certificate; the Office of Airworthiness must hereby ensure completeness of the necessary documentation. If these requirements are met, the Office of Airworthiness issues a recommendation to the head of design organisation to sign the so-called declaration of compliance. Continuous Airworthiness In addition to the management of the certification process, the Office of Airworthiness is also responsible for on-going monitoring of own design products and has to ensure that findings from incidents, evaluations and operational experiences result in appropriate design-related measures. In addition to that, the Office of Airworthiness supports the preparation of technical reports, e.g. when it comes to Airworthiness Directives. Last but not least, the Office of Airworthiness acts as the focal point of contact for the organisation’s employees in all questions of airworthiness.

4.3 Specification of Design Projects 55

Supporting the Aviation Authority In the context of design projects, the Office of Airworthiness also serves as the primary point of contact to the Agency. It continuously informs the authority about the status of the type-certification process, supporting it on request. In addition to that, Office of Airworthiness also supports the aviation authorities, irrespective of individual design projects.

4.3

Specification of Design Projects

4.3.1 Definition and Tasks A specification (in short: spec.) is the clear and formalised description of a planned design, whereby requirements are determined by customer, market, operational management or legislator. The objective of a design specification is to turn requirements into descriptions that are as complete, conclusive and clear as possible, ultimately serving as a product design basis. Therefore, an ideal specification does not contain solutions, but rather formulates requirements. The specification thereby ideally serves as initial and basic document for the upcoming design activities. An additional aim of a specification is to create a mutual understanding of the design output between the customer and the design organisation as contractor. The specification is often created by the contractor and must be approved and confirmed by the customer. Both parties comprehensibly document that they are in agreement when it comes to the execution of the corresponding design activities.11 This means that the specification is a binding document between customer and contractor, where, after signing, changes must be mutually coordinated. For this reason, the specification is usually part of the quotation and the customer contract. To be able to evaluate the degree of completion of the requirements in the follow-up, it is important that the specifications define objectively measurable characteristics against which the product or the design service can be verified upon delivery. The achieved degree of fulfilment of the specification decides on the acceptance by the client. From this perspective, the specification’s quality can be measured by how easily it can be verified – against the predefined requirements in the follow-up. This means that specifications, although their contents are predominantly of technical nature, are also important from a business and legal perspective (e.g. payment obligation, cooperation obligation, warranty, liability). For the contractor, the specification forms the basis of the claim for payment. The scope of a specification is based on the size of the design project. Product development limited to component level might only require a specification containing a few pages, while complex aircraft design projects regularly involve documents comprising several hundred, up to thousands of pages. In the context of

See EN 9100:2016 Sect. 8.2.3

4 Design

such extensive design projects, the degree of detail gradually increases during the acquisition process. Only in small projects can a first draft quickly be turned into a final version. When it comes to complex design activities, specification is an iterative coordination process.

4.3.2 Formal Design Specification Requirements Regardless of their content, design specifications should meet a series of fundamental criteria, so that customers and designers can efficiently work with them. To achieve this objective, specifications should be standardised across the entire organisation in the best possible way and irrespective of individual contracts. This does not only simplify their creation, as design engineers can always orient their activities on a central sample specification. Standardisation also contributes to higher description quality, as it promotes • completeness and • clearness. In addition to that, a specification should generally comply with other basic requirements, such as: • • • •

comprehensibility, clarity, verifiability and transparent documentation.

Completeness A specification must completely outline all relevant requirements of the customer (e.g. customer or internal client). Implicit assumptions create risks of later need for clarification. Since aviation industry specifications can be of a highly extensive and complex nature, design activities must be properly planned and supervised. Therefore it is advisable to take quality assurance capacities into account. Especially in the case of complex specifications, or in case many employees are involved and error probability is high. This is a critical aspect, as the specification definition phase is the beginning of the value chain. Incomplete data at this early stage can lead to substantial corrections in later project phases. Comprehensibility and Clearness A specification must be understandable both for the customer as well as for the contractor, and have a clear and consistent structure. This is helpful for clarity and comprehensibility, i. e. from a comprehensive, standardised layout, of which includes cover page, table of contents, glossary, revision history, division of requirement types and uniform requirement descriptions.

4.3â&#x20AC;&#x192; Specification of Design Projects 57

Common sense is required when it comes to clarity. A basic principle should be that requirements can easily be read and understood with reasonable effort. Clarity Specifications must be clear and free of contradictions, to avoid misinterpretations between the parties. Incomprehensible paraphrasing or organisation-specific technical terms are to be avoided. As specifications are usually created in English, they should use simple language (simplified English) and dispense with unnecessary explanations. It is therefore advisable to provide a glossary of terms prior to the actual content, in order to avoid misunderstandings (a common example is the definition of words like shall, should, must, will and may). In order to ensure clarity, requirements should be clearly identifiable. This can most easily be implemented by assigning an identifier or number to each requirement. Clarity can be visually enhanced by applying a cohesive structure, e.g. by only describing one requirement per section or sentence. In practice, requirements are often presented using a compliance matrix (see Fig.Â 4.4). Verifiability It must be possible to match the contents of the specifications with actual design. The formulated requirements only meet their purpose, if the customer is able to verify compliance at the end. After all, the client needs to be sure that the finished product complies with the requirements defined in the specification. It can therefore make sense to link the specification requirements to defined acceptance criteria. Transparent Documentation Since aviation industry documentation is usually highly complex, there is always a risk of decreasing clarity in the documents themselves, between revisions or throughout a series of referenced documents. To limit this risk, it is advisable to provide one specification document only that contains all requirements. To maintain documentation transparency in the best possible way, referencing other documents is to be avoided as far as possible. In addition to that, specifications are to be provided with a revision history, so that changes can easily be tracked. Revisions are always to be specified by both parties in writing and approved by the customer in a traceable manner. Ideally, there should be a process between contractor and client, among other things, defining authorised signatories or contacts. Within the organisation, changes must be communicated between the departments involved. In everyday practice, changes are often agreed upon between customer and contractor, but not systematically communicated internally or to subcontractors. This regularly results in rework, delays, cost increases and customer dissatisfaction.

4.3.3 Content and Structure of Design Specifications The basic description of the planned product forms the core of the specification process. Customer requirements must hereby be structured, completed and specified as to generate a clear understanding.

Â«

3 0LOOHU

1DPH :KR"

Â«

Fig.Â 4.4â&#x20AC;&#x192; Compliance matrix (example)

5HTXLUHPHQW 'HVFULSWLRQ

Â«

'HVFULSWLRQ

Â«

5HVSRQVLEOH IRU WHVW

)LUVW 5HOHDVH

6RXUFH

5HTXLUHPHQW

'DWH

5HYLVLRQ 1R

&XVWRPHU VSHFLILFDWLRQ

3URMHFW 1XPEHU

Â«

&RPPHQW $GYLVH

Â«

7HVW FDUULHG RXW 1DPH 'DWH

Â«

)XOILOOHG &HUWLILFDWH 'RFXPHQW

(QJLQHHULQJ /RJLVWLFV

&KDQJHV ZHUH UHSRUWHG LQWHUQDOO\

)HDVLELOLW\ 5LVNV 0HDVXUHV 3URRI

Â«

&XVWRPHU DSSURYDO

5HOHDVH

Â«

)XOILOOHG <HV 1R

58 4â&#x20AC;&#x192;Design

4.3 Specification of Design Projects 59

In terms of importance, requirements can be essentially distinguished in: • Must or mandatory criteria: indispensable characteristics for the product, where compliance must be ensured in each case, • Should criteria: compliance is not directly necessary, however, a realization of the requirement is desired, • Can criteria: the fulfilment is not necessary, but it is aimed, as long as the planned use of resources is not exceeded, • Restrictive criteria: these requirements explicitly outline that certain criteria should not be met (exclusion principle). In terms of content, requirements can be essentially differentiated into: • • • •

general information, functional information, technical information, qualification.

General Information The functional and technical description is usually preceded by a section containing general information on product or programme requirements that has an overview character and provides a project summary. The general part also defines premises and documents to be used as well as references to further documentation (e.g. system or master/framework specifications). In this context, also the revision status as well as responsibilities, competencies, and scheduling of document provision are usually defined. The general part of the specification furthermore contains definitions regarding certification basis; i. e. on legislation, Certification Specifications and standards to be complied with. Increased attention is required in the further process of specification preparation, if the certification is not (only) planned to the approval of the most important aviation authorities (EASA, FAA). Sometimes other country-specific certification requirements might have to be considered as well. At this point, a short scheduling and project management definition is not unusual. In this context, milestones and reviews, i. e. coordination meetings between customer and contractor are to be defined. This section of general information furthermore comprises handling with intellectual property. Additional standard elements usually precede or follow the specification, supplementing the concrete description of service. This includes, for example: • cover page with header data (e.g. name of client, specification revision status, aircraft type and registration, customer or operator, for parts ATA chapters as well as signatures), • table of contents, • introduction,

4 Design

• abbreviations, • glossary: definitions (e.g. shall, should, must, will and may), • amendments. Such information is ideally presented in the form of standardised text modules that can be supplemented, deleted or adapted as required. ▶▶

ATA systematics are a pattern of the Air Transport Association of America (ATA), according to which all sections of modern passenger aircraft are defined and structured. Initially only designed for US American aeronautical products, today the ATA structure is applied by nearly all aircraft manufacturers. The ATA structure thus constitutes a world-wide standard regarding the fundamental structure of aircraft documentation that is partly also used for the assignment of part numbers. The widespread use and acceptance of the ATA structure is, not least, attributed to the fact that FAA and EASA refer to it in their Certification Specifications. However, recently, organisations seem to increasingly abandon the ATA systematics. New aircraft types are already often designed using the document management standard S1000D. The world-wide acknowledgment of the ATA structure facilitates the technical comparability of aircraft types of different manufacturers and above all allows for a simpler exchange of information. Among other things, the ATA standard thus contributes to higher safety levels and more efficient work flows (particulary in maintenance). The starting point is formed by the ATA numbering systematics with the ATA chapters in the top level as well as sections and subjects in the levels underneath. Example: &KDSWHU 6\VWHP ± )LUH 3URWHFWLRQ 6HFWLRQ 6XE 6\VWHP ± $38 )LUH ([WLQJXLVKLQJ 6XEMHFW *HUlW ± %RWWOHV 3DJH %ORFN ± 5HPRYDO ,QVWDOODWLRQ

± ± ±

Functional Information A specification outlines all function-oriented parameters. It is therefore necessary to answer the question of what the product can or must contain. This includes above all: • design information (colour, form, ergonomics, dimensions, interchangeability, surfaces, cabin layout, seating, etc.),

4.3 Specification of Design Projects 61

• general performance characteristics, • components, systems and their interfaces. Basic and optional specifications are hereby differentiated as required. Technical Information In order to be able to meet general and functional requirements, technical requirements must be defined at the beginning as well. This technical description should have a depth of detail that makes it possible to determine with certainty whether the product can be designed as planned and is officially certifiable. Typical parameters for describing the technical requirements are: • • • • • • • • •

tolerances, precisions, weight, component/part or material quality and performance, applicable standards, integration of existing subassemblies as well as interfaces (electrical/mechanical), transportation and storage requirements, environmental protection and hazardous material standards, material specifications with materials to be used and explicitly not to be used, operational and maintenance standards, release certificates.

Specifications describing critical components are to be marked as such.12 This quickly indicates that special product qualification methods are required. Qualification Already in the specification, certification and test requirements are determined, e.g. based on Certification Specifications or generally accepted test standards (e.g. RTCA, SAE). Frequently applied qualification criteria are, e.g.: • • • • • • •

product lifetime, weight, reliability, error tolerances, load capacity, compatibility (electro-magnetic interference – EMI), flammability.

If necessary, the test specifications are to be combined into a rough Qualification Test Plan (QTP) already in this design phase. If the specification contains performance characteristics, where the organisation has little experience, it makes sense to integrate all internal departments involved (especially production, work planning,

See EN 9100:2016 Sect. 8.3.5 e)

4 Design

engineering and customer service) into the specification creation process. In this way, the greatest possible consensus can be achieved and disruptions in the later design or production process can be avoided. In parallel to the specification process, expenditures associated with the design are to be calculated at an early stage. In addition to the man hours, this includes expected costs for material and subcontracting that are to be determined across the entire design process (preparing production and maintenance standards, showing of compliance, certification, documentation).

4.4

Production, Maintenance & Operating Documents

In addition to the showing of compliance as a main element of the certification process, creation of production and maintenance as well as of operating documents form other basic tasks in the design process. A Part 21J organisation must hereby create and provide all information and data required for production, maintenance, testing and operation of own design products. The output of documents must hereby comply with the following basic criteria:13 • compliance with the design input, e.g. Certification Specifications and customer requirements, • definition of data and information that are necessary for the procurement and production or maintenance of the product as well as for the associated service contribution, • definition of test and acceptance criteria on the product’s airworthiness, • description of product properties permitting safe operation.

4.4.1 Production Documents (Approved Design Data) Production documents (approved design data or approved production data)14 are all documents, describing the type design or changes and additions thereto. EASA therefore also refers to them as type design definition documents. These design documents must be sufficiently detailed, allowing production in consistent compliance with approved data. To that extent, a detailed design solution is to be defined, such as drawings, diagrams and schematics, which can be used as a basis for later production. The related design activities are usually based on the specification (customer requirements). However, any type of specification usually only describes characteristics of a product, but not fully the technique and nature with which it is realized.

See IR Initial Airworthiness Part 21 – 21A.239 (a)(1), 21A.265 (b, c), 21A.4 and/or EN 9100:2016, Sect. 8.3.5 14 Also referred to as design documents or design description 13

4.4 Production, Maintenance & Operating Documents 63

In order to create approved design data, specifications are hence to be refined and supplemented. Approved production data form an important output of the design and construction activities. This data comprises all information outlining the product’s functions and (type) design, e.g.:15 • designs, specifications, layouts, drafts, schematics, diagrams as well as system or component descriptions defining the product’s configuration and design characteristics, • material lists and information on material characteristics and quality, • references with regard to processes, procedures, techniques as well as instructions on processing or installation of products, • test instructions including necessary inspections and as far as applicable acceptance criteria and tolerances considering all related systems. When creating the production documents it must be ensured that these comply with Certification Specifications. Monitoring and verifying this is the task of each individual design engineer, however, these tasks are ultimately to be checked by the Office of Airworthiness. During design and engineering activities it is to be ensured that (expected) results are not only technically feasible, but also economically justifiable. Especially when it comes to complex designs, solution finding can be associated with significant engineering efforts. The design output must be clear, comprehensible/traceable and complete. The design solution must be documented in a level of detail, enabling the implementing production organisation to execute instructions without further inquiries. According to calculations and basic design activities of engineers, the detailing of production documents, including all specified dimensions and tolerances, is often the responsibility of designers or technical draughtsmen. The level of detail of this data is sufficient, if the information for production organisation is sufficient to ensure product conformity and its intended use. Helpful for the creation of production documentation is compliance with operational or industry-typical standards, e.g.: • • • •

format and structure of the design document, reference to standard procedures instead of own standards, use of forms, use of text modules, use of simplified English.

The design documents must be allocated to a clear document number. In addition to that, information on revision status, ATA chapter and design project must be included. The design standards are to be ultimately verified by a second design

See IR Initial Part 21 – 21A.31, as well as EN 9100:2016, Sect. 8.3.5

4 Design

engineer and to be signed by all involved participants, confirming proper preparation (see Sect. 4.4.3).

4.4.2 Operating and Maintenance Documentation If a Part 21J organisation initiates a design project to obtain a TC or STC, then it is not sufficient to create design documents only. In addition, the design approval holder must also provide the associated operating and maintenance documentation, allowing the operator to ensure continuing airworthiness of its aircraft after product phase in.16 In this context, the TC holder must provide appropriate documentation in the form of manuals that outline how the aircraft is operated and maintained. The design organisation is also responsible for the on-going updating (revisions) of documents. In the case of supplemental type-certifications, the STC holder must furthermore identify the TC holder manuals to be amended, prepare supplements on their own responsibility and request the TC holder to integrate the respective elements of the maintenance and operating instructions into the documentation. The procedure and requirements for creating operating and maintenance instructions are more or less identical to those applicable to production documents. The Guidance Material nevertheless explicitly points out the necessity of a process and an organisational structure for permanent provision of the relevant documentation. After all, updating, releasing, publishing and distributing information to aircraft operators are continuously repeated processes and thus substantially differ from a one-off creation of production documents within the own organisation. The scope of the existing documentation, as represented in Fig. 4.5, furthermore clarifies that only a structured process is able to ensure permanent document topicality.

4.4.3 Verification and Release After completion of design and engineering activities and preparation of the associated documentation, the design solution is to be examined by a second design engineer as part of an independent secondary verification. This is an examination of the documents with regards to technical and formal aspects: • completeness, correctness and plausibility, • design premises (e.g. load assumptions, heat, interference), • compliance with operational and industry standards. Ideally, the organisation hereby uses checklists for verification, providing the respective engineers with assistance and ensuring that no test criteria are forgotten. To be able to perform verification tasks, an engineer must have detailed system 16 This requirement results from IR Initial Airworthiness Part 21 – 21A.57 and 21A.239 (a), and in particular from the relevant GM 3.1.5.

4.5 Design Classification 65 &RPSRQHQW 0DLQWHQDQFH 0DQXDO &00

(7236 0DQXDO

%RHLQJ 6WDQGDUG 2YHUKDXO 3UDFWLFH 0DQXDO

)OLJKW &UHZ 2SHUDWLRQ 0DQXDO )&20

$LUFUDIW 0DLQWHQDQFH 0DQXDO

2SHUDWLQJ 0DLQWHQDQFH ,QVWUXFWLRQV

$00

)OLJKW /LPLWDWLRQV 7URXEOH 6KRRWLQJ 0DQXDO 760

$LUEXV

3URFHVV DQG 0DWHULDO 6SHFLILFDWLRQ

6WDQGDUG 3UDFWLFHV 0DQXDO 630

,OOXVWUDWHG 3DUWV &DWDORJXH ,3&

:LULQJ 'LDJUDP 0DQXDO :'0

$LUEXV 3URFHVV DQG 0DWHULDO 6SHFLILFDWLRQ &DELQ ,QWHULRU 0DQXDO &,0

0DLQWHQDQFH 3ODQQLQJ 'RFXPHQW 03'

6WUXFWXUH 5HSDLU 0DQXDO 650

Fig. 4.5 Significant operating and maintenance documentation

expertise. Furthermore responsible engineers have to undergo advanced training prior to their appointment. After verification, the responsible Office of Airworthiness engineer checks the design documentation, subject to certification-relevant aspects according to the requirements of certification programme. Focus hereby usually is less on a general, technical or formal examination. The Office of Airworthiness rather clarifies, whether production, maintenance or operational documents comply with the identified Certification Specifications and whether the documentation is complete. After creation, checking and signing of the production, maintenance or operating documents by the responsible design engineer as well as after the following examination and signing by the verifications engineer, the certification engineer of the Office of Airworthiness releases the respective document. As soon as the Agency issues the TCs or STCs, the design documents are considered “approved data”. In addition to the approved data itself, all relevant design information, drawings and test reports, including inspection reports at the tested products, should be archived in accordance with 21A.55 and 21A.105 and to be submitted to the Agency at any time, if requested.

4.5

Design Classification

At the beginning of a design process, planned activities are to be classified according to their extent and complexity. The following design categories are hereby officially differentiated:

4 Design

&HUWLILFDWLRQ SURFHVV IRU «

7\SH FHUWLILFDWLRQ 7&

&KDQJH RI W\SH FHUWLILFDWLRQ &KDQJH RI 7&

6XSSOHPHQWDO W\SH FHUWLILFDWLRQ 67&

5HSDLU DSSURYDO

0DMRU GHVLJQ SURMHFWV

0LQRU FKDQJH

Fig. 4.6 Context between approval type and classification

• minor and • major. All design activities that have no “noticeable impact” on characteristics, such as mass, trim, form, fit, functional stability, reliability, operational parameters, noise, fuel discharge, emissions or on other features that influence the product’s airworthiness, are classified as minor.17 All other designs have major character. The classification can hereby be performed by an approved design organisation or on request by the Agencies. Within the design organisation, the Office of Airworthiness is responsible for the classification decision. The classification of a design is necessary, as the certification process is based on the scope of the planned design activities. The substantial difference of both design categories lies in the fact that minor changes may be released by the 21J design organisation, while major designs are approved by the Agency. Figure 4.6 presents the different classification opportunities in the certification process. When performing major or minor classification, organisations generally refer to the EASA Guidance Material instructions represented in Fig. 4.7. The AMC18 contain implementation recommendations, that serve as a rough guideline. Every 21J design organisation must have a documented procedure in place that internally defines design classifications, hereby making them transparent. The focus is to identify, describe and justify the planned design (change), in order to derive a comprehensible classification decision. In particular, the question is to be clarified whether the constellation constitutes: 17 18

See IR Initial Airworthiness Part 21 – 21A.91 See in particular AMC No. 1 to 21A.263 (c) (1).

4.5 Design Classification 67 &KDQJH LQ 7\SH 'HVLJQ &ODVVLILFDWLRQ SURFHVV

$Q\ RI IROORZLQJ FULWHULD PHW " DSSUHFLDEOH HIIHFW RQ ZHLJKW DSSUHFLDEOH HIIHFW RQ EDODQFH DSSUHFLDEOH HIIHFW RQ VWUXFWXUDO VWUHQJWK DSSUHFLDEOH HIIHFW RQ UHOLDELOLW\ DSSUHFLDEOH HIIHFW RQ RSHUDWLRQDO FKDUDFWHULVWLFV « RI WKH SURGXFW

\HV

:KHUHYHU WKHUH LV GRXEW WKH ($6$ VKRXOG EH FRQVXOWHG IRU FODULILFDWLRQ

$Q\ RI IROORZLQJ FULWHULD PHW " - DGMXVWPHQW RI FHUWLILFDWLRQ EDVLV - QHZ LQWHUSUHWDWLRQ RI WKH UHTXLUHPHQWV XVHG IRU WKH 7& EDVLV - DVSHFWV RI FRPSOLDQFH GHPRQVWUDWLRQ QRW SUHYLRXVO\ DFFHSWHG - H[WHQW RI QHZ VXEVWDQWLDWLRQ GDWD DQG GHJUHH RI UHDVVHVVPHQW DQG UHHYDOXDWLRQ FRQVLGHUDEOH - DOWHUV WKH OLPLWDWLRQV GLUHFWO\ DSSURYHG E\ WKH $JHQF\ - PDQGDWHG E\ $' RU WHUPLQDWLQJ DFWLRQ RI $' - LQWURGXFHV RU DIIHFWV IXQFWLRQ ZKHUH IDLOXUH FRQGLWLRQ LV FDWDVWURSKLF RU KD]DUGRXV

$JHQF\ GHFLGHV RQ UHFODVVLILFDWLRQ

\HV

$Q\ JRRG UHDVRQ WR UHFODVVLI\ PLQRU "

PLQRU

PDMRU

Fig. 4.7 References for a major vs. minor classification (GM 21A.91)

• a major change of a type-certification or a major repair, • a minor change of a type-certification or a minor repair, requiring further showing of compliance or • a minor change or repair that does not require further showing of compliance. As (new) type-certificates are generally defined as major designs, classification is not required in this case.19 A clear signature regulation is to ensure that responsibilities and decisions for each individual classification are comprehensibly documented. In practice, relevant data often is not fully available at the intended time of classification. In this case, decision making is to be postponed according to GM to 21A.91 until the data is available.

See IR Initial Airworthiness Part 21 – 21A.97 (5) (1) in c. with 21A.33 and 21A.35

4 Design

Section 4.6 portrays the certification process of a major design. The appropriate minor change process is presented in Sect. 4.8.

4.6

Design Certification Process (Major)

4.6.1 Certification Programme Classification of the design activity is followed by the definition of the certification programme (type investigation programme). The certification programme forms the basis for certification and consists of a project schedule including major milestones as well as a certification plan. The latter includes the following elements:20 • description of the project and the kind of planned operation, • proposed certification specifications, special conditions and environmental protection requirements • the description of how compliance will be demonstrated, with proposed method of compliance (MoC). A compliance checklist addressing each paragraphs of the type-certification basis, with reference to the MoC and the related compliance documents (see Sect. 4.6.3 and Fig. 4.8) • identification of relevant personnel making decisions affecting airworthiness and environmental protection.

$LUFUDIW 6\VWHP GHVLJQ SURFHVV )XQFWLRQDO UHTXLUHPHQWV

6DIHW\ YHULILFDWLRQ DLUFUDIW V\VWHP

6XESURFHVV ,

6XESURFHVV ,,,

)XQFWLRQDO +D]DUG $VVHVVPHQW

6\VWHP 6DIHW\ $QDO\VLV

)+$

66$

,WHUDWLYH VDIHW\ DVVHVVPHQW SURFHVV 6XESURFHVV ,,

366$

3UHOLPLQDU\ 6\VWHP 6DIHW\ $QDO\VLV

Fig. 4.8 Rough structure of the safety assessment process

See AMC 21.A.20(b)

4.6 Design Certification Process (Major) 69

Thus, this step comprises: • • • •

identification and interpretation of applicable Certification Specifications, derivation of methods for the showing of compliance, merging individual elements of the certification programme into a holistic draft, coordinating the certification programme draft among the Office of Airworthiness and the responsible aviation authorities.

Identification and Interpretation of Applicable Certification Specification The applicable certification specifications are to be identified in a first step, hereby referring to a general technical description of the design project. Depending on time of approval and country of certification, certification specifications are subject to: • Federal Aviation Regulations (FAR), • Joint Aviation Regulations (JAR), • EASA Certification Specifications (CS). Validity and application of a certification specification is not always clear in a specific, individual case, so that interpretation is often required. If no internal agreement can be reached in the interpretation of a certification specification, this issue needs to be clarified with the Agency. Sometimes further coordination is required, as supplementing design requirements of authorities or customers might have to be taken into account (e.g. for ETOPS or all-weather flights). In addition to certification specifications, the relevant environmental protection requirements (in particular from EASA Part 21 and ICAO Annex 16) are to be integrated into the certification programme. Specific airworthiness and operational regulations should furthermore already be considered when creating the type investigation programme. These regulations might be irrelevant for the type-certification, however, could be crucial for later airworthiness and aircraft registration by the aviation authority of the appropriate country (state of registration) in the US, e.g. FAR Part 91 und 121. In the case of non-substantial changes or repair procedures to existing type-certificates, those certification specifications which have been the basis of the initial approval can be used as such. These are outlined in the TC Data Sheet of the corresponding aircraft or engine model. Categorisation Compliance Demonstration In the course of the compliance checklist creation, the showing of compliance is of substantial importance in addition to identification and interpretation of all Certification Specifications and environmental protection requirements. In this context it must be defined, which methods must be applied to show compliance with the applicable Certification Specifications (e.g. concerning strength, flammability of applied materials) and the environmental protection requirements (emission values, noise, etc.).

4 Design

The applicable method of compliance (MoC) in each respective case (e.g. aircraft, system, sub-system, component) sometimes results directly from the Certification Specifications. However, this is not always the case and so, for the correct selection, other recognised sources must be used to identify suitable methods, e.g. AMC, AC, RTCA DO’s, EUROCAE, SAE ARP, MOPS. The selected compliance method is to be determined by the responsible Office of Airworthiness engineer and needs to be justified and confirmed in writing. This task requires sound experience of the responsible engineers. Methodical showing of compliance is structured on basis of the Means of Compliance (MoC). The MoC (also referred to as Methods of Compliance) categorise compliance verification in ten classes (MoC 0 – MoC 9), (see Table 4.1).21 Compliance with the applicable Certification Specifications is hereby demonstrated using the following means: • calculations, analyses, derivations, design investigations or design documentation, • specifications, designs, diagrams or reports, • test results and reports including aircraft, engine or component parameters. Summary, Coordination and Approval of the Certification Programme After relevant Certification Specifications were identified and the respective compliance method specified, the respective data is gathered for the entire project in one single, aggregated document, the certification checklist (as part of the compliance programme). This overview must be complete and clear. In parallel or after definition of the certification programme draft by the Office of Airworthiness, this is to be coordinated with the conceptions of Agency.22 In addition to a presentation of the respective design project in general, such a coordination is to particularly outline the certification programme. To avoid misunderstandings in the further course of the project, the results of certification-relevant coordination aspects should be documented by both parties. After examination and possible changes to the programme draft, the Agency approves the certification programme. Eventually, it is task of the Office of Airworthiness to publish the officially approved certification programme internally and to make it known in the departments concerned. In operational practice, this step is often taken by the Office of Airworthiness prior to the official release. Especially when it comes to complex design projects, it has proven effective to already commence design activities (design documents, electrical diagrams etc.) and showing of compliance during the certification programme’s definition phase. Any changes required by the Agency are then additionally amended after official approval of the certification programme.

21 22

A detailed overview of the MoC is available in Sect. 4.6.2. See No. 1 to 21A.239 (a) 3.1.4

4.6 Design Certification Process (Major) 71 Table 4.1 DAL classification (FAA AC 25.1309-1A, S. 4, incl. DAL E as per AMJ 25.1309) Failure Condition Classification

System Design Assurance Level (DAL)

Impact

Catastrophic

DAL A

Failure conditions which would prevent continued safe flight or landing.

Hazardous/Severe Major

DAL B

Failure condition which would reduce the capability of the airplane or the ability of the crew to cope with adverse operating conditions to the extent that there would be, for example, a large reduction in safety margins or functional capabilities, higher workload or physical distress such that the crew could not be relied on to perform its tasks accurately or completely. Or adverse effects on occupants.

Major

DAL C

Failure condition which would reduce the capability of the airplane or the ability of the crew to cope with adverse operating conditions to the extent that there would be, for example, a significant reduction in safety margins or functional capabilities, a significant increase in crew workload or in conditions impairing crew efficiency, or some discomfort to occupants.

Minor

DAL D

Failure condition which would not significantly reduce airplane safety, and which involve crew actions that are well within their capabilities.

No safety effect

DAL E

Failure condition which would have no influence on aircraft safety

4.6.2 Safety Assessment 4.6.2.1 The Need for Safety Assessment In the context of aviation design projects, the issue of safety requirements applicable to the aircraft and the systems therein arises at an early stage. A particular challenge is the high complexity and comprehensive degree of integration. This is due to the fact that systems today are no longer just mechanical, but usually linked to reliable electronic hardware and software. In addition to that, aircraft systems interact with each other to a high degree – in a functional higher-level environment, but also with other systems. Not only the fail-safe design of individual hardware and software elements play a role here, but also their respective system integration. This results in extensive consequences for the design process in general as well as for safety assessment in particular. Such a complex environment means that safety cannot be solely assessed by tests and calculations. Due to their comprehensive logical links and interdependencies, systems have to be evaluated using analytical methods, thus making risks calculable. Technical aspects only represent one side of the coin when designing complex systems. Design will only be successful, if the Part 21J organisation has implemented

4 Design

suitable processes, enabling safe product development. On the other hand, clear structures and guidelines as well as uniform tools and methods are to be applied, ensuring that systems or system components can be jointly developed by a variety of employees, organisational units or different companies. In order to determine the safety and reliability of aircraft systems under these conditions and to achieve an appropriate safety level, there is a worldwide uniform and officially recognised approach for safety assessment.23 This concept is outlined in the SAE ARP 4761 regulation “Guidelines and Methods for Conducting the Safety Assessment Process on Civil Airborne Systems and Equipment.24 By applying this method, requirements of the certification specifications FAR/JAR/CS 25.1309 can be met.25 This guideline with approx. 20-pages focuses mainly on processes and less on the technical approach. In this regards, SAE ARP 4761 hereby refers to the additionally applicable standards and specifications. Among the most important are: • SAE ARP 4754A – Certification Considerations for Highly-Integrated or Complex Aircraft Systems, • FAR/CS 25.1309 – Equipment, systems, and installations, • AC 25.1309-1A/AMC 25.1309 – System Design and Analysis, • RTCA DO 178B – Software Considerations in Airborne Systems and Equipment Certification, • RTCA DO 254 – Design Assurance Guidance for Airborne Electronic Hardware. Above all, SAE ARP 4761 presents the most important tools and methods for performing safety assessments and their application is presented in an exemplary manner: • • • • • •

Functional Hazard Assessment (FHA) Fault Tree Analysis (FTA), Dependence Diagram (DD), Markov Analysis (MA), Failure Modes and Effect Analysis (FMEA), Failure Modes and Effects Summary (FMES), Common Cause Analysis (CCA) (subdivided into Zonal Safety Analysis – ZSA), Particular Risk Analysis (PRA), and Common Mode Analysis (CMA).

23 In the 1990s, the American aviation authority FAA commissioned SAE to develop a uniform aviation system design process and a safety assessment procedure. The SAE ARP 4754 and SAE ARP 4761 were created with the involvement of authorities, manufacturers and operators. 24 SAE International is a non-profit technology and science organisation. SAE was founded in 1905 as Society of Automobile Engineers aiming at increasing the degree of standardisation in the automotive industry. Today, SAE has about 120,000 members and focuses on the transport industry, in particular automotive and aviation. SAE's technical committees set standards for the aerospace and automotive sectors. 25 SAE (1996). The annex also contains detailed descriptions and practical examples for each process step. ARP = Aerospace Recommended Practice

4.6 Design Certification Process (Major) 73

Both, qualitative and quantitative assessment methods can be applied to each of these tools. In the qualitative approach, a verbal-argumentative solution is used, whereas quantitative methods are based on mathematical calculations. The analysis process consists of three immediately following, partial processes that mostly run highly iteratively (Fig. 4.8). 1. Functional Hazard Assessment (FHA) 2. Preliminary System Safety Assessment (PSSA) 3. System Safety Assessment (SSA) The aim of safety assessment is to determine a system safety level ensuring safety of aircraft, crew and passengers in all relevant failure conditions. Therefore all error combinations (e.g. system failures), as well as the corresponding risks are to be taken into account for each flight phase.26 Safety assessment thus forms the crucial element for the aviation safety fail-safe concept. The analysis starting point is the aircraft’s conceptual design and the system architecture with all associated functional requirements. In the context of safety assessment, the safety and reliability requirements are subsequently derived. The beginning is marked by the identification and assessment of risks in aircraft and system design.27

4.6.2.2 Subprocess I – Functional Hazard Assessment (FHA) The Functional Hazard Assessment (FHA) is the starting point of the safety assessment process. The aim of the FHA is to identify all possible errors and failures. In addition to possible inner-system errors, potential errors occurring in subordinate systems or those interacting with other systems are to be evaluated as well. In the context of the FHA, reasonable safety levels are allocated to the system or its functions (risk classification) and safety requirements are derived. The FHA is subdivided into the following stages: • • • • •

Step 1 – Identifying possible system malfunctions Step 2 – Identifying risks Step 3 – Assessing consequences (severity) including risk classification Step 4 – Rational for classification decision Step 5 – Establishing a method for verifying compliance of the designs with safety requirements

SAE (1996), p. 12 A detailed description of the safety assessment shall not be provided at this point, since this would have to be accompanied by a review of SAE ARP 4761.

26 27

4 Design

A FHA is performed qualitatively and across two levels: 1. high-level FHA on aircraft level as well as 2. system-level FHA. The determination of all possible malfunctions in a modern passenger aircraft is an extremely complex undertaking. The challenge hereby not only lies in identifying potential system malfunctions, but above all in the determination of possible malfunctions in interaction with other systems. Since expertise on system dependencies increases in line with the design progress, they must always be examined with regard to safety impact. These interdependencies are the main cause of the safety assessment being an iterative process. At the end of the FHA, hazards are assessed and classified in a Design Assurance Level – DAL, according to AC 25.1309-1A (Table 4.1). The DAL of a system component is defined by the system architecture as well as by the effects of the failure or design error on aircraft, crew or passengers. Finally, the results of the FHA provide the input for preparation and summary of safety requirements in the context of the following PSSA sub-process. During the entire FHA, significant focus must always be on transparency, ensuring traceability of malfunctions and hazards with regard to aircraft, system and subsystem levels. This does not only include their accurate detection and allocation, but also traceability and credibility of related assumptions and justifications. If this is not managed by a separate software, complex tabular solutions can be used for fault function analyses, e.g. for related hazards, risk assessments and classifications, assumptions (condition, flight phase, operational effects, etc.) and necessary safety requirements. To ensure completeness at lower functional levels (components or parts), the use of a fault tree analysis (dependence diagrams or Markov analyses) and checklists, e.g. for possible error/failure modes might be advisable as well.

4.6.2.3 Subprocess II – Preliminary System Safety Assessment (PSSA) The purpose of the Preliminary System Safety Assessment (PSSA) is to determine how potential errors and failures identified in the FHA can cause malfunctions. In addition, it is determined how the FHA safety requirements can be met with using product design and test specifications. The FHA requirements might hereby eventually have to be complemented and completed during the PSSA. While the FHA’s objective is to identify systemic risks and the safety levels for the system functions, the PSSA derives safety mechanisms (such as redundancy, monitoring and maintenance intervals), in order to demonstrate that the FHA safety requirements are met.28

SAE (1996), p. 17

4.6 Design Certification Process (Major) 75

In the PSSA process, interdependencies between functions and malfunctions are determined, hereby examining the causes of possible error states. The FHA’s functional safety requirements are hereby first subdivided into subsystems and then into hardware and software components. Methodically, the Fault Tree Analysis (FTA), the Failure Modes Effect Analysis (FMEA) and Common Cause Analyses (CCA) are hereby primarily applied. In many cases, additional analysis methods of quantitative or qualitative nature are necessary as well. Detailed explanations and implementation samples are outlined in the appendix of the SAE ARP 4761. Scope and Nature of the PSSA are mainly based on relevant system aspects and their classification in terms of design, complexity and DAL as well as on the respective technical solution used to meet the safety requirements.29 With increasing complexity and system hazard probability, analysis and evaluation generally become more demanding. The PSSA is an essential component of the aviation safety fail-safe concept; meaning that system failures are safe, i. e. by ensuring that system failures are compensated by designed system redundancy and do not lead to a catastrophic aircraft failure. PSSAs can also be implemented on lower system levels. Starting points hereby are aircraft or system PSSA output interfaces, followed by lower-level PSSAs on subsystem or component level. Like the FHA, the PSSA is an iterative analysis process that is a part of the overall design project (Fig. 4.8). With increasing system design progress, system integration or design adjustments, PSSA must therefore be repeated or expanded. The results of the PSSA are directly used as input parameters for System Safety Assessment (SSA) as the last part of the safety assessment process. The system or equipment requirements from the PSSA are additionally integrated into the technical specification. The essential documents that must be available upon completion of a PSSA are30: • Updated/revised FHA documentation (including assigned DAL) • Safety requirements, • Qualitative FTAs (possibly supplemented by dependence diagrams or Markov analyses) • Preliminary common cause analyses, • Operational requirements for flight operation and maintenance.

4.6.2.4 Part III – System Safety Analysis (SSA) The System Safety Assessment (SSA) is supposed to analyse an implemented system in a structured manner. The objective is to demonstrate that the system architecture and its installation comply with the FHA and PSSA safety requirements.

29 30

SAE (1996), p. 40 Similar to SAE (1996), p. 44

4 Design

Both qualitative as well as quantitative analytical methods are hereby applied to demonstrate compliance. The SSA process does not significantly deviate from the methodology of PSSA. The PSSA and SSA activities, however, differ in terms of focus. The PSSA focuses on the determination of safety and system requirements, while the SSA concentrates on whether the implemented design meets these safety requirements.31 For each PSSA, a corresponding SSA has to be assigned, regardless of the system level. To complete the safety assessment, each SSA must be examined against the original requirements and the adequate implementation of FHA and PSSA safety requirements.

4.6.3 Showing of Compliance General Information The purpose of the showing of compliance is to examine and justify the conformity of design with the applicable Certification Specifications. Compliance demonstration is the structured validation of design activities, ensuring that the planned product is able to meet the predetermined airworthiness and environmental protection requirements. This process can hereby comprise an examination of: • strength, flammability or maximum stress (e.g. fatigue resistance, load assumption), • design and architecture or • operational behaviour, i. e. service and operating characteristics or limits. The necessity for compliance demonstration results from Subpart 21J as well as from EN 910032 and is a key element of the entire design and certification process. For this reason, the compliance process is accompanied by the Office of Airworthiness and supervised by Agency. Compliance can also be shown “on paper”, for example in the form of calculations, analyses or simulations. Compliance can, however, be demonstrated also by using applied materials as well as the finished product, e.g. performing of laboratory, statics or ground tests as well as by performing test flights. Methods and/or Means of Compliance (MoC or MC) are applied, as outlined in Table 4.2.

31 32

Similar to SAE (1996), p. 21 and 45 See IR Initial Airworthiness Part 21 – 21A.33 and EN 9100:2016, Sect. 8.3.4

4.6 Design Certification Process (Major) 77 Table 4.2 Means of Compliance Codes33 MoC 0

Compliance Statement

The fulfillment of the Certification Specifications is justified by descriptions or explanations.

MoC 1

Design Review

Compliance that the Certification Specifications is fulfilled is made by checking the specifications on the basis of documents (circuit diagrams, drawings, parts lists).

MoC 2

Calculation/ Analysis

Compliance is provided on the basis of calculations, analyzes or derivations.

MoC 3

Safety Assessment

Structured risk assessment of a system and its integration into the aircraft. An assessment usually consists of an error assessment and one or more analyses (for example Fault Hazard Assessment, Fault Tree Analysis, Markov Analysis, Failure Mode Effective Analysis).

MoC 4

Laboratory Tests

Tests performed on the material or component (eg fire test). The implementation takes place in workshops and laboratories.

MoC 5

Test on Aircraft (on ground)

Ground test on the aircraft after production or modification. Conformity with the CS is demonstrated by testing the operability or compatibility (e.g., functional test, electromagnetic compatibility tests) of the affected systems and components.

MoC 6

Flight Test

As part of the test flight functional capabilities or compatibilities are tested. The flights are to be coordinated with the Agency and, depending on the extent of the verification, with pilots of the operator.

MoC 7

Inspection

In contrast to the ground test, the system or component is not activated, but compliance with the Certification Specifications is instead verified by a manual or visual condition check.

MoC 8

Simulation

The test is conducted on the basis of a model in order to gain insight into the real system. On simulations, e.g. resorted to when real examinations are too cumbersome, too expensive, too dangerous, or if the real system does not (yet) exist.

MoC 9

Equipment Qualification

A component qualification must be demonstrated as soon as the appropriate component is installed in an aircraft or engine. Proofing under the MoC 9 may include all of the aforementioned forms of detection (e.g., tests, analyzes, assessments, inspections). If the component already has an official approval (for example in the context of a TC, STC or ETSO, TSO, PMA), the provision of proof can be sufficiently performed.

Showing of Compliance Process Depending on the Means of Compliance (MoC) specified in the compliance checklist (type investigation programme), appropriate evidence is to be provided. Especially tests hereby often require detailed preparation. The most important test requirements are specified in the following:34

33 34

Appendix to AMC 21.A.20(b) See IR Initial Airworthiness Part 21 – 21A.33 and 21A.35 as well as EN 9100:2016 Sect. 8.3.4

4 Design

• A test description that outlines what is to be tested and which objectives should be achieved. In the test plans or specifications, the product to be tested and the methods to be used are ideally named with reference to the corresponding design documents. In addition, test conditions and recording parameters are determined. • Test instructions must be clear and complete. That means that necessary preconditions (test methods and inputs), test execution, recording of results as well as the assumption criteria must be outlined, • Test equipment and measuring instruments that are used in the test, must be suitable and calibrated. • The actual configuration status of the test object at the time of the test must comply with the applicable test instructions. It must be ensured that the individual parts of the test piece meet the type design requirements, so that design, production processes and assembly of the test product were executed according to the requirements and that the specified materials were used. The compliance demonstration process must not necessarily mark the end of design activities. It can also make sense to perform partial tests of products that are not yet completely finished (e.g. material quality tests or tests on points that that will no longer be accessible after installation). A necessary precondition for the successful conclusion of a compliance demonstration, is conformity with the test plan and test instructions on the one hand, as well as with acceptance criteria on the other.35 Results must be unambiguous and clearly state whether the test results demonstrated compliance with the requirements. The compliance results are to be documented in an appropriate manner (e.g. using statements, calculations, or test reports). Compliance is normally demonstrated using a comprehensive compliance document or the original test record (substantiation data). While the substantiation data records the compliance result (e.g. a strength calculation or a fire test report) thus containing factual evidence, a compliance document is the formal confirmation for the fact that compliance was demonstrated. At the same time, the compliance document links the reference document to the compliance checklist. To allow for clear, fast and transparent allocation between substantiation data and compliance checklist, a compliance document should contain some of the following information: • a clear identification number, to allow references to the compliance document from other documents, • reference to applicable Certification Specifications, special conditions or environmental protection requirements derived from the compliance checklist, • reference to the associated substantiation data, • reference on the associated design documents, • aircraft/engine type and/or aircraft registration,

Special conditions apply to flight tests (MoC 6), whose requirements are roughly outlined under 21A.35. Flight tests are always to be specified in close coordination with authorities.

4.6 Design Certification Process (Major) 79

• the system or component concerned, • signatures of the responsible engineers as well as of the Office of Airworthiness. The connection between certification programme, substantiation data and compliance document is visualized in Fig. 4.9 (upper section). Compliance Verification Following the showing of compliance, this process step must be submitted to an independent secondary verification to ensure that all design results meet the specification, as well as the applicable design and environmental protection requirements.36 The secondary examination extends both to formal as well as to technical aspects of the compliance demonstration and documentation: • • • • • •

completeness, plausibility, accuracy, validity, correctness of basic assumptions as well as compliance with the assigned Certification Specifications.

To ensure an appropriate level of verification effectiveness, this secondary control process is to be accomplished by an individual, who was not directly involved in the respective compliance demonstration.37 Also, each test area (e.g. emergency lighting) should be assigned only one verification engineer, who is entirely responsible for the associated secondary controls.38 The independent verification process is to be documented for reasons of traceability. With his signature on the compliance document, and if applicable additionally on test instructions as well as on the test report, the verification engineer in charge hereby confirms that he accomplished the verification considering above mentioned criteria. Compliance Tasks of the Office of Airworthiness While the showing of compliance is usually prepared and performed by the design engineering, the Office of Airworthiness takes over the following tasks:39

36 See EN 9100: 2016, Sect. 8.3.4; Subpart 21J outlines the corresponding verification instructions in 21A.239 and especially in the corresponding AMC and GM. 37 In general, close organisational connections between the engineer responsible for the compliance demonstration and the engineer in charge of verification are permissible (both may be active in the same department). 38 See AMC 21A.239 (b) (1). 39 See GM No. 1 to 21A.239(a) (3.1.3)

5HSRUW ILUH WHVW

6XEVWDQWLDWLRQ 'DWD 'RFXPHQW 1R

&RPSOLDQFH 'RFXPHQW &'

(QJLQHHU 2R$ BBBBBBBBBBBB

(QJLQHHU 9HULILFDWLRQ BBBBBB

(QJLQHHU 'HVLJQ BBBBBBBBBB

6LJQDWXUHV

6XEVWDQWLDWLRQ GDWD 1R

&HUWLI 6SHFLILFDWLRQ &6 Â«

'HVLJQ 'RFXPHQW ;<

%HORQJLQJ

$ & 7\SH $

'RFXPHQW 1R

Fig.Â 4.9â&#x20AC;&#x192; Interdependencies investigation programme, substantiation data and compliance document

'HILQLWLRQ PHDQV RI FRPSOLDQFH 0R&V

,GHQWLILFDWLRQ RI UHOHYDQW &HUWLILFDWLRQ 6SHFLILFDWLRQ

3URJUDP

&HUWLILFDWLRQ

6XEVWDQWLDWLRQ 'DWD 'RFXPHQW 1R

Â«

&' 1R Â«

&' 1R

2YHUYLHZ RI DOO FRPSOLDQFH GRFXPHQWV

&RPSOLDQFH FKHFNOLVW

3UHSDUDWLRQ IRU 7\SH &HUWLILFDWLRQ

4.6 Design Certification Process (Major) 81

• • • • •

accompanying and monitoring of the processing of all compliance activities, ensuring completeness of compliance and verification documents, if applicable, test participation, release of compliance documents, interface to the aviation authorities.

Compliance demonstration is performed in close coordination between designer engineers and the Office of Airworthiness. Support from the Office of Airworthiness already commences in the test preparation and extends all the way to the execution phase. After the review and verification phase, the responsible engineer at the Office of Airworthiness releases the documents. This is usually done by signing the compliance document. In addition to that, the above task list shows that the Office of Airworthiness also serves as a link to the Agency during the demonstration phase. The Office of Airworthiness hereby provides information on planned tests and if necessary, coordinates prepartory activities with the Agency. Once the verification activities have been fully concluded, the compliance documentation is finalised by the Office of Airworthiness. All compliance documents are either completely submitted to the Agency or provided in the form of the filled compliance checklist, i. e. a list of all compliance documents (see Fig. 4.7, lower section).

4.6.4 Type Investigation The assessment of design activities by the Agency is referred to as type investigation. It is a necessary precondition for obtaining a type-certificate of the category major. This means that the Agency examines every major design for compliance with Certification Specifications, irrespective of whether this applies to a new aircraft or to a modification only. Thus, an integral element of the type investigation is a review and examination of the compliance documentation. Part of the type investigations is also the verification of type definition documents, i. e. the production and maintenance documentation as well as operating instructions. Applicants of major design approvals (21J organisations) are under obligation to provide all design documentation to EASA on request and allowing the Agency to carry out its own or monitoring the organisation’s inspections, tests and test flights. The Agency is hereby given the possibility to examine whether the compliance verification was correctly accomplished, certificates meet the requirements and the documentation complies with relevant requirements. These sample examinations are to ensure that “no feature or characteristic makes the product unsafe for the uses for which certification is requested”.40 The type investigation is not focused on a certain point in time, but rather is a period-related investigation covering the entire period of the type investigation/ certification programme, all the way to the release of the type definition documents.

IR Initial Airworthiness Part 21 – 21A.33 (d)

4 Design

The type investigation is a project-accompanying monitoring of design activities by the Agency. Due to the extensive scope of designs projects, the Agency is usually not able to examine the entire design output for capacitive reasons. For this reason, a so-called evaluation programme and thereby the level of involvement is defined during the preparation of the certification programme, in which the later sample examination is defined. This can include the following activities: • attending and monitoring investigations, tests and examinations to verify airworthiness, • examination of the design documentation, • compliance documentation, • type design definition documents, • maintenance data, • operating instructions. The evaluation programme is hereby coordinated between the Agency and the Office of Airworthiness. The Office of Airworthiness supports the Agency with regard to all questions as a partner during the type investigation and at the same time serves as the interface to design engineering.

4.6.5 Type-Certification Certification Basis Once all design activities have been completed, the associated compliance documents were finalized and the type investigation has been concluded, an EASA type-certificate can be issued. Therefore, the following documents must be submitted by the applicant as the basis: • • • •

applicant’s declaration of compliance, type definition documents and operating instructions, type investigation report, declaration of commitment.

Applicant’s Declaration of Compliance After the Office of Airworthiness informed the head of the design organisation about the conclusion of the compliance process and its verification,41 a declaration of compliance must be issued by the applicant. With this so-called applicant’s declaration the head of the design organisation confirms to the Agency that all measures in the context of the type investigation were duly performed and that compliance with the relevant Certification Specifications and environmental protection requirements is ensured.42 GM to 21A.239 (a) 3.1.4 (q) IR Initial Airworthiness Part 21 – 21A.97 (a) (3) for change and supplementing type-certificates, for type-certifications a similar formulation is contained in 21A.20 (b).

41 42

4.6 Design Certification Process (Major) 83

Type Definition Documents The type definition documents comprise all documentation materials that outline the type design. These documents contain designs, layout, instructions, part lists, descriptions; in a nutshell: all relevant design and technical implementation data, required for the compliance with the applicable design and environmental regulations as well as all design data necessary for the production of the defined aircraft or changes thereto (design documents). This comprises, in particular, information regarding production, assembly procedures, type design and component characteristics, material requirements and characteristics. Among the type definition documents are thus all instructions and information necessary to ensure airworthy type reproduction (Fig. 4.10). In addition to that, compliance with all provisional basic data as well as operating instructions must be documented. This information includes, the intended operating data and operating limits as well as all relevant information and instructions on continuing airworthiness (continued airworthiness documents).

'HVLJQ 'RFXPHQWV ƒ ƒ ƒ ƒ ƒ ƒ ƒ ƒ

6SHFLILFDWLRQ 'HILQLWLRQV 'HVFULSWLRQV 'UDZLQJV /LVW RI PDWHULDO 7HVW SURJUDPV WHVW LQVWUXFWLRQV 3URFHGXUHV PHWKRGV ,QVWUXFWLRQ IRU SURGXFWLRQV

&RPSOLDQFH 'RFXPHQWV ƒ ƒ ƒ ƒ ƒ ƒ ƒ ƒ ƒ

&RQWLQXHG $LUZRUWKLQHVV 'RFXPHQWV ƒ ƒ ƒ ƒ ƒ ƒ

0DLQWHQDQFH PDQXDOV 6WUXFWXUDO UHSDLU PDQXDO 0DLQWHQDQFH LQVWUXFWLRQV

&RPSOLDQFH VWDWHPHQW &RPSOLDQFH FKHFNOLVW &RPSOLDQFH UHFRUG OLVW VXPPDU\ UHSRUW ,QVSHFWLRQ UHSRUWV 7HVWV 6LPXODWLRQV 6XEVWDQWLDWLRQ UHSRUWV 4XDOLILFDWLRQ WHVW UHSRUWV 6XSSRUWLQJ HQJLQHHULQJ GDWD

2SHUDWLQJ /LPLWDWLRQV ƒ ƒ ƒ

$ & IOLJKW PDQXDO :HLJKW %DODQFH PDQXDO (7236 PDQXDO

$LUZRUWKLQHVV OLPLWDWLRQV 05% UHSRUW ,QVWUXFWLRQV IRU FRQWLQXHG DLUZRUWKLQHVV

Fig. 4.10 Supplementing type-certification documentation

4 Design

In the case of changes or additions to an existing type-certificate a description of all changes, including details of components and materials used and of the approved manuals affected by this design change, is to be provided. Since the entire certification process is closely coordinated with the Agency in operational practice, it is always involved in the current design and compliance activities. When submitting certification-relevant documents, it is usually not required to submit the design documentation in its entirety. As a rule, such documentation is only partially provided, or reference lists are submitted that refer to the appropriate source documents. The associated documentation is then supplied, as required. Type Investigation Report In addition to the type design definition documents, the compliance documents are to be submitted for approval. The applicant must hereby comprehensively show that compliance with all relevant requirements for type-certification and environmental protection is ensured and documented. A type investigation report (e.g. in form of the compliance checklist) is to be submitted, where compliance verification, usually in form of an overview with references to the appropriate source documents, is demonstrated. When existing type-certifications are changed, the type investigation report must also contain data on renewed examinations and tests in order to demonstrate the changed product’s compliance with the relevant Certification Specifications and environmental protection requirements. Declaration of Commitment With the declaration of commitment, the design organisation confirms (as applicant of type-certification or applicant of changes) that the continuing airworthiness instructions are made available to all known users for the entire operating period of the product.43 Since a supplementing type-certification (STC) can be obtained by every design organisation, the applicant must furthermore demonstrate that there are no technical objections with regard to the requested change on part of the TC holder. In addition to that, the applicant of a STC must be able to prove the existence of an agreement with the holder of the type-certificate stating that both parties collaborate, ensuring the continued airworthiness of the changed product.44 Type-Certification Once the basis of the type-certification has been established, the Agency approves the airworthiness of the type design and confirms the aircraft’s compliance with the respective Certification Specifications and environmental protection requirements. In addition to that, it is stated that all documents ensuring the product’s safety,

See IR Initial Airworthiness Part 21 – 21A.61, 21A.107, 21A.120 as well as 21A.449. For the special conditions on supplemental type-certifications see IR Initial Airworthiness Part 21 – 21A.115 (c) in connection with 21A.113 (b).

43 44

4.7 Management Basics of Major Design Projects 85

describing features and characteristics, are available. The type-certification can be issued subject to limitations, e.g. in the form of operating restrictions (e.g. ETOPS). Type-certifications and their changes are issued with unlimited duration. In principle, the holder of the type-certification has the possibility of returning the certificate and the Agency can revoke it, however, in practice such cases are the exception. With the type-certification, the applicable design documents (applicable, i. e. non-approved data) are transformed into approved production and/or maintenance instructions (approved data).45 Upon official EASA approval, the design organisation that applied for application, becomes holder of the type-certificate (Type-certificate – TC); i. e. it becomes a TC or STC holder.

4.7

Management Basics of Major Design Projects

4.7.1 Tasks and Characteristics of Design Management When it comes to the engineering, major design projects are characterised by expenditures ranging between a few dozen hundred man-hours for smaller modifications or repairs up to over several million for the design of a new aircraft type. Such projects can neither be mastered organisationally nor economically, unless they are systematically prepared and managed. The staff and other resources such as infrastructure, subcontracting and materials, must be planned, managed and supervised in detail, so that an idea or a customer order can lead to an approvable design. To successfully implement such complex events, projects are established in operational practice. Projects are characterised by the following factors: • • • •

uniqueness, clear targets (temporal, financial and staff-related or other limitations), clear segregation in relation to other projects, project-specific organisation.

The project management covers the organisation, planning, monitoring and steering regarding scheduling and structuring of such projects. The agreed project objectives as well as the basic capacitive, technical, scheduling and financial project conditions are hereby to be taken into account.46

The Guidance Material to EASA Part 21 defines at what time and under which conditions design documents become approved data: “After issue of the TC, STC, approval of repair or minor change or ETSO authorisation, or equivalent, this design is defined as ‘approved’ …”. Prior to that, it is merely referred to as non-approved data (also: applicable design data): “Prior to a TC, STC, approval of repair or minor change design or ETSO authorisation, or equivalent, design data is defined not approved …”, GM 21A.131. 46 A comprehensive overview of large-scale project management in aircraft production is provided by Altfeld (2010). 45

4â&#x20AC;&#x192;Design

3URMHFW 0DQDJHPHQW DQG 0RQLWRULQJ Â&#x2021; UHVXOW WUDFNLQJ Â&#x2021; RQJRLQJ LQIRUPDWLRQ RI FOLHQWV H J PDQDJHPHQW FRVWXPHU Â&#x2021; ZKHQ QHHGHG 'HYHORSPHQW RI 'HFLVLRQ RQ FRXQWHU PHDVXUHV

3URMHFW 'HILQLWLRQ

3URMHFW 3ODQQLQJ

3URMHFW ,PSOHPHWDWLRQ

Â&#x2021;

Â&#x2021; 3ODQQLQJ RI Â&#x2021; 3URFHVV Â&#x2021; &DSDFLWLHV Â&#x2021; 5HVSRQVLELOLW\ Â&#x2021; 6FKHGXOH Â&#x2021; 'HWHUPLQDWLRQ RI LQWHUGHSHQGHQFLHV PHDVXUHPHQW FULWHULD

Â&#x2021; FRQWUROOHG ,PSOHPHQWDWLRQ Â&#x2021; FRQVLGHUDWLRQ RI SODQ DGMXVWPHQWV Â&#x2021; )HHGEDFN RI WKH VWDWXV WR 3URMHFW 0DQDJHPHQW

Â&#x2021; Â&#x2021;

'HWHUPLQLQJ 3URMHFW REMHFWLYHV 6HWWLQJ WKH 3URMHFW 5HVRXUFH )UDPH $SSRLQWPHQW RI SURMHFW PDQDJHU

3URMHFW &RPSOHWLRQ Â&#x2021; /HVVRQV /HDUQHG Â&#x2021; ,GHQWLILFDWLRQ RI 6WUHQJKWV DQG :HDNQHVVHV RI WKH 3URMHFW 6HWWOHPHQW Â&#x2021; 6HFXULQJ 3URMHFW 5HVXOWV DQG .QRZOHGJH Â&#x2021; 5HOHDVLQJ WKH 3URMHFW 7HDP

Fig.Â 4.11â&#x20AC;&#x192; Exemplary basic structure of a project flow

Project management represents a management and an organisation concept, used to control often mutually affecting project elements and parts, hereby ensuring that individual aspects are not left to chance or to the ingenuity of individual staff members. Implementing Rule Initial Airworthiness Subpart J 21A.245 (a) is requiring the structured supply of qualified resources. Project handling can be subdivided into several phases (see Fig.Â 4.11). The fundamental project structure hereby is to be aligned with general project management standards and always supplemented in line with the specific project requirements. The project structure needs an individual depth of detail, both allowing control and monitoring by the management and a appropriate operationalisation of defined steps for the project team and stakeholders. â&#x2013;¶â&#x2013;¶

Four Questions for Flora von Heise-Rotenburg,47 EN 9100 Auditor and Former Head of Major Design Projectsâ&#x20AC;&#x201A; What are good design projects characterised by? Good design projects are characterised by realistic planning that takes into account the essential project environment. It is hereby crucial to reconcile available resources with the time requirements of internal and/or external customers. Often, planning is performed at the absolute limits;

Flora von Heise-Rotenburg is certified aviation auditor and managing partner of AirCert GmbH, certification body for EN 9100. Prior to that, she headed large-scale projects in the aerospace industry for many years.

4.7 Management Basics of Major Design Projects 87

i. e. available personnel and production capacities are planned at 100 % in the project. This, however, is unrealistic and regularly leads to major delays of the planned project progress in the early project stages already. Good planning provides sufficient room for manoeuvre and reserves, and never includes 100 % staff capacity. Future-oriented and continuously tracked risk management is essential to proactively prevent all types of project management problems. It is only rarely possible to recognise all problems at the beginning and solve them beforehand. Nevertheless, design tasks must be analysed with experience and expertise prior to the project start and their impact and consequences must be assessed. Later in the project, they must be continuously tracked, revised and, if necessary, expanded with new risks. Knowledge on organisational project environment is as important as technical know-how. If design difficulties occur in the project, these must not be ignored or bypassed, but must be communicated openly and directly to those involved. Problems and difficulties in projects are no exception, they occur in almost all development ventures, as new technical territory is regularly entered. If everything was known and technically mature, no design project would be necessary, and production could start immediately. Technical challenges and difficulties in the implementation of design requirements are therefore a characteristic feature of such projects. Poor and good projects are regularly separated by an open handling and proper internal and external communication of these challenges. Are there typical planning risks that too little attention is paid to at the start? Existing resources and competencies are often overestimated. Sufficient system engineering experience is required to be able to compare technical requirements and own possibilities. This matching is often inadequate. If this coincides with insufficient risk management that provides incorrect or understated initial evaluations of possible technical risks, an undesirable project progress is highly probable. This also applies to external resources, where possibilities and competences of suppliers are often misjudged or overrated. Necessary supplier approvals and supplier surveillance are not existing, commissioning is often inaccurate, and results are not checked until the damage to the design has already been done. Within the supplier management, one practices the project management! What are common mistakes in the (technical) design process? Unrecognised or misunderstood customer requirements as well as inadequate knowledge of other, e.g. governmental, legal or internal requirements often lead to unsatisfactory project results or even to complete project termination. It is crucial that all of the requirements have been recorded and understood before the project is kicked off. Only then project planning is possible on a robust background. Well-crafted requirements documents coordinated with the customer, such as requirement

4 Design

specifications, system requirement documents, system specifications, are indispensable prerequisites. Only when requirements are known and understood, a targeted technical implementation as well as a verification and validation can be carried out in the course of the project. Especially when it comes to subcontracting, inadequate specifications are often the cause of time-consuming mistakes that lead to disputes between the contract partners and open the doors for additional claims, which often burden the financial side of the project far beyond the planning approaches. Where do you see improvement potentials in project management? The more complex and difficult design projects are, the more important a clear separation of “organisational” project management and “technical” system and project engineering is. “Technical problems eat away at your soul”. Even experienced project managers are too often caught up in technical problems and neglect the equally urgent project management tasks. Project management is, above all, a management task. A project and thus the project stakeholders have to be managed. A project manager needs leadership skills, must have communicative and integrative skills and be a good politician and negotiator (it does not hurt, if he also has some technical insight). Good project leaders will already contribute their negotiation skills during contractual negotiations and try to set up a project with the necessary resources. In the course of the project, gained knowledge and results can lead far away from the original project objective. Project targets are expanding or need to be redefined. Project managers must thus master the change and claim management system. At the same time, they have to analyse opportunities and risks together with their project team and try to tackle resulting potentials both technically and financially.

4.7.2 Project Preparation Starting point of a successful project flow is careful preparation. The first step is marked by a project definition that is documented in a project assignment, where the aims of the project as well as a rough schedule and resource requirements are outlined. Once the project assignment has been formulated, it must be accepted by the customer and the contractor (as a rule by the project leader). The customer thereby declares its project targets as binding, while the contractor confirms the acceptance of the project assignment based on the conditions formulated there. The accepted project assignment serves as basis for a detailed project planning. This must be detailed at a degree allowing supervision and management of the subsequent execution. First, the design project is thus to be divided into defined and transparent project steps. The definition of work packages helps to structure the project and facilitates the allocation of milestones and responsibilities. To fully exploit the control effect of the work packages, they must meet the following requirements:

4.7 Management Basics of Major Design Projects 89

• • • •

scope, tasks and objectives are clearly formulated, well-defined results in form of reviews and a concluding documentation, expected results are clear and realistic, allocation to a person or a clearly defined group.

The sum of the work packages leads to a project plan, where binding sequence of task steps is determined taking into account interdependences (e.g. between individual aircraft systems). This plan also comprises capacity planning and scheduling. The allocation of staff capacities and subcontracted tasks to work packages is hereby performed on basis of project scheduling on the one hand and operational resource planning on the other. Staff capacities in this early project phase can often only be based on estimations and adjustments in later project phases are not unusual. The estimation of capacity requirements and the definition of the realisation period are hereby to be made in cooperation with the responsible staff members, reducing the risk of unrealistic processing periods; at the same time an active integration of project stakeholders and subproject leaders guarantees their approval. In addition to the allocation of the staff capacities the capacity planning also comprises the determination of the necessary project infrastructure. The framework (e.g. premises, hard/software, kind and scope of project-internal communication) must be planned to ensure smooth project flows. Not least, the project preparation phase also includes opening of commercial project orders, so that the project costs and manhours of the individual project members can be booked to the work packages. Scope and quality of the project supervision in later project phase are considerably determined by the cost recording structure specified in the project planning phase. Project milestones, i. e. clearly defined time-sensitive results, are eventually derived from the findings of the planning stage. A milestone is only reached, if the demanded partial results were completely furnished and accepted by the project review board (and/or the customer). Milestones are substantial key events of a project, providing orientation that facilitates success measurement of the project and at the same time allowing the client to claim corrective measures in case of deviations.

4.7.3 Project Flow Based on the project plan, the actual design activities can commence. During this execution phase, focus from project management perspective is on controlling and monitoring the execution as well as on compliance with technical and commercial targets. Since designs to some extent are always subject to uncertainties, the planning of related activities is usually a shifting, iterative process. Original planning must then be updated according to new findings. While smaller deviations can fast be adjusted in the planning, significant changes require that all associated consequences are to be taken into account. These might not only affect the work package directly concerned, but also all other project parts as well as the related resource

4 Design

planning. Managing this complexity, in particular regarding indirect subsequent effects of a plan adjustment, forms the neuralgic point of every (design) project in operational practice. Projects are steered across different project hierarchies including subcontractors. Daily and weekly project supervision usually is the responsibility of the project manager or its subproject leader. Focus hereby lies on the degree of processing of individual (partial) work packages. The target work progress is hereby usually compared to the capacities used. Such a comparison usually takes place on the basis of daily or weekly updated actual versus target values per work package. This allows for fast identification of plan deviations as well as for initiation of possible countermeasures. In addition to this short term-oriented project tracking, there is medium to longterm project monitoring. This includes the tracking of large work packages or entire project phases, whose completion was marked by subproject objectives or milestones in the planning phase. The achievement of such key events must be confirmed and the transition to the following design phase be approved.48 The acceptance of such strategic project intermediate objectives is not only approved by the project management alone. So-called milestone or design reviews are held, where the degree of completion of project planning requirements is evaluated and corrective measures are taken in case of deviations. In addition to the project manager and if necessary the subproject leaders also the customer, executive staff and line management staff of different affected departments participate in these reviews. The participant circles of these design reviews is often also referred to as review board. Typical Design Reviews • Programme Design Review: Programme draft completed • Preliminary Design Review (PDR): Rough specification incl. defined functions are available. Requirements have mostly been formulated • Critical Design Review (CDR): Requirement definition phase completed. • Client specification finalised (design freeze). Required PDR changes identified and documented • Verification Review: Compliance demonstration completed, design ready for certification

An important decision basis for design review stakeholders is a project status report that points out existing deviations and risks regarding the specification and the project plan. The report should also present suggestions for corrective measures. A regular, critical verification of the project development on a higher level in form of designs reviews should be ensured, because:

See EN 9100 Sect. 8.3.4.

4.7 Management Basics of Major Design Projects 91

• interdisciplinary communication is improved. This applies, in particular, to corporate group structures, where a high degree of division of labour leads to countless interfaces. Information is easily lost or misdirected. Project periphery risks can be identified better, as the review board does not only consist of directly affected project staff. • delays can be avoided or reduced. Comprehensive and systematic project status analyses can contribute to an early identification of plan deviation risk. In addition to that the review board is entitled to assign sustainable corrective measures. Both circumstances favour shorter design times. • the risk of later changes is reduced. As a careful approach in the early design phase requires fewer corrections and rework later in the project or in series production, design reviews contribute to better production starts. • when well prepared, only comparatively low efforts are required to conduct design reviews, in particular, if one contrasts this with the prevented additional expenses of a troubleshooting Tasks and Objectives of Design Reviews/Milestone Meetings • Comparison of the (intermediate) design results and planned results or specification requirements (verification) • Assessment whether the design meets intended purpose/use, i. e. assessment of the adequacy of the specification (validation) • Examination whether the design results comply with the state-of-the-art • Assessment and coordination of design problems, bottlenecks and weaknesses (resources, costs, design realisation, assembly, maintenance, testing/certification, procurement or production) • assessment and approval of design/project changes • Monitoring project progress and approving the transition to the next project phase • Assessment of project management tools (project set-up, responsibilities, communication, documentation)

So far, the considerations on project implementation have focused on scheduling and resource management. The social component was more or less neglected. Project success, however, considerably depends on the quality of interaction between involved participants. Project management must control and maintain interfaces between the different groups involved in the design process. Over the entire project duration, this can only succeed, if responsibilities are clearly allocated on the one hand and effective communication structures are in place that take into account interface-related risks on the other. Due to the strongly fragmented process and organisational structure as well as the associated high number of interfaces and contacts, large aeronautical organisations regularly face major challenges. This in particular applies to multi-national

4 Design

projects, spatially separated project teams and a high degree of outsourced design services. Typical factors disturbing interaction quality in design projects above all are: • • • • •

uncertainty and complexity of tasks, different perception of critical project phases, cultural differences and subjective strangeness, geographical distance as well as lacking of trust.

If these difficult basic conditions are additionally accompanied by diverging interests or information asymmetries between individual project stakeholders, different departments or project groups, that are interpreted by project participants in their favour exclusively, efficient project steering is hardly possible. After reaching the defined project objectives, the project ends with the discharge of the project management by the customer or the review board. Prior to its dissolution, the project team should critically reflect the project in a (lessons learned review) and record the results. The findings identified here can be used as decision support in future projects. Turning past experiences into improvement measures, however, requires that the expertise already be available in the current project, e.g. milestone results or project meetings are recorded. At the end of the project, they are to be consolidated and communicated to the organisation.

4.7.4 Project Structures An organizational structure tailored to the project and operational needs forms the basis for the success of a design project. In industrial aviation management practice mainly matrix project management as well as pure project organisation structures are applied.

4.7.4.1 Matrix Project Management The matrix project structure is characterised by an overlay of linear and project-related organizational structures that are formally similar to a matrix. During the entire project, related resources remain disciplinarily rooted in their line hierarchy. Staff capacities are allocated by the functional departments according to current requirements, while the staff remains in other projects or in line functions. Resources are thus not firmly but only partially assigned to the project. The structure of a matrix project organisation is represented in Fig. 4.12. The project leader is responsible for the project and has full authority over the resources allocated to him. Exceeding influence on the overall organisation and its capacities is, however, limited to the project’s specific resource requirements. The matrix project structure is primarily applied to small or medium-sized project volumes as well as with short or medium-term project periods (e.g. modifications or component development).

4.7â&#x20AC;&#x192; Management Basics of Major Design Projects 93 0DQDJHPHQW

6DOHV

(QJLQHHULQJ

2IILFH RI DLUZRUWKLQHVV

&RPSRQHQW GHYHORSPHQW

&RQWUROOLQJ

0DWHULDO /RJLVWLFV 6XEFRQWUDFWLQJ

3URMHFW $

3URMHFW %

3URMHNW &

Fig.Â 4.12â&#x20AC;&#x192; Matrix project organisation

Substantial advantage of the matrix project structure is its flexibility. Staff capacities can be assigned to the project according to current requirements, allowing for efficient resource control, particularly since a re-integration at the end of the project is comparatively easily. Administrative efforts for the disciplinary staff management (e.g. supporting career development, training courses and advanced training) substantially remains within the line organisation. In the matrix project organisation, the project manager is also able to fully concentrate on the achievement of project objectives and the project flow. For this he also has the necessary authority to decide and instruct the project team members. Last but not least, the matrix project structure proves to be advantageous because it requires little change in organizational structure. Reputation and powers of executive line staff are hardly limited, as they must only give up their staff temporarily and can retain their disciplinary responsibilities at the same time. However, the matrix project organization also holds potential for conflict due to overlapping competence between line and project business. In addition to that, there is always a risk of fighting over capacities, especially when several projects are implemented in parallel. High communication and coordination requirements are to be expected in particular, if projects and line managers are not able to constructively collaborate. Therefore clear criteria and rules for the supply and cost allocation of resources must be defined.

4.7.4.2 Pure Project Organisation When applying a pure project organisation, a line organisation is established on a temporary basis. Subject to project requirements, resources (staff, team, and infrastructure) are extracted from the existing organisational structure and transferred into a new project hierarchy. The pure project organisation integrates projects in form of independent structures into the existing line organisation. The structure of the pure project organization is shown as an example in Fig.Â 4.13.

Fig.Â 4.13â&#x20AC;&#x192; Pure project organisation

0DWHULDO /RJLVWLFV 6XEFRQWUDFWLQJ

&RQWUROOLQJ

&RPSRQHQW GHYHORSPHQW

2IILFH RI DLUZRUWKLQHVV

(QJLQHHULQJ

6DOHV

0DWHULDO /RJLVWLFV 6XEFRQWUDFWLQJ

&RQWUROOLQJ

0DWHULDO /RJLVWLFV 6XEFRQWUDFWLQJ

&RPSRQHQW GHYHORSPHQW

(QJLQHHULQJ

6DOHV

2IILFH RI DLUZRUWKLQHVV

(QJLQHHULQJ

6DOHV

3URMHFW &

2IILFH RI DLUZRUWKLQHVV

3URMHFW %

2IILFH RI DLUZRUWKLQHVV

(QJLQHHULQJ

6DOHV

0DWHULDO /RJLVWLFV 6XEFRQWUDFWLQJ

3URMHFW $

0DQDJHPHQW

94 4â&#x20AC;&#x192;Design

4.8 Minor Design Changes 95

The project manager is hereby granted both technical as well as disciplinary staff responsibilities. These will be taken out from their previous line organization for the duration of the project and including all capacities exclusively assigned to the specific project. The project manager thus receives full staff responsibility and has similar power as the line manager. Pure project management is primary established in the context of major, largescale projects that run over several years, e.g. in the design of new aircraft or engine types. The advantages of the pure project organisation particularly lie above all in the clearly regulated responsibilities. Since staff are fully allocated for the duration of the project, it is possible to achieve project objectives free from conflict by other departments and projects. Other advantages of the pure project organisation are transparent decision and communication structures as a result of the clear, hierarchically structured staff allocation. The clear, long-term allocation compared to the matrix project organisation, causes higher staff identification with the project as well. The main disadvantage of the pure project organisation is the risk of inefficient resource employment. It is not atypical that project resources are peak oriented and that project staff is not accordingly reduced in periods of shortage. The reason for this is the difficulty of temporarily finding other uses for resources. In addition to that, project managers often lack the willingness of giving up resources in practice, as these resources might not be immediately available, once demand rises (again). Another disadvantage is the difficult reintegration of project staff after project completion.

4.8

Minor Design Changes

After describing the certification process for designs projects classified as major in Sects. 4.6 and 4.7, the following chapter deals with minor design changes. Section 4.5 outlined that every change that has no noticeable impact on characteristics such as mass, trim, form stability, reliability, operational parameters, noise, fuel discharge, emissions or on other features that influence the product’s airworthiness, is classified as minor. Contrary to major changes, no certification programme is prepared for minor changes; because compliance is to be demonstrated for a few Certification Specifications only is. Accordingly, minor changes are subject to clearly lower verification efforts. Renewed or extended compliance demonstration is partially not even required. Minor changes therefore undergo a simplified certification process.49 In contrast to major changes, design organisations can independently certify minor changes on the basis EASA approved procedures. Individual minor change design activities are thus not usually subject to direct EASA monitoring. The Agency is limited to a voice and approval rights with regard to the organisations general minor change procedure.

See IR Initial Airworthiness Part 21 – 21A.95

4 Design

The certification procedure for minor changes is specified in the AMC. As a result every design organisation has to develop “its own internal procedures following this AMC”50; however, there are nevertheless rough requirements concerning compliance, certification and monitoring of subcontracting. The certification process for minor changes starts with a description/justification. As far as required, this process must additionally ensure the identification and compliance demonstration of additional or renewed Certification Specifications or other legal requirements. AMC hereby demand a formalised document control, where the following aspects should, among other things, be specified:51 • description of the planned change including reason for its necessity, • applicable Certification Specifications and environmental protection requirements as well as applicable Means of Compliance (MoC), • reference documentation (if applicable), • impact on operating and performance limits as well as, influence on or necessary changes in existing documents (approved data) • execution of the verification (review), • signature and date of approval. To ensure traceability, compliance with Certification Specifications must be justified and documented for minor changes. This should also be the case, if obvious Certification Specifications do not apply. It can hereby suffice to confirm the compliance with several Certification Specifications in a single sentence or short paragraph without outlining every single requirement in detail. Once the technical documentation was created or supplemented, compliance was fully demonstrated and all relevant Certification Specifications were met, a minor design can directly be certified by the design organisation (without authority support or approval). Certification must neither necessarily be performed by the Office of Airworthiness, however, according to the internal procedure, engineers authorised to certify minor design changes are to be designated under indication of their scope of approval.

4.9 Repairs Focus so far has been on new designs and changes for aircraft and engines. In addition to that, also repairs are subject to the design-organisational sovereignty regulated in the EASA Part 21 Subpart M.52

See AMC No. 1 to 21A.263 (c)(2). See AMC No. 2 to 21A.263(c)(1) 52 See Part 21/M (Implementing Rule Initial Airworthiness), not to be mixed up with EASA Part M (Implementing Rule Continuing Airworthiness). 50 51

4.9 Repairs 97

Repairs are defined as measures to rectify damage and to re-establish airworthiness.53 In the legal sense of Subpart M only work is deemed repair work that require design activities. Less complex damage that can be repaired without constructive effort, e.g. because repair methods are clearly outlined in a repair manual (Structure Repair Manual – SRM) is defined as maintenance.54 21J organisations are entitled to issue repair designs and request their approval. However, the design organisation must have the respective qualification for the repair of aircraft, engine or propeller. Otherwise a coordination with the type-certification holder is necessary. In addition to that, also organisations without Part 21J approval may perform repair designs, if a) the repairs are of minor extent, b) the design competence can be demonstrated and c) approval is performed via the Agency. The approval process for repairs is more or less identical to the procedures for type-certifications and design changes. The beginning of a repair process is marked by the classification into minor and/or major. For repairs decision criteria depend on,55 whether the design activities influence structure or systems, weight & balance, operating parameters or other factors affecting airworthiness. Repairs require a major classification in any case, if one of the following activities is necessary:56 • showing of compliance in context of significant deviations from wear, fatigue, statics or damage tolerance limits (including tests), • application of uncommon repair procedures including use of uncommon materials, application of atypical repair methods, practices or techniques. In contrast to that, repairs are usually classified as minor, if the aircraft or engine remains compliant to the existing compliance basis (CS) despite repair and no or only minor changes are necessary. Following to the classification, it is necessary to describe the repair in order to derive the repair instructions and any necessary compliance demonstration. The repair can be usually documented in form of a written damage statement, also detailing the cause of damage. When designing a repair procedure, an existing production or maintenance documentation of the TC or STC holder usually serves as basis. Documentation of similar damage in the past can also provide useful assistance for current problem solving.57

See IR Initial Airworthiness Part 21 – 21A.431 (b) See IR Initial Airworthiness Part 21 – 21A.431 (c) 55 For classification also see IR Initial Airworthiness Part 21 – 21A.91 and/or Sect. 4.5 56 See GM 21A.435(a) 57 According to GM 21A.437 (2) (renewed) repair design is not required in all other respects, if a repair approval is available that can be a repair solution for the identified damage. 53 54

4 Design

As result of a repair design the following data must be available for implementation and repair approval, as far as applicable:58 • overview of applicable Certification Specifications including reason for their necessity (and thus reason for the classification decision), • design data, drawings, test reports, repair standards, • coordination correspondence with the design approval holder , • compliance documents, e.g. static calculations, fatigue calculations, damage tolerances, vibration response (flutter) or references to such data, • special test requirements. The repair design must also contain additional data on possible influences on: • aircraft, engines and systems (e.g. efficiency, reciprocal effects, flight characteristics, operating or performance limits), • maintenance programme, flight and operating manual, • weight and balance. Once all that data is available and compliance demonstrated, the approval process can commence. Depending on the classification and the organisation’s scope of authorisation repair approvals according to Fig. 4.14 are differentiated.59 Prior to approval, the applicant of a repair design must at any case:60 • document and formally state that the validity of the type-certification basis and the environmental protection requirements are not impaired by the repair, • provide the complete compliance documentation to the Agency to demonstrate that the repair design complies with the applicable regulations, if requested. • provide an appropriate agreement with the type-certificate holder, if the applicant is not able to meet the requirements specified above. If the repair design is approved by the Agency, this will not be done in the context of an STC, but through a separate approval (major repair approval or minor repair approval). If the repair is approved by the design organisation, the individual repairs do not always require the Agencies’ direct approval, however, the fundamental procedures must be coordinated with and approved by the Agency (similar to minor design changes). Such an internal approval procedure is then subject to on-going official monitoring. For this purpose, the design organisation must be able to present its QM

See AMC 21A.433 (a) and AMC 21A.447 See IR Initial Airworthiness Part 21 – 21A.437 as well as 21A.432 in conn. with 21A.432B 60 See IR Initial Airworthiness Part 21 – 21A.433(a) 58 59

4.10 Component Development 99

1RQ GHVLJQ RUJDQLVDWLRQV

- GHVLJQ RUJDQLVDWLRQV

PDMRU

PLQRU

,I 7\SH &HUWLILFDWH +ROGHU

PLQRU

PDMRU

,I QRW 7\SH &HUWLILFDWH +ROGHU

,QGHSHQGHQW FHUWLILFDWLRQ SURFHVV RU

&HUWLILFDWLRQ E\

&HUWLILFDWLRQ E\ ($6$

1RW SHUPLWWHG

($6$

IRU GHWDLOV *0 $ D

Fig. 4.14 Approval paths for repairs

documentation on repair procedures and responsibilities at all times. In addition, the repairs approval documentation must be presented fast and completely. A repair is not possible, “if the Agency finds that the change in design, power, thrust, or mass is so extensive that a substantially complete investigation of compliance with the applicable type-certification basis is required.”.61 In this case the existing type-certificate must be revoked and a new one has to be applied. The execution of the repair following to the approval is only permitted by an approved maintenance organisation (according to EASA Part 145) based on the design organisation’s approved data.

4.10

Component Development

The focus of previous aspects was mainly on design activities that are directly applied to the aircraft. In the following, the text is dedicated to the design of components. Technically, development of components differs marginally from aircraft design. However, the component design plays a special role in terms of organisational requirements and aviation legislation, as it is not explicitly governed by EASA Part 21J. From a formal point of view, components are designed in a legal

See Initial Airworthiness Part 21 – 21A.19

100

4 Design

grey area. Component designs do not receive their own (installation) approval, but are certified with the type-certificate or supplemental type-certificate together with the aircraft.62 In operational practice, many large design organisations use this gap by extensively outsourcing component development to suppliers without own 21J approval. The responsible design organisation then mostly influences the component development only by defining and approving input and output of design activities’: • • • • •

definition of design requirements, examination and release of the specification, verification and approval of compliance documentation, verification and release of the relevant component documentation, design-technical integration of the component into the aircraft.

The actual design, including the construction of the component, the showing of compliance and creation of design documents, are thus performed by the respective supplier. Similarity to the design of aircraft or engines is quite helpful in operational practice, as suppliers already receive the design-organisational standards. In the context of the specification and these standards they can then act comparatively independently without having to demonstrate a formal 21J approval. The process cycle illustrated in Fig. 4.15 outlines the similarity of component and the aircraft design process. As soon as this high description level is deviated from and the degree of detail increases, the differences become clearly visible. These are outlined in the following.

4.10.1 Specification of Parts The beginning of the component design is marked by the definition of design objectives. Hereby a specification is to be provided that states how the component is supposed to look and which characteristics it has to meet. This in particular, comprises functional and technical basic requirements that are summarised as the so-called “4 F” (form, fit, function, fatigue) as well as the “5 F” qualification. In addition to that, exceeding requirement criteria like quality, maintenance, material or transportation and storage standards are usually defined as well.63 The component’s significance (criticality) for continuing airworthiness in an installed condition is to be particularly determined in the context of the specification. Depending on this, it may be necessary to go beyond the normal design and qualification requirements, which are then usually derived from the Certification Specifications. If the CS are, however, insufficiently specified, the definition of qualification requirements can be based on a risk classification, where the level of the

62 63

With the exception of ETSO products and PMA parts, see Sects. 4.11 and 4.12 For specification creation details see Sect. 4.3.3

4.10 Component Development 101

Specification / Definition of component requirements

Component development • Design • Design documents • Test instructions

Production (Prototyping, Red label unit)

Component qualification and showing of compliance

Integration of component into the aircraft

Fig. 4.15 Procedural component design base structure

component qualification results from the error or failure probability. The following table classifies risks according to the FAA AC 25.1309 (Design Assurance Level): • Level A: Misconduct or failure leads to malfunction of an aircraft system and has catastrophic consequences for the aircraft (i. e., many fatalities, total loss of aircraft). • Level B: Misconduct or failure contributes to the malfunction of an aircraft system and has hazardous consequences for the aircraft (i. e., severely injured passengers or fatalities, serious damage to the aircraft). • Level C: Misconduct or failure results in the malfunction of an aircraft system with major consequences for the aircraft (some injuries, performance limits of crew or aircraft exceeded). • Level D: Misconduct or failure results in the malfunction of an aircraft system with minor consequences for the aircraft (operation at performance limit of crew or aircraft, use of emergency procedures). • Level E: Misconduct or failure contribute to the malfunction of an aircraft system, but has no impact on aircraft, flight operation or the pilots’ workload.

102

4â&#x20AC;&#x192;Design

A substantial element of a component specification is the identification of requirements for the compliance demonstration. Before the design phase commences, it must be identified, under which conditions approval of the component is possible. The procedure for showing of compliance is hereby based on the standards of MoC 9 (equipment qualification) as well as on additional information from Certification Specifications and recognised industry standards (e.g., RTCA, SAE). When component design is subcontracted, it is not uncommon for the design organisation to specify the component requirements, in particular for the showing of compliance, while the actual specification is created by the contracted supplier. It is, however, important that the component specification is released according to GM 21A.131 by an approved Part 21J organisation.

4.10.2 Construction of Components The specification serves as the basis for the actual design activities. While the specification phase primarily defines input and output parameters of the design activities, the subsequent design phase, above all, is to develop and detail a technical concept for optimal implementation. The search for solutions, in particular when it comes to complete component designs, can be simplified by structuring the design process in phases. A common division hereby is: Conceptual design: Specification requirements are first to be systemised and a methodical definition of the approach (structural design methodology) is to be determined. In addition to defining a technical and organizational concept, it is often necessary to handle the trade-off, on the one hand to meet the requirements of the specification and, on the other hand, to ensure a cost-effective solution. Draft: The second phase focuses on the application of the selected design methodology. Concrete solutions are to be developed and their implementation must be specified, without going too much into detail. Check lists, catalogues, templates, forms, samples or the documentation of similar parts can hereby be helpful. In a flowing transition from conceptual to elaboration stage, the degree of concretisation continuously increases. Elaboration: The elaboration phase refines the design description to a degree allowing a 21/G production organisation to produce, verify and release the component on that basis. For this purpose, at the latest in the elaboration phase, all necessary information is to be created and provided. This includes specifications, drawings, wiring diagrams, required subassemblies, material requirements, labels, applicable standards, manufacturing procedure specifications (MPS), inspection points, requirements for the acceptance test procedures (ATP), etc. If the component was not developed by an approved 21J organisation, design is to be examined and released at the latest after its completion. In addition to that, the design organisation must assign a part number to the component. The number is issued once, must remain permanently valid and may not be changed. Exceptions are only made if the part is modified and this new status influences the 4F, respectively the 5F classification. In this case, a new part number must be generated, as

4.10 Component Development 103

interchangeability with the original part is no longer ensured. In case of a change below the 4F and/or 5F level, only the modification status is changed, not the part number.64 Re-orders always refer to the component with the known and expected functional and performance characteristics. ▶▶

Configuration Management Configuration is the definition of a product composition or a state of construction. Configuration management consequently is the systematic control and documentation of related activities.65 The fully documented product description plays a substantial role here, as it is necessary to determine the associated product elements and properties at any time throughout the entire lifecycle. Configuration management is based on the idea of interpreting the design process as a sequence of changes to the initially defined specification or requirements, considering their interaction with other products (e.g. next higher assembly). Configuration management should help to keep the evolutionary process of product development in order to minimize errors or at least to make them traceable. In addition to defining the product structure and the initial configuration (baseline), configuration management above all focuses on change management that is subject to a supervised approval process. The starting point of every configuration management is applying a logical structure (numbering system), which is used in documentation (document number) and product (part/serial number). Using configuration management, it must be possible to answer the following questions at any time and for any manufactured product: • How was the product designed? (Which design documentation is the product basis?) • How was the product produced? (In which physical condition is the product?) • How was the product tested? (Which test environment, test parameters and test results were the basis of the product approval?) • How was the product delivered? (In which structural condition was the product at the time of delivery?) • What design status does the product have? (Which changes have been made to since its delivery?)

This can then be taken from a part number appendix in the form of letters or abbreviations (e.g., Mod 1, Mod A). 65 The necessity to establish a configuration management results from EN 9100 series (2016) Sect. 8.1.2. The ISO EN 10007 guidelines for configuration management can hereby be used as aid. ASA legislation only implicitly requires a configuration management via IR Initial Airworthiness Part 21 – 21A.239 as well as 21A.139 b) (1) (iv). 64

104

4 Design

4.10.3 Qualification and Approval of Parts The qualification of components forms one of the most important elements of the design process. It must hereby be demonstrated that the design results comply with both the specification as well as with safety and reliability standards (e.g. Certification Specifications) and environmental protection requirements. If the construction and qualification was carried out by a subcontractor, at least the verification and release of the corresponding documents must be carried out by an approved Part 21J organisation. The MoC 9 (equipment qualification) to be used for components usually requires not only theoretical methods of compliance (e.g. simulations, safety assessments) but also physical component qualification. Usually, at least the following risk characteristics must be checked: • • • • •

intended function under simulated environmental conditions, flammability, electrical overload and overheating (over-temperature) protection, compatibility behaviour (in particular EMI), rigidity, in particular considering pressure and temperature changes, vibrations.

In the case of mathematical-statistical hazard or fault analyses, it is theoretically estimated which risks originate from the component. These analytic reliability methods are predominantly based on probability calculations. However, these analysis methods marred by the stigma that their input, is only based on experience and expertise and thus there is always an uncertainty factor in the premises. Typical Risk and Failure/Fault Analysis Methods FMEA Failure Mode and Effect Analysis FMECA Failure Mode Effects and Critically Analysis FTA Fault Tree Analysis ETA Event Tree Analysis MTBF Mean Time between Failure All means of compliance share the common goal of making safety and reliability calculable. The qualification requirements and activities are to be determined and executed, as far as not already obtainable from the specification, in close coordination with the design organisation’s Office of Airworthiness. Since test results (and/or associated substantiation data) are to confirm compliance with the design specification, careful and comprehensive test preparation and execution is mandatory. Substantial questions for test planning are: • What is to be tested? • How is it to be tested (test structure) and which test parameters are defined?

4.10 Component Development 105

• What is required for the test (test environment)? • Is an individual or an already system-integrated part to be tested? • How are test results evaluated (e.g. underlying assumptions)? A structured preparation that takes these questions into account can often be based on test standards, e.g. according to RTCA, SAE or FAR. Should this, however, not be possible for reasons of high test specificity, an individual qualification plan is to be provided (Qualification Test Procedure – QTP) that outlines the test in detail. Under normal conditions, tests are performed using a so-called red label unit; i. e. a finished part that was produced in line with design-organisational standards.66 Such a part serves for qualification and compliance verification and is therefore not yet approved (via TC, STC).67 After the test, results either directly serve as reference (substantiation data) or are merged into a test report (Qualification Test Report – QTR). In both cases, an associated compliance document is often provided. With this, the design engineer confirms that the test result is in accordance with the previously defined test specifications (e.g. CS, FAR, RTCA).68 Via the compliance document, the part, respectively its part number, can be integrated into a design-organisational installation document (e.g. design data for production). The Office of Airworthiness subsequently examines the entire installation document (with all its sub-documents, including the component contained). As soon as the Agency issued the TC or STC, the design and maintenance documents of the component become approved data. The component is then defined as an approved aircraft part for the specific type-certification (exclusively). Figure 4.16 outlines the fundamental procedure from compliance demonstration to component approval via a TC or STC. Parts are usually not subject to an own or separate design approval. All aircraft parts are to be approved in context of their integration into an aircraft or engine (TC or STC). Parts produced in an approved status are initially referred to as black label unit and after conclusion of the start-up phase as production unit. If the part is integrated into other aircraft systems or type-designs at a later time, this integration must again be approved, as environmental conditions (pressure, temperature etc.) might significantly differ. Should parameters be similar, it can be sufficient for compliance demonstration referring to already existing approvals (e.g. TC, STC, PMA), whereby a copy of the appropriate official document serves as reference. Data for this component becomes approved data combined with official approval via a TC or STC.

IR Initial Airworthiness Part 21 – 21A.33 In contrast to that, the prototype is strictly speaking not intended for qualification and compliance demonstration. The prototype is a first part based on the specification that is used for pretesting and further improvements. 68 For a distinction between substantiation data and compliance document see also end of Sect. 4.6.2. 66 67

106

4 Design

6KRZLQJ RI FRPSOLDQFH

&UHDWLRQ RI VXEVWDQWLDWLRQ GDWD

,QWHJUDWLRQ RI VXEVWDQWLDWLRQ GDWD LQWR - FRPSOLDQFH GRFXPHQW

,QWHJUDWLRQ WKH FRPSRQHQWV SDUW QR LQWR - LQVWDOODWLRQ GRFXPHQW

&RPSRQHQW RU V\VWHP FHUWLILFDWLRQ YLD 7& RU 67&

Fig. 4.16 Component qualification and approval procedure

4.11

ETSO Parts

The European Technical Standard Order (ETSO) is a standard for selected parts, equipment and materials, installed in civil aircraft.69 ETSO parts are subject to their own official approval. However, this approval merely comprises minimum requirements with regard to the performance level or characteristics of the related products. These minimum requirements are defined in own Certification Specifications (CSETSO). Typical parts that are subject to the ETSO standard are e.g. instruments, seats, tyres, rescue and safety equipment as well as APUs. The requirements with regard to design, approval and production of ETSO products are defined in EASA Part 21 Subpart O. An ETSO approval can in principle be requested by any organisation that documents design practice and resources

The US-American equivalent is the Technical Standard Order (TSO). The specific product requirements are determined in the AC 20-110L.

4.12 PMA Parts 107

necessary for the respective product.70 When applying for an ETSO approval, an approval as a Part 21J design organisation is not required. A prerequisite for a specific ETSO product approval by the Agency is the filing of comprehensive information on design and performance characteristics (declaration of design & performance – DDP). The following box shows that this mainly refers to data on design and showing of compliance, operation and continuing airworthiness. In this respect, it is not surprising that the ETSO design process is comparable to that of other aviation parts and appliances (see Sect. 4.10) Declaration of Design & Performance for ETSO Products71 • Information on design and test procedures as well as product description • Information on the article’s nominal output • Statement that the article complies with the corresponding CS-ETSO • References to test reports • Reference to the relevant maintenance and repair manuals • Conformity levels, as far as permissible for CS-ETSO • List of permitted deviations Since ETSO is a minimum standard, the associated approval does not automatically entitled the holder to integrate the respective part in any aircraft. Only compliance of the ETSO product with the standard (CS) is confirmed, not the approval for installation in a specific aircraft or aircraft type. Due to individual system characteristics it might be necessary for an ETSO product to meet properties exceeding minimum standards and additional Certification Specifications. As like any other component aircraft integration of ETSO products thus require additional approval via an installation document and a TC or a STC. When producing ETSO products, the certification holder requires a production approval according to EASA 21G.72 Accordingly, when maintaining ETSO products, an approval as 145-Organisation is required.

4.12

PMA Parts

PMA parts (Parts Manufacturer Approval) are parts that come with a separate official approval. While parts are usually certified together with the aircraft or engine via a TC or a STC, PMA parts receive an own official approval. These parts can thus be directly installed into an aircraft, without changing the aircrafts certification basis (TC or STC). See IR Initial Airworthiness Part 21 – 21A.602B (b); however APUs are exempt from this rule, as their design requires approval as 21/J design organisation. 71 See IR Initial Airworthiness Part 21 – 21A.608. 72 See IR Initial Airworthiness Part 21 – 21A.602B, alternative Part 21F approval. 70

108

4 Design

The special feature hereby is that holders of PMA approvals must not necessarily have access to the original approved data. To that extent, PMAs can be design copies of OEM parts. Under compliance with legal regulations, PMA parts may then be installed as alternative parts into the respective aircraft or engine, without having to obtain renewed type-certification. PMAs are a special FAA option and are usually granted on basis of a combined design and production approval. The approval is referred to as Parts & Manufacturer Approval.73 Although PMA parts are US specific, they are also accepted by the EASA, if they come with the American release certificate FAA Form 8130–3. Due to import of these parts, mainly maintenance organisations are confronted with PMA parts in Europe. In the EU, with the exception of PMA parts, any aircraft component may only be approved and installed in in the context of a TC or STC. A distinction is made between the PMA design approval and the PMA production approval. Starting point for a PMA design approval is a FAA approved product design. Using the standard methods (MoC), the applicant has to demonstrate that its product compiles with the Federal Aviation Regulation (FARs – US Certification Specifications) after installation in the aircraft, engine or propeller. This form of compliance verification can only be dropped, if design and performance characteristics are identical to the certified OEM product and are confirmed by respective TC holder statements. The PMA design approval then confirms the interchangeability of PMA parts and the appropriate original OEM product. On the other hand, there is the PMA production approval that entitles holders to produce and sell PMA parts. This approval includes the parts installation in aircraft according to approved interchangeabilities. PMA part manufacturers are under FAA supervision and must demonstrate that they have a quality system for production monitoring to ensure permanent product conformity according to PMA design standards. A PMA is valid for an unlimited duration, unless it is returned or withdrawn. The approval itself is non-transferable, however, the data underlying the approval is. PMA parts play a considerable role in the aviation spare part market (and there in particular for engine parts). Due to their lower costs, PMA parts are particularly interesting for aircraft operators. Price differences of up to 50 % on the respective OEM products. Thus, PMA parts at present constitute about five to ten per cent of the spare part market.

References Altfeld, H.H.: Commercial Aircraft Projects: Managing the Development of Highly Complex Products. Farnham 2010 ASD-STAN Standard: ASD-STAN prEN 9100-P4 – Quality Management Systems – Requirements for Aviation, Space and Defense Organisations. English version. prEN 9100:2016 (E), 2017 With EPA parts (EASA part 21K) there is a European counterpart to the PMAs. However, international aviation organisations have so far not sustainably accepted them, and they are hence not common on the market. 73

References 109 European Commission (EU): Commission Regulation laying down implementing rules for the airworthiness and environmental certification of aircraft and related products, parts and appliances, as well as for the certification of design and production organisations [Implementing Rule Initial Airworthiness]. No 748/2012 of 03/08/2012 European Aviation Safety Agency â&#x20AC;&#x201C; EASA: Acceptable Means of Compliance and Guidance Material to Part 21. Annex I to ED Decision 2012/020/R. Issue 2. Oct. 2012. SAE ARP 4761: Guidelines and Methods for conducting the Safety Assessment â&#x20AC;&#x201C; Process on Civil Airborne Systems and Equipment, Warrendale 1996

Maintenance Management

The purpose of maintenance management is to ensure airworthiness of an aircraft during its life cycle by way of systematic maintenance planning. Therefore, first and foremost basic maintenance measures must be defined. Later, their implementation is to be monitored and the maintenance planning adjusted where necessary. At the same time, early identification of any issues that could put airworthiness at risk must be ensured within the context of maintenance management. Following an introduction to maintenance management in general, a first emphasis of this chapter is directed toward the maintenance programme, where all planned maintenance activities are defined during the product lifetime of an aircraft. Sects.Â 5.1 and 5.2 deal with necessity, creation as well as with structure and content of maintenance programmes. Reliability programmes form a second focus of this chapter, by which the reliability of individual parts of an aircraft are supervised and evaluated during operation. In a concluding sub-chapter, the purpose of and the way of how to proceed in the case of notifications by aviation authorities or by the manufacturer are outlined. This focuses mainly on Airworthiness Directives and Service Bulletins.

5.1

Tasks and Objectives of Maintenance Management

Sustainable and continuous airworthiness during the lifecycle respectively, operating time of an aircraft can only be obtained when it is subject to permanent technical monitoring. Based on this rational, the European Union issued EASA Part M, a regulation that defines rules for Continuing Airworthiness.

ÂŠ Springer-Verlag GmbH Germany, part of Springer Nature 2019 M. Hinsch, Industrial Aviation Management, https://doi.org/10.1007/978-3-662-54740-3_5

111

112

5 Maintenance Management

Part M represents a separate and mandatory operating licence for aircraft operators and contains, among other things, minimum requirements for airworthiness and maintenance. This covers mainly:1 • securing all maintenance on basis of an officially approved maintenance programme, • rectification of any deficiencies and damage that could influence safe operation, as well as executing changes and repairs on the basis of approved maintenance documentation and repair standards, • a system for evaluating the effectiveness of a maintenance programme (reliability monitoring), • compliance with Airworthiness Directives and all other officially issued measures. The multiplicity and complexity of these tasks can be mastered only, if the continuing airworthiness is structurally planned, steered and supervised. Comprehensive management of maintenance activities is therefore necessary, moreover, as economic aspects must be considered next to legal standards. The requirements defined by aviation authorities nowadays often represent only a basic service taken for granted in practice. Today the goal is not only to prevent system or component failures, but rather the minimisation of operating costs. That can be achieved by determination, analysis and recovery of any degradation of any components or aircraft performance and at the same time optimising ground times due to maintenance. Aircraft operators (or, respectively, CAMOs) can either carry out maintenance management tasks themselves or outsource this service fully or partially to qualified organisations. The responsibility for monitoring and implementation of all activities, however, always remains with the respective CAMO. The advantage of cooperating with third parties typically is the fact that these contractors are specialists (e.g. Part 145 or other Part M organisations Section G, CAMO) with profound experience and comprehensive know-how in maintenance and maintenance management. In particular for airlines with a small fleet, subcontracting these services offers an opportunity to participate in the experiences of large maintenance organisations as well in economies of scale and thus reduce their own operating and maintenance costs. In the following, typical maintenance management tasks are described which aircraft operators are obliged to perform: • Developing, updating and administration of maintenance programmes as well as its implementation monitoring (Sect. 5.2), • Development and operation of reliability management incl. condition monitoring systems to ensure the effectiveness of the maintenance programme (Sect. 5.3), • Tracking, evaluation and instruction of regulatory requirements and recommendations of the design approval holder (Sect. 5.4). 1

see IR Continuing Airworthiness EASA Part M–M.A.301

5.2 Maintenance Programmes 113

5.2

Maintenance Programmes

5.2.1 Necessity of Maintenance Programmes Many parts of an aircraft have a limited service life and must either be replaced or maintained at hard time or soft time limits. Typical parameters that affect the serviceability of aircraft, engines and propellers as well as parts and appliances, are: • • • •

time since initial operation flight hours/cycles number of take-offs and landings (flight cycles) the operating area of the aircraft. Performance and operational capability of aircraft equipment (e.g., engines, APUs, air conditioning system) are not only reduced by very high or very low external temperatures, but also environmental contributing factors such as humidity, salinity and dust.

Since wear and tear affect aircraft, comprehensive maintenance activities are necessary for sustainable, continuing airworthiness. Thus fatigue damages, environmental deterioration and accidental damages in particular are to be detected or, respectively, prevented in time. Due to high technical complexity of aircraft these measures must be specified in a structured way for the entire service life of an aircraft and its parts. The listing of all (future) maintenance tasks during the service life is compiled in an aircraft maintenance programme. This contains detailed information on scope and frequency of maintenance on the aircraft structure, its systems, engines, components and parts. Maintenance programmes cove, at the same time, the description of extent and periodicity of checks. In accordance with EASA Part M, operators of aircraft are under obligation to provide a maintenance programme for each of their aircraft. This has to be applied constantly and be monitored by qualified engineers at least once a year with regard to topicality and suitability. Carrying out these activities is subject to official supervision by the responsible aviation authority. In addition, all first issues as well as any revisions of maintenance programmes must be approved by the responsible aviation authority. The framework of maintenance programmes is usually pre-determined by the aircraft manufacturer, but operators must adapt their maintenance programmes to the respective aircraft configuration and the individual requirements of their fleets. For this reason, the maintenance programmes of the diverse aircraft types differ in practice; but even with identical aircraft types the details of maintenance programmes can vary between airlines, depending on operational area and utilization, or on the individual operational experiences. In addition to that, maintenance programmes also reflect more or less clearly the maintenance philosophies of operators (e.g. block or phase-related maintenance, focus on prevention or maximum utilisation of permissible limits).

114

5 Maintenance Management

5.2.2 From MRB Report to Maintenance Programme 5.2.2.1 Maintenance Review Board Report Until the Boeing 747 was designed at the end of the 1960’s, each airline had to compile an entirely individual maintenance plan for the respective aircraft type. Since then, the aviation industry has moved on to gather the know-how of all direct or indirect stakeholders in aircraft maintenance when new aircraft types are being developed. The objective was to put together a basic maintenance document for each type of aircraft for the benefit of all interest groups. The result of these activities is the Maintenance Review Board Report (MRB Report) which is published by the design organisation parallel to the type- certification. The MRB Report is a kind of guideline that specifies minimum requirements to maintenance of an aircraft type. The MRB Report serves today as generally approved starting point for creating a maintenance programme. Furthermore it is accepted by aviation authorities, Part M and Part 145 organisations as a key basic maintenance document of an aircraft type. The report is aligned to the entire world fleet of an aircraft type but gives, at the same time, consideration to different aircraft-configurations as well as individual usage behaviour and extent. The First step is the establishment of a maintenance review board consisting of representatives of the authorities responsible for the approval of the MRB Report (e.g. EASA, FAA, Transport Canada). In parallel, an Industry Steering Committee (ISC) constitutes itself. This ISC consists of representatives of the manufacturer as applicant for a type-certification, the concerned engine manufacturers, key suppliers, as well as experts of airlines or large maintenance organisations. Participants are thus all organisations that either have a direct influence on continuing airworthiness of the respective aircraft type, or which can contribute experiences. Furthermore, MRB members are represented in the ISC in an observing function. The ISC appoints and supervises Maintenance Working Groups comprised of specialists in previously defined special areas (usually for structure, systems, engines and aircraft zones).2 On the basis of a standardised processing blueprint, Maintenance Working Groups work out proposals within the scope of their subject for scope and frequency of maintenance measures. Information basis is, e.g., comparable or expected technical properties and deterioration characteristics as well as other data on real or theoretically identified failure or replacement rates. On this basis Maintenance Working Groups determine the minimum requirements for maintenance of an aircraft and its components. The MRB and the ISC act in an advisory function for the Working Groups in the execution of their work. The Working Groups determine the maintenance tasks applicable for the future aircraft on basis of the MSG-3 logic, including measures and intervals. The process of determining type and scope of maintenance within the framework of the MRB Report is outlined in Fig. 5.1. 2 The members of the Working Groups are staff of the aircraft or engine manufacturer, the suppliers, large airline companies and large maintenance service providers.

5.2â&#x20AC;&#x192; Maintenance Programmes 115 :RUNLQJ JURXS 6WUXFWXUH

:RUNLQJ JURXS 6\VWHPV LQFO HQJLQHV

:RUNLQJ JURXS =RQH

EDVHG RQ 06* V\VWHP 'HILQLWLRQ RI PDLQWHQDQFH WDVNV $ & VWUXFWXUH

0DLQHWDQFH WDVN FRYHUHG E\ ]RQDO SURJUDP"

'HILQLWLRQ RI PDLQWHQDQFH WDVNV $ & V\VWHPV

'HILQLWLRQ RI PDLQWHQDQFH WDVNV $ & ]RQHV

0DLQHWDQFH WDVN FRYHUHG E\ ]RQDO SURJUDP"

,QVSHFWLRQ RI V\VWHPV WKDW LQ WKH FDVH RI IDLOXUH LQIOXHQFH IOLJKW VDIHW\ VKRXOG QRW EH FRYHUHG E\ WKH ]RQDO SURJUDP DQG UHPDLQ LQ V\VWHP SURJUDP DV LQGLYLGXDO WDVNV

05% 5HSRUW 6WUXFWXUH SURJUDP

=RQDO SURJUDP

6\VWHP SURJUDP

Fig.Â 5.1â&#x20AC;&#x192; Determining maintenance tasks in the framework of an MRB Report

Therefore, the aircraft is subdivided on paper into individual zones, (structural) components and systems. Based on this, a MSG-3 analysis of these aircraft components is carried out. This means that all components, zones and systems are analysed with regard to their functions, safety, failure risks, error impact, inspection accessibility and damage visibility as well as affecting environmental factors. Based on this analysis, inspection intervals (e.g., after every 500Â flight hours), inspection intensities (e.g., depth of control), tests (e.g., functional tests) and maintenance measures (e.g., lubrication) are subsequently determined. Such an investigation is carried out independently in the Working Groups for structure, systems and zones. To avoid any unnecessary (multiple) controls during the operational phase of the aircraft, all maintenance tasks defined in the Working Groups are subsequently consolidated. This is done by checking in the maintenance tasks for the areas of structure and systems whether comparable maintenance activities have already been defined in the zonal programme. If that is the case, the maintenance tasks will be taken from the structure or, respectively, system programme, since it is already included in the MRB Report via the zonal programme. As a result, the MRB Report is thus composed of at least the chapters Zone (Zonal), Structure and Systems (including engines).3 3 Depending on the number of Working Groups. For the Airbus A330, e.g., not only three, but six Working Groups were formed: 1) Systems (flight controls, landing gear); 2) Mechanical Systems;Â 3) APU & Engines; 4) Electrical Systems; 5) Structure; 6) Zonal; 7) Systems (fuel); see Airbus SAS (2010), p. 788 et seq.

116

5 Maintenance Management

The proposals prepared by the Maintenance Working Groups will afterwards be submitted to the Industry Steering Committee. Based on the results of the MRB Working Groups, the ISC develops a proposal of the MRB Report, the so-called Maintenance Programme Proposal, and submits it to the Chairman of the MRB. After jointly reviewing it with his specialist advisors, the MRB chairman releases the proposal then for publication as the official MRB Report. ▶▶

MSG-3 Analysis In the early days of aviation history, aircraft maintenance was carried out on the basis of the mechanics’ experiences. Only with the beginning of the jet age and the establishment of aviation safety authorities, a paradigm shift took place for structured maintenance planned by engineers. These maintenance activities were, however, based on the idea that measures were all the more effective, the more they were carried out (“much helps much”). In the 1960’s it was realized, that this philosophy was not sufficient because the practical experience was not take into account in the maintenance schedules. Thereupon, for the first time in the context of the B747 development, a systematically planned maintenance programme under consideration of the aircraft’s or part`s condition, became the standard (the so-called MSG-1 and/or MSG-2). Since 1980, MSG-3 logic has been applied for defining scope of maintenance. This approach is defined to be preventive and, in addition to safety aspects it also takes its orientation from flight-operational and economic requirements. The principle of the MSG-3 logic is based on a possible failure and effects analysis (Failure Mode and Effects Analysis – FMEA). This is a standardised decision diagram methodology which helps to derive maintenance tasks. The MSG-3 method does not focus on the appearance of a failure in general, but rather on its effects (Consequence of Failure Approach). Thus, rather than focussing on whether an error or failure occurred, the deciding factor is whether this affects flight operation. In addition, the MSG-3 approach is task oriented (see end of Sect. 5.3.2). Other than earlier MSG-processes, the MSG-3 approach assigns concretely designated maintenance tasks (e.g., lubrication, functional control, replacement) for any individual aircraft component. The MSG-3 approach is thus considered an approach as precise as surgery which can be aligned individually and flexibly to specific maintenance requirements.

MRB reports are subject to continuous evaluation regarding adequacy and topicality. This means, that experiences gathered in operation and the lessons learned are evaluated and continuous improvement be achieved. Accordingly, the original MRB Report is to be adapted if required and the user circle informed. Although the MRB Report is valid throughout the aircraft’s entire life cycle, it has the greatest use for the operators when they have not yet been able to gather own maintenance experience (see also Fig. 5.2).

5.2â&#x20AC;&#x192; Maintenance Programmes 117 3DUWLFLSDQWV 5HVSRQVLELOLW\

0DQDJHPHQW DQG 0RQLWRULQJ WKH FUHDWLRQ SURFHVV RI DQ 05% 5HSRUW

05% DXWKRULWLHV UHSUHVHQWDWLYHV 0DLQWHQDQFH 5HYLHZ %RDUG 05%

,QGXVWU\ 6WHHULQJ &RPPLWWHH ,6&

,QLWLDO GHWHUPLQDWLRQ RI PLQLPXP PDLQWHQDQFH WDVNV LQ ZRUNLQJ JURXSV 6WUXFWXUH

6\VWHPV

(QJLQHV

(YDOXDWLQJ UHVXOWV RI WKH ZRUNLQJ JURXSV 05% 3URSRVDO

$SSURYDO RI 05% 5HSRUW

5HOHDVH DQG SXEOLFDWLRQ RI 05% 5HSRUW

=RQHV

,6& 0DQXIDFWXUHU LPSRUWDQW VXSSOLHUV DLUOLQHV SRVVLEO\ PDLQWHQDQFH FRPSDQLHV DGYLVRU\ 05% 0HPEHUV ZRUNLQJ JURXSV 0DQXIDFWXUHU LPSRUWDQW VXSSOLHUV DLUOLQHV SRVVLEO\ PDLQWHQDQFH FRPSDQLHV DGYLVRU\ 05% ,6& 0HPEHUV

,6&

05% 0HPEHU

$LUFUDIW 0DQXIDFWXUHU

Fig.Â 5.2â&#x20AC;&#x192; Deriving the MRB Report

5.2.2.2 Maintenance Planning Document The information resulting from the MRB Report are only of little suitability for operationally maintenance planning and direct maintenance execution due to insufficient structuring and detailing. Thus aircraft manufacturers offer their customers in addition, a type- and/or configuration-specific document. The Boeing document is called Maintenance Planning Data Document (MPD) and Airbus Maintenance Planning Document (MPD). The MPD is an enhanced version and at the same time represents a substitute for the MRB Report in maintenance planning. Therefore MPD is the central basic document for developing maintenance programmes. It provides Part M and Part 145 organisations further information for carrying out maintenance, e.g., with regard to structuring the work, defining the sequence of maintenance tasks, detailed reference to maintenance manuals, tools to be used, as well as notifications and illustrations of access panels and doors. In addition, it contains information on maintenance of components that are not covered by the MRB Report but are nevertheless part of the overall maintenance scope. In addition, the MPD contains manufacturer requirements and recommendations. To facilitate planning of maintenance events, the MPD additionally lists average times for the execution of tasks. However, this information refers solely to the measure itself, without considering the time required to get any material, tools,

118

5 Maintenance Management

documentation, or for gaining access to the components, etc. These benchmark indicators must therefore be individually adapted in the production planning of the specific maintenance operation. For an aircraft operator, the main benefit of the MPD is the provisioning of a detailed basic structure for his own maintenance programme as well as important type- or configuration-specific basic maintenance information. The MPD is especially useful for creating a maintenance programme for operators with no previous experience with a specific aircraft type. Even if the MPD provides adequate structure and detailing and is thus much more suitable for the development of a maintenance programme than the MRB Report, the information contained therein is not fully sufficient. The MPD is only a generally applicable maintenance guideline of the manufacturer. It provides a host of important basic information, but does not consider the individual aircraft’s configuration in total or insights into specific operating condition.

5.2.2.3 Deriving Maintenance Programmes The MRB Report or, respectively the MPD form is the generally recognised basic documentation for modern aircraft maintenance. Therefore, one or the other of these two documents should always be used for the starting data of the maintenance programme development.4 The MPD always offers the advantage that this already contains detailed maintenance information which can be used directly. A maintenance programme, however, must furthermore be tailored to the individual aircraft configuration and to the utilisation of the aircraft operator. In addition to the MPD, specific requirements of the operator and the fundamental (organisational) procedures of maintenance management must be considered. A maintenance programme must furthermore contain maintenance information on other parts and components installed on the aircraft, if these are not specified in the MRB Report or MPD. Last but not least, a maintenance programme must cover individual operating and maintenance experiences resulting from the specific operation and utilisation of the aircraft and/or fleet. To this intent, the given maintenance intervals and inspection level must be adapted, or other measures will have to be planned. A maintenance programme must be issued for each aircraft. In aircraft operation, where operators mostly do not just use only a single aircraft, but a fleet of aircraft of the same type, it is often the case that one and the same maintenance programme is used. The reason behind this is reduced data administration. At the same time, comparability of the operating and maintenance experience with the aircrafts within the same type is simplified, and thus the quality of reliability programmes is increased. Although large aircraft manufacturers (Airbus, Boeing, Bombardier, Embraer) always publish an MRB Report and a MPD, this is not necessarily valid for all manufacturers. Maintenance programmes can therefore also be based on specifically approved maintenance standards instead of generally approved MRB standards. The entire process of document formation described in this Sect. 5.2.2, from the MRB Report to the maintenance event, is visually presented in Fig. 5.3. 4

See AMC M.A.302 (c) (1).

5.2â&#x20AC;&#x192; Maintenance Programmes 119 &RQWHQW

0LQLPXP UHTXLUHPHQWV IRU PDLQWHQDQFH RI DQ $ & 7\SH

0DLQWHQDQFH 5HYLHZ %RDUG 05%

,QGXVWU\ 6WHHULQJ &RPPLWWHH ,6&

0DLQWHQDQFH ZRUNLQJ JURXSV

(GLWRU 0DQXIDFWXUHU $XWKRULWLHV LQ FRRSHUDWLRQ ZLWK $ & RSHUDWRUV SRVVLEO\ PDLQWHQDQFH RUJDQLVDWLRQV LPSRUWDQW VXSSOLHUV

0DLQWHQDQFH 5HYLHZ %RDUG 05% 5HSRUW

05% 5HSRUW WLPH UHTXLUHPHQWV UHVRXUFHV $FFHVVDELOLW\ OLIH OLPLWHG 3DUWV

03' 0DLQWHQDQFH PDQXDOV UHTXLUHPHQWV RI $ & RSHUDWRUV FRPSHWHQW DXWKRULW\

-RE &DUGV PDLQWHQDQFH LQVWUXFWLRQV EDVHG RQ 03' DQG 03

0DLQWHQDQFH 3ODQQLQJ 'DWD 'RFXPHQW 03'

0DLQWHQDQFH SURJUDP 03

0DLQWHQDQFH HYHQW H J & &KHFN

0DQXIDFWXUHU

$ & RSHUDWRUV ($6$ 3DUW 0

0DLQWHQDQFH 2UJDQLVDWLRQ ($6$ 3DUW

Fig.Â 5.3â&#x20AC;&#x192; The path from MRB Report to the maintenance event

5.2.3 Structure and Contents of Maintenance Programmes European Commission and EASA have defined some fundamental requirements with regard to the content of maintenance programmes, their data administration, their monitoring and change management. With regard to the scope, a maintenance programme must contain at least the following basic elements:5 â&#x20AC;¢ Details of all maintenance work and maintenance intervals to be implemented, including any special measures, â&#x20AC;¢ Consideration of all directives and notifications with regard to continuing airworthiness, irrespective of whether these have been issued by the aviation authority or the manufacturer (e.g., life-limited parts, airworthiness directives), â&#x20AC;¢ A reliability programme. Next to legal standards, the EASA also issued recommendations for the structure of maintenance programmes.6 These should begin with an introductory part containing the following information: 5

see IR Continuing Airworthiness EASA Part M â&#x20AC;&#x201C; M.A.302 (c) and (d)

see Appendix I to AMC M.A.302 and AMC M.B.301 (b)

120

5 Maintenance Management

• Aircraft data, such as registration, aircraft engine configuration as well as information on the APU, • Detailed data on the operator or owner of the aircraft as well as, where applicable, further information on the responsible CAMO, • Date of issue and edition of the maintenance programme, • Table of content and information on revision status as well as additions and amendments • Description of the procedures for the change of maintenance intervals, declarations of the operator and/or the responsible CAMO that –– the maintenance programme is regularly examined and updated whenever required and that the maintenance of the respective aircraft is carried out on basis of these guidelines –– the maintenance instructions and procedures correspond to the standards of the holder of the type-certificate (TC holder). Should they be different from these, this must be mentioned clearly in the explanation. The main part of a maintenance programme should then contain the listing of actual maintenance measures, including associated maintenance intervals. In addition, for each maintenance task a corresponding reference to the MPD or to the MRB report and, if applicable, to corresponding sections in the maintenance documentation must be listed. In addition to information on systems, components and engines, the maintenance programme should focus on the structural elements and there as well consider specific maintenance measures.7 Last but not least, a maintenance programme must provide information and references to the corresponding reliability programme (Reliability Management, Health or Condition Monitoring). The maintenance programme is a “living” document that must be reviewed regularly for adequacy and topicality by authorised personal. Reviewing the maintenance programme must be done at least once a year. Airworthiness Directives (ADs) must be included promptly – independent of any monitoring intervals.8 During regular periodic monitoring it is to be examined at least whether changes were made regarding the MRB Report or the MPD, or if other manufacturer notifications were published that require inclusion into the maintenance programme. In addition, a periodic evaluation of own operating and maintenance experiences (e.g., on basis of the reliability programme) is to be made. If adjustment requirements regarding frequency or level of maintenance are identified on the basis of individual utilisation (flight hours, take-offs and landings, operational area), appropriate changes must be made in amendments and revisions to the maintenance

7 8

See appendix I to AMC M.A.302 and AMC M.B.301 (b). See AMC M.A.302 (3)

5.2 Maintenance Programmes 121

Important Elements of a Maintenance Programme9 • Type and extent of pre-flight maintenance accomplished by maintenance staff • Maintenance tasks and periodicities for all parts of aircraft, engines/propellers, APU as well as systems • Maintenance, test and exchange intervals for parts • Special measures of structural maintenance (i. e., if necessary a specific structural maintenance programme issued by the TC holder) specifying, e.g., the following activities: –– Maintenance standards for structural parts as well as measures for additional structural inspections, particularly in case of special damage tolerances –– Measures for corrosion control and prevention –– Procedures for repair assessments –– Control measures for the prevention of general fatigue damage (e.g., fatique cracks) • As far as available, data on structure-related limits (take-offs/landings, flight hours, calendar limits) • References to documents that contain further information on execution of obligatory directives by authorities (e.g., life-limited parts or Airworthiness Directives) • Detailed information or references concerning reliability programmes used, condition monitoring activities or inspections carried out randomly in particular for determining the structural condition, or other statistic methods for monitoring sustainable continuing airworthiness programme. The adjustments of maintenance intervals must, however, be justified and explainable by the actual or future utilisation of the aircraft. If no proper forecast can be made for the utilization, additional calendar dates must be defined in the maintenance programme next to the intervals. All changes to the maintenance programme require approval by the relevant national aviation authority (i. e. in the UK the CAA, in France the DGAC, in Germany the LBA). When changing to an entirely new maintenance programme, or in case of significant modifications, it may be necessary in addition, to carry out a transfer check on the aircraft.10 Classification of Maintenance Activities Although most MRB Reports instruct exclusively task-oriented maintenance, there are in principle four types of maintenance activities in parallel:

Based on appendix I to AMC M.A.302 and AMC M.B.301 (b). See AMC M.A.302 (2)

122

• • • •

5 Maintenance Management

hard time maintenance on-condition maintenance condition monitoring task-oriented maintenance.

Hard time maintenance is always referred, if fixed maintenance intervals are defined. This means that the replacement or maintenance must be carried out in fixed intervals (hard time limits), e.g. before the defined calendar time, flight hours or flight cycles have elapsed.11 As this activity is to prevent any failure or wear, this makes hard time maintenance a preventive procedure. Examples for hard time maintenance items are generators, landing gear, various engine parts as well as life limited parts. On-condition maintenance is referred to maintenance measures depending on inspections or tests that must be carried out periodically. As soon as defined condition limits (e.g., scrap limits, serviceable limits) are exceeded, the defined maintenance measure or the replacement is to be carried out. This means that on-condition maintenance is also a preventive maintenance procedure. Especially with regard to engines, applying on-condition maintenance depends partially on the existence of condition monitoring. Typical procedures for condition monitoring are, e.g., visual inspections, Non-Destructive Testing (NDT) or borescope inspections. Examples of on-condition maintenance items are most mechanical parts. Condition monitoring represents a procedure of monitoring the condition of aircraft systems, components and engines without inspection. Any maintenance measures are derived from the results and analyses of monitoring activities. Key performance indicators serve as reference points, such as temperature evolutions, decreased performance or failures. Thus this procedure is not preventive but reactive, i. e., interventions are only called for after deviation from defined parameters. Condition monitoring is used in particular where no direct relationship can be detected between utilisation or lifetime and failure probability. Next to these three maintenance approaches, there also exists task-oriented maintenance. This can concern condition-dependant maintenance (on-condition maintenance or condition monitoring) or fixed intervals (hard time maintenance). Other than the procedures outlined before, task-oriented maintenance assigns to each aircraft part concretely named maintenance procedures and tasks (maintenance tasks) (e.g. lubrication, functional controls, replacement). This approach is considered as precise as surgery and, at the same time, more individual and flexible than the procedures specified above. Task-oriented maintenance is the most widely represented approach today, in particular because this is used in the context of MSG-3 methodology and is thus propagated with the MRB Report.

See Kinnison (2004), p. 19

5.2 Maintenance Programmes 123

5.2.4 Life Cycle Monitoring and Status Reporting The prescribed life or application limit of all aircraft parts must under no condition be exceeded.12 In order to fulfil this requirement, it is necessary to systematically monitor the lifecycle of certain parts. It is not enough to specify the elements of the maintenance programme before phasing an aircraft into operation and just hope that in everyday operation it will be implemented on time. It must be structurally ensured that in later operation all prescribed maintenance tasks are carried out within the required period. All prescribed maintenance tasks must be subject to permanent time and cycle tracking and assigned on time to concrete maintenance events. Their successful execution must be reported back. This is comparatively easy for some maintenance tasks, as their due date is connected to a fixed maintenance event (checks). For other maintenance tasks the allocation becomes less simple. Early planning is difficult in cases where the required maintenance instructions are provided only at short notice (e.g., Airworthiness Directives, manufacturer recommendations). The allocation of maintenance tasks may also be difficult in the case where maintenance is linked not with fixed events, but with flight hours or take-offs and landings or with calendar time intervals. With such limits in operation or lifetime determined by manufacturers or authorities, a complex time and cycle monitoring as well as structured maintenance planning and control is required. Life cycle monitoring is made in practice by IT tools in which all maintenance tasks of an aircraft are filed. As an example, content and structure of such a tool are roughly shown in Table 5.1. Although the systems are usually able to indicate due maintenance tasks for the near future, the responsible planning engineer must make concrete time schedules for their execution. This task allocation is extremely important. Because at this planning level intelligent solutions are required which not only meet requirement of aviation legislation but are also able to exploit economic potentials through optimal maintenance execution. For this purpose, the respective parts or tasks that are due for maintenance must be combined in a cost-optimised manner. It would not make sense, for example, to install an assembly with three sub-modules, two new ones with a lifetime of 6,000 flight hours and a third one, already used, with a remaining lifetime of only 1,500 flight hours. This does not conflict with aviation legislation, but from economic point of view the next module disassembly would already be necessary in 1,500 hours. The aim is therefore to have an intelligent module and parts assembly, with tailored work packages under special consideration of hardtime limits, in order to optimise maintenance in the long term under economic aspects. In addition to controlled delays in maintenance up to the permissible interval limits, another possibility for optimisation is carrying out maintenance measures early by making maximum use of scheduled ground time.

see IR Continuing Airworthiness, Part M – M.A.503

124

5 Maintenance Management

Table 5.1 Example of a basic structure for life cycle monitoring Source

Frequency/Threshold

Last performed

Next Due

MP Task 1

C5 Check

C6 Check

MP Task2

5000 FH

4358 FH

9358 FH

every 30 days

28.07.2017

27.08.2017

SB Task xy

15.06.2020

–

15.06.2020

SB Task xz

1500 FC

2270 FC

3770 FC

max. 1500 FH or 16 months after taking effect the AD, while the earlier date is binding

–

9507 FH resp. 10.10.2017 (Effective date: 10.06.2016, current flight hours: 8007 FH)

… MP Task 342 …

… AD abc

FH : Flight Hours FC : Flight Cycle (no. of take-offs/landings) MP: Maintenance Program SB : Service Letter (see chapt. 5.4.2) AD : Airworthiness Directive (see chapt. 5.4.1)

After putting together the work packages, these are scheduled in production as well as in flight operation and then executed according to the instructions. After carrying out the scheduled maintenance tasks, production reports back execution to engineering or the responsible planning department. After processing the data in the IT-tools of maintenance management, the next due dates are determined and entered in the system.

5.3

Reliability Management

5.3.1 Purpose and Objectives of Reliability Management Each aircraft operator must ensure that it has an analysis system in place for evaluating the reliability of its maintenance programmes. This is done with the help of reliability management. Such an instrument serves the primary goal of increasing the quality and effectiveness of the maintenance programme through continuous improvement. At the same time, it serves for early identification and minimisation of technical and maintenance-related risks to airworthiness. Reliability management furthermore monitors the reliability of those systems which, due to their architecture, do not fall under the control of the maintenance programme.

5.3 Reliability Management 125

To this intent, a reliability programme is developed and executed. It contains details of monitored objects from maintenance and flight operation and specifies the associated monitoring level. The key elements of a reliability programme are thus: • • • •

parts (e.g., systems, components, engines), parameters (e.g., consumption, temperatures, error messages, findings, failures), frequency (e.g., permanently, weekly, monthly, only after occurrences), evaluation requirements (extent of analysis, actions required, communication structures and reporting procedure).

Based on a programme framework, monitoring of condition and trend is developed and continuously performed. From the data obtained, engineering must derive the technical reliability and identify needs for adaptation in the maintenance programme or define other measures. This can lead to either reduction or expansion of maintenance activities. Next to modifications to the maintenance programme, further corrective measures must be devised and implemented in case of insufficient technical reliability. The effectiveness of such measures is to be supervised. Modern reliability programmes are, not only used for improving aviation safety. Their functionalities go beyond the requirements of aviation legislation and aim at economic optimisation of operating conditions. Here, focus is directed on minimisation of operating and maintenance costs. The necessary starting points of this are, e.g., minimisation of scope of maintenance, minimisation of downtimes, maximisation of lifetimes or minimisation of fuel and material consumption. Type and extent of a reliability programme are based on the size of the fleet. The spectrum reaches from simple component defect monitoring for small CAMO13 up to complex maintenance management programmes for large Part M organisations. Beyond the actual aircraft reliability programme, the latter also have further reliability management sub-systems, such as for: • • • •

parts (component reliability monitoring), engines (engine condition monitoring), auxiliary power units (APU health monitoring) or structural components (sampling programmes) for random sample-related condition monitoring.

Since CAMOs with small fleets (less than six airplanes of the same type) have only access to a limited data base, special conditions apply for them in the context of reliability management. They should focus particularly on access to sources providing a sufficient number of data. At the same time, engineering investigations and assessments have greater importance. For substantiating decisions, engineering should therefore try to secure the decisions either by using reliability data from the manufacturer or from other Part-M organisations (see appendix I to AMC M.A.302 and AMC M.B.301 (b), Sect. 6.2). To take advantage of economies of scale, small and medium-sized CAMOs can benefit from purchasing maintenance and/or reliability management services rather than handling these inhouse. 13

126

5 Maintenance Management

From an aviation legislation perspective, a reliability programme is not required in principle, however, not having one is rather unusual in view of the standards defined in Part M. Having a reliability management in place is namely always mandatory, if:14 • a maintenance programme is part of reliability-oriented maintenance (i. e., condition-monitored and not only based on hard-time or on-condition maintenance); • the maintenance programme does not define maintenance intervals for all important system components; • the maintenance programme is based on the so-called MSG-3 logic (in practice this means: if the maintenance programme is based on an MRB or MPD); • it is ordered in the MRB or MPD. European aviation legislation permits Part M organisations (CAMO) to subcontract some reliability management activities, e.g. to Part 145 organisations. This can be quite useful, since maintenance organisations collect many of the necessary data anyway. In addition, Part 145 organisations often have a more comprehensive technical maintenance know-how than aircraft operators or their respective CAMO. Such a subcontracting necessitates that maintenance organisations not only take care of data collection but also develop corrective measures. Implementing such recommendations must be, however, directed and approved via the responsible CAMO, since the final responsibility remains with them, even in the case of subcontracting.

5.3.2 Components of a Reliability Programme Reliability management starts with the determination of those components that should be monitored by the reliability programme. Once this is clear, parameters must be defined that can be monitored. This means that the information must be obtainable with an appropriate effort and must provide conclusions about the desired cause. Thus, to put it simply, there is little sense in monitoring number of passengers when the focus is on engines oil consumption. Besides defining individual monitoring objects and associated evaluation parameters, organisational structures and processes must be established to ensure the viability of reliability management in everyday operation. The necessary core elements comprise: 1. Data collection 2. Definition and identification of thresholds 3. Data evaluation and analysis 4. Data preparation 5. Development and monitoring of corrective measures

See AMC M.A.302 as well as AMC M.B.301 (d) 6.1.1.

5.3 Reliability Management 127

Data Collection Continuous data collection forms the basis for any activity in the context of reliability management. A realistic assessment of considered parameters requires a sufficient database. Attention must be paid to the fact that reliability programmes usually do not consider the entire fleet data of an airline. Instead, they compare the performance data of aircraft of the same type (e.g. all A320neo or all B777-200). The following data from flight operation and maintenance are typically used:15 • • • • • •

Maintenance reports (MAREPS), like deferred defects, findings, etc. Technical logs or pilot reports (TechLogs and/or PIREPS) Workshop records (e.g., findings, unjustified or unscheduled removals) Reports on special inspections and investigations (e.g., to ADs, SBs, EOs) Air safety reports and occurrence reporting Influence of technical disturbances or incidents in flight operation (operational irregularities, aircraft substitution, aborted take-off, air turn-back, aircraft on ground (AOG) • ETOPS data • Flight recorder data Definition and Identification of Thresholds An essential element of reliability monitoring is the detection of deviations from defined standards. For this purpose, it is necessary to define critical thresholds whose over- or undershoot define the deviation from the normal state and show the need for action. Once such limits are defined, IT-based systems generate automatic warning messages whenever they are exceeded, or they can at least be filtered out rapidly. Any limit-exceeding values are furthermore cumulatively entered into the reporting system. Such a warning system is meant to provide safety by defining clear and documented limits. For this reason, the operational procedures for determining or modifying thresholds must always be documented in the reliability programme. Such programmes must furthermore always contain a description of monitoring level and frequencies as well as the organisational responsibility. Data Evaluation and Analysis Based on the collected information, an assessment, analysis and interpretation of this reliability data must be performed by qualified engineering staff. Although the analysis is facilitated by automatic alerts on limit violations, it should not be limited to them. The analysis must be holistically oriented towards all data of the reliability programme, although emphasis should be placed on abnormalities.

See Appendix I to AMC M.A.302 and AMC M.B.301 (b), Sect. 6.5.4.2.

128

5 Maintenance Management

Type and extend of this data analysis depend on the size of the fleet and the characteristics of the reliability programme. At least the following sources of data must be included in the evaluation:16 • Findings of maintenance activities • Malfunction/failure behaviour of systems and devices during flight operation • Results of (structural) sampling programmes For data analysis (e.g., for consumption, pressures, temperatures and intervals) the following parameters, among others, play an important role: • Use of the aircraft (airline, charter, low-cost, VIP, respectively, high/low/seasonal utilization, operational area, ratio of flight cycle/hour, etc. • Fleet structure • Accuracy of collected data • Operating and maintenance procedures and standards Analyses should contain a description of the condition as well as an explanation of the cause, referring to effects and dangers of repetition. It should cover an indication of important risks and problems. Typical activities in the context of data evaluation are, e.g., investigations of defect accumulations, trend analyses and reliability prognoses as well as interpretations. The analysis process should not only focus on reliability monitoring itself, but should also keep in mind the effectiveness of the reliability programme. Data Preparation Following the collection and analysis of the data, it must be ensured that the results, including any warnings, are visualized in an appropriate manner. Therefore, graphic and table form are recommended. While data collection is carried out at the level of individual aircraft or objects (engines, parts, systems), periodic data preparation is performed on fleet level (i. e., aircraft of the same type) and thus cumulatively. Next to the actual situation, representations should also indicate trends, emphasize highlights and visualise important correlations. The reporting is addressed both to operational staff as well as to decision-makers. Selected data of the reliability monitoring is furthermore made available to the manufacturer at regular intervals for further evaluations and analyses. The structure of reliability reporting usually follows ATA chapters, unless the evaluation is presented in separate reliability programmes (e.g., engine, APU, or structure programme). In addition to periodically recurring reporting (usually monthly), reliability reports are also provided on a demand-oriented basis upon request. These contain information on specially selected issues or monitoring objects (aircraft, engines, components, etc.). Fig. 5.4 presents an example of data preparation at Lufthansa Technik AG. 16

See appendix I of AMC M.A.302 and AMC M.B.301 (b), Sect. 6.5.6.3

Fig. 5.4 Reliability management tool m/reliability of Lufthansa Technik AG for a sample fleet

5.3 Reliability Management 129

130

5 Maintenance Management

Development and Monitoring of Corrective Measures If the need for action has been identified as a result of exceedances and analyses, corrective measures must be developed and implemented or instructed. The leadership usually has the engineering here. Other technical departments (logistics, production, office of airworthiness, quality and training management), the flight operation or the manufacturer are consulted depending on the findings for decision-making or implementation. Corrective measures may include: • Modification of maintenance measures. This may cover an expansion or reduction of maintenance, i. e., an addition, modification or a cancellation of maintenance tasks • Adjustment of workflows, procedures or training contents • Execution of modifications • Special tests on the fleet or individual aircraft To ensure effectiveness of corrective measures, their implementation must be supervised. Where required, further follow-up activities and analyses should be carried out for appropriate sustainability.

5.4

Notifications by Authorities and Manufacturers

5.4.1 Airworthiness Directives (ADs) An Airworthiness Directive is an officially ordered measure by an aviation authority to restore adequate safety to an aircraft or component. ADs are addressed to owners and operators of aircraft. Their implementation is mandatory. The aviation authority decides for publishing an AD if:17 • an aircraft, an engine/propeller or a component display a deficiency which endangers airworthiness and • this condition could exists or arise also in other aircraft. ADs normally concern a few aircraft or engine types or specific devices or systems. When ADs are published, there are failure modes or deficiencies, that were not foreseeable during the type-certification process. These deficiencies are usually identified during flight operation or maintenance by the airlines, maintenance or CAMO. After reporting to the competent aviation authority and the responsible 21 J design organisation, these determine any potential hazard. Depending on hazard, two AD categories can be differentiated:

See IR Initial Airworthiness part 21-21A.3B (b)

5.4 Notifications by Authorities and Manufacturers 131

1. Emergency ADs of high urgency. Their fulfilment requires immediate action. Emergency ADs usually become effective two days after date of issue. 2. ADs of lesser urgency. Their fulfilment must be proven within a defined time period or a specific operational interval (e.g., flight hours flight cycles). If the deadline of an AD is not kept (i. e., measures are not implemented within the defined time period) and no special authorisation exists, the aircraft concerned is considered to be not airworthy and may not be used in flight operation until the measure has been implemented. In most cases, ADs based on technical deficiencies are initially published by the aviation authority of that country where the design approval holder resides. ADs based on technical issues are always made public world-wide and are made known within the aviation industry. All other aviation authorities must then decide whether it declares the AD as also applicable for its own area of responsibility. Next to technical deficiencies, Airworthiness Directives are occasionally based on changes in national or international aviation regulations. In Europe, Airworthiness Directives are issued by the EASA which publishes all ADs effective in its area of competence on its homepage via the so-called Airworthiness Directives Publishing Tool (see also Fig. 5.5).18 ADs of foreign authorities are usually directly adopted by the EASA and not re-issued as an own AD. The national authorities within the European Union (CAA, DGAC, LBA etc.) support the distribution. To ensure the correct and timely correction of deficiencies endangering safety, ADs contain at least the following information (see also Fig. 5.6)19: • • • • •

Description of the unsafe condition or deficiency Designation of the type of aircraft concerned Description of the measures to be accomplished Period setting for the execution of the mandatory measures Date of effectiveness of the AD

When issuing ADs, aviation authorities usually need the support of the TC or STC holder concerned. Only they can supply precise information with regard to criticality and can identify at the same time the aircrafts concerned. Usually only the design approval holder (TC and/or STC holder) is able to derive appropriate measures from the deficiency effective, e.g., in the form of inspections, modifications of repair work, and to formulate approved implementation instructions (Approved Maintenance Data). Therefore the TC or STC holder is obligated to support the authorities in publishing an AD. The design approval holder concerned must – in parallel with the publication of an AD by the authorities – make available all necessary information and instructions to all known operators or owners of the

18 19

http://ad.easa.europa.eu see IR Initial Airworthiness part 21 – 21A.3B (d)

Fig. 5.5 Airworthiness Directives Publishing Tool of the EASA

5.4â&#x20AC;&#x192; Notifications by Authorities and Manufacturers 133 ($6$

127,),&$7,21 2) $ 352326$/ 72 ,668( $1 $,5:257+,1(66 ',5(&7,9( 3$'1R $' 1R 5 'DWH -XQH 1RWH 7KLV $LUZRUWKLQHVV 'LUHFWLYH $' LV LVVXHG E\ ($6$ DFWLQJ LQ DFFRUGDQFH ZLWK 5HJXODWLRQ (& 1R RQ EHKDOI RI WKH (XURSHDQ &RPPXQLW\ LWV 0HPEHU 6WDWHV DQG RI WKH (XURSHDQ WKLUG FRXQWULHV WKDW SDUWLFLSDWH LQ WKH DFWLYLWLHV RI ($6$ XQGHU $UWLFOH RI WKDW 5HJXODWLRQ

7KLV $' LV LVVXHG LQ DFFRUGDQFH ZLWK (8 3DUW $ % ,Q DFFRUGDQFH ZLWK (8 $QQH[ , 3DUW 0 $ WKH FRQWLQXLQJ DLUZRUWKLQHVV RI DQ DLUFUDIW VKDOO EH HQVXUHG E\ DFFRPSOLVKLQJ DQ\ DSSOLFDEOH $'V &RQVHTXHQWO\ QR SHUVRQ PD\ RSHUDWH DQ DLUFUDIW WR ZKLFK DQ $' DSSOLHV H[FHSW LQ DFFRUGDQFH ZLWK WKH UHTXLUHPHQWV RI WKDW $' XQOHVV RWKHUZLVH VSHFLILHG E\ WKH $JHQF\ >(8 $QQH[ , 3DUW 0 $ @ RU DJUHHG ZLWK WKH $XWKRULW\ RI WKH 6WDWH RI 5HJLVWU\ >(& $UWLFOH H[HPSWLRQ@ &

7\SH $SSURYDO +ROGHUÂ¶V 1DPH $,5%86

$7$

7\SH 0RGHO GHVLJQDWLRQ V $ DHURSODQHV

:LQJV Â± :LQJ 5LE )HHW Â± 0RGLILFDWLRQ

$SSOLFDELOLW\

5HDVRQ

5HTXLUHG (IIHFWLYH 'DWH $FWLRQ V

DQG &RPSOLDQFH 7LPH V

$LUEXV $ $ DQG $ DHURSODQHV DOO PDQXIDFWXUHU VHULDO QXPEHUV H[FHSW DHURSODQHV RQ ZKLFK$LUEXV PRGLILFDWLRQ PRG DQG $LUEXV PRG KDYH EHHQ HPERGLHG LQ SURGXFWLRQ Â« )ROORZLQJ DQ XQVFKHGXOHG LQWHUQDO LQVSHFWLRQ RI DQ $ ZLQJ VRPH ULE IHHW ZHUH IRXQG ZLWK FUDFNV RULJLQDWLQJ IURP WKH ULE WR ZLQJ VNLQ SDQHO DWWDFKPHQW KROHVÂ« 3URPSWHG E\ WKLV ILQGLQJ LQVSHFWLRQV ZHUH FDUULHG RXW RQ D QXPEHU RI RWKHU DHURSODQHV WKH UHVXOWV RI ZKLFK FRQILUPHG WKH H[LVWHQFH RI WKHVH FUDFNV 'XULQJ RQH RI WKRVH LQVSHFWLRQV D QHZ IRUP RI ULE IRRW FUDFNLQJ RULJLQDWLQJ IURP WKH IRUZDUG DQG DIWHGJHV RI WKH YHUWLFDO ZHE RI WKH ULE IHHW ZDV LGHQWLILHG Â«

5HTXLUHG DV LQGLFDWHG XQOHVV DFFRPSOLVKHG SUHYLRXVO\ >7%' GD\V DIWHU )LQDO $' LVVXH GDWH@ )RU DHURSODQHV RQ ZKLFK $LUEXV PRG KDV QRW EHHQ HPERGLHG LQ SURGXFWLRQ ZLWKLQ WKH FRPSOLDQFH WLPHV DV LQGLFDWHG LQ 7DEOH RI WKLV $' DFFRPSOLVK DOO DFWLRQV VSHFLILHG LQ 7DEOH RI WKLV $' RQ WKH OHIW KDQG /+ DQG ULJKW KDQG 5+ ZLQJV Â« Â« $LUEXV 6% $ RULJLQDO LVVXH GDWHG 'HFHPEHU

5HI 3XEOLFDWLRQV

$LUEXV 6% $ RULJLQDO LVVXH GDWHG 'HFHPEHU Â« ,I UHTXHVWHG DQG DSSURSULDWHO\ VXEVWDQWLDWHG ($6$ FDQ DSSURYH $OWHUQDWLYH 0HWKRGV RI &RPSOLDQFH IRU WKLV $'

5HPDUNV

Â« (QTXLULHV UHJDUGLQJ WKLV $' VKRXOG EH UHIHUUHG WR WKH 6DIHW\ ,QIRUPDWLRQ 6HFWLRQ &HUWLILFDWLRQ 'LUHFWRUDWH ($6$ ( PDLO $'V#HDVD HXURSD HX Â«

Fig. 5.6â&#x20AC;&#x192; Airworthiness Directive (AD) of the EASA (abbreviated for demonstration purposes)

134

5â&#x20AC;&#x192; Maintenance Management

aircraft, engine, component or part, and upon request to any other persons.20 Thus, the TC or STC holder typically publishes an inspection or modification Service Letters or even ASB (Alert Service Bulletin). Through the publication of the AD these SB/ASB becomes mandatory for continuous airworthiness conditions. In justified cases, the EASA can authorise aircraft owners or operators to deviate from Airworthiness Directives. In such cases, an Alternative Method of Compliance (AMOC) must be provided. In this case, it must be proven that the deviation from the AD is capable of correcting the deficiency. Furthermore, the AMOC must be able to deliver not only a sufficient safety level, but one comparable to the ADs. Next to ADs, the EASA publishes Safety Information Bulletins (SIB). These publications are implementation recommendations from EASA that, while having a safety-related nature, it does not directly affect the airworthiness. SIBs are thus always published when the risk potential of a deficiency does not justify the publication of an AD.

5.4.2 Manufacturer Notifications Next to mandatory Airworthiness Directives issued by the aviation authorities, aircrafts/engine manufacturers (type-certificate holders), issue regularly non-obligatory Service Bulletins (SBs) for their customers. Implementing SBs is voluntary since their content normally has no or is only of low safety relevance.21 Service Bulletins do not necessarily represent a quality shortfall, so that the publication of SBs is not comparable with a recall. The manufacturer is therefore neither obligated to publish SBs, nor to carry out SBs for the customer or take over the costs for their implementation. Normally Service Bulletins contain technical measures (e.g., modifications/ inspections) to optimize flight operation or increase passenger comfort. With an SB, a manufacturer provides detailed information (e.g., with regard to workmanship, material and supplies) for their execution. Usually the associated documentation already has the character of Approved Maintenance Data. SBs are often based on new findings of the TC holders in the context of current design activities. However, SBs also find their origin in the exchange of experience between manufacturers on the one hand and operators or maintenance organisations on the other. The know-how gained in this way is brought together by manufacturers. They develop it further and make it known to their customers in the form of SBs. Since Service Bulletins are voluntary by nature, the aircraft operators or their maintenance organisations decide in each individual case about their implementation

see IR Initial Airworthiness part 21 â&#x20AC;&#x201C; 21A.3B (c) as well as 21A.61, 21A.107, 21A.120 resp. 21A.449 21 Occasionally an SB can become obligatory when the authorities (possibly at a later point in time) take it up and issue an Airworthiness Directive on basis of the Service Bulletin. 20

References 135

in the context of a SB analysis. Some manufacturers class their SBs22 to facilitate decision-making. The engineering of the responsible aeronautical organisation contrasts advantages, i. e., benefits, with disadvantages, i. e., costs, of a possible implementation. On this basis, engineering makes its recommendation for or against carrying out the SB measure. If the decision has been made in favour of the SB implementation, it must be planned and implemented individually by each airline or each maintenance organisation. This is normally done by transforming the SB documentation into engineering orders (EOs). For this, engineering usually uses the approved SB design data and terminates the execution of the SB. Some airlines (e.g. many LCCs) intentionally and regularly abstain from implementing Service Bulletin and largely concentrate on the fulfilment of ADs. (e.g. for cost reasons) In addition to Service Bulletins, some manufacturers regularly publish Service Letters (SL) or Service Information Letters (SIL). These are recommendations for optimisation of maintenance execution. These letters contain information on how to facilitate maintenance work, speed it up or reduce its expenditure. In addition, interchangeabilities (Part numbers) are published via such circulars. Furthermore, modifications to the Aircraft Maintenance Manual are announced that are not yet published in an official revision. Thus customers receive early information on upcoming modifications before these take on a binding character. Service (Information) Letters serve mainly for convenience and no obligation exists to pay attention to them.

References Airbus SAS: Maintenance Review Board Report A340. Rev. July 2010, Appendix 5, Blagnac 2010 European C ommission (EU): Commission Regulation laying down implementing rules for the airworthiness and environmental certification of aircraft and related products, parts and appliances, as well as for the certification of design and production organisations [Implementing Rule Initial Airworthiness]. No 748/2012 of 03/08/2012 European Commission: Commission Regulation (EC) on the continuing airworthiness of aircraft and aeronautical products, parts and appliances, and on the approval of organisations and personnel involved in these tasks [Implementing Rule Continuing Airworthiness]. No. 1321/2014, 2014 European Aviation Safety Agency – EASA: Acceptable Means of Compliance and Guidance Material to Commission Regulation (EC) to the Annexes to Regulation (EU) No 1321/2014 Issue 2 [Implementing Rule Continuing Airworthiness]. ED Decision 2015/029/R. AMC/GM European Aviation Safety Agency – EASA: Acceptable Means of Compliance and Guidance Material to Part 21. Annex I to ED Decision 2012/020/R. Issue 2. Oct. 2012. European Aviation Safety Agency – EASA: Work Instruction Control Sheet – Maintenance Review Board. Doc C.I011-01, 2009 Kinnison, H.A.: Aviation Maintenance Management. New York u.a., 2004

22 Classification options are, e.g., desirable, recommended, alert (urgently recommended), mandatory

Aviation Production Management

This chapter outlines basic shop floor requirements that are applicable to production and maintenance, primarily focusing on preparatory activities, i. e. on requirements that must be met from a legal and regulatory or economic perspective to be able to commence production activities in the first place. This in particular, comprises basics of production and maintenance planning presented in the first subsection, as well as the supply of job cards that are detailed in Sect. 6.2. An indispensable prerequisite of aviation production and maintenance is technical documentation management, which is outlined in Sect. 6.3. In an excursion, basic maintenance documents are discussed as well, followed by a presentation of legally determined production requirements (TOP conditions) in Sect. 6.4. These are partially similar to the subsequently presented requirements with regard to infrastructure, working environment and operating equipment. The last part of this chapter is dedicated to certificates and conformity statements. Their purpose is first detailed, before European certificates and statements are outlined.

6.1

Production and Maintenance Planning

The beginning of production or maintenance process is marked by structured preparation. This requires systematic acquisition of information on tasks to be executed as well as the anticipation of the necessary actions. Planning activities are successful, if the expected result or its over-fulfilment from a legal and economic perspective is achieved. Nature and scope of planning activities are not explicitly regulated by the EASA. However, they must take into account aeronautical organisation size and the complexity of respective production portfolio or the maintenance event.1 The planning 1 See IR Continuing Airworthiness EASA Part 145–145.A.47 (A) and IR Initial Airworthiness Part 21 – 21A. 145. 1 as well as EN 9100:2016 Sect. 8.1 and 8.5.1

137

138

6 Aviation Production Management

system in place can therefore, on the one hand, be characterised by simple structures, processes and tools for the production of simple parts or the execution of smaller maintenance events for one or a few aircraft type(s) only. On the other hand, complex planning systems, including individual IT tools, are e.g. required for production of different aircraft types or for parallel base maintenance activities. Regardless of organisation size and the extent of work, every approved aeronautical organisation must have a job card system in place2 that is used to structure the planned work package and to keep it transparent by disassembling it into individual work steps. In addition to that, the work package break down allows for a simpler determination of required resources, in particular, with regard to personnel requirements. Via a bottom-up planning approach, not only the extent, but also qualifications (by scope or authorisation) and deployment times of staff can be anticipated. Besides a definition of work steps, provision of job cards, determination of necessary workforce and material requirements necessary for a work execution need to be determined and made available as well. However, material planning is normally not part of production planning (department), but is rather assumed by purchasing and logistics, where material requirements are identified, schedules specified and on-time supply is ensured. Suppliers shall be approved by the quality management department after an initial review/audit and their performance shall be continuously monitored.

6.2

Job Cards

Any work to be accomplished during production or maintenance is to be detailed in a structured manner, i. e. must be subdivided into clear work steps. Only then, activities can be systematically implemented on operational level and traceability of the same can be ensured.3 To reach this objective, planned tasks and activities are outlined in the form of job cards (also referred to as task cards, job or shop orders, routers, route cards) and allocated to workflow. Fig. 6.1 presents a SWISS job card. By using job cards the entire work package is subdivided into individual work sections and steps. Job cards thus help production staff to organise scheduled/ pending work. At the same time, job cards represent direct work instructions on the lowest operational hierarchy level, as they normally contain a (rough) description and a summary of work steps to be accomplished. Detailed information on execution of activities are provided by the technical instructions (production or maintenance) that are usually attached or referenced on the job cards. While job cards determine what is to be accomplished and who is responsible, the attached production or maintenance standards outline how the work is to be executed.

2 3

See IR Continuing Airworthiness Part 145 – 145A.45 (e) Similar to AMC M.A.401(c)

6.2â&#x20AC;&#x192; Job Cards 139

Fig.Â 6.1â&#x20AC;&#x192; SWISS maintenance job card (from AMOS system)

Creation and Change of Job Cards Job cards are to be provided and changed in line with a pre-defined organisational procedure. Job cards may thus only be created or changed by qualified and approved staff appointed by the organisation. Job cards that were created within the organisation must have undergone an internal release process, before they can be used in production. Job cards can be made available in paper or digital format. When creating job cards, a subdivision of the entire work package, first into larger individual elements, then into work tasks and eventually into work steps is

140

6 Aviation Production Management

advisable. These are to be represented in a transparent, logical and clear manner. The structuring of the work outlined on the job card is to be based on the natural workflow: preparation, execution of work and completion, including inspections and tests. Job cards need to detail the qualification level of the individual tasks. This is not always clearly defined in daily operational life. However, all information must be correct, complete, clear and understandable. When creating or changing job cards the planning department must ensure that only approved production or maintenance specifications (Approved Data) are instructed.4 Individual tasks to be performed can hereby directly and completely be taken over from the original document (e.g. design specifications, approved maintenance manuals) to the job cards. In practice, an alternative approach is usually selected, only referencing the origin documentation. The technical instructions are then printed and attached to the job card as appendix. Additional processing of the approved production or maintenance data is hereby not required.5 A job card must list the revision status of the respective production or maintenance instructions. The status shown on the job cards, must comply with the actual revision status used on shop floor level. In practice, however, deficits are sometimes apparent in that regard. If job cards not are provided by the customer but bought, or supplied by the customer, these are to be adapted or supplemented to the organisations own operational needs. For example they need to come with an individual identification number or be allocated to subordinate order packages. In addition to that, a commercial recording structure is to be set up and the planned execution time or period as well as evaluation of time consumption must be ensured.6 In the context of the job card creation planning department must minimize the risk of mistakes and multiple errors during work execution. Complex work or such that requires the employment of various disciplines or shop floor processes, as well as work which is performed through shifts, is to be additionally divided into individual work steps.7 The planned duration of a work process should hereby ideally not exceed the duration of single shift. These and other rules aim at a clear structuring and should support transparency and traceability during work execution. This can e.g. be ensured by:

Production is an exception, if no final official certification, i. e. TC or STC (e.g., prototype or individual manufacturing) is available. In this case, however, design data must be used, which were not officially released, but at least by the responsible Part 21 J design organisation. 5 A reference to the associated section (task) of the maintenance programme or the associated inspection task code is to be created on maintenance job cards as far as applicable. See Fig. 6.1 “MRB no: 36-1A” 6 During maintenance, it should also be noted that maintenance instructions provided by the customer, must also be used. The maintenance organisation is therefore not entitled to use other than the data provided by the customer. See 145A.45 (e) and (f). 7 See AMC 145.A.45 (f). 4

6.2 Job Cards 141

• dividing the work package in sensible work steps, considering human factors (e.g. no work on critical items during night shifts, if this is avoidable), • notes on job cards when working on critical aircraft parts (critical tasks), e.g. warnings, cautions, special execution information or references to hazardous materials, • correctly scheduling double inspections. For instance during maintenance; when components of the same type are to be installed into more than one system of the same aircraft, it should be ensured that different individuals are assigned with execution and inspection of the work,8 • references to the applicable equipment, • shift-compliant distribution of working steps, since these points should not be shared among several individuals for reasons of traceability. In addition to that, a steering process must exist, which describes the way in which job cards are passed through the organisation – from the creation or receipt to the archiving or return to the customer. This process should also specify how errors in job cards are identified, communicated and corrected. Job Cards as Documentation Media The use of a job card systems is not only mandatory both in production and maintenance for reasons of structuring execution, but also for the purpose of creating traceability.9 Thus, in addition to their structuring function, job cards also serve as documentation media. In order for job cards to fulfil this function, the work carried out must be signed by the person responsible, who was assigned with the respective production or maintenance activity. Usually such confirmations are done with a personal stamp and/or signature or initials.10 In some organisations this process is supported by an electronic procedure. By confirming the accomplished work the employee documents that: • the work was accomplished according to the production or maintenance instructions and in compliance with the procedures of the organisational quality management system and • materials used were provided with a valid certificate of origin and • the assigned equipment is approved and • the employee was authorised to perform the work. The employee confirms compliance of the personal authorisation level with the assigned authorisation on the job card.

If only one person is available for assigning the task (e.g. on outstations), work planning must ensure that the job card requires a second inspection of this task by the same staff member after final work completion. See 145.A.65 (B) (3). 9 See R Continuing Airworthiness Part 145 – 145A.45 (e); IR Initial Airworthiness Part 21G – 21.139 (b) 10 When using initials, a reference list must be available, so initials can be assigned to the appropriate employee. 8

142

6.3

6 Aviation Production Management

Technical Document Management

Every aeronautical organisation must have a revision-proof document management system in place.11 This must be able to maintain the technical documents in their valid version need for production or maintenance. It must be ensured that the documentation is available to the corresponding departments whenever necessary. The minimum extent of documents to be made available in such form depends on the organisation’s scope of approval at the respective production or maintenance facility. In principle this includes the approved design data (i. e. any production documentation) and the approved maintenance data as well as the maintenance programme. In addition to that, the technical documentation includes technical instructions (e.g. process/work sequences) and applicable standards that are generally recognised as good workmanship production or maintenance standards by EASA or the industry (e.g. RTCA, SAE, ISO EN standards).12 Last but not least, internal specifications can also be assigned to technical documentation (e.g. technical processes instructions, procedures or operating specifications, such as chemical mixing ratios in galvanic or processing temperatures for adhesive or painting specifications). This broad variety of documents can only be managed transparently, if the organisation has a controlled, internal document management process that is also retroactively comprehensible. Therefore a document management must be established that essentially guarantees the following:13 • examination of documents before publication regarding suitability and appropriateness. To that extent technical documents are to be released prior to their publication • evaluation of documents regarding topicality and correctness. As required updating and corrections and, if necessary, renewed document release. • ensuring that the valid revision status of the technical documents is available at the workplaces and at the same time prevention of unintended use of outdated documents. • highlighting changed document parts including revision status. As far as production and maintenance organisations issue own technical documents (e.g. job cards, standards, hazardous material lists), these are to be examined with regard to suitability and adequacy prior to their publication and must be formally released by a respectively authorised person. External documents are to be examined

The requirement for controlling technical documentation in production stems from IR Initial Airworthiness Part 21 – 21A.165 (c) and (d) as well as from the IR Continuing Airworthiness Part 145–145.A.45 for maintenance. In the context of the EN 9100 series, document management is detailed in Sect. 7.5. 12 See IR Continuing Airworthiness EASA Part 145–145.A.45 (B) 4 as well as AMC 145.A.45 (b) 2–4. 13 Following EN 9100 series Sect. 7.5. 11

6.3 Technical Document Management 143

with regard to their applicability and validity.14 Documents of external origin must be recognizable as such or be marked accordingly. In some cases, a completeness check must be carried out as well; however, in practice recipients often dispense with that step due to the electronic distribution of documents. There must also be a procedure ensuring the topicality and correctness of documents. This is usually performed prior to the document’s publication. In addition to that, operational processes must be suited to identify incorrect, incomplete or misleading information in the technical documents and to ensure appropriate feedback to the publisher or author.15 Next to that, the organisation must ensure the availability of all production or maintenance data required for work execution at any time. This means that documents must be available in the dock, workshop or at the work place in direct proximity to work execution. Depending on the size of the organisation, production staff in particular is to be provided with an appropriate number of PCs, so that technical documents can also be reviewed in greater detail.16 Aeronautical organisations must resort to a documented procedure when it comes to distributing controlled documents. This must not only ensure one-off document provision, but at the same time, be capable of managing the distribution of updates (revisions). This explicitly includes control of invalid documents. The challenge hereby often lies in collecting old paper-based document revisions and respectively ensuring their destruction. Carelessness, comfort or a lack of awareness can rapidly lead to a work execution based on outdated technical documents. Many organisations limit their efforts to add a note to the footer that paper-based documents are not subject to revision and are to be destroyed after use. For traceability, controlled documents must be provided with a revision tracking, detailing the change’s page number, revision number, date of issue, history as a clear responsibility. In many cases, technical documents come with an overview that lists the respectively revised pages (List of Effective Pages – LEP) allowing for a better identification of changes. Often a special team or department is responsible for the technical documentation across the entire organisation. These teams are assigned with the following tasks:17 • receipt of the documentation from publisher (e.g. design organisation, NAA). In addition, this task includes the subscription of the relevant technical documentation, their allocation as well as examination and if necessary the importing into the own IT based documentation system. • distribution and publication of the first and changed versions among the respective departments. This also includes the exchange of the outdated technical If an operator or a customer provides maintenance data, they must either supply a written confirmation that all maintenance data are up to date or the operator/customer has to inform the maintenance organisation about the applicable revision status. Similar: IR Continuing Airworthiness EASA Part 145–145A.45 (g). 15 See AMC 145.A.45(c) (1) 16 See AMC M.A.401(c) 17 Following Kinnison (2004), S. 125 14

144

6â&#x20AC;&#x192; Aviation Production Management

documents. If a production organisation is at the same time the design approval holder (i.Â e. issuing design organisation), the department responsible for technical documentation is additionally tasked with managing own engineering, operating and maintenance documents and with ensuring external distribution to customers (operators, maintenance organisations). â&#x20AC;˘ maintenance and advancement of a complete, constantly updated documentation system with a traceable document flow. This includes not only the ongoing operational monitoring, but also the error correction or the complaint processing as well as the archiving of outdated documents. The publication and actualisation of internal quality management documentation is usually not managed by the department responsible for the technical documentation, but by the quality management, if necessary, under cooperation of the concerned departments. Excursion: Basic Maintenance Documentation A substantial part of maintenance documentation are manuals that detail the accomplishment of maintenance work on aircraft, parts and appliances as well as on engines and propellers. This documentation is published by the design organisation (TC holder) of the respective manufacturer, so that these manuals are published as approved maintenance data. In the following, the frequently used maintenance documentation is explained. (In production, there are no comparable standard manuals as production-specific design standards are used.) Aircraft Maintenance Manual (AMM) The AMM is the maintenance manual for an aircraft. The AMM contains descriptions of aircraft systems as well as associated work instructions on installation, removal, error identification and overhaul as well as standards with regard to functional tests and technical settings. In addition to that, it contains data on inspections and maintenance of aircraft structure. Partially, the AMM also provides standards regarding applicable tools and equipment. The AMM is adapted to the individual aircraft configuration. The structure of the AMM is based on ATA chapters. Some aircraft manufacturers publish two different types of AMM. Embraer, for instance, has an AMM for structure & systems as well as another one for parts and functional tests. Component Maintenance Manual (CMM) The CMM is the maintenance manual for parts/components and contains a description of functions, work instructions for disassembling, cleaning, inspections and repair as well as for assembly. In addition to that, it usually also comprises information on functional tests and release. As far as applicable, special tools are specified as well. For more complex parts the CMM is supplemented by its own Illustrated Parts Catalogue (IPC).

6.3â&#x20AC;&#x192; Technical Document Management 145

Engine Manual (EM) The EM is the maintenance manual for engines. Herein contained are among other information disassembly and assembly instructions, criteria for maintenance and overhaul, repair processes, test data as well as references to equipment and materials. Engine manuals are specifically designed for the appropriate engine types and shall be used for removed engines (off-wing). For maintenance work to be performed on-wing, the required tasks are listed in the AMM Structure Repair Manual (SRM) The SRM is the repair manual for the aircraft structure, detailing the procedures for standard repairs. This includes among other things general repair practices, materials information, inspection standards (corrosion, tears), repair requirements, damage criteria as well as damage tolerances. Damage that exceeds specific criteria or limits, however, requires integration of the manufacturer/the responsible design approval holder. In addition to the SRM, the AMM is often used to obtain information on certain issues to determine the total extent of damage and repair. A SRM is published for a specific aircraft types. Wiring Diagram Manual (WDM) The WDM outlines the structure and composition of all electrical and electronic systems. Next to diagrams it contains, among other things, information (Standard Practices) for fault location and identification, procedure for simple repairs, on handling wiring and lugs. It furthermore contains electrical and electronics equipment lists as well as measuring charts and lists. The latter facilitate necessary target/actual comparisions during the maintenance event (e.g. resistance tests). The WDM is not only issued on a type, but also on an aircraft serial number (MSN) level. Illustrated Parts Catalogue (IPC) The IPC specifies components of an aircraft. Such a catalogue, among other things, includes component illustration (e.g. exploded drawings) and a parts list with associated part numbers; sometimes even detailing interchangeability information. Detailed descriptions of subassies are usually only contained in the IPC, if the IPC publisher (the responsible design approval holder) is responsible for them too. Complex components sometimes also come with their own IPCs or these elements are integrated into the appropriate CMM/EM. Usually the structure of an IPCs is based on ATA chapters (aircraft) and on the modules for engines and propellers. IPCs are type-specific. Minimum Equipment List (MEL) The MEL determines which systems and equipment must be at least functionally available to ensure the aircraftâ&#x20AC;&#x2122;s airworthiness. The MEL furthermore contains operational restrictions regarding technical and temporal extent. The MEL is not an actual maintenance instruction, however, particularly in the context of line maintenance, it provides standards for the deferral of defects (see Sect.Â 8.7).

146

6â&#x20AC;&#x192; Aviation Production Management

Engineering Order (EO) Engineering Orders are implementation instructions for maintenance measures or modifications that are provided by the engineering of a Part 21Â J organisation. EOs hereby originate from ADs, SBs, repair designs, special inspections or modifications. The EO contains an exact description of the measure to be accomplished, the time required as well as data for the executing maintenance organisation. In addition to that, an EO always contains information regarding the concerned aircraft (e.g. registration) and/or the component (e.g. serial number). Before it is issued, an Engineering Order must have undergone an internal release (usually at least approved by the head of engineering).

6.4

TOP Requirements

The technical, organisational and personnel requirements that must be met by approved aeronautical organisations, in order to perform an aviation production or maintenance service, are referred to as TOP requirements. TOP requirements are hereby not only to be ensured and shown to the responsible aviation authority when applying or extending the scope of approval. The organisation must rather make sure prior to every order that the TOP requirements for the offered service can be met upon starting the order processing (self-assessment). Work may not be started, unless compliance with the TOP requirements is ensured. When complex production or maintenance services are performed (e.g. base maintenance or aircraft production) the organisation is also under obligation to actively supervise the compliance with TOP requirements during the execution phase. In addition to the operational self-assessment, the responsible aviation authority can examine compliance with TOP requirements during work execution or thereafter by performing an audit. In practice, the scope of the organisationâ&#x20AC;&#x2122;s TOP examination strongly depends on specific production or maintenance requirements. Project based single item production or large events usually require a more comprehensive and more careful examination of the TOP requirements than large-scale productions or standardised work on parts. The executive staff is responsible for ensuring compliance with the TOP requirements and is usually supported by quality management and executive staff of lower management levels (e.g. shift or project manager, production engineers) who are in charge of direct order handling. If work is assigned in the context of the extended work bench, the TOP requirements must to be fulfilled both by the organisation in the function of the client and by the subcontractor in line with the respective scope of work. TOP requirements must always be checked before each new production and maintenance event. The risk of non-compliance might be low when the organisation remains within the scope of its standard processes and orders; however it becomes virulent when these are deviated from. This is the case, for example, if the product/service portfolio is expanded, new customers or customers of previously unsupported nationality are acquired, new aircraft-engine combinations are to be

6.4â&#x20AC;&#x192; TOP Requirements 147

723 5HTXLUHPHQWV 7HFKQLFDO Â&#x2021; PDWHULDO DYDLODEOH WUDFHDEOH Â&#x2021; VXIILFLHQW VWRUDJH FRQGLWLRQV Â&#x2021; HTXLSPHQW WRROV DYDLODEOH SURSHUO\ DSSURYHG FDOLEUDWHG LI QHFHVVDU\ Â&#x2021; DFFHSWDEOH HQYLURQPHQWDO DQG ZRUNLQJ FRQGLWLRQV Â&#x2021; WHFKQLFDO GRFXPHQWDWLRQ DYDLODEOH LQ WKH UHTXLUHG UHYLVLRQ VWDWXV

2UJDQL]DWLRQDO Â&#x2021; DSSURSULDWH RUJDQLVDWLRQDO VWUXFWUXUH DQG SURFHVVHV Â&#x2021; HIIHFWLYH TXDOLW\ V\VWHP Â&#x2021; 2IILFLDO VFRSH RI DSSURYDOV Â&#x2021; 40 GRFXPHQWDWLRQ LQ FRPSOLDQFH ZLWK UHJXODWRU\ UHTXLUHPHQWV Â&#x2021; )RU * RUJDQLVDWLRQV DYDLODELOLW\ RI 32 '2 FRQWUDFW Â&#x2021; HIIHFWLYH SODQQLQJ DQG FRQWURO V\VWHPV

3HUVRQQHO Â&#x2021;

Â&#x2021; Â&#x2021;

VXIILFLHQWO\ TXDOLILHG SHUVRQQHO DFFRUGLQJ WR WKH UHTXLUHPHQWV RI WKH VFRSH RI DSSURYDO DQG WKH VSHFLILF RUGHU

VXIILFLHQW DXWKRULVHG SHUVRQQHO LQ PDLQWHQDQFH PLQ RZQ VWDII IRU %DVH 0DLQWHQDQFH XVH RI VXSSRUW SHUVRQQHO

Fig.Â 6.2â&#x20AC;&#x192; TOP requirements

maintained, or maintenance is to be carried out at a new location. In such cases it must thus be ensured that sufficiently qualified staff and the necessary equipment are available. Fig.Â 6.2 provides an overview of essential TOP requirements. A clear categorisation according to technical and organisational TOP requirements is not always easy due to fluent transitions. In practice, this is ultimately irrelevant, as long as the responsibilities of all the subjects are clarified and known to the designated persons.

6.4.1 Technical Requirements Before any work begins it must be examined and ensured that the planned work is performed in a controlled working environment. The organisation must hereby have access to suitable hangar, workshops and dock systems (e.g. platforms) that provide weather protection and ensure appropriate climatic and lighting conditions. Adequate work conditions, however, must not only be generally available, but concretely secured in the planned work execution period. It should also be verified, whether the organisation has the necessary tools and test equipment and if they are available at the time of work execution. Standard equipment must be permanently at the organisationâ&#x20AC;&#x2122;s disposal. The assigned tools must be suitable and approved as well as protected from unauthorised access. Measurement and test equipment is furthermore to be regularly calibrated. If non-Âstandard equipment is used, requirements results from the AMM and CMM, or from the design data of the Part 21J organisation. Next to tools and test equipment, large-scale tool (dock and crane installations, work platforms) are to be included in an examination as well. Before commencing work it must furthermore be ensured that the technical documentation is available in the respectively valid revision status. Essential technical documents are among others, the approved production data or maintenance manuals, the maintenance programme and job cards.

148

6â&#x20AC;&#x192; Aviation Production Management

In the area of materials, it must be ensured that the materials specified for carrying out the work can be procured and made available in a timely manner. Professional storage conditions are to be taken into account as well. In addition to controlled storage conditions (e.g. temperature, humidity, dust content, tidiness, ESD-protection), compliance with TOP requirements call for a separation of serviceable and unserviceable material, continuous control of materials with shelf life as well as the traceability of material flows. Material provided by the customers (customer issue material) must be stored separately.

6.4.2 Organisational Requirements The organisational TOP requirements are less aligned to an individual event than to event types. The completion of work generally requires an organisation structure in line with the scope and complexity of the pending event. Depending on the work to be accomplished, the structure can thus vary quite widely, from a simple organisation e.g. for the production of one part series only, all the way to a complex organisational structure with comprehensive planning system and agile production control during aircraft production. In addition to an appropriate organisational structure, an effective quality management system forms the second pillar of the organisational requirements. TOP examination comprises an appropriate quality documentation with operational procedures, descriptions of processes as well as regulations regarding competencies and authorisations. These documents must be valid and accessible to the staff. The high degree of abstraction of organisational requirements and the difficulty of directly allocating its responsibilities, often lead to TOP requirements not being explicitly monitored in the context of every order. This applies e.g. for the existence of an appropriate organization and process structure or job card system. The appropriateness of these high level TOP requirements is examined regularly via internal audits. The organisational TOP requirements equally include the examination of the official scope of approval. The quality management is hereby usually tasked with verifying that the required official approval is compliant with the respective scope of production or maintenance. In practice, special focus must hereby be put on production or maintenance of new part numbers and on supplementing rules of national aviation authorities outside of EASA area. While these authorities mostly recognise the EASA approvals for aeronautical organisations and the EASA release certificates, they partially require compliance with additional country-specific regulations (supplements). Especially in cases of broad product portfolios and a high number of authority approvals with different supplemental rules these are not always easily and sustainably complied with in practice. In the case of production orders, it must furthermore be ensured that cooperation with the responsible design organisation is contractually agreed upon via a PO/DO arrangement.

6.5 Infrastructure, Work Environment and Equipment 149

6.4.3 Personnel Requirements Ensuring TOP requirements includes the examination of staff availability. Sufficiently qualified personnel for handling the order must be both generally and specifically available in the work execution period. A prerequisite therefore is to ensure the necessary quality of personnel as well as the determination of the appropriate personnel quantity, i. e. the number of production or maintenance staff. With regard to the quality of the personnel, the necessary specialists must be defined for the individual authorisation and scope. The necessary quantity is determined by the individual organisational needs and is to be calculated so that their number should be such that airworthiness consideration may be applied and work can be carried out in all areas without undue pressure.”18 In base maintenance the certifying staff, as well as the support staff, must be available. EASA Part 145 requires a ratio for own maintenance staff of at least 50 %. For production, the third party ratio for releasing staff is not regulated by the EASA. Next to sufficient production personnel, the TOP assessment needs to clarify whether sufficiently qualified planning staff is available during order processing. This in particular comprises work and material planners as well as production and design engineers. Operational practice shows that compliance with the TOP requirements is not only relevant from a legal perspective, but also from a commercial point of view. Although staff resources are in principle available, a foresighted detailed planning of capacities is not always ensured. Sufficiently qualified staff is often available in principle, however, the necessary specialised trade-qualification (e.g. CAT B1 vs. B2) might not be. In the worst case, this can lead to the postponement of agreed delivery dates or the cancellation of orders that have already been contracted.

6.5

Infrastructure, Work Environment and Equipment

6.5.1 Infrastructure and Work Environment Production and maintenance organisations require facilities suitable for their work to carry out all ordered tasks.19 In addition to hangars, workshops and test sites,20 also storage facilities, offices and associated supply installations are required. Among the infrastructure are internal IT and communications technology and transport facilities as well.

GM 21A.145(a) See IR Continuing Airworthiness EASA Part 145–145.A.25 and 145.A.40 for maintenance as well as IR Certification 21A.126 and 21A.145 for production organisations. See furthermore EN 9100 series (2016) Sect. 7.1.3. 20 Facilities must, among other things, be designed in a way that maintenance staff has access to a separate area, where instructions and data can be studied and work execution can be certified, see AMC 145.A.25 (a). 18 19

150

6 Aviation Production Management

Facilities do, however, not only have to be available, it is to be ensured that the working environment is in “controlled condition”.21 That means that shop floors, workshops and office spaces are suited for the completion of the respective work and, particularly, comply with the aeronautical organisation’s specific requirements. Next to accessibility, cleanliness and orderliness this comprises: • appropriate temperature, humidity, ventilation, • all-season protection from weather influences (wind, rain, snow, ice, sand; this applies especially in maintenance) • dust and other pollution as low as possible, • lighting, • minimum, at least however tolerable background noise, • job-specific execution precautions, for example regarding environmental protection or the industrial safety (e.g. in non-destructive testing facilities), • fire-extinguishing systems, emergency exits and alarm instructions, etc., • first aid facilities, eye wash bottles. The wording above is partially taken from the Implementing Rules and is thus characterised by a non-specific description level.22 As a rule of thumb, therefore, working conditions must be such that they do not cause any deterioration in performance or excessive distraction of staff.23 In addition to requirements by aviation legislation, applicable occupational safety and health regulations must, of course, always be complied with.

6.5.2 Equipment In addition to the infrastructure, production and maintenance, organisations must have access to suitable and, if necessary, approved equipment and tools required for the approved extent of work.24 Such equipment must usually be at the organisation’s permanent disposal. Hereby, the organisation has to ensure the operational efficiency, accuracy and labelling of tools, equipment and testing systems and have operational procedures

See IR Continuing Airworthiness EASA Part 145–145.A.25 and GM to 21A.145 (a). See IR Continuing Airworthiness EASA Part 145–145.A.25 (c) and GM to 21A.145 (a) the legal standards of the EASA Part 145 are more comprehensive and thus more detailed as those of Part 21/G. Therefore the maintenance regulations including AMC are suited as guideline for production organisations on an operational description level. 23 Especially in line maintenance the working environment is sometimes not optimal. In case of unacceptable work conditions regarding weather, lighting, dust, other pollution, etc., the respective maintenance or inspection work is to be suspended, until acceptable conditions are guaranteed again., IR Continuing Airworthiness Part 145–145.A.25 (c) (6). 24 See IR Continuing Airworthiness Part 145–145.A.40 (c) for maintenance as well as GM to 21A.145 (a) and GM No. 2 to 21A.126 (a) (3) as well as EN 9100:2016 Sect. 8.5.1 and 8.5.1.1. 21 22

6.6 Release Certificates and Conformity Statements 151

defined. If calibrations are necessary, it has to be taken into account that it is to be accomplished in line with an officially recognised standard,25 considering appropriate calibration intervals. Next to that the completeness or the loss of tools and equipment must be checked in the course of regular controls. Practice shows that equipment is sometimes forgotten in the aircraft after conclusion of maintenance or production work. If the object remains there during flight, it could in the worst case put the aircraft’s airworthiness at risk. In production and maintenance foreign object damage (FOD) control processes are therefore to be specified. In addition to that, an approach is to be defined for cases where equipment was misplaced. Sometimes production or maintenance instructions (e.g. AMM, CMM) firmly define the use of special equipment or determine special requirements. Since these instructions are approved data, the production or maintenance organisation is then obliged to carry out the work involved with the correspondingly specified equipment. Administration and controlling of equipment in modern aeronautical organisations are no longer implemented via tool books, but by using personal smart cards and IT solutions. Similar to the procedure in a public library, the staff receive requested tools and equipment upon presentation of their ID card.The tool account of the employee is charged accordingly and relieved upon tool return. Using such electronic booking the traceability of equipment in the production or maintenance process is ensured at any time. In some organisations, IT systems even allow for staff to pass on their tools to other staff across shifts without including the tool depositary in the first place. In addition to tools and equipment that can only be obtained from the depositary, production personnel in many aeronautical organisations resort to personal equipment that remains in the employee’s permanent possession and sole responsibility. Such personal equipment mostly comprises standard tools required on a daily basis (e.g. screw driver, spanner, mirror, pliers). The provision of personal tools must also be systematically recorded and completeness is regularly to be checked in defined intervals (FOD control). For personalized tool boxes, shadowboards help to ensure, by a quick visual check, the completeness of the tools.

6.6

Release Certificates and Conformity Statements

6.6.1 Purpose and Procedure of Release and Conformity Certificates In the aviation industry, all work carried out is to be signed by the individual implementing it or a person directly responsible, for reasons of traceability and a clear personal assignment. The completion of assigned tasks is hereby confirmed on the job card or in the associated documentation. After work execution, aviation products either receive: See EN 9100 Sect. 7.1.5. Examinations and calibrations can usually also be based on the standards of the equipment manufacturer as specified in the respective manual .

152

6 Aviation Production Management

• an officially acknowledged release certificate26 • a conformity certificate • a confirmation of review as concluding measure. The release process is subdivided into two review steps. On the one hand, the hardware, i. e. the work carried out, is to be inspected; on the other hand, the documentation provided or created during the work process has to be examined. These activities immediately precede the issue of the release document. A release certificate must be issued before installation (component) or before flight (aircraft), but only after the full completion of all production and maintenance work.27 A release certificate contains essential information on the work carried out. That includes, among others, a clear, short description of the product released, the revision status of the documentation used, the date of issue, the signature of the releasing employee, or, if applicable, an electronic stamp. The certificate can either be issued on paper or as an electronically generated release document. A release document may only be issued by appropriately qualified and authorised releasing/certifying staff. In this respect, employees authorised to release are exempt from instructions of superiors regarding their release decision, but do not issue the release in their own name, but in the name of the officially approved organisation. On behalf of the approved Part 21G or Part 145 organisation, the certifying staff confirms that the production or maintenance work was properly accomplished. This means, that the released aircraft or part is in safe operational condition in line with the following prerequisites: • released by an officially approved this makes no sense in accordance with the organisation’s official scope of approval and • according to the approved operational procedures and • according to the valid approved maintenance data (for maintenance) or the approved production data (for production) and • completely according to the required scope of work. A certificate of release may not be issued, if facts are known that seriously affect operational safety.28 To that extent an aircraft may only be released for service, if it and all parts contained therein received a valid certificate. After issuing an aircraft release certificate it is normally directly handed over to the customer. This is in contrast to component releases, where the original certificate

26 Alternatively used are the following terms: Certificate of release, airworthiness approval tag, see IR Certification Part 21-21A.163 and IR Continuing Airworthiness Part 145–145.A.50 (d). 27 See IR Initial Airworthiness Part 21 – 21A.165 (c) (1) as well as IR Continuing Airworthiness Part 145 – 145.A.50 (a) and 145.A.75 (e) 28 See IR Continuing Airworthiness Part 145-145.A.50 in conn. with 145.A.70 and 145.A.45 for maintenance as well as IR Certification Part 21-21A.165 (c) (1) for production

6.6 Release Certificates and Conformity Statements 153

after completion of the production or maintenance work remains with the part, until this is installed in the aircraft. Afterwards the release document is added to the aircraft documentation and, after completion of all work, handed over to the aircraft operator. Independent of the kind of release certificate, the production or maintenance organisation must keep a copy of the certificate.

6.6.2 Types of Release Certificates The EASA release and conformity certificates in production and maintenance are: • conformity statement according to EASA form 52 that is issued as the official release document after production of an aircraft, • certificate of release to service (CRS), used to release the aircraft for flight operation after maintenance, • EASA Form 1 release certificate that is used both in the production and in the maintenance for the release of components or parts, • certificate of conformity (CoC) that is not an official EASA release document. With a CoC the issuer only confirms that the work was accomplished according to the assigned technical instructions. CoCs are issued e.g. by subcontractors and suppliers without official approvals according to Part 21G or Part 145. CoCs are also used to document conformity of (e.g. ISO) standard parts. • material certificates according to EN 10204 are test certificates. These are specific CoCs that do not only show the specifications taken into account during processing, but also confirm a certain type of acceptance test. These certificates are not widespread and in practice are mainly used for raw materials. Figure 6.3 outlines the substantial release and conformity certificates according to production and maintenance on the one hand as well as to parts and aircraft on the other. Conformity Statement after Aircraft Production After completion of the production and before service phase, the manufacturer confirms airworthiness and type design compliance by issuing a conformity statement (aircraft statement of conformity). This so-called EASA form 52 is shown in Fig. 6.4. Such a conformity statement is not a release for flight operation, because the release can only be given through the responsible authority by issuing a certificate of airworthiness.29 The need to present a statement of conformity applies not only to new but also used aircraft imported into the EU.

See IR Initial Airworthiness Part 21 – 21A.174 for details on application process for certificate of airworthiness

154

6â&#x20AC;&#x192; Aviation Production Management

&HUWLILFDWHV FRQIRUPLW\ VWDWHPHQWV

3URGXFWLRQ

0DLQWHQDQFH

&RPSRQHQWV $LUFUDIW

6WDWHPHQW RI FRQIRUPLW\ DFF ($6$ )RUP

$LUFUDIW ($6$ )RUP IRU SURGXFWLRQ RU PDLQWHQDQFH

&HUWLILFDWH RI 5HOHDVH WR 6HUYLFH &56

6WDQGDUW SDUWV UDZ PDWHULDOV DQG FRQVXPDEOHV &HUWLILFDWH RI &RQIRUPLW\ &RI&

Fig.Â 6.3â&#x20AC;&#x192; European release and conformity certificates

Release after Maintenance of an Aircraft The release document after aircraft maintenance in Part 145 is referred to as certificate of release to service (CRS).30 Even though EASA does not specify the layout, it must nevertheless be clear from this certificate who, when and what has been carried out or released. Additionally, the EASA demands the following reference on the release document: The certifying staff certifies in the name of the maintenance organisation â&#x20AC;&#x153;that the work specified except as otherwise specified was carried out in accordance with Part-145 and in respect to that work the aircraft/aircraft component is considered ready for release to service.â&#x20AC;?31 For line maintenance, the CRS is issued on the basis of the organisations Part 145 approval, regardless of the location of execution. This means that an aircraft of European airlines (e.g. released in Los Angeles or New York) is released under EASA and not under local FAA approval, if these airlines operate a line maintenance station there under their own maintenance organisationâ&#x20AC;&#x2122;s approval. Release of a Part after Production or Maintenance Only parts produced or maintained according approved data or a clearly specified standard may be installed into aircraft. In addition to that, parts must have an EASA

30 The fact that a production organisation can also maintain ex-factory aircraft, is not portrayed in detail here, see IR Continuing Airworthiness Part 145 â&#x20AC;&#x201C; 21A.163 (d). 31 AMC 145.A.50 (b).

6.6 Release Certificates and Conformity Statements 155

Fig. 6.4 Conformity statement after aircraft production (EASA form 52)

156

6 Aviation Production Management

Fig. 6.5 Release certificate EASA form 1 (for parts & components)

release certificate in maintenance. A comparable official EASA release document is preferred in production for each part or component, although it is not mandatory here.32 In the EASA area this component release document is referred to as EASA Form 1 (see also Fig. 6.5).33 This certificate can only be issued by official production or maintenance organisations and only within their scope of approval. Next to EASA Form 1 some foreign release certificates are recognised by EASA, ensuring that such parts are equally certified for installation into aircraft. Such acknowledgments are e.g. mutually available for the American release certificate FAA Form 8130-3 and the Canadian release certificate TCCA 24-0078. An EASA Form 1 is often substituted by a certificate of conformity (CoC), if the articles installed in an aircraft are standard parts34 as well as in the case of raw materials or consumables. These must be specified as such in the approved design or maintenance data and exactly correspond to the details specified therein.

First production is a special case (e.g. prototypes or individual manufacture), as the aircraft is produced or modified, without a TC or a STC. In this case the installed parts are in non-approved status (non-approved data). Accordingly a reference to the non-approved character of the parts must be made on the release certificate in the field 13. Only after issuing the TCs or STCs these parts then automatically change to an approved status. 33 Detailed EASA form 1 filling references can be found in Annex II to the Implementing Continuing Airworthiness – Part 145. 34 Standard components or parts must at all times comply with a generally accepted standard (e.g., ISO, EN) 32

References 157

Occasionally, suppliers alternatively submit a certificate according to EN 10204 instead of a CoC. In these cases, two types of certification are distinguished, each with two subcategories: • non-specific test certificates (type 2) confirm that products have been manufactured according to the customer specifications, but have not been specifically tested by the manufacturer for the respective order (i. e. unspecific). The test certificate of type 2.1 (declaration of compliance with the order) is characterised by the fact that the review is generally carried out by the manufacturer and no results are stated on the certificate. In the test certificate of type 2.2 (test report) test results are given, but also non-specific. These certificates are based only on batch-related tests carried out in the past. • specific inspection certificates (type 3) confirm that products have been manufactured according to the customer specifications and have been adequately verified by the manufacturer for the specific product. For inspection certificate of type 3.1, inspection was carried out by a manufacturer’s authorised inspectors independent of the production department. Type 3.2 tests are performed by a customer-specific or manufacturer-independent and officially recognised inspector.

Production

This chapter is dedicated to the production of aviation products as well as parts and appliances. The focus is not only on the production or assembly of the actual aircraft. The activities of suppliers are discussed for the components and module production as well. Fundamentals of the production of aeronautical products are first presented in Sect. 7.1. Subsequently, general quality requirements and the production-specific quality systems are illustrated in Sect. 7.2 where a couple of sections thereby detail individual elements of such systems. The last part of this subsection exclusively focuses on quality systems of suppliers. Thereafter, Sects. 7.3 and 7.4 describe the production of parts, components and modules on the one hand, as well as activities of an aircraft manufacturer on the other. Following, Sect. 7.5 is focused on the design and production of VIP aircraft. Chap. 7 concludes with a presentation of archiving requirements in production documentation.

7.1 Fundamentals of Production of Aviation Products, Parts and Appliances The production process is a transformation process in which products are manufactured by combining operational resources and purchased parts and services. Aviation products are generally characterised by high degree of complexity. Due to this fact, planning, controlling and monitoring of the production flow play a vital role in addition to physically combining the production factors. In industrial production, a distinction is made between three types of production, which are always executed in aviation industry on an order-related basis: • Single-unit production: Production of unique, individual products (unique items). Their production offers only limited possibilities of standardization. In addition to that, individual production always requires improvisation and © Springer-Verlag GmbH Germany, part of Springer Nature 2019 M. Hinsch, Industrial Aviation Management, https://doi.org/10.1007/978-3-662-54740-3_7

159

160

7 Production

inventor’s spirit, so that such work is predominantly performed by qualified and flexible staff. Examples of single-unit production are e.g., the production of experimental, so-called special mission or VIP aircraft. • Small-batch production: Production of a small quantity of homogenous products often within a previously specified period. Quantity is insufficient for typical production frequencies. Standardisation and simplification potentials can be applied, however, often not appropriately exploited. Examples of small-batch production are some corporate aircraft, as well as Boeing (B747-8) or Airbus models (A380, A318) that are less in demand. • Mass production: Parallel or directly sequential production of homogenous products with large numbers of items. The production is often subject to fixed clocking intervals. Substantial economies of scale (e.g. learning curves) as well as measures of production standardisation and simplification can be applied. By a strong division of labour and often repetitive work steps, the comprehensive use of less qualified personnel is possible. Examples of mass produced aircraft are Airbus A320 or Boeing B737. Production activities in aviation industry deviate insignificantly from other industrially shaped high-tech branches when it comes to fundamental production methods and production processes. Due to high quantities, mass production dominates here as well, partially subject to clocked flow production. To be able to produce technically safe and economically successful products under these conditions, simplified, collaborative and standardised process steps are applied in aircraft production, as far as possible. In addition, increasing modularity in product design and the use of assemblies generate the prerequisites allowing to continuously advanced simplification of production processes. Regarding quality management requirements, production of aviation products shares a significant level of similarities with other major industrial sectors (e.g. automotive). This is underlined by the recognisable similarity between ISO and IATF standards on the one hand and the EASA Part 21G and EN 9100 regulations on the other. This is neither opposed by the fact ISO and EN focus on the customer and product quality, while officially approved production organisations rather concentrate on safety, traceability and showing of compliance. Regarding the organisation of the complex supply chain of aircraft production, a clear concentration to core competencies is recognisable in aircraft production. While aircraft original equipment manufacturers (OEMs) focus on aircraft assembly itself as far as possible, they resort to specialised suppliers that produce the necessary systems, subsystems, modules, components and parts. The concept of comprehensively outsourcing even elementary value added elements is thus no specific characteristic of the automotive industry that is generally known to apply that principle. In aviation industry as well, this business concept has matured to such an extent that production output (vertical range of manufacture) of the OEM has been minimized and (product) manufacturing in the traditional sense usually only plays a minor role for them as they focus on assembly instead.

7.1â&#x20AC;&#x192; Fundamentals of Production of Aviation Products, Parts and Appliances 161

On the other hand, this means that the manufacturer must put a stronger focus on the management and control of its suppliers. Reducing vertical integration requires precisely structured planning and control of external production activities and comprehensive quality monitoring of the suppliers. FigureÂ 7.1 shows the generic structure of the supply chain from the lowest level supplier to the customer (aircraft owner). The more the supply chain approaches the aircraft manufacturer, the more value is removed from typical production processes and increasingly moves toward system integration and assembly. While lower level suppliers concentrate on the processing of raw materials, mid-level suppliers rather focus on the production of components. The end of the supply chain is marked by system and module suppliers, whose products are then eventually assembled by the manufacturer, forming an aircraft. The cross-company supply chain outlined here is only an exemplary and Âideal-typical model; after all there are often more than only the two stages as represented in Fig.Â 7.1. Moreover, such a clear supplier cascade that is so clear here is rarely to be found in everyday operations. The structure shown here, however, structurally corresponds to reality and will continue to approximate to practical application in future. While outsourcing itself and its general control have been the focus of attention in the past, optimisation in suppier management is becoming increasingly important. To that extent, aircraft manufacturers already push the implementation of ideal-typical, i.Â e. pyramid-like and transparently structured supply chains. $LUFUDIW RZQHU FXVWRPHU

6XSSOLHU QG WLHU

VW WLHU

QG WLHU QG WLHU QG WLHU

$LUFUDIW PDQXIDFWXUHU

VW WLHU

QG WLHU QG WLHU

VW WLHU

QG WLHU 3URGXFWLRQ RI FRPSRQHQWV

! 6\VWHP LQWHJUDWLRQ !

$VVHPEO\

)ORZ RI LQIRUPDWLRQ )ORZ RI PDWHULDO

3URGXFWV 3DUWV FRPSRQHQWV V\VWHPV PRGXOV DLUFUDIW

Fig.Â 7.1â&#x20AC;&#x192; Supply chain in production (exemplary structure)

162

7.2

7 Production

Quality Management Systems in Production

7.2.1 Fundamental Quality Requirements and Approval Requirements An officially approved production organisation must document that a quality system is introduced and maintained.1 Such a system is to ensure that production is performed under controlled conditions. The organisation must additionally always be able to produce aviation products in compliance with the relevant approved production data and to bring them on the market in operationally safe condition. This can only succeed if the organisation has transparent and comprehensible operating structures and procedures. An officially approved Part 21G quality system in production must at least comprise the following elements: 1. An overall independent quality assurance system to control processes, procedures, documents and resources, 2. an independent quality management function (staff position), 3. a comprehensible system for the acceptance of products (quality assurance), 4. supplier integration, in particular if suppliers have no own production approval. To obtain appropriate production quality levels, the approval requirements for Subpart G2 are to be fulfilled as followed: • The company must have a manual (Production Organisation Exposure – POE), where structure, processes and responsibilities of the organisation are defined and described (see Sect. 11.1.3). The POE also includes all operational procedures that must be available in documented form.3 The POE must always be up to date. It is to be seen as a contract between the aviation authority and the production organisation, which puts it under obligation to comply with all relevant requirements. • The organisation must have sufficiently numbered and qualified staff to appropriately perform the respective work and staff must be accordingly authorised (the respective staff also has to be aware of these authorisations!). Sufficient training, expertise and experience are demanded and explicitly required from individually designated certifying staff, the quality manager, senior management and the accountable manager. • Facilities and equipment must allow for proper work execution. The organisation must thus be able to demonstrate sufficient facilities, work environment and equipment.

IR Initial Airworthiness Part 21 – 21A.139 (a) see partially also TOP requirements 3 See IR Initial Airworthiness Part 21 – 21A.143 (a) (11) 1 2

7.2 Quality Management Systems in Production 163

• The organisation must ensure that aeronautical products are only placed on the market on the basis of approved production data. In particular, it must be ensured that this data is used in production correctly and on the basis of the valid revision. Topicality of data is often the cause of audit findings in practice. • A designated accountable manager, who was accepted by the aviation authority, must determine the operational quality principles, hereby considering regulatory requirements. This person furthermore has to ensure that the quality system is completely implemented and applied in practice.4 Under normal conditions, the head of quality management is responsible for the conceptual and operational implementation, while the accountable manager has overall responsibility. However, not only officially approved production organisations must meet all the approval requirements specified above, but also their suppliers that do not have an official approval according to Part 21G. This has to be ensured and supervised by the production organisation that contracts the assignment. Approval-Relevant Process Descriptions in Subpart G5 • Production processes • Identification and traceability • Control of nonconforming parts • Inspections and tests, including flight tests • Issuing airworthiness release documents • Incoming inspection • Carrying out work after production, but before delivery to maintain the aircraft’s safe operational condition • Record keeping/archiving • Issue, approval and revision of documents • Calibration of jigs & tools and test equipment • Coordination of airworthiness issues with design approval holder (or applicant) • Personnel competence and qualification • Handling, storage and packaging • Internal quality audits and resulting corrective actions • Work within the terms of approval performed at any location other than the approved facilities

See GM No. 1 to 21A.139 (a) see IR Initial Airworthiness Part 21 – 21A.139 (b) (1), to be applied depending on scope of approval

4 5

164

7â&#x20AC;&#x192;Production

7.2.2 Independent Control and Quality Assurance System Any organisation producing aeronautical products, be it as an official Part 21G organization or as its supplier, is required to maintain an internal quality system. This system must be able to monitor and control the performance of the entire production flow from a quality point of view. In such a system the organisational structure and processes must be described and the organisation must be able to demonstrate that production is performed and services are provided under controlled conditions.6 An integral part of the independent quality system is the organisationâ&#x20AC;&#x2122;s QM documentation, whose contents at the same time must be reflected in daily organisational structure and processes. The following documentation elements form the written basis of a production organisation, approved according to Part 21G (see Fig.Â 7.2): â&#x20AC;˘ The organisational manual (Production Organisation Exposition â&#x20AC;&#x201C; POE) that is a comprehensive self-manifestation of the organisation and contains general information on facilities, staff and organisational principles as well as on the quality system and the quality principles. â&#x20AC;˘ Production-relevant procedures and processes (organisational flows) must be established, described and associated responsibilities must be named.

0DLQ HOHPHQWV RI D 40 V\VWHP

2SHUDWLRQ PDQXDO LQVWUXFWLRQV IRUPV JXLGHOLQHV

3URFHVVHV ZRUNIORZ PDQDJHPHQW

2UJDQL]DWLRQ FKDUWV RUJDQL]DWLRQDO VWUXFWXUH

5HVSRQVLELOLWLHV DQG SHUPLVVLRQV

'2&80(17(' ($6,/< $&&(66,%/( )25 (03/2<((6 Fig.Â 7.2â&#x20AC;&#x192; Documentation elements of an independent quality system in production

See GM 21A.139 (b) (1)

7.2 Quality Management Systems in Production 165

• Description of company structures and responsibilities via organisational charts, allowing to fragment the organisation, thus allocating staff and responsibilities. • Regulations, instructions and forms or checklists that simplify, clarify individual activities or provide security to staff on the lowest operational level. They help the staff to implement the work correctly and completely. In addition to QM documentation, every production organisation or supplier must have a transparent production or project management. This contains, among other things, resource and production flow planning and control, as well as a procedure for the definition of work packages and checkpoints integrated therein. Moreover, the organisations must have defined their interfaces in the supply chain with the respective client (e.g. OEM) as well as with own subcontractors. Approved production organisations must furthermore ensure that their cooperation with the responsible design organisation is coordinated and specified in writing. Hereby, a PO/DO arrangement7 is required to ensure permanent availability of the latest approved production data. The accordingly authorised contact persons are specified in writing therein as well (Fig. 7.2). The quality system of the supplier, should be based on recognised quality management system, e.g. the EN 9100. This applies in particular for suppliers without own regulatory approval as they can usually demonstrate their qualification to clients by this certification, obtained from an accredited certification body (e.g. TÜV, SGS, DNV-GL, Dekra, AirCert). A standardised QM systems in the supply chain gives the OEM the opportunity to uniformly integrate them into its own QM system. In any case, it must be ensured that the structures do not only exist “on paper”, but also find an effective correspondence in everyday operations. The quality system must comprehensively show that production is performed under controlled conditions. In particular, operational reality and documented quality management system must always comply. The documentation must be easily accessible to the employees, enabling them to immediately close any knowledge gaps with regards to work execution at all times. For this reason the document control process must be clearly outlined.8 This comprises a description of how updates are circulated and how outdated documentation is withdrawn from the information cycle. Especially the latter aspect is often not sufficiently taken into account in practice. All system-related quality efforts ultimately serve the purpose of ensuring that manufactured products are in a condition of operational safety and comply with relevant production data. Within the quality system, product quality assurance is therefore of particular importance. The production organisation has to set up processes and procedures both inhouse and at his contractors, which ensure a comprehensible control system based on inspections, tests and acceptance standards. For

See AMC No. 2 to 21A.122 and Fig. 3.5, Sect. 3.1.3, other cooperation forms, provided in writing, is also permitted. 8 See GM No. 1 to 21A.139 (a) 7

166

7 Production

critical items, the inspection procedures must contain specific regulations. Since the quality system is one of the most important requirements for a Part 21G approval, its efficiency is reviewed annually in the context of audits by the responsible aviation authority.

7.2.3 Function of Independent Quality Assurance An important part of a QM system is an independent monitoring and quality assurance body. In practice, this monitoring function is assigned to the quality management representative (QMR) as a staff position of the accountable manager. The person in charge must continuously monitor and ensure appropriate performance of the quality system in terms of compliance, adequacy and effectiveness in accordance with Subpart G (and, where applicable, EN 9100)9 “Independent” means that there is no dependency on the operating units to be monitored in terms of instructions, reporting structures or resources.10 The audit and monitoring activities of this independent body should primarily focus on system-oriented evaluations, where compliance of the organisation’s structure and processes with respective requirements is controlled. Internal auditing is an important tool for this. Auditing includes a check for completeness and appropriateness of the QM documentation and on the other hand an evaluation of their implementation and effectiveness in everyday operations. If the requirements for an independent quality system cannot be adequately demonstrated, the QMR must order corrective actions and verify their effective implementation.11 In addition, the independent monitoring system must contain a feedback loop to the senior management and the accountable manager that reports system deficiencies and triggering appropriate corrective measures.12 The person in charge of quality management, being responsible for implementing and maintaining the quality system and its tools, must be designated by the organisation’s accountable manager and accepted by the respective aviation authority (after an interview).

7.2.4 Quality Systems of Suppliers Without Part 21G Approval As subject to aviation legislation, the officially approved manufacturer is always fully responsibility for all products manufactured under its approval. For this reason every 21G manufacturer has to integrate its suppliers into its own quality system and appropriately document their suppliers’ quality measures. To ensure this, suppliers

See IR Initial Airworthiness Part 21-21A.139 (2) See GM No. 1 to 21A.139 (b) (2) 11 For auditing see also Sect. 11.3 12 See IR Initial Airworthiness Part 21-21A.139 (2) 9

7.3 Part and Component Production as Well as System Integration 167

must also have implemented an appropriate QM system in place. Type and extent must be determined, accepted and monitored by the contracting Part 21G organisation at specified intervals. Since suppliers often do not have an own 21G approval, their quality integration in practice is often ensured via an EN 9100 certification. The supplier requirements of the manufacturer then presuppose the existence of such a QM system as a premise for cooperation. Due to high supplier complexity and diversity, this is – especially for large aircraft manufacturers – usually the only feasible option in practice for uniformly integrating all suppliers into their own quality system in a uniform and therefore appropriate and controllable manner. After all, a certified QM system according to EN 9100 does not necessarily ensure the fulfilment of the customer's quality requirements for the product to be delivered. Thus, in some cases, additional company-specific quality and supplier agreements or approvals defined by the manufacturer (e.g. ASR or Airbus GRAMS and GRESS) are partially used in practice. Every production organisation must supervise its suppliers on the basis of a systematic and documented procedure. It is therefore ensured that suppliers are able to sustainably provide products subject to agreed quality criteria via regular monitoring, evaluation and audits.13

7.3 Part and Component Production as Well as System Integration The constantly decreasing production depth among aircraft manufacturers leads to a scenario, where substantial elements of value creation are provided by suppliers especially in production stages prior to the actual aircraft assembly process. This therefore largely affects the parts and components production and also applies to system integration, i. e. assembling several simple components, then forming more complex aircraft components. With this division of labour across the supply chain, production is not much different to the automobile industry. Manufacturers determine their requirements based on stable cycle rates and own order processing data and accordingly inform their respective subcontractors. Due to the normally firmly defined client-contractor relationships, suppliers must then provide the requested quantities in time and compatible quality to the manufacturer. The starting point of all production activities is usually marked by a long-term production planning of the OEM, on the basis of which the suppliers can roughly estimate the future capacity demand (6–12 months) regarding dates and quantities (production programme planning). The planning of the series production hereby substantially differs from maintenance, as all production activities are known and fully plannable, with exception of production interruptions. The supplier as well can

See IR Initial Airworthiness Part 21-21A.139 (b) as well as EN 9100:2016 Sect. 9.1

168

7 Production

thus be contracted relatively precisely by the manufacturer on basis of the rough planning. The corresponding processing usually runs automatically via the Internet, allowing suppliers to access the production schedules in the OEM's IT system. In this way quantities and delivery dates are communicated to the parts and component manufacturers as well as system integrators. Based on the associated customer contracts, they are then able to derive their own production planning.

7.3.1 Production Planning and Control After receipt of the order, it is necessary to prepare the production and to ensure the smoothest possible flow of production through appropriate planning. The aim is an on-time and minimal cost order processing. This means that planning focuses on minimising process times and circulating stock on the one hand and on maximising utilisation of capacities on the other. This requires, in particular when it comes to complex products, requirement-oriented resource management. Starting point for any planning and control is the underlying data necessary for production that needs to be provided by the IT. These are primary: • master data of the own products as well as of purchased materials and parts. These data includes part numbers, costs, suppliers and subcontractors, stock piles, etc. • product structures/material requirements information that lists composition of the product to be produced. These are usually available as parts lists that detail the material and quantities needed for production (secondary material requirements). • data on capacity supply and demand. This data provides information on type and scope of available resources (staff, machine and equipment data, stocks, delivery times) as well as on the capacity demand (production programme, orders), • production documents that supply detailed information on the production of products. These documents ideally contain both data that detail the production procedure (plans, designs, process standards, qualification and equipment requirements, parts lists, test instructions, etc.), as well as information on the associated operational resource requirements (e.g. setup and operating times). Part of this data is transmitted by the OEM to its suppliers as part of the order process. Depending on the scope of the contract, suppliers themselves create another part. Data is hereby usually transferred directly to the production planning and control systems (Enterprise Resource System, ERP). On basis of the ERP system data production can be planned and gradually prepared. The resource demand corresponding to the setup and processing times as well as the material requirements are hereby compared to the resources offer (staff, equipment, stocks etc.).

7.3â&#x20AC;&#x192; Part and Component Production as Well as System Integration 169 â&#x2013;¶â&#x2013;¶

Production Planning and Control System (ERP Systems)â&#x20AC;&#x201A;A majority of the manufacturing companies in the supply chain use computer-aided planning and control systems when processing production orders. These IT tools that are usually referred to as Enterprise Resource Planning (ERP) systems, are capable of defining, releasing and monitoring the production process in terms of quantity and scheduling, taking into account production restrictions. Such systems hereby use previously stored master data and planning specifications. By integrating expected and existing customer orders, the ERP systems link programming on the one hand, as well as capacity planning and sequencing on the other. ERP systems therefore combine demand for operational resources with the available supply under planning aspects. In addition to that, ERP systems are able to provide immediate support in the event of unforeseen changes in order processing or production disruptions, by automatically determining alternative proposals.

Capacity requirements and availability are then iteratively merged, allowing for a scheduling of orders and process times. This is usually effected via lead time shifting. Net time and net resource requirements are assigned to those periods (weeks/ months) during which the parts are delivered or manufactured in order to complete the production orders at the scheduled time. At the same time, the level of detail of the planning increases with the beginning of production (see Fig.Â 7.3). Shortly before production eventually commences, production planning ends and the production control phase begins. Subject of production control is the detailed scheduling of production, resource organisation (production flow and machine allocation) and 3URGXFWLRQ SODQQLQJ

7DVNV RI WKH (53 6\VWHP

6HYHUDO PRQWKV D IHZ \HDUV

0HGLXP WHUP SURGXFWLRQ SODQQLQJ VHYHUDO PRQWKV VHYHUDO ZHHNV

'HWDLOHG SURGXFWLRQ SODQQLQJ DGRSWLRQ RI WKH ODWHVW DSSURYHG GDWD UHOHDVH IRU SURGXFWLRQ

0DQXIDFWXULQJ SURGXFWLRQ FRQWURO LQVSHFWLRQ

FRQWURO YLD (53 6\VWHP

3URGXFWLRQ 3ODQQLQJ 6DOHV RUGHUV 6DOHV IRUHFDVW

0DWHULDO UHTXLUHPHQWV SODQQLQJ SDUWV OLVWV LQYHQWRULHV ORW VL]HV RUGHU TXDQWLWLHV

&DSDFLW\ SODQQLQJ 2UGHU VFKHGXOLQJ 7KURXJKSXW VFKHGXOLQJ &DSDFLW\ OHYHOLQJ 2UGHU UHOHDVH

3URGXFWLRQ &RQWURO PDFKLQH DOORFDWLRQ RSHUDWLQJ GDWD DFTXLVLWLRQ RUGHU PRQLWRULQJ FDSDFLW\ PRQLWRULQJ

,QWHUQDO H[WHUQDO DFFHSWDQFH LQFOXGLQJ GHOLYHU\ WR WKH FXVWRPHU $LUFUDIW PDQXIDFWXUHU

Fig.Â 7.3â&#x20AC;&#x192; Production flow primarily from the perspective of production planning and control

170

7 Production

ensuring availability of capacities. From beginning of production, the production control is in charge of monitoring the order processing regarding quality, quantity and scheduling. The beginning of the production control process is marked by the order release, where the availability of personnel resources, of material and parts as well as of the documentation (TOP requirements, see Chap. 6.4) is checked to make sure that the released orders can be executed without restrictions or problems. Thus, in this phase planning checks for or provides the last valid production documents (plans, designs, work or assembly instructions, and quality specifications of the OEM) and test or machine programmes (e.g. CNC, automatic insertion and milling machines, 3D printers, etc.) according to the production plan. Such data is partly created by the organisation’s own engineering, but can also be provided directly by the aircraft manufacturer (e.g. as approved production data). Directly before the beginning of production, the production documents are then provided to the shift or team manager, where personnel-related tasks are as a rule allocated and production documents are issued to the executing production staff. With the start of order processing, continuous monitoring of production progress and capacities is required as unexpected production flow interruptions are part of daily practice and can significantly obstruct or stop the production process. Typical reasons for this are material defects, missing deliveries, further production data inquiries, machine malfunctions, lack of staff, missing documentation). Production control then makes appropriate corrections for the detailed planning, considering these production restrictions. Production planning and control must be able to react flexibly to such events at very short notice. ERP systems might hereby offer substantial support, in practice, however, often human improvisation is required. Depending on the production technique, i. e. the production procedures applied, there are often no special aviation features to be taken into account in part or component production, which would not be applied in other industries as well. A characteristic of aviation, however, is the broad variety of production and assembly procedures (see Fig. 7.4) and documentation requirements. The predominant production method hereby applied is almost exclusively the serial production, i. e. production on basis of constantly recurring production processes.14 In order to optimally exploit economies of scale and minimise average costs, the following measures can be taken and effects be used in series production processes: • substitution of manpower by machines, • dividing production into simple, easily repeatable work steps (division of work), • using standardized techniques and methods to simply work steps (e.g. templates or devices), • using standard parts, • simplified storage/reserve management,, • exploiting learning curve effects.

14 Assembly lines are, however, usually only used for larger numbers of items as well as for complex components and modules.

7.3â&#x20AC;&#x192; Part and Component Production as Well as System Integration 171

3URGXFWLRQ

PDQXIDFWXULQJ SURFHVVHV

FRPSRVLWH

V\QWKHWLF Â&#x2021; LQMHFWLRQ PROGLQJ Â&#x2021; EORZ PRXOGLQJ Â&#x2021; ' 3ULQWLQJ

DVVHPEO\ SURFHGXUHV

Â&#x2021; ILEHU FRPSRVLWHV Â&#x2021; OD\HU FRPSRVLWHV

Â&#x2021; Â&#x2021; Â&#x2021; Â&#x2021;

ULYHWLQJ JOXLQJ ZHOGLQJ VROGHULQJ

PHWDOO

Â&#x2021; FDVWLQJ WHFKQRORJ\ Â&#x2021; IRUPLQJ Â&#x2021; VHSHUDWLQJ FKLSSLQJ UHPRYDO

Â&#x2021; ' 3ULQWLQJ

Fig.Â 7.4â&#x20AC;&#x192; Production procedures in aircraft production â&#x2013;śâ&#x2013;ś

Special Processes15â&#x20AC;&#x201A; Special processes are those parts of service provision in which the manufacturing results cannot be easily verified directly. For this purpose, the manufactured product would have to be destroyed or economically unreasonable single testing would have to be carried out. Without special testing, problems during the value creation process could not be detected, before the product was delivered and commissioned. Typical examples of special processes are welding processes, heat treatments, electroplating, varnishing, bonding, sealing, and coating, baking and pressing. As an alternative to direct product verifications, the validation of the associated production processes is used. The product test is thus indirectly ensured via the evaluation of process parameters. Such impact variables, can e.g. be processing temperatures, humidity, mixing ratios or viscosities. Associated validation criteria for the process quality are hardness, tension or flexure tests, material samples, colour evaluations, etc. The organisation thus has to determine how the validation is to be carried out. In addition, process parameters (voltages, temperatures, etc.) as to determine how process conformity is regularly verified after the validation. Only if the test results of the process validation are within the specified tolerance, products can be released. In addition to that, it is necessary to verify whether supplementary requirements concerning personnel qualification or equipment is necessary in order to ensure proper implementation (for example welding qualification or furnaces with specific cooling properties). Special processes can be verified by NADCAP certification.

see EN 9100: 2016 Chap.Â 8.5.1.2

172

7 Production

7.3.2 Product Quality Assurance and Acceptance To ensure appropriate production quality and thus the airworthiness of products, quality checks are carried out both during the production process and at its completion before delivery to the OEM. Such inspections are implemented by the supplier, but also by the OEM as client. Among the most applied controls are: • self-inspection after completed work steps. By stamping processed job cards the production staff documents that the work was executed on the basis of and according to approved production data. • Personnel decoupling of production and inspection step. Here, two procedures are applied above all: –– quality controls by another, if necessary higher qualified production employee.16 Such secondary controls are instructed in job cards. –– Receiving inspections of parts or semi-finished products as part of the transfer to the next work step. • production-accompanying quality controls by the client (OEM). Depending on the complexity of the product, such controls take place on the basis of previously agreed checkpoints. In this way, the risk of delivery delays can be reduced, because an early identification of deficiencies is possible. In addition to that, intermediate inspections can be useful, as access to parts and components to be inspected is no longer possible with further production progress (zone closure). • internal final inspection after completion of production activities and testing. If the supplier does not deliver products with an EASA Form 1 due to missing official approval, a certificate of conformity (CoC) is issued to confirm that the products were produced in compliance with agreed production data. • final inspection and acceptance by the OEM as client. The acceptance can either take place at the supplier’s facilities17 or in the context of the incoming inspection with the OEM on basis of the product’s criticality, (up to 100 % product quality controls). In addition to these on-going quality controls, every delivered product is always submitted of a so-called First Article Inspection (FAI) at the beginning of new series, batch production or after modifications. The extent of such a FAI is determined by the OEM, the result is documents and approved by signature on part of the OEM.

Simple work, for example, (e.g. assembly of a plate) can be performed by a less qualified employee, while only the final examination is made by a trained technician or certifying staff. 17 This makes in particular sense for parts/products, whose (return) transport would be complicated in case of complaints. 16

7.3 Part and Component Production as Well as System Integration 173 ▶▶

First Article Inspection (FAI) First Article Inspection18 is the systematic

inspection and testing of a representative unit at the beginning of a new production. A First Article Inspection shall be used to demonstrate that the documents (production specifications), jigs and tools and production processes meet the requirements and are suitable for manufacturing the parts in such a way that the product can be produced in compliance with the respective requirements.19 Essential FAI components are individual inspections of: • product features such as 4F (form, fit, function, fatigue), dimensions (length, width, height, gap dimensions, etc.), weight, look and feel or risk of injury, • production documentation (completeness, precision, traceability, conformity) • compliance documentation (test specifications, test reports, certificates), • for suppliers, if applicable, additional compliance with the commercial terms and conditions (price, delivery date, completeness, shipping conditions). • customer-specific requirements (e.g., surfaces, colour, grain) In order not to forget any criteria, the verification is ideally carried out with the help of a standardized checklist. Each test criterion is individually checked and the result is documented completely with the information obtained in this checklist or a supplementary First Article Inspection Report (FAIR). This FAIR shall also list all manufacturing documents, test plans and test specifications as well as the underlying procedural instructions (including the revision status). The same applies to the most important tools and test equipment. An FAI has to be carried out again completely or partially, if design or documentation changes or product-relevant changes to the production process (process sequence or equipment) have been carried. Responsibility for the FAI lies usually with the engineering. Production, purchasing or quality management will participate as required.

Not least, the product quality is supervised indirectly by regular audits (in particular the quality management system) on part of the OEM.

Its elements and methods are outlined in the EN 9102 “First article inspection”. It is not permissible to use prototypes for the FAI! A qualification or a red label unit must be used instead.

18 19

174

7 Production

The intensive quality control of the aircraft manufacturer among its suppliers is based on the fact that after completion and delivery of the products, the OEM usually takes the overall responsibility for the quality of the product in terms of aviation legislation. Normally, only suppliers (Tier 1 and Tier 2) at the upper end of the supply chain have their own official approval as production organisation20 in addition to the OEM. Parts without EASA Form 1 (or other recognised official certificates (e.g. FAA Form 8130–3, TCCA Form 24–0078) are released via the conformity certificate of the aircraft (via the EASA form 52).

7.4

Aircraft Production

As the market for large aircraft is globally duo-political, and even monopolistic in Europe, an OEM-independent description of the production is not a simple venture. The production processes presented in the following therefore contains specific characteristics of Airbus production. Aircraft manufacturers generally differ in process organisation, production technique or processing sequence, however, they do so only punctually and are comparable when it comes to basics. Substantial production steps are roughly outlined in Fig. 7.5.

7.4.1 Assembly of Shells and Fuselage Segments The transition of the component or module production towards aircraft production should be defined as the time, when the fuselage takes its actual form. The starting point is thus the assembly of so-called shells to fuselage segments. Shells are horizontally and vertically limited individual segments of the aircraft’s outer shell. Shells are thus not produced across entire aircraft length, but divided into fuselage sections. Windows, doors and flaps have already been machined out of these. Also, the shells are stabilized horizontally and vertically at the time of assembly with connecting elements (so-called stringers and/or ribs). The shells are joined in a way resulting in the fuselage’s round form. In a first step, the shells and the framework of the later floor (floor grid) are integrated in an assembly bay and merged into a fuselage barrel. After their initial fitting, the shell parts are connected at the seams of the corresponding frames and stringers. As in the entire aircraft production process, the rivet technique hereby is predominantly applied for metal aircrafts. In contrast to most subsequent production steps, the use of rivet robots is possible when stabilising the shells. To ensure corrosion protection of shells, the riveting points in particular are covered with protective lacquer (i. e., they are puttied). The joined shell parts and the floor grid finally form the so-called fuselage barrel. All sections together then form the entire fuselage.

Delivery by suppliers is mostly effected with a CoC only and not with an EASA form 1.

7.4â&#x20AC;&#x192; Aircraft Production 175

0HUJLQJ WKH VKHOOV WR IXVHODJH EDUUHOV

&RPSRVLWLRQ RI WKH EDUUHOV WR WKH IXVHODJH

(TXLSPHQW DVVHPEO\

H J V\VWHPV GRRUV LQVXODWLRQ IORRU HWF

$VVHPEO\ RI WKH ZLQJV DQG FKDVVLV DV ZHOO DV VLGHV DQG KRUL]RQWDO VWDELOL]HUV

&RFNSLW HTXLSPHQW DQG EDVLF FKHFNV RQ V\VWHPV DQG IXVHODJH

)LQDO HTXLSPHQW DVVHPEO\ )$/

H J LQWHULRU JURXQG WHVW LQ WKH KDQJDU $VVHPEO\ RI WKH HQJLQHV

*URXQG WHVWV DQG HQJLQH UXQ XSÂ?V WHVW IOLJKWV

Fig.Â 7.5â&#x20AC;&#x192; Basic production steps in aircraft series production

With Airbus, aircraft fuselage barrels are assembled at different locations (among others in Hamburg, Toulouse, Saint Nazaire, Nordenham) and equipped with electric, pneumatic and hydraulic systems. The associated wirings and pipes are already being tested for functionality and tightness at this stage (pre-tested). The advantage is that the systems can be directly connected after the barrels were merged. Due to Airbusâ&#x20AC;&#x2122; highly decentralized production, significant logistical effort is necessary in this production phase. Depending on aircraft type, shells are transported from and to different locations on roads, water and by aircraft. Subsequently, the different fuselage barrels are integrated one by one in an assembly bay, to form the fuselage (see Fig.Â 7.6). After their integration, the segments are precisely connected. Particular attention is hereby put on the exact fit of individual fuselage segments, because it can lead to minimal, but for the

176

7 Production

Fig. 7.6 Fuselage integrated in dock. (© Airbus 2011)

assembly crucial, deviations on the real product despite precise and harmonious design specifications. As soon as the barrels are accurately fitted, they are riveted at the seams, just like with the shells. To prevent later inflight corrosion, all rivets, screws and nuts are also covered with a protective lacquer after they have been inserted. In addition to that, materials are conserved in places where plates meet, to prevent humidity from forming in the gaps later. This work on the finished fuselage is carried out manually. ▶▶

Handling Incompleted Work Steps (Open Items) It is not always possible to finish all the work of a production step in time. This can be caused by errors in work execution, delayed parts deliveries and missing or defective parts. In order to avoid delays in the overall production progress, the assembly bay change is, if possible, is not stopped or postponed until the work is completed in such cases. Compliance with the production schedule is thus higher prioritised than the complete processing of all production orders. To ensure a complete implementation of all planned work steps, open activities are recorded in an IT system by order, and their completion is monitored at a later date.

As soon as the fuselage is basically assembled, it is equipped with basic systems and parts in different assembly docks. Elements like doors, windows and flooring are installed and damming material embedded into the outer shell (see Fig. 7.7). This

7.4 Aircraft Production 177

Fig. 7.7 Equipment assembly. (© Airbus 2011)

is followed by final installation and assembly of equipment (electrical connection, ventilation, hydraulics, etc.). Customised specifics, e.g. in the area of electrical connections, are hereby taken into account at this early stage already. Excursion: From Dock to Flow Production An important process method today is aircraft manufacturing in fixed assembly bays or docks where fuselage parts and wings as well as instrumentation and equipment are assembled and installed. The fuselage hereby first transported and set up into the production dock. Since work in this site is usually completed after a few days already, the production site is disassembled and the fuselage transported to the next dock. Such production technique has the disadvantage that in setup time, work cannot be performed on the aircraft. In addition to that, frequent dock changes pose significant risks of damage in the context of crane movements as well as in the course of inhouse fuselage transportation, making particularly concentrated and thus time-consuming work a necessity. Therefore, there currently is a clear trend away from dock production towards flow production with rail-guided conveying systems. The weaknesses of dock production are clearly decreased in flow production, as the related facilities (e.g. machines, storage, and workstations) are strictly aligned to the production sequence, ensuring constant production progress and allowing interruption-free production. Work steps are hereby temporally predetermined by a cycle rate. Airbus partially uses the so-called movingline single aisle technique, where the fuselage moves at a speed of approximately 1 km/h and passes various work stations. At and in between these stations, clocked

178

7 Production

production steps are processed. Suppliers merged into the cycled flow production as far as possible too. The main advantages of flow technology in the context of aircraft production are: • controlled production management via a predetermined, transparent assembly progress, • shortening transportation cycles, reducing transport costs and reduction of space requirements, • reducing process times (esp. setup times and transportation periods) and possibility to expand production performance, • decreasing capital lockup, since fewer semi-finished products are in flow due to shorter process cycles.

7.4.2 Assembly of Wings and Tail Units After the fuselage has been fully assembled and equipped with basic elements, wings are mounted to the fuselage. In a first step wings are approximated to the aircraft in the assembly dock and aligned with the aircraft structure to examine the precise fit of wing and fuselage. This trial fitting not only needs to ensure proof that every wing fits individually, but also that both fit into the fuselage in a coordinated production manner. As soon as adjustments and connecting bores between aircraft fuselage and wing segment have been made and corrosion-protected (puttied), the wings are firmly connected to the fuselage by lockbolt rivets (high locks). Not only in the transition zone between wings and fuselage, but also in other places no longer be accessible later, so-called tear stoppers are attached to promptly stop possibly occurring tears, before they can put the structure’s integrity at risk. Following wing assembly, the aircraft receives its landing gears that is usually supplied as complete module to the aircraft manufacturer. The landing gear component is attached to the fuselage as finished system. To complete the fuselage, the finished horizontal and vertical tail as well as the tailpiece are to be fitted and fixed at the fuselage with eyelets, pins and rivets. Afterwards, the cockpit instruments are installed and their functions as well as the related components and systems are tested. In addition to that, further tests (e.g. cabin pressure, tank tightness, landing gear tests) are accomplished in the sequence of this production phase.

7.4.3 Final Assembly Line (FAL) The completion of the actual production and assembly process is also referred to as Final Assembly Line (FAL). At this stage, the so-called monuments such as toilets and galleys and interior cabin elements, e.g. passenger lighting, trays, covers, carpets and seats are gradually installed. The aircraft is also equipped with emergency systems (emergency escape slides, life jackets, oxygen masks) and inflight entertainment. Fig. 7.8 shows the FAL of the Airbus A320 family in Hamburg.

7.4 Aircraft Production 179

Fig. 7.8 FAL with the Airbus A320-Familie. (© Airbus 2011) ▶▶

Production Progress Monitoring When manufacturing an aircraft, many airlines have experts on-site carry out inspections in order to monitor the production progress and the quality, despite the manufacturer's comprehensive quality assurance measures. These are conducted to identify deficiencies (at an early stage) that cannot be detected later due to lacking access or that could lead to delays in the event of later correction. Production surveillance is typically tasked with tracking damages, foreign objects (FOD) and impurities (for example, drilling chips), as well as finding design deviations and improper or inadequate installations. The customer’s auditors must also identify deviations or deficiencies that might lead to problems after years only, but would then increase maintenance costs. The inspections comprises monitoring of good workmanship aspects as well as compliance with production data and AMM requirements. The monitoring activities are based on a production monitoring plan with intermediate checkpoints that is coordinated between customer and manufacturer. Such a plan, for example, provided for the installation of the first Lufthansa A380 comprised about 150 fixed individual inspections performed by Lufthansa Technik inspectors.

During or after the aircraft interior has been completed, comprehensive ground tests and checks on the entire aircraft are carried out. These activities are often accompanied by the customer and serve acceptance purposes, both in the context of cockpit tests and of the final cabin control.

180

7 Production

To ensure that defects are rectified immediately, suppliers usually have to provide on-site product support at the final assembly line. Activities hereby to be covered includes, e.g.: • Processing of identified defects and issues on the open item list, • Installation support, • Execution of trade- or zonal specific corrections/modifications on behalf the OEM. In many cases, suppliers do not perform this task themselves, but have it done through service partners. Also allocated to the FAL is the mounting of the engines to pylons at the wings. Engines are not fixed with rivets (contrary to the structure), but with bolds, allowing easy disassembly and engine change during operation. After mounting the engines at the pylons their final system integration to the aircraft is to be ensured (fuel supply, electricity, air, etc.). After completion of the final interior and assembly activities and the associated partial customer acceptances, the aircraft leaves the final assembly line.

7.4.4 Ground and Flight Testing After the activities of the final assembly line the following working phases are directed to a slow aimed approach to the flights. During this phase ground tests and subsequently flight tests have to be carried out. These focus on the:21 • • • • •

control characteristics, flight performance (with normal aircraft instrumentation), system-integrated functioning of all components and systems of the aircraft, compliance with the aircraft’s operational characteristics on ground, any special features of the aircraft.

These final tests of the manufacturer are used to determine that the characteristics of the aircraft comply with the design requirements. After the final assembly line stage has been completed, initial ground tests are performed including running engines. Not only the engines themselves, but also their interaction with aircraft systems and other components are checked. Supply functions of the engines are tested and taxi tests are performed (low-speed taxiing, high-speed taxiing, rejected take-off). The recorded data are evaluated after conclusion of these ground tests. Visual inspections of engines (e.g. to identify impurities in fuel filters through undesired remainders) and brakes are carried out as well. Only if all ground tests have been successfully completed, test flights (functional check flights) are carried out.

Similar to IR Initial Airworthiness Part 21-21A.127 (b).

7.5 VIP Aircraft Completion 181

The aircraft enters an approx. 2–3-week test flight phase, where systems that cannot be sufficiently stressed on ground, are evaluated. Subjects of investigation are in particular flight characteristics and aircraft performance (including all cabin systems). This also comprises the behaviour under non-standard or abnormal flight manoeuvres or events, e.g.: • • • •

simulation of engine failures, pitch/bank tests (pitch/bank limits), exceeding the permissible maximum speed (over-speed) stall behaviour at minimum speed (stall protection).

7.4.5 Aircraft Handover Once the test flights have been successfully completed, the aircraft is prepared for handover, a multi-level procedure: In a first step, experts of the customer (auditors) test the aircraft on basis of a customer acceptance manual (CAM) for a period of approximately 4–5 days. These audits are completed by a customer test flight. Once all nonconformities resulting from this have been rectified, the technical acceptance of the aircraft (Technical Acceptance – TAC) takes place, followed by the formal legal transfer of the aircraft from manufacturer to customer (transfer of title – TOT). Prior to that, however, the (remaining) payment of the purchasing price is credited to the account of the manufacturer by express transfer. The customer then receives the aircraft documentation, the so-called AIR (Aircraft Inspection Report). This contains among other things: • • • • •

airworthiness certificate/Statement of Conformity (EASA form 52) report on AD and Service Bulletin status weight and balance report list of all parts (part incl. serial numbers) list all production deviations (concession report)

With the transfer to the customer and the first take-off after transfer of ownership, the aircraft is no longer subject to the regulations applicable to a production organisation according to EASA Part 21G. From then the aircraft condition is regulated via EASA Part M (maintenance management) and EASA Part 145 (Maintenance).

7.5

VIP Aircraft Completion

7.5.1 Market Structure Next to the production of aircraft for passenger airlines, a small market for VIP aircraft has developed since the mid/end 1980’s.

182

7 Production

While smaller VIP aircraft of the Learjet, Gulfstream, Citation and Falcon series are usually fully equipped by the manufacturer already, the VIP completion at Boeing and Airbus aircraft is performed via independent completion centers. These organisations are highly specialised even within the aeronautical industry and within their niche can look back on substantial learning curve effects. Since custom-built aircraft have at least partial prototype character, improvisation and high testing expenditure are typical characteristics in daily operation of the VIP business, despite decades of experience. Such projects can only succeed with highly-qualified staff – not only in engineering, but also in project management and not least in interior construction, manufacturing, assembly and installation. Aviation legislation hereby requires conformity of comprehensive requirements, as VIP completion activities are subject to almost all organisational EASA approvals: • like all aviation design activities, also VIP cabin design is subject to the standards of EASA Part 21 J (design). • the cabin interior mostly comprises new parts, so that components and furniture are to be manufactured under EASA Part 21G (production). • if VIP aircraft are already formally delivered by the manufacturer to the customer or the completion center, assembly and installation of the cabin is legally effected in the context of EASA Part 145 (maintenance). • as VIP aircraft already have official registration upon modification layover, not least the requirements of EASA Part M are to be taken into account as well. The high design and production complexity is a substantial reason that completion centers are so far exclusively found in highly industrialised Western European and North American countries. In the German-speaking countries above all Lufthansa Technik in Hamburg has developed a reputation when it comes to the design of VIP aircraft. The highest concentration of completion centers in Europe meanwhile can be found at the EuroAirport Basel-Mulhouse-Freiburg, where Jet Aviation and Amac Aerospace work on VIP aircraft of different categories (including wide bodies). The service spectrum of completion centers hereby covers • the completion of brand new aircraft, • the modification or refurbishment of VIP cabins as well as • conversion of used airliners into VIP jets. In the VIP aircraft completion market, the conversion of new B737 and A319 narrow bodies22 into business aircraft forms an essential segment. These aircraft are then called Boeing Business Jets (BBJ) and/or Airbus Corporate Jets (ACJ). Both types of aircraft can be fully customized. Increasingly, however, also VIP and

(Short and medium range) Aircraft with one aisle only (single-aisle aircraft), e.g. of the Airbus A320 family, Boeing B737, Embraer or Bombardier aircraft are referred to as narrow bodies.

7.5 VIP Aircraft Completion 183

corporate aircraft of this category have been manufactured in small series. Boeing and Airbus offer these aircraft in various variants with a standardised VIP configuration and have them adapted by external completion center on modular system basis. The market for these corporate jets has been characterized by solid demand for years. With a completion of dozen aircraft per year world-wide, demand at times even exceeds capacities. The clientele for these aircraft includes international corporations, leasing companies, governments, oligarchs, ruling Arab families as well as a few selected private individuals. In addition to the B737 and A319 VIP aircraft, there is also a very small market for interior wide body23 design and manufacturing. These large-scale VIP aircraft are completely custom-built versions, in which all technically feasible design wishes, amenities and equipment are implemented. To that extent it is not surprising that product innovations in commercial airliners sometimes originate from the design of VIP cabins. The wide-body market is relatively small with three to ten completions world-wide per year, in particular since the circle of buyers is essentially limited to the few ruling Middle Eastern dynasties (Fig. 7.9).

Fig. 7.9 Boeing Business Jet, © Lufthansa Technik 2012

(Long range) aircraft with two aisles such as Airbus A330, A340, A350, A380 as well as Boeing B767, B777, B787, B747 are referred to as wide bodies. On the VIP market, in particular B747 and A330 are highly popular.

184

7â&#x20AC;&#x192;Production

7.5.2 Design, Manufacturing and Installation of a VIP Cabin 7.5.2.1 Specification and Design The VIP cabin upgrade process begins with a customer request. The aircraft and engine configuration has usually already been determined at this point. Thus, the individualisation of a series-produced aircraft into an individual VIP jet is the prime focus from the beginning. As part of the specification, a rough concept for cabin or room layout and interior design must first be designed together with the customer representative. Once this layout is generally determined, the definition of colours and furniture surfaces, coverings, carpets, etc. follows. The customer's requests regarding lighting, satellite communication or cabin entertainment are among other features additionally coordinated. In parallel to the interior design, technical functionalities outside the cabin that will equally be a part of the modification are to be specified as well. This typically comprises the installation of additional tanks for long-range flights, the installation of missile defence system or an upgrade of the cockpit equipment. All customer requests and resulting aircraft system and structure adaptation requirements (electrical connections, water supply, climate, etc.) are to be determined during the quotation process. Since the VIP customer and the completion center under normal conditions are not yet contractually interrelated at this time, it is important to already at this point assess whether customer desires can be implemented in compliance with aviation legislation.24 By clarifying such issues before signing the contract, later renegotiation and disappointments on part of the customer can be prevented in time. Before completing the specification, weight & balance calculations should also be performed to determine effects of the planned aircraft modification on flight characteristics, balance and range. In order to be able to derive a (business) offer from the (technical) specification, the associated man hours, material requirements and supplier services are to be determined and costs to be derived in parallel n to all other activities. The complexity of a cabin layout makes it necessary to set up the quotation phase as a structured project with clearly defined tasks, deadlines and responsibilities. When the contract is signed, the project volume grows from a few hundred or a thousand man-hours to several 10,000Â working hours. At least from this point, economical order processing is doomed to fail without an experienced project management team and due to the high project volumes can put the entire organisation at risk. Following the specification of the VIP aircraft and after signing the contract, many completion centers will first carry out a laser-assisted measurement of the empty cabin (electronic fit check) of the future VIP aircraft. This way, the exact cabin dimensions are determined and smallest deviations from design documents identified. This is necessary because in series production of aircraft deviations of a A bath tub, for instance, cannot be certified, as water could impair the aircraft and cause system damage in case of turbulences. For the customer, visible and noticeable approval restrictions often also result from certification specifications with regard to fire protection and passenger evacuation. 24

7.5 VIP Aircraft Completion 185

few centimetres from the design documents can occur. Although such differences do not have a decisive influence on airworthiness and are non-problematic in the configuration of ordinary passenger aircraft, they can be a visible shortcoming in a luxury cabin. By measuring the cabin prior to the start of the design and the later electronic fit check upon design completion, possible deviations are easily identified. As a result, the exact cabin dimensions are already known in the design phase, and later rework can be largely avoided during installation. After surveying the cabin, component engineers as well as suppliers begin to detail the interior components (in particular furniture) to an extent, that production specification (design data) can be created. Since VIP aircraft, as a rule, are customised, i. e. single-unit productions, the showing of compliance for the interior components and changes to structures and structures are an important element of the design process.25 The component designers (own staff or suppliers) do not need an own Part 21J approval. However, the results (production and maintenance data as well as compliance documentation) must be released by an approved 21J design organisation at the end of the component design process in order to confirm compliance with all required Certification Specifications. In parallel to the cabin interior, 21J engineers are working on structural and system modifications (such as installation, cabling) to prepare later installation of VIP equipment. As part of their activities, they also have to prepare installation data for the production staff. Since the cabin installation of a VIP aircraft can take many months during which the aircraft remains on the ground, it is necessary to check and determine the necessary maintenance events (e.g. A or C checks) according to the maintenance programme in parallel to the actual design activities. These maintenance management tasks are the responsibility of the respective Part M organisation in charge.

7.5.2.2 Production and Installation of the VIP Cabin As soon as engineering has provided the design data for the interior as well as the standards for assembly and installation, work and material planning can begin to prepare the activities in the workshops and the dock. Comparably with previous planning activities in the context of aircraft maintenance, these activities in particular comprise: • definition of work packages and work steps, • job card preparation,26 • definition of staff qualification for individual work steps, See Sect. 4.6.2, the part design for VIP aircraft differs only in nuances from the procedures outlined in Sect. 4.10 26 If the cabin installation is not carried out by the aircraft manufacturer, i. e. the aircraft has already been delivered or approved for operation, it is required for installation and changes to the structure and systems to create maintenance job cards (EASA Part 145). In contrast, production job cards (EASA Part 21/G) should be used for manufacturing of interior components. This distinction between production and maintenance is important, however, less for practical reasons, than for documentation requirements according to aviation legislation. 25

186

7 Production

• definition of smaller external supplier assignments (partially already done beforehand), • materials purchasing. After the job cards were distributed to production and material as well as necessary tools and equipment are available, production in the workshops and work on structure and systems on the aircraft can begin. In parallel to own tasks, work packages that are outsourced to external suppliers, must be controlled and accompanied by work planning and engineering. On the basis of demand, production staff must support the mechanics on-site in the supplier’s facilities with their know-how. In order to efficiently monitor changes and deviations in the case of external contracts, a joint process must be defined before the cooperation begins. As soon as the interior components have been manufactured and the preparatory structural and system changes have been completed on the aircraft, the installation of the cabin is carried out. If a laser-assisted measurement of the cabin was not used at the beginning of the design process, comprehensive pre-installation of the cabin interior is now necessary. This is to determine the accuracy of cabin components and deviations (fit check). Afterwards, the corrections are made (for example, reduction gaps, and changes to connections or wiring). Since VIP upgrades are individually manufactured and thus are subject to prototype characteristics, it is not unusual that the production data are not always exactly in line with reality during the production installation process. Thus they need to be updated and revised prior to the STC approval. Necessary adjustments, however, may not be carried out by production staff “on one’s own”. In this case, a change process has to be initiated in which the responsible design engineer checks or prepares a new design solution, which is then integrated into the design documentation. The change must finally be released by the 21 J design organisation. Only after the release the change can be re-directed into production and executed.27 Due to the frequency of deviations, it is important to have close cooperation with short communication channels between the design engineers, the work planners and the production staff in the dock or backshops. Furniture components are initially fitted only with the corpus, to prevent surface damage, e.g. doors or drawers, prior to the final installation. The latter are not installed before further adjustments are no longer to be made. The conclusion of the installation form functional checks of the components and systems, that are based on the design documents (e.g. job cards, test instruction, specifications).

27 Marginal changes may also be accomplished by production staff without directly consulting engineering. On basis of a redline procedure adjustments are directly integrated into the drawings and noted in a separate redlining overview by authorised staff. The responsible 21J engineer has to assess and integrate those changes into the official design revision documentation at the latest before final completion of the component (release). This guarantees that the component complies with the actual design after release.

7.6 Archiving Production Records 187

At the latest for installation, each component must have a valid installation certificate. The difficulty hereby is that some parts are not delivered with a valid certificate of release or only come with an unclear documentation. In light of a large number of options it is not always clear which release document can be accepted in each specific application case or which measures are required for post-certification. The validity of the certificate or the circumstances of the subsequent certification then substantially depend on the type of product. Differentiations are hereby made between semi-finished parts, simple and complex products without certificate or with CoC as well as between products of unknown or already approved suppliers. In order to avoid errors, the ideal process is, that the exact certification requirements are already defined by the engineering during the design phase and clearly identified in the production documents. In addition to that, clear procedures should be determined for the different post-certification opportunities. Once all upgrade and installation activities have been finished and the necessary documentation is complete, the VIP aircraft receives official approval in form of a supplemental type-certificate (STC). At about the same time, the aircraft customer acceptance is performed; first documentation reviews on a random basis, followed by cabin inspections. Deficiencies are either immediately rectified or – other than in the case of airliners – eliminated as rework after the handover.

7.6

Archiving Production Records

After conclusion of a production order, all documents that demonstrate compliance as proof of a proper execution of the work must be archived. A production organisation must have an archiving system in place that meets operational requirements and specifics (e.g. in terms of products, production procedures and production volume).28 This system must be documented and specify type and extent of the production records to be archived. The archiving process usually begins with transfer of the production records from production to the organisational unit responsible for archiving. This is where the core archiving process, including storage of data and associated preliminary work starts. In a first step, requirements with regard to format (paper, micro fish, CD, EDP) and structure (archiving/storage e.g. structured by product, order or date as well as if necessary additionally destruction date) should be defined. In the context of the actual archiving process, it must furthermore be specified, how legibility of records (data protection, e.g. storage, fire and humidity protection) and protection against unauthorised access is ensured during retention period. Prescribed archiving period is normally at least 3 years. Production data on critical items has to be stored over the product’s entire period of operation.29

28 29

See GM 21A.165 (d) and (h). See GM 21A.165 (d) and (h).

188

7 Production

Production organisations must furthermore ensure that supplier documentation is kept under reasonable conditions and for the prescribed period of time. For this purpose, there is either the possibility that archiving is ensured by the supplier himself or this task is alternatively taken over by the responsible Part 21G organisation. In each case, archiving-relevant activities and responsibilities must be coordinated between production organisation and supplier (e.g. via a quality assurance agreement). This has to be specified and fixed in writing. Particularly the handling of archived production records is to be regulated for cases where the cooperation ends before the specified archiving period. Archiving of production records is a regular part of audits of all kinds. Auditors hereby often focus on the performance of archiving process and in particular on the interface to suppliers.

References ASD-STAN Standard: ASD-STAN prEN 9100-P4 – Quality Management Systems – Requirements for Aviation, Space and Defense Organisations. English version. prEN 9100:2016 (E), 2017 European Commission: Commission Regulation (EC) on the continuing airworthiness of aircraft and aeronautical products, parts and appliances, and on the approval of organisations and personnel involved in these tasks [Implementing Rule Continuing Airworthiness]. No. 1321/2014, 2014 European Aviation Safety Agency – EASA: Acceptable Means of Compliance and Guidance Material to Part 21. Annex I to ED Decision 2012/020/R. Issue 2. Oct. 2012

Maintenance

As soon as aircraft were handed over after production, it is to be ensured that they constantly remain in an airworthy condition during operation; this requires regular examination and maintenance activities. These activities may only be carried out by approved maintenance organisations according to EASA Part 145. This chapter deals with their structure and function in detail by first outlining the basics of aircraft maintenance. Subsequently, terms such as line and base maintenance (Sect. 8.2) as well as the characteristics of scheduled and unscheduled maintenance are outlined (Sect. 8.3), followed by a representation of the organisational structure of a typical maintenance organisation. After this introduction, the following subchapters are dedicated to the aircraft maintenance process. Beginning with planning and maintenance control (Sects. 8.5 and 8.6), the section continues with a representation of the line maintenance process. Sect. 8.8 then provides a description of a typical base maintenance event. Detailed information on maintenance docking of the aircraft, identification and deferral of defects, quality controls and aircraft releases is provided there. Subsequently, Sects. 8.9 and 8.10 present the characteristics of component and engine maintenance. The last part on maintenance is dedicated to the issue of archiving maintenance records. To develop a comprehensive understanding of aircraft maintenance, it helps to have read Chap. 6 Aviation production management beforehand.

8.1

Aircraft Maintenance Basics

8.1.1 Definitions for Maintenance Maintenance of devices, technical systems, components and equipment refers to all measures applied to preserve or re-establish the intended condition. Maintenance is hereby subdivided into:

189

190

8 Maintenance

• maintenance that comprises all maintenance measures that help to retain the intended condition and delay wear and tear. • overhaul that encloses all measures for the re-establishment of an intended condition, contributing to a sustainable return to functional condition. Not contained are, however, improvements or advancements. Both in the context of maintenance and overhaul, experts differentiate between predictable, preventive maintenance on the one hand and non-predictable, restoring maintenance on the other. Predictable maintenance has preventive character and encloses all activities that serve the purpose of preventing errors and thus failure of a device, technical equipment or system during operation. Under normal conditions, these measures are implemented on a scheduled or event-related basis and contain, e.g., inspections, condition monitoring, calibrations or the replacement of components. Non-predictable maintenance is a consequence of the fact that technical wear and tear processes cannot always be fully predicted. This form of maintenance thus is applied, when a part or a system fails or operates at reduced efficiency. It covers troubleshooting of the actual condition as well as restoring the intended condition. Maintenance requires high organisational flexibility in terms of factual conditions, space, as well as scheduling and capacities: • factual flexibility is necessary, as maintenance often comprises different, labour-intensive and complex individual activities with low degrees of repetition. For this reason, maintenance staff must be highly qualified and broadly experienced. Factual flexibility makes comprehensive substitution of workers by machines difficult in maintenance practice. • temporal and capacitive flexibility is necessary, as time, type and scope of component, system or equipment failures are highly uncertain. Required resources can thus be planned at limited extent only. In addition to that, maintenance activities can often not be carried out independently of the organisations daily routine. The reason for this is that maintenance-related production stops are too expensive and production-free periods must be taken into account. • spatial flexibility is necessary, if maintenance can only be performed at the system’s or the (current) equipment’s location, due to lacking mobility. This spatial flexibility is sometimes affiliated with less favourable work conditions maintenance staff face, e.g., caused by dirt, tightness, distance or weather influences.

8.1.2 Characteristics of Aircraft Maintenance As already outlined previously, aircraft maintenance (Maintenance, Repair, and Overhaul – MRO) is regulated by the Implementing Rule Continuing Airworthiness.1 It determines that maintenance on aircraft, engines as well as on associated 1

In addition to that, EN 9110 regulates setup and structure of maintenance organisations.

8.1 Aircraft Maintenance Basics 191

components and equipment may exclusively be performed by approved maintenance organisations according to Part 145. In addition to the actual maintenance and overhaul, aircraft maintenance also covers: • aircraft painting, • modifications and cabin refurbishments, • implementation of ADs, SBs or EOs and special instructions by the operator or the aviation authorities. • non-destructive testing (NDT). Aircraft cleaning, water supply and disposal, toilet servicing, de-icing as well as disinfection are not maintenance activities on the other hand. However, there are maintenance organisations that offer some of these services in the context of their (line) maintenance product portfolio. Not only the organisational structures and procedures are influenced by aviation legislation, but also the type and extent of the maintenance execution. Maintenance work may only be performed on basis of Approved Maintenance Data, (e.g. AMM, CMM, EMM) that was released by an approved design organisation according to Part 21J. In addition to that, every operator must have a maintenance concept for the planned aircraft maintenance of its fleet.2 Such maintenance programmes specify the respective extent of maintenance for each type of aircraft. Aircraft maintenance is usually subject to clear seasonality. Since many European airlines have a thinned out flight plan in winter, this season is typically used to perform larger overhaul events. During summer months, when airlines are facing increased demand, only (smaller scale) maintenance activities are carried out as far as possible.

8.1.3 Quality Requirements and Approval Requirements Approved maintenance organisations according to Part 145 must demonstrate their ability to implement and uphold a quality management system. Such a system is to ensure that maintenance activities are performed under controlled conditions. The organisation must always be able to maintain or to repair aviation products in compliance with relevant maintenance data. This can only succeed, if organisations have clearly defined and comprehensible operating structures and processes. For this reason, the QM system and associated procedures are to be documented.3 Official requirements are, however, not clearly determined for operational practice and depend on the size of the organisation and its official scope of approval.

2 3

See Chap. 5 See IR Continuing Airworthiness Part 145 – 145.A.70

192

8 Maintenance

An approved QM system in maintenance must, however, at least exhibit the following elements: 1. comprehensive control and quality system to manage processes, procedures, documents and resources, 2. independent function (staff position) of quality management, 3. comprehensible system for acceptance and release of products (quality assurance), 4. systematic and documented procedure for subcontracting. To obtain appropriate quality of maintenance services additional approval requirements listed in Part 145 (see partially also TOP conditions) must be fulfilled: • The organisation must be sufficiently staffed in terms of quantity and quality to appropriately perform the maintenance tasks. Personnel must furthermore be authorised (and the respective employee has to be aware thereof!). In particular, the organisation must have sufficient certifying staff with official aircraft maintenance licences (AMLs) that has expertise and experience within the organisation’s scope of approval. In addition to that, own certifying staff ratio in maintenance must always amount to at least 50 % per shift, dock, workshop and trades. • The facilities and equipment must allow employees to carry out the work in accordance with regulations. The organisation must thus be able to demonstrate appropriate facilities and work conditions as well as necessary equipment and tools. • The organisation must ensure that aviation products are maintained, repaired and delivered on the basis of approved maintenance data only. It is to be ensured in particular that such data are available on basis of the last valid maintenance documentation revision as provided by the customer. In particular, lack of data topicality sometimes causes issues in practice. • An accountable manager must be designated and approved by the NAA. This person must set the quality strategy in accordance with regulatory requirements and ensures its implementation. Furthermore the accountable manager is responsible for ensuring availability of all resources necessary for the maintenance execution in compliance with Part 145.4 This explicitly also includes financial means. • Maintenance organisations must maintain an internal occurrence reporting system. Such an instrument is used to inform both the responsible aviation authority and the operator of the aircraft, if aircraft conditions are identified that could put flight safety at risk.5 The organisation’s structures and procedures are to be determined in a Maintenance Organisation Exposition (MOE) including associated procedures. The MOE must

4 5

See IR Initial Airworthiness Part 145 – 145.A.30 (a). See IR Initial Airworthiness Part 145 – 145.A.60

8.2 Line Maintenance Versus Base Maintenance 193

be known throughout the organisation. Compliance with operational standards is periodically examined by the responsible NAA.

8.2

Line Maintenance Versus Base Maintenance

Aircraft maintenance differentiates between line and base maintenance. While all maintenance activities (preservation of intended conditions) are usually summarised as line maintenance, base maintenance6 under normal conditions includes measures of overhaul (measures to restore intended conditions). The distinction between line and base maintenance is important, as the two forms are subject to different approval requirements. The technical, organisational and personnel requirements (TOP) are, for instance, clearly more challenging when it comes to base maintenance. Since the complexity of tasks is usually more extensive and the scope of work is spread across all trades, qualification requirements for base maintenance staff are more comprehensive than the ones applicable to line maintenance employees.7 In addition to that, in base maintenance hangar and dock facilities need to be permanently available in addition to the general operating equipment. Periodically recurring maintenance events (checks) are classified regarding line or base maintenance in the maintenance programme. As a rule of thumb, events below the C-check are usually classified as line maintenance.8 However, in order to enable a clear classification of the maintenance events and also to classify maintenance services that are not covered by maintenance programmes (modifications, painting), the exact differentiation according to line or base maintenance is based on the technical depth. This means that all line maintenance activities must be carried out using simple means and must neither have a high degree of disassembly, nor deeply interfere with the aircraft’s structure or require extensive testing. Thus, the following activities are assigned to line maintenance:9 • Visual inspections and troubleshooting, • rectification of defects, • Component replacement – with use of external test equipment, if required. This can also include engine or propeller changes. • Scheduled maintenance including visual inspections that will detect obvious unsatisfactory conditions/discrepancies but do not require extensive in depth inspection. It may also include internal structure, systems and powerplant items which are visible through quick opening access panels/doors.

Base maintenance is sometime also referred to as heavy maintenance See IR Continuing Airworthiness Part 66. 8 All maintenance activities that are performed during daily flight operation, between two flights are thus also referred to as line maintenance. 9 See AMC 145.A.10 as well as GM 66.A.20 (a). 6 7

194

8 Maintenance

• minor repairs, changes or modification, which do not require extensive disassembly and can be accomplished by simple means. • as far as approved by the quality management, also base maintenance tasks may be performed in special cases (e.g. airworthiness directives, service bulletins) as part of line maintenance. Maintenance events in which activities clearly exceed those listed above must be attributed to the base maintenance. Another criterion can also be the duration of a maintenance event (hourly limits). Table 8.1 compares scope and periodicities of some line and base maintenance events, exemplary for large-capacity aircraft (wide body).

8.3

Scheduled Versus Unscheduled Maintenance

8.3.1 Scheduled Maintenance Before an aircraft comes to the check in a maintenance organisation, the upcoming activities are already known and planned to a large extent. This is caused by the fact that an aircraft – comparable to a car – has certain components that must be subjected to an inspection at fixed intervals or, must be exchanged preventively due to special demands, ensuring the components operational condition. Such known in advance and thus planned maintenance measures are also referred to as scheduled maintenance and form the routine task package of a layover. The high number of such maintenance activities that are determined before a check, facilitates planning and allows precise planning of staff, documentation, material as well as equipment and tools. An extensive routine task package, at the same time, simplifies smooth layover execution and contributes to shorter and more calculable ground times. Type and scope of routine maintenance measures are suggested by the manufacturer in the MPD and adapted in a maintenance programme by the aircraft operators. For each aircraft and for each check, measures are determined that must be routinely accomplished. Via a reference to the MPD maintenance measures are described in detail on the job cards, as well as a rough duration of work execution. Table 8.1 Comparison of different line and base maintenance checks for wide bodies Check

Frequency

Manhours

Duration

S-Check

weekly

10–50

3–5 hours

A-Check

every 4–8 weeks

50–250

approx. 12 hours

C-Check

ca. every 18 month

2000–5000

1–2 weeks

D-Check

every 6–10 years

30.000–50.000

4–8 weeks

Line Maintenance

Base Maintenance

8.3 Scheduled Versus Unscheduled Maintenance 195

After the routine task package was evaluated (and if necessary adapted by engineering), work planning prepares the job cards. The routine task package is thereafter examined in the maintenance control center (MCC) and assigned to the trades. The routine tasks are then handed over to authorised mechanics via job cards and in accordance to the required staff qualification. This is followed by the processing of the routine work. After execution and confirmation on the job card, actual time requirements are documented, ideally allowing for a real-time tracking of the routine task work package. In addition to the maintenance activities detailed in the maintenance programme, there are other measures that are equally known and thus plannable before a layover period, which are, however, not part of the routine task package. This includes modifications or the implementation of Service Bulletins and Airworthiness Directives that are separately planned and documented for the layover.

8.3.2 Unscheduled Maintenance If malfunctions or damage occur during operation or identified during a maintenance event, and if their rectification is not covered by routine job cards, this is referred to as non-routine task (e.g., corrosion, wear and tear). Non-routine maintenance thus is unplanned maintenance; also called unscheduled maintenance. For the execution of unplanned maintenance measures, approved Part 145 organisation must have documented internal procedures.10 The beginning of a non-routine maintenance process (Fig. 8.1) is marked by the identification of findings, e.g. by documentation in the technical logbook or by inspections.11 Findings are then usually documented in an IT-system, where a clear description of damage, the aircraft concerned, the sector (trade, ATA chapter, zone, station, etc.) and if necessary associated references (AD, MPD point, engineering order, etc.) are specified. In parallel to new finding often a (commercial) work order is opened automatically. As far as necessary, troubleshooting will be carried out, which should not only focus on the primary damage, but also on other potentially related defects. On the basis of damage assessment, the finding is classified. This work steps includes the determination of the documentation required for processing (Approved Data, e.g. according to SRM, CMM, EM, WDM). Complex defects can, however, often not be processed via these standard maintenance manuals. It is then regularly necessary to consult the responsible design organisation (TC or STC holder) to obtain the repair instructions (Approved Data) for the specific case of damage. Defects must always be processed on basis of approved maintenance data or authorised repair instructions. See IR Continuing Airworthiness EASA Part 145 – 145.A.65 (b) 3. According to IR Continuing Airworthiness Part M – M.A.306, the technical logbook is mandatory for all commercially used aircraft. In addition to flight information (time, distance, flight number, pilots) technical anomalies, malfunctions and error reports arising in flight are documented therein. 10 11

196

8â&#x20AC;&#x192;Maintenance 'HWHUPLQDWLRQ RI WKH ILQGLQJ

H J YLD LQVSHFWLRQ H[SRVXUH RU UHFRUG LQ WKH WHFKQLFDO ORJERRN

'RFXPHQWDWLRQ RI WKH ILQGLQJ

7URXEOHVKRRWLQJ URRW FDXVH DQDO\VLV FRQVLGHULQJ SRVVLEOH VHFRQGDU\ HUURUV DQG ULVNV

$VVHVVPHQW DQG FODVVLILFDWLRQ RI ILGLQJ LQFOXGLQJ LGHQWLILFDWLRQ RI WKH DSSOLFDEOH PDLQWHQDQFH LQVWUXFWLRQV DSSURYHG PDLQWHQDQFH GDWD

,I VWDQGDUG PDLQWHQDQFH GDWD DUH LQVXIILFLHQW 2EWDLQ LQGLYLGXDO PDLQWHQDQFH LQVWUXFWLRQ IURP WKH UHVSRQVLEOH - GHVLJQ RUJDQLVDWLRQ

'HWHUPLQDWLRQ RI SHUVRQQHO TXDOLILFDWLRQ PDWHULDO UHTXLUHPHQWV WLPH DQG ILQDQFLDO HIIRUW

5HFWLILFDWLRQ DQG GRFXPHQWDWLRQ RI WKH SURFHVVLQJ

Fig.Â 8.1â&#x20AC;&#x192; Process steps in unscheduled maintenance

On the basis of the assessment of findings, the necessary duration, as well as staff qualification and material requirements can be determined and if necessary customer approval be obtained. Only then, the conditions for defect rectification have been met. After the findings were successfully rectified, completion is to be confirmed in the IT system and/or in the associated maintenance documents (and if necessary in the technical logbook as well). Non-routine work can only be planned to a limited extent prior to a layover. Comprehensive non-routine planning would not only require a forecast of type and extent of the damage, but also expertise on durations required to rectify the defects. If maintenance is, however, carried out on a larger number of the same aircraft type by a PartÂ 145 organisation, patterns of non-routine become recognisable after many years. Such experience facilitates forecasting regarding total duration and capacities of future layover and are therefore regularly taken into account when defining the work packages (ratio routine to non-routine expenditure). The associated planning stability enables a more economical use of resources, especially in the case of capacities and material availability. The customer as well benefits from such knowhow, e.g. by reduced aircraft ground times.

8.4

Setup of a Maintenance Organisation

Although the PartÂ 145 does not provide any direct requirements for the organizational structure of a maintenance organisations, they still show a high degree of similarity in practice. Fig.Â 8.2 presents the setup of a typical maintenance organisation (operational production departments are framed by a broken line).

8.4â&#x20AC;&#x192; Setup of a Maintenance Organisation 197

Aircraft maintenance, divided into base and line maintenance, forms the core element of the production department. Line maintenance comprises a control center (LMCC) as well as maintenance execution at the homebase and on outstations. In base maintenance experts usually differentiate production management and maintenance execution. Aircraft maintenance furthermore often integrates the ground support equipment (GSE) and the facility management. In addition to that, maintenance workshops (backshops) form a second key sector that is often broken down in engine, landing gear and component maintenance. The reason for this is that engine overhaul is subject to an own legal rating (B-rating), requiring complex maintenance procedures and highly specialised, experienced staff. Landing gears are the largest individual components and the associated maintenance frequently also requires a detached backshop. A third sub-area is component overhaul that due to its complexity requires comparatively broad maintenance expertise. Not least, non-destructive testing (NDT) in many cases forms an own backshop section as well. This discipline requires niche know-how with extensive experience, so that all production departments usually jointly use one NDT unit. The backshop structure outlined here is primarily an example of a setup used in medium-sized and large maintenance organisations. In the case of smaller maintenance organisations, it is not unusual for aircraft maintenance and backshops to form a unit. Essential elements of the maintenance are then often outsourced.

4XDOLW\ PDQDJHPHQW

0DLQWHQDQFH 2UJDQLVDWLRQ

3ODQQLQJ HQJLQHHULQJ

(QJLQHHULQJ VXSSRUW

/LQH 0DLQWHQDQFH 2SHUDWLRQ FRQWURO OLQH PDLQW

3URGXFWLRQV SODQQLQJ

3XUFKDVLQJ ORJLVWLFV PDWHULDO

:RUNVKRSV FRPSRQHQW PDLQWHQDQFH

$LUFUDIW PDLQWHQDQFH

(QJLQHV

3XUFKDVLQJ

/DQGLQJ JHDUV

6WRFN

&RPSRQHQWV

*RRGV UHFHLSW VKLSSLQJ

1'7

7RROV

7HUPLQDO KDQJDU 7HFKQLFDO GRFXPHQWDWLRQ

$UFKLYLQJ

2XWVWDWLRQV

%DVH PDLQWHQDQFH $LUFUDIW PDLQWHQDQFH 2SHUDWLRQ FRQWURO EDVH PDLQW *6( IDFLOLWLHV

*URXQG 6XSSRUW (TXLSPHQW

Fig.Â 8.2â&#x20AC;&#x192; Typical structure of a maintenance organisation

198

8 Maintenance

The production departments are furthermore flanked by the engineering support on the one hand, as well as by supply chain and logistics on the other. Maintenance planning is either allocated to engineering in practice; or (not atypical either) directly to aircraft maintenance. All units of a maintenance organisation are also subject to quality management monitoring, which must be assigned directly to the accountable manager.

8.5

Production Planning in Maintenance

Task of production planning12 in a maintenance organisation is to plan all maintenance activities on the ramp, in the docks or in specialised workshops as well as externally in the context of extended work benches.13 In addition to line and base maintenance checks as well as component maintenance, this comprises planning of transfer checks or engineering orders based on Airworthiness Directives, Service Bulletins, modifications and refurbishments. The production planning structures the pending work execution by breaking down commissioned work package into individual work steps. At the same time it belongs to the tasks of the work preparation, to determine • sequence of execution and/or times as well as • qualification requirements and • time targets for the staff. That data forms the basis for the planning of personnel, hangar and/or backshop capacities. The planners are often former authorised maintenance employees and have detailed work execution expertise. However, the job of the production planning is not to determine the contents of a check or work package. This is the task of engineering, whose activities result in the maintenance programme, the maintenance data or in engineering orders. This information forms the starting point for the production planning activities. In a first step production planning receives the work package from engineering or the customer. In the following, this package must be structured and divided into clearly separated work steps, to ensure the transparency and traceability of the entire maintenance process.14 This is effected by job cards that are either provided by the customer, purchased or self-created. If the cards were purchased or provided by the customer, planning activities are as far as possible limited to organisationally and commercially structure the work execution. At the same time, material and equipment requirements are determined. This information is then provided to purchasing and to the material planner. Work orders

The terms work planning, production preparation are used alternatively as well. For production planning basics, see Sect. 6.1 14 See IR Continuing Airworthiness Part 145 – 145A.45 (e) 12 13

8.6â&#x20AC;&#x192; Production Controlling in Maintenance 199

have to be opened in order to enable a commercial recording of incurred manhours and material expenses. If job cards are provided by the organisation itself, the process deviates, as the structure and steps of the work package need to be defined and job cards have to be created (see Sect.Â 6.2). This is affiliated with comprehensive time and staff resources, so that production planning of large maintenance events requires separate project planning. If the work cards are available and these are customized for the upcoming maintenance event, they are either made available electronically or printed out and maintenance data and other work documents are attached. At the end of the production planning process not only the job cards, but the entire documentation necessary for maintenance execution is made available and submitted to production control by the planning department. In parallel to the preparation of the maintenance execution, the maintenance event is to be coordinated with flight operation control and other internal support areas, with ground handling (e.g. for availability of a aircraft tractor or de-fueling) and if necessary with customs or external suppliers. With regard to the essential process, the preparation of an A check hereby differs only little from a D-check. The general steps from work package provision by engineering, all the way to the submission of maintenance requirements to production control are more or less congruent. The preparation of an A-check differs only slightly from a D-check from the perspective of the process. The basics steps from the provision of the work package through the engineering to the provision of job cards to shop floor are largely congruent. In practice, however, the execution routine differs as the preparation of small checks are highly familiar standard processes that are performed on a daily basis. In contrast to this large base maintenance events usually are only performed every four to six weeks and due to their size and technical depth are subject to higher planning risks.

8.6

Production Controlling in Maintenance

A maintenance event (layover) can only be successfully completed, if in addition to planning, the execution, monitoring and quality assurance of work is managed in a structured manner. For this purpose, the maintenance control center (MCC) must ensure that work packages are distributed to shifts and teams in accordance with the planning requirements in such a way that the work can be carried out without undue pressure.15 Moreover, it is part of the maintenance control to monitor the work progress, to ensure the availability of the required resources and to organize other support for a smooth execution of maintenance (e.g. manufacturer inquiries with engineering). Last but not least, compliance with TOP requirements is to be

See AMC 145.A.47 (a) 2.

200

8 Maintenance

ensured during the maintenance event as well (among other things, by sufficiently qualified maintenance and support staff). Some days prior to the maintenance event, the control center receives the final work package including the related job cards from maintenance planning. In the case of larger layover periods a handover meeting between both teams is usually scheduled, if necessary, integrating other departments. This is to ensure a complete flow of communication in order to make known all important information to production level on layover early on. Furthermore, the specification of the maintenance event is hereby clearly separated from other daily activities. Such an early exchange of information at the same time allows maintenance planning and the production management to communicate planning inadequacies or potential conflicts in execution. Countermeasures, ideally in joint coordination of maintenance planning and maintenance control, can be implemented before the event begins. At the start of the layover, a meeting of the executive production staff (e.g. shift leader, team leader, foreman) is usually held at the beginning of each shift to exchange information on the status and pending maintenance activities. This does not only include the determination of the degree of completion and deviations from plan as well as appropriate counter measures. During this meeting also regular co-ordination between trades and backshops or integration of third party services are to be coordinated as well. After the meeting the pending maintenance tasks are allocated to the teams at the beginning of each shift, before the work is then assigned to individual employees. Aviation legislation explicitly requires that the limits of human performance are hereby taken into account.16 Based on these requirements, the job cards are eventually issued to mechanics. Work progress is measured and monitored via the returned processed job cards. In modern maintenance organisations, this is done electronically, almost in real time. In practice, however, accurate, exact daily monitoring of process status is rarely possible. In the normal case, the determination of the work progress is based on estimates, because the processing is not recorded by the maintenance employee immediately after the work has been carried out, but only after job cards have electronically recorded, usually by employees of the archiving department. A timely countermeasure in work steps that disturb the event flow is not always easy with such a work progress check. This regularly requires excellent communication, a high level of awareness and regular onsite monitoring by production management (several times a day), either at the aircraft or in the backshops. Taking into account process disruptions in a complex setting like aircraft maintenance, is rather the normal than the exceptional case. In the context of daily work execution, the following unplanned influences are regularly to be considered: • unexpected non-routine tasks, • expansion of assigned work package by customer (request on additional work),

As far as possible, critical tasks are not to be performed during night shifts or at least not in highest fatigue periods (usually between 2 and 4 am), see AMC 145.A.47 (b)

8.7 Line Maintenance 201

• • • • • •

Shifts in staff capacity in favour of a more highly prioritised layover period, delays in material deliveries, late returns from backshops and subcontractors, availability of documentation, waiting on manufacturer inquiries, incorrect planning assumptions, equipment defects or malfunctions.

Production management is tasked with integrating these shortcomings in the maintenance process with as little interruptions as possible. If the malfunctions during the maintenance process cannot be remedied by countermeasures, only a deferral of tasks or parts of the work package or an extension of the maintenance layover can be considered as a way out. Independently of the assigned control and monitoring instruments, in particular in the case of larger adaptations, a determination of effects proves difficult. While direct consequences within the trade concerned can mostly be reliably determined, a comprehensive evaluation of indirect subsequent effects across trades regularly causes problems in practice. Incidentally, production control measures are not solely performed by executive staff on shop floor level. Every individual employee entitled to perform maintenance, is actively responsible as well. This is particularly important, when work steps must be handed over between shifts or staff changes. The organisation must have a formalised procedure in place that ensures transparent communication between the employee handing over and the one taking over the task, including corresponding documentation (e.g. shift handover record or documentation of the status of processing in the job card).17

8.7

Line Maintenance

8.7.1 Line Maintenance Setup In Sect. 8.2, line maintenance was characterised as maintenance that neither requires extensive disassembly, nor complex functional testing. Line maintenance must be performed applying simple means. As a rule, line maintenance therefore comprises planned small-scale maintenance layovers. In addition to that, it contains unplanned maintenance that must be accomplished during two flights, in order to ensure the aircraft’s airworthiness all the way to the next planned check. An important part of line maintenance furthermore is the deferral of defects. Since line maintenance only covers minor maintenance events, the aircraft is not taken out of operation and removed from the flight plan. To achieve this goal and to minimise the high capital burden of an aircraft, the following line maintenance measures are applied to optimise costs:

See IR Continuing Airworthiness EASA Part 145 – 145.A.47 (c).

202

• • • •

8 Maintenance

minimisation of maintenance activities and/or aircraft on ground times, integration of maintenance aspects into operational planning, deferral of defects, as far as possible, using (nightly) operating pauses in operation to perform as many maintenance measures as possible.

It is not always possible to perform line maintenance at the maintenance organisation’s well-equipped homebase. Especially when it comes to unplanned maintenance, it can become necessary to perform measures at the aircraft’s current location. Large airlines therefore use so-called outstations, i.e. own line maintenance locations at airports of importance to them. If this is not possible (e.g. from cost reasons or because of lacking frequency), maintenance is usually ensured via a subcontractor. Both for homebase and outstations, a distinction is made between maintenance work on the ramp and in a maintenance hangar on the one hand and work at terminals on the other. While ramp/apron or hangars are used for small over-night checks or for more difficult unplanned maintenance, short-term and fast maintenance activities are mostly performed at the terminal during ground time between two flights. The line maintenance control center (LMCC), i.e. the organisational unit of a maintenance organisation that plans and manages all line maintenance activities for aircraft or a fleet during operation, plays an important role. Its activities are coordinated with the flight operation management of the aircraft operator (airline). Therefore the LMCC serves as technical interface to the operator. This does not only apply to activities at the homebase and at own line outstations, but also if maintenance is performed by an external maintenance organisation. Line Maintenance Control Center Tasks • Ensuring all planned line maintenance activities • Coordinating and controlling all maintenance measures between ground times • Interface to flight management for all maintenance issues • Supervising and controlling all deferred defects, if necessary, planning its rectification in upcoming line or base maintenance checks • Ensuring and coordinating material procurement and providing personnel or know-how from other departments (e.g., engineering, planning) • Coordinating maintenance activities of subcontractors (at outstations) • Controlling and monitoring servicing (refuelling, catering, water, etc.) Typical characteristic of line maintenance is a broad staff qualification. The personnel entitled to perform maintenance must usually be comprehensively familiar with the entire aircraft across trades, often also with several aircraft types. However,

8.7 Line Maintenance 203

in contrast to base maintenance, line maintenance requires a very broad spectrum of expertise, with comparably low levels of in-depth know-how. After all, line maintenance is characterised by simple, not highly complex maintenance work, without high disassembling degrees. To release aircraft, an aviation qualification of category B1 or B2 with corresponding aircraft type rating is required.18

8.7.2 Line Maintenance Procedures – Terminal Preparation of line maintenance activities can already commence before landing, if the airline uses the ACARS data radio system as supporting maintenance system. This system permits to automatically or manually transfer technical error messages during flight to the maintenance organisation’s LMCC. ▶▶

ACARS (Aircraft Communication and Reporting System) is a digital data communication system for the transmission of messages between commercial aircraft and ground stations (control center, flight control). Comparable with mobile phone SMS it allows for communication with aircraft by exchanging simple messages. Through ACARS, crews are provided with flight-relevant data, printed out via a small printer in the cockpit (for example, fuel consumption, delays, weather data, de-icing processes, load sheet). On the other hand, ACARS can be used to transmit flight operating data to the ground station, manually or automatically. The system was developed in the 1970s to reduce the strain on radio frequencies, which had turned into a problem, especially in urban areas. Through the introduction of ACARS, the number of standard messages could be significantly reduced. However, ACARS has apparently become overburdened, so that the VDL2 (VHF Digital Link Mode 2) will probably replace it within the next few years.

As soon as the aircraft has landed and docked at the terminal, the final work of the completed flight will begin. Already during passenger disembarkment, luggage and freight are unloaded. Directly thereafter, the cabin is cleaned and waste water is discharged. In parallel to that, the next flight is prepared, among other things by providing catering, water, loading freight and luggage and refuelling the aircraft. In addition to that, the work of the line maintenance staff commences. Information and error messages form the starting point of relevant activities • that were already provided to the LMCC via ACARS during flight, • that are communicated to the maintenance staff after landing via the technical or the cabin logbook and/or by the crew.

For details of maintenance staff qualification see Sect. 10.2.

204

8 Maintenance

If error messages were already transferred to the LMCC via ACARS during flight, error tracing and rectification often directly commences. Since maintenance in this case has time to prepare measures between message and landing, the required solution as well as necessary material might already be directly available upon the aircraft’s arrival at the terminal. ACARS can thus essentially contribute to minimising maintenance-related ground times and preventing delays. In addition to possible ACARS messages, maintenance staff checks the technical logbook after the aircraft has docked at the terminal. As far as possible, maintenance staff hereby obtains more detailed information from the flight crew before work execution, to identify the causes of defects and apply expertise as broadly as possible. Should that information not be enough a troubleshooting, i.e. a complex error and solution search, if necessary under consultation of engineering, is to be performed. Defects are finally always rectified on basis of approved maintenance data (e.g. AMM, CMM, EM, SRM). After successful rectification of defects, work performed is recorded in the technical logbook. ▶▶

escription of line maintenance activities of a CAT B mechanic for D a A320 flight during a 70-minute ground time. The jet from Barcelona landed punctually in Munich at 4:30 pm. The connecting flight to Vienna took off as planned at 5:40 pm. 16:05 taking over the aircrafts maintenance for the upcoming ground time by the mechanic 16:05 associated deferrals as well as ARCARS messages in the IT examined 16:10 material on basis of new ARCARS message ordered 16:25 material and tools collected 16:35 aircraft docks at gate 16:40 visual inspection on damage to landing gear, engines, flight controls and fuselage 16:45 passengers left aircraft 16:45 coordination defects with captain, examination of the technical log book (TLB) 16:50 while aircraft is cleaned, rectify and afterwards confirm all defects listed in the TLB 16:55 more serious problem with the APU generator control unit, troubleshooting necessary. Documentation research 17:10 problem solved, second maintenance colleague performs double inspection and accomplishes examination 17:15 four defects in the TLB are deferred to the nightshift, information to cockpit crew 17:15 passengers embark aircraft 17:20 release to service is issued in the TLB 17:30 aircraft leaves parking position and heads from MUC towards VIE 17:35 accomplished work is electronically documented at the workstation in the hangar

8.7 Line Maintenance 205

Due to the technical extent and the complexity of maintenance work, required time might exceed the planned ground time of the aircraft. In order not to influence flight operation in these cases, not all defects are immediately rectified after their occurrence or identification. This applies in particular to outstations, as sufficiently qualified staff or material and equipment required for certain defects are often not available. For this reason the deferral of defects is a typical characteristic of line maintenance. Defects are then rectified and the relevant maintenance data at the next possible time (e.g. after next homebase landing or the next regular check). Until then a confirmation of deferral is issued (by making a note in the technical logbook) in compliance with the minimum equipment list (MEL). If a deferral is not permitted, the aircraft is no longer in an airworthy condition as long as the defect has not been rectified and the aircraft may no longer kept in flight operation. A so-called AOG case (Aircraft on Ground) is then constituted. In such a situation, maintenance is to be performed and if necessary spare parts are to be procured with highest priority and as fast as possible. The objective hereby is to immediately restore the aircraft’s airworthiness, minimising delays in flight operation as well as associated costs.

8.7.3 Line Maintenance Procedures – Ramp and Hangar In addition to line maintenance at the terminal, it is also performed at the ramp or in the hangar. The service spectrum, however, slightly differs from terminal maintenance measures. Focus hereby is on • execution of small checks as per maintenance programme (e.g. A, R and check), usually in connection with • rectification of accumulated deferred defects and if necessary • processing complex AOG findings. For such maintenance activities the aircraft is usually towed to the airport’s maintenance area and parked either before or in a hangar, in order to ensure direct and fast access to facilities and equipment. The aircraft is hereby, however, not extensively docked, but only connected to the necessary access and work platforms and the actual maintenance work commences in line with the planned work package. Routine maintenance measures, such as visual inspections and functional tests are accomplished or component are replaced according to job cards. If defects are identified, they are recorded as non-routine items and – as far as possible – fixed and certified during the current check on basis of approved maintenance data (SRM, AMM, CMM, etc.). If the time does not suffice and as far as this is permissible, the defect is deferred to a later event.

206

8 Maintenance

In addition to that, line maintenance checks are used to rectify deferred defects that have accumulated since the last check. In contrast to the non-routine findings identified during the check, deferred defects can be relatively precisely integrated into the layover. After all, information on kind and scope of defects and results of troubleshooting are usually available at the time of the layover period. Therefore, direct availability of material and equipment required is ensured. Once all maintenance work has been completed and or again deferred, the aircraft can be released for flight operation. The certifying staff must hereby issue a certificate of release to service (CRS). Planned line maintenance activities are often also accomplished over-night to minimise aircraft ground times. ▶▶

Four Questions to Sven Pawliska, Intercont Maintenance Manager with Lufthansa Technik in Munich:19 How are maintenance programme requirements coordinated with the flight schedule for an aircraft to be grounded for maintenance purposes as little as possible? The starting point for our activity is the maintenance programme developed by engineering and approved by the aviation authority, which we then analyse under flight schedule aspects. Our job is to identify ground times and/or gaps in the flight schedule, allowing us to advance tasks, even if the corresponding work on the maintenance programme is not yet due. It is therefore a matter of summarising orders through clever packaging, so that costs of maintenance measures performed earlier than required, can be overcompensated by minimising ground times. It is also important to ensure that tasks are technically coordinated. It makes, for instance, little sense to schedule work where the aircraft must be without power, e.g. tank inspection, together with cabin work on the in-flight entertainment system, as these systems require on-board electricity. All our activities hereby aim at maximising the aircraft’s operation periods. Optimisation efforts even extend to preventing the purchase of additional aircraft, while maintaining the flight schedule at the same time. These are, however, only planned maintenance events. How do you deal with unplanned events, when, for example, defects or damage are identified after flights? To stabilise the flight plan, a maintenance organisation must ensure basic availability of personnel for unplanned events, in particular at the homebase. However, keeping staff available to cover all eventualities immediately would be uneconomical here. Therefore, in the event of

Sven Pawliska has been an engineering and production manager in various management positions at Lufthansa Technik AG for more than 15 years.

8.7â&#x20AC;&#x192; Line Maintenance 207

aircraft problems, other activities, i.e. planned work on the rest of the fleet, should be controlled in a way ensuring the availability of enough aircraft to uphold the flight plan at all times. This means that not all planned maintenance tasks can be deferred until their due date, as there would no longer be room for integrating unforeseen maintenance events. This demonstrates that skilled order planning is only one side of the coin. Doesnâ&#x20AC;&#x2122;t personnel management play an important role in ensuring success? Yes that's true. The basic framework for personnel planning is initially provided by the maintenance events or the flight plan. If ground periods change, the shift plan has to be adapted and that poses a special challenge. In Germany, on the one hand, the labour laws provide the framework on how staff can be used. On the other, the organisation has concluded work arrangements for employee participation on how personnel planning is to be carried out. To put it simply, changes in shift times or days scheduling are changed, as colleagues have organised their private interests. For normal people weekends are off, for people in an aeronautical organisation with a 24/7 and 365-day coverage, they are a personal challenge. Shift service is burdensome, but plays an important role in maintenance, where a large part of the work is done at night, when the short range fleet mainly is on the ground in large parts of Central Europe due to bans on night flights. How do you succeed in creating the necessary flexibility taking into account strict German labour legislation and co-determination? Due to high labour costs in Germany, staff has to be optimally used. Idle times are expensive. Operational flexibility is hereby limited by the legislative framework. Of course, you cannot call in or send home employees just because the workload in the hangar has changed for a few hours. If you want to be successful at an above average level, you have to involve employees. As banal as it sounds, but you have to keep up their motivation. Employees contribute lots of intrinsic motivation when they trust the management. We hereby succeed on basis of sincerity, good communication and above all by applying a give and take approach. In practice, this means, for example, that we do not send employees home after a few hours of work, just because there is no aircraft in the hangar. My colleagues see and appreciate that and are then willing to come back to work on short notice as well, when workload is extremely high again. Success thus is based on unwritten, trust-related arrangements that you cannot define by contracts.

208

8.8

8 Maintenance

Base Maintenance

8.8.1 Base Maintenance Characteristics It was already outlined in Sect. 8.2 that base maintenance (heavy maintenance) is by definition constituted whenever the line maintenance criteria of Part 145 are not met. The regulation is thus based on the exclusion principle. Typical characteristics of base maintenance events are a high degree of detail or extensive disassembling. In addition to that, the duration of layover periods usually amounts to one or several weeks and not just hours or a few days, as it usually is the case in line maintenance. At the same time, component and engine maintenance represent own base maintenance disciplines that must be planned and managed in an event-related manner. Examples of typical base maintenance events are: • • • •

letter checks, from C-check level, modifications, implementation of extensive Airworthiness Directives or engineering orders, aircraft painting.

Since the aircraft is temporarily taken out of flight operation during base maintenance, daily work fulfilment during the layover is not based on the flight plan, but on planned processing degree. The event duration is hereby limited, as the aircraft is to be reintegrated into flight operation as fast as possible. Contrary to line maintenance, there is nevertheless substantial room for scheduling during the layover period. Other than in line maintenance, where the responsibility for punctual aircraft release lies with individual certifying staff, the pressure of compliance with schedules is distributed across a large number of employees due to the high staff employment in base maintenance. In base maintenance, individual employees thus work free from the direct time pressure of flight organisation that often characterises line maintenance. In base maintenance, pressure primarily concentrates on production management that has to ensure the schedule handover agreed with the airline, applying intelligent event planning and controlling. In terms of staff qualification, base maintenance is characterised by the use of specialists. While all-rounders are rather necessary in line maintenance, heavy maintenance requires high levels of detailed knowledge from maintenance staff due to the high technical depth and the level of disassembling. This way, the entire technical maintenance spectrum of an aircraft type and its associated systems can be covered. In practice, this is ensured via comprehensive division of labour and a specialisation of trades (avionics, structure, mechanics, components, engines, etc.). Since base maintenance requirements are more comprehensive, the respective authority approval comprises authorisation to perform line maintenance measures as well.

8.8â&#x20AC;&#x192; Base Maintenance 209

8.8.2 Base Maintenance Layovers 8.8.2.1 Preparation of Layovers At the beginning of maintenance activities in the dock, the checks are handed over from maintenance planning to maintenance control. This includes the transfer of information regarding the scope of work (routine work package, ADs, SBs, modifications) and the handover of job cards. Job cards are then examined and distributed according to trades (avionics, electrical, structure, etc.). Material requirements must furthermore be examined shortly before beginning of the layover period, whether the necessary materials and parts will be not only in stock when needed, but also whether their provision or commissioning can be ensured as required. Prior to aircraft arrival parts and materials that are in the dock and not related with the upcoming event are to be removed from the dock area of the layover. At the same time, dock facilities, ground support equipment (GSE) and systems needed upon arrival of the aircraft are to be made available. When the aircraft arrives from countries outside the European Union, customs procedures should be prepared if requested by the customer. 8.8.2.2 Aircraft Arrival and Docking After arrival, customs formalities for crew and cargo are first completed. In addition to that, the aircraft is unloaded and cargo equipment stored. Fuel is discharged from the aircraftâ&#x20AC;&#x2122;s tanks. For safety and environmental protection reasons, defueling may never be performed in the hangar, but in special apron areas only. At the beginning of the check a first aircraft inspection is performed (e.g. external examination, cabin inspection including determination and documentation of damage, if necessary activation of emergency escape slides). The aircraft is then towed into the hangar. Since the tractor operator can never fully view the aircraft due to its size, towing is always to be accomplished using several staff members. Particularly inside the hangar sufficient staff as well as fixed communication procedures are to ensure that collisions with gates, dock facilities, supports as well as with mobile equipment or other aircraft are prevented. As soon as the aircraft has reached the dock, it is lifted with hydraulic jacks according to job card and aircraft maintenance manual to allow for removal of the landing gear. Afterwards the aircraft is integrated into the dock using stands and work platforms ensuring access to all areas during the layover period. Among other things, it is to be ensured that industrial safety requirements are taken into account by installing safety features and warning references. In addition, the space required for later functional checks (e.g. on rudders, stabilizers, slats, flaps) must already be taken into account during docking process. Another element of the aircraft docking is the ground supply with power, hydraulics, pneumatics and fresh air. 8.8.2.3 Processing Steps During Layover After aircraft arrival and docking the actual maintenance activities begin. In a first step, landing gear and if necessary engines are removed and transported to the workshops or to a subcontractor for overhaul.

210

8 Maintenance

In parallel, the aircraft-structure is made accessible during the processing the routine task package, followed by routine inspections of structural elements and components (NDT, visual inspections, function tests, etc.). Also non-routine items are hereby constantly identified, whose rectification or repair either directly follow or are integrated into layover planning in case of more complex measures. Identification of findings in an early phase of the layover period is favourable as it allows for adequate processing time, e.g. for material procurement, manufacturer inquiries and execution. In addition to maintenance activities on integrated aircraft parts, other parts are removed by routine or on basis of findings. The parts removed must be characterised as serviceable or unserviceable and stored separately and handed over to the backshops.20 There, the parts are inspected, if necessary disassembled and overhauled and sent back to the aircraft after their maintenance. All maintenance activities are without exception performed on basis of approved maintenance data. Unauthorised maintenance instructions that were not released by an approved design organisation are not allowed. In parallel to the maintenance activities – as far as assigned – SBs and ADs or modifications are implemented as well. Especially when it comes to the modifications, increased expenditure is often to be taken into account during the first layover of an entire fleet. Teething troubles that did not manifest or where not considered in the design phase, regularly occur during modifications and can only be rectified with support of the engineering and production rework. While processing was set in the maintenance planning before the layover, the production management is responsible for monitoring and keeping the schedule during the layover. Current production controlling measures thus are carried out in parallel to the work. Measurement or (often) estimation of work progress is primarily ensured by tracking issued and returned job cards. If deviations from the planning can be recognised, e.g. due to unexpected increase of work or delays, the plan must be adapted, if possible under compliance with the handover date. After a layover has essentially been completed, the maintenance activities are concluded by painting the aircraft, depending on the check or the assigned work package. For painting, the aircraft is to be docked out from the maintenance hangar and docked in the painting hangar. After preparatory measures, e.g., masking, preparation of paints and coordination of paint procedure, the aircraft is painted. More extensive paint jobs may only be performed in a specially prepared paint hangar to ensure compliance with required work conditions (e.g. as regards temperature, humidity, etc.) and with environmental as well as industrial safety legislation.

8.8.2.4 Quality Controls and Aircraft Release Typical characteristic of a base maintenance check is the presence of support staff with release authorisation of categories B1 and B2 that support the base maintenance

See IR Continuing Airworthiness EASA Part 145 – 145.A.42 (d).

8.8 Base Maintenance 211

aircraft releasing employee with CAT C authorisation during the entire layover for quality assurance.21 Support staff have to ensure that all tasks are accomplished completely and according to the maintenance data, in line with the organisation’s scope of approval. Support staff is thus responsible for monitoring compliance with technical, organisational and personnel requirements during a base maintenance layover. The activity spectrum of support staff hereby above all covers document examinations and technical sample tests. Type and extent of the examinations are at the discretion of the support staff and should be based on the individual circumstances of the layover. The support staff’s testing and monitoring activities primarily focus on the examination of the following documents and activities: • application of correct approved maintenance data according to the instructed revision level based on the customer specification, • topicality and correctness of job cards, • correct (qualification-compliant) confirmations of job cards and release certificates, • constant compliance with the operational QM documentation as well as with offical scope of approval, • correct execution and documentation of shift-extenting tasks, • staff availability according to qualification requirements, • support at and monitoring of complex non-routine findings. Directly before the certificate of release to service (CRS) is issued for the aircraft, the support staff must verify that all routine job cards were completely carried out and correctly certified. In addition to that, the support staff must check that all non-routine items were either completed or deferred.22 Should this not be the case, the open items must be rectified or clarified before the release. Lastly, the completeness and correctness of the entries in the ground logbook and the on-board documents are to be examined by the support staff. Before release of the aircraft the certifying staff (AML CAT C) examines the maintenance documentation and the work of its support staff at the same time. The certifying staff is hereby entitled to specify further inspections at his discretion. The certifying employee is not bound by instructions of his superiors in all release decisions. Once all maintenance work and the associated examinations have been completed, the certificate of release to service (CRS) is issued before the flight. That

See IR Continuing Airworthiness EASA Part 145 – 145A.35 (h). A deferral of defects is not unusual, however predominant in base maintenance for the end of a layover as not to putting the handover date at risk. Such unfinished work must be communicated to the aircraft operator before aircraft release, see IR Continuing Airworthiness Part 145 – 145. A.50 (c).

212

8 Maintenance

happens irrespective of whether a test flight is planned or whether the aircraft is directly handed over to the customer. By issuing this certificate of release to service, the certifying staff confirms in the name of the organisation that maintenance was properly performed: • by an officially approved maintenance organisation and within its scope of approval, • according to the authorised operational procedures, • in line with approved maintenance data, • completely according to the assigned extent of work. and that no circumstances are known that could put flight safety at serious risk.23

8.8.2.5 Aircraft Handover After the maintenance activities have essentially been completed, the preparations for the handover of the aircraft begin. These are highly similar to the aircraft arrival and docking process, in reverse order. Stands and work platforms are first to be removed, the aircraft is lowered (if necessary) and towed out of the hangar. As soon as the aircraft left the dock and concluding maintenance work is performed on the ramp, the hangar is to be prepared for the next layover already. Concluding inspections (e.g. leakage tests) are eventually performed on the ramp. Depending on the accomplished maintenance measure, a test flight is to be performed to examine the operability of systems that can only be fully tested in flight. Such a test flight is effected on the basis of a firmly defined test flight plan and subject to a flight profile that was specified in advance. During flight, the test plan is processed according to the predetermined structure. After the evaluation of test results, concluding corrective measures and inspections usually follow on ground. Once the entire work package of the layover has finally been completely carried out and possible test flight defects were eliminated or properly deferred, the aircraft is (again) released via a renewed certificate of release to service. The aircraft can consequently be handed over to the customer (operator) and again commence flight operation. In addition to the CRS, the maintenance organisation also has to provide all release certificate originals (e.g. EASA Form 1) as well as possible repair and modification documentation to the aircraft operator.24 Many aircraft operators furthermore require copies of all certified job cards.

See IR Continuing Airworthiness EASA Part 145 – 145.A.50 in connection with 145.A.70 and 145.A.45. 24 See IR Continuing Airworthiness Part 145 – 145.A.55 (b) as well as Part M, M.A. 614 (B), subject to aviation legislation it suffices to submit copies to the holder. In practice, it is however common for the maintenance organisation to hand over the originals, retaining the copies. 23

8.9 Component Maintenance 213

8.9

Component Maintenance

8.9.1 Typical Maintenance Workshop Structure An important part of the maintenance process is effected on-wing in the hangar, i.e. directly at the aircraft, however, many components of an aircraft are removed and passed on to specialised workshops (so-called backshops) for overhaul, where qualified staff and appropriate equipment are available. Activities performed in these backshops reach from cleaning, adjustment or crack testing, all the way to complete disassembly, maintenance and modification of components and systems. Typical examples of elements to be removed are hydraulic pumps, landing gear parts, navigational instruments, galleys, seats, on-board toilets. Many maintenance organisations differentiate between specialised workshops for mechanical as well as for avionic parts. In addition to that, there are usually own backshops for engine and propeller overhaul25 as well as for near-hangar maintenance activities (maintenance support shops). Depending on the size and structure of the maintenance organisation, these specialised workshops are further subdivided. The market for component maintenance is not only covered by aircraft maintenance companies. Original equipment manufacturers (OEM) as well as independent specialised workshops with 145-approval cover the component maintenance market, offering specialised service portfolios. The areas of component maintenance presented in the following are the typical workshops in an aircraft maintenance organisation:26 • • • •

specialised mechanical backshop, avionics backshop, maintenance support shops, non-destructive testing.

Next to mechanical parts, usually also hydraulic and pneumatic devices, assemblies and oxygen systems are maintained, repaired and modified in specialised mechanical workshops. Typical examples are controllers, hydraulic pumps and/or flight controls, landing gear parts, emergency escape slides, hydraulic or valves or supply elements for hot-air and oxygen supply. Larger maintenance organisations are usually characterised by a high degree of specialisation. The areas of hydraulics, mechanics and pneumatics might thus be subdivided into various workshops. The maintenance of wheels and brakes as well as of rescue and safety components might also be distributed across different workshops. Maintenance on electrical and electronic components and systems is accomplished in an avionics workshop. Typical examples of avionic components are control and monitoring instruments, communication systems, navigational instruments and

25 26

Engines and propellers are looked at in the next chapter. Scope of approval covers A, B and C-rating.

214

8 Maintenance

systems, flight computers and flight data recorders, bus systems, generators, electric drives, batteries, engine control instruments and monitoring devices. The diversity and complexity of maintenance require a high measure of specialised expertise, especially in this sector. This is all the more valid, since avionics has undergone a trend with regard to a substitution of electro-mechanical with electronic parts for some years. Within the avionics sector extent and structure of the backshop depend on the size of the maintenance organisation. In addition to that, there are backshops that are directly assigned to the hangar in many maintenance organisations. The activities in maintenance support shops are broadly diversified and among other things cover welding, metal as well as surface work or cabin refurbishment (e.g. seating). Maintenance support shops are also typically in charge of manufacturing parts during the maintenance process.27 Activities in maintenance support shops are usually not linked to the maintenance programme and the MRB report. Activities are often based on non-routine findings, modifications and refurbishment measures as well as on SBs and ADs.28 In addition to component maintenance a Part 145 organisation usually has a workshop for non-destructive testing (NDT). Its task is to determine the condition or quality of material by means of special test methods without damaging the material or component itself. Typical fields of application of the NDT are the determination of the accuracy and resilience of welds or highly mechanically stressed structures. A typical example are also crack tests on structural elements and in particular on engine parts, that are exposed to extraordinary stress during operation. The following methods are primarily used in the context of non-destructive testing: • • • • •

X-ray inspection on basis of X or gamma rays (RT), Magnetic particle testing (MT), Eddy current inspection (ET), Penetrant method (PT), Ultrasonic testing (OT).

NDT is usually attributed to the maintenance support shop or is part of engine maintenance, since these workshops have the highest need for non-destructive testing.

8.9.2 Component Maintenance Procedures After the aircraft components concerned have been made accessible and removed, possible findings are to be labelled. Components that are not immediately reinstalled into the aircraft, are to be provided with an unserviceable tag after they In addition to maintenance, 145 organisations are entitled to manufacture a limited number of parts that are needed for work pending in own shops. For detailed information and restrictions, see IR Continuing Airworthiness Part 145 – 145.A 42 (c). 28 See Kinnison (2004), p. 159. 27

8.9 Component Maintenance 215

were removed and must always be separated from usable parts.29 This way, the risk of unintentional installation is to be reduced. After components labelling, they are transported to the responsible backshop. After arrival of the components, the attached documentation is to be examined first. Inspection procedure follows on basis of the approved maintenance data. Findings are to be documented and repaired. After the respective work is completed and defects rectified, a function test usually is to be accomplished to ensure that maintenance was successfully concluded. If all examinations are positive, the successful execution of maintenance is to be confirmed in the job card. As far as certificates of installed materials or sub-assemblies are available, these are to be attached. Lastly, release is effected by issuing a component release certificate (EASA form 1). Following the maintenance, return of the component including certificate of release is instructed to the dock. After the re-installation into the aircraft the EASA Form 1 is removed from the component and sent together with the stamped in job card to the documentation/archiving team or department. There component replacement is then booked as accomplished. ▶▶

Closed-Loop Maintenance In principle, components are to be released by an EASA Form 1 after they were maintained and before reinstallation. However, this can be dispensed with if a component is maintained for own use.30 In this case, however, a closed loop procedure31 must be defined that begins with the removal of the part from an aircraft, continues with the workshop repair and ends with the reinstallation into the same aircraft. The closed-loop procedure can be attractive for maintenance organisations, as the documentation requirements are lower than in case of releases with an official release certificate. A prerequisite for the permissibility of closed-loop maintenance is the availability of a correspondingly defined and documented process. This must, as a rule, be approved by the competent aviation authority. In addition to the prerequisites for application, procedure of component release must be described. The closed-loop release is normally carried out by stamping (certifying) the maintenance work on the part’s job card by the maintenance employee.

In addition to maintaining parts, specialised workshops can also opt to scrap them. This happens, for example, in case of safety-relevant wear parts or parts, where no approved maintenance data are available. Life limited parts are either maintained or based on their life cycle tracking withdrawn from service in time and scrapped. Next to such technical, economic criteria as well can provide cause for scrapping,

See IR Continuing Airworthiness Part 145 – 145.A 42 (d) and appropriate AMC. See IR Continuing Airworthiness Part 145 – 145.A 50 (d) 31 The opposite of the closed-loop procedure is open-loop maintenance. However, the latter term is usually only used for the purpose of explicit distinction from the closed-loop procedure. 29 30

216

8 Maintenance

if, for instance, maintenance costs exceed new procurement costs. Parts that are intended for scrapping, must be labelled accordingly and are in principle to be processed (physically destroyed) so that reintroduction into the material cycle is made impossible.32 Excursion: Equipment Pooling In addition to standard maintenance services, large Part 145 organisations partly offer component pooling for aircraft operators. Pool participants hereby receive access to the pool and can resort to aircraft parts according to individual usage agreements. If a part is to be exchanged during the term of the agreement, it is provided to the aircraft operator by the pool provider. If the pool provider is the airline’s maintenance organisation at the same time, it independently removes the parts and replaces them with new or repaired pool parts. In the meantime, the removed part is assessed in the backshop of the pool provider and depending on technical and economic aspects a decision is made as to whether it is maintained or replaced. The pool participant is ensured the constant availability of his component types, while the pool provider responsible for ensuring part availability (by replacement, maintenance, storage etc.). Pooling provides several economic advantages to airlines: • utilisation of experience, synergies and economies of scale of large maintenance organisations and reduction of operating cost. This applies in particular to airlines with smaller fleets, • increased part availability also outside the respective homebase and increased aircraft serviceability, • plannable maintenance cost and usage-dependant pool contributions (e.g. on basis of flight hours or cycles). The benefits of pooling become even more important, when taking into account that it is not sufficient for airlines to have only the components installed in the aircraft. In addition to installed parts, they must also have a comprehensive spare part repository to avoid putting the serviceability of the entire aircraft at risk due to defects of individual parts. Against this background, in particular capital tie-up, logistics and the organisation of maintenance are given a completely new meaning. However, the permanent advantages might be opposed by initially high entry costs. To be able to participate in an equipment pool, all devices of the new pool partner must be aligned with applicable technical pool standards. Only then full exchangeability can be ensured within the concerned equipment (compatibility with aircraft and engine types). Among the large pooling providers is, e.g. Lufthansa Technik AG that services approximately 1500 aircrafts world-wide. The service spectrum hereby not only

For details on material scrapping, see Sect. 9.2.5.

8.10â&#x20AC;&#x192; Engine and Propeller Maintenance 217

covers actual equipment pooling with world-wide part supply, but also the execution of demand analyses, troubleshooting as well as documentation and engineering services.

8.10

Engine and Propeller Maintenance

Engines and propellers represent the largest and most complex aircraft components. Under aviation legislation, engine maintenance is therefore not categorised as component maintenance, but is subject â&#x20AC;&#x201C; together with auxiliary power units (APUs)Â â&#x20AC;&#x201C; to its own official approval, the so-called B-rating. Limited engine or propeller maintenance can be performed on-wing, i.e. directly at the aircraft in the context of A-rating, however, as soon as more comprehensive work is to be accomplished, this is possible only in an appropriate backshop with own B-rating. The engine is hereby to be removed from the aircraft and to be transported via an air suspension system33 to the own or an external engine workshop. The respective work steps are outlined in detail in the following and are visualised in Fig.Â 8.3. After arrival in the specialised workshop the engine is subjected to a visual inspection (transport damages, use-caused damages, other anomalies, etc.) in a first step and set up or otherwise hung up. Afterwards â&#x20AC;&#x201C; usually before the engine is 5HWXUQ 7UDQVSRUWDWLRQ HQJLQH LQVWDOODWLRQ UXQ XS WHVWIOLJKW

(QJLQH UHPRYDO DQG WUDQVSRUW

7HVWUXQ 4(& EXLOGXS FRPSOHWLRQ

,QFRPLQJ LQVSHFWLRQ HQJLQH LQFRPLQJ WHVWUXQ

$VVHPEO\

'LVDVVHPEO\

&OHDQLQJ LQVSHFWLRQ 1'7 UHSDLU PDLQWHQDQFH

Fig.Â 8.3â&#x20AC;&#x192; Fundamental engine maintenance procedure

Pneumatic suspension is necessary to avoid damage to ball bearings.

218

8 Maintenance

disassembled – borescope inspections and if necessary an initial test run are performed to specify the required scope of disassembly and maintenance on basis of findings hereby identified. Depending on the maintenance event and the condition of the engine, disassembly begins on module/assembly level. This work can be implemented by less qualified staff, as the parts are in unserviceable condition, i.e. are not usable and thus not airworthy. As soon as the modules are made accessible, dismounted and disconnected from the engine, they are equally disassembled, as far as required. Subsequently cleaning, maintenance and other overhaul measures, like visual checks, non-routine maintenance or exchange of individual life-limited parts. Due to the extreme thermal loads individual engine parts are subjected to maintenance activities e.g. by non-destructive testing. Through this method, smallest defects on critical parts that are not visible by visual inspection, such as on combustion chambers, rotors, blades or housings, which are caused by material fatigue (fatigue tears) or forced ruptures (e.g. bird strike), can be identified. NDT checks are also used to check welding repairs, detecting cracks that might have formed due to the thermal tension that develops during the welding process. Once the maintenance has been accomplished, first the modules and subsequently the engine is assembled (assembly) on basis of approved maintenance data (engine manual). Likewise, during reassembly, any modifications made by the engineering to improve engine stability and performance are integrated into the engine as well. The maintenance work on engine components is eventually released by issuing an EASA Form 1. An alternative procedure is the confirmation by stamping the job card, if the module or part is intended for re-installation in the original engine (closed loop procedure). After each maintenance, it is necessary to check exactly which parts were installed in the engine, not only because of traceability, but also for economic purposes. It is not a matter of reinstalling the same parts in the same engine after overhauling, but optimally extending the maintenance and disassembly intervals. It, for example, makes little sense to integrate an assembly with three equal sub-components, two new parts with a limitation of 5000 flight hours as well as with a (third) used part with a remaining 1000 hours only, as this would already require the next module disassembly in 1000 hours. The objective therefore is an intelligent module and part-life limitation management, especially considering hard time limits. At the same time, it must be ensured that certain component configurations are complied with during assembly of new and/or parts returning from repair cycles. Following assembly, a test run at a test cell is usually required to determine whether the service parameters specified in the engine manual were complied with during the maintenance and/or overhaul process. If the test run results fulfil the requirements according the given test parameters, additional work on the engine (Quick Engine Change components, so-called QEC kits) is to be performed. The parts hereby installed are not needed for a test run, however, are required for flight operation. If the engine is put on stock after successful maintenance, preservation measures are to be performed (e.g. preservation

8.11 Archiving Maintenance Records 219

of fuel systems, attaching and detaching substances preventing humidity formation, airtight packaging).34 After conclusion of all maintenance, testing and upgrading measures, the engine is released with an EASA Form 1. The propeller or the engine is lastly again transported to the dock for aircraft installation. Shortly before the aircraft is handed over to the customer, additional performance inspections might be accomplished in form of engine run ups or in connection with a test flight. From a commercial view, engine maintenance differs from typical component maintenance in terms of a high ratio of special part that must withstand extreme stress (e.g. combustion chambers, turbine blades). These are particularly cost-intensive, i.e. material expenditure plays an above average role (up to 70 % material costs ratio) in engine maintenance.

8.11

Archiving Maintenance Records

In parallel to the aircraft handover and/or after completion of the component maintenance, the return of job cards is to be ensured. These are sent to the documentation and/or archiving team that makes a check for completeness and sorting. If necessary, the return is recorded in the IT. Subsequently, the work cards together with all other components that serve as proof of a proper of maintenance execution are to be archived.35 This includes all maintenance records that are necessary to issue the certificate of release. Data requirements provided by aviation legislation do not only serve as evidence in possible investigations of flight accidents and incidents. According to GM 145.A.55, archiving is to support an involvement of the documentation of earlier checks, if necessary, e.g. for tracing and rectification of defects for trouble shooting. In practice, however, this is only applied in cases of emergency, as the efforts required to organise archived material is usually very high. To ensure traceability of maintenance records during the specified retention period of 3 years, EASA demands compliance with the following archiving requirements: • Archiving can be ensured electronically, in paper format or by a combination of the methods. • If paper records are used, the maintenance organisation has to make sure that these records consist of a material that meets operational requirements and the legibility of records is ensured over the retention period.

If the engine is held in reserve a longer time and manufacturer standards are hereby exceeded, a renewed preservation of the fuel system is necessary. 35 Archiving maintenance records is regulated in the IR Continuing Airworthiness EASA Part 145 – 145.A.55 and the associated Guidance Material. 34

220

8 Maintenance

• Electronic records are to be secured in an IT environment that protects data and ensures long-term legibility of file formats. • Records must be protected against fire, water and unauthorised access.

References European Commission: Commission Regulation (EC) on the continuing airworthiness of aircraft and aeronautical products, parts and appliances, and on the approval of organisations and personnel involved in these tasks [Implementing Rule Continuing Airworthiness]. No. 1321/2014, 2014 European Aviation Safety Agency – EASA: Acceptable Means of Compliance and Guidance Material to Commission Regulation (EC) to the Annexes to Regulation (EU) No 1321/2014 – Issue 2 [Implementing Rule Continuing Airworthiness]. ED Decision 2015/029/R. AMC/GM Kinnison, H.A.: Aviation Maintenance Management. New York, 2004

Material and Service Supply

Similar to other industries, aeronautical organisations are highly dependent on other companies. Not only material, operating supplies and standard parts, but also components, modules and services have to be procured externally. Conditions are made more difficult by the fact that aeronautical organisations have full responsibility for the quality of the delivered products with respect to aviation legislation. Moreover traceability of material flow must be ensured from the source to installation in the aircraft for many parts. Therefore, procurement of materials and services is of considerable importance. To describe this extensive process clearly, this chapter is subdivided into three parts: Following the natural process flow, the first subchapter is dedicated to the specification of services to be procured as well as to the selection and approval suppliers. Finally, the last part of Sect. 9.1 is dedicated to the ongoing evaluation of suppliers. SectionÂ 9.2 describes the material flow within the organisation, from acceptance of goods, via storage and material processing, all the way to final assembly. Due to its importance within the aeronautical industry, material identification and tracking (traceability) will be discussed separately. In each of its own sections, the handling of nonconforming products as well as the processing of suspected unapproved and counterfeit parts is also presented. The third subchapter is dedicated to the management of subcontractors and service suppliers. Afterwards the corresponding requirements for aeronautical production and maintenance are illustrated. A distinction is made between subcontracting to organisations with and without own regulatory approval. Finally, the specifics of the outsourcing of design services and the purchase of external staff are discussed.

ÂŠ Springer-Verlag GmbH Germany, part of Springer Nature 2019 M. Hinsch, Industrial Aviation Management, https://doi.org/10.1007/978-3-662-54740-3_9

221

222

9.1

9 Material and Service Supply

Selection and Monitoring of Suppliers

9.1.1 Selection of Suppliers In terms of production and service provision, it is not enough to only resort to own resources. Materials, parts, components or services must be procured externally to a large extent. Therefore, organisations must select efficient suppliers. The search begins normally within the existing supplier pool and is extended to other companies only if required. For reasons of comparability, cost minimization and compliance there should always be several potential suppliers available in operational practice. The most important criteria for pre-selection are normally: • • • •

product and/or service requirements, price and terms of delivery, possible previous experience with the supplier, flexibility and lead times.

Once the potential suppliers have been preselected, they will be provided with the product or service specification (part numbers, descriptions, materials, designs or wiring diagrams) but also with general order information (e.g. deadline of tender, delivery date). Especially in case of complex services, a supplier can only form a proper picture of his task spectrum when provided with sufficiently detailed information. This is also important for the client to avoid later re-negotiations as well as delivery delays and cost increases during the service provision. Once the quotations have been received, they are usually evaluated by the purchasing department. In the case of complex or non-standard products, the engineering or planning departments are often also consulted for technical assessment. Apart from the abovementioned pre-selection criteria, the following criteria are applied to bid assessment and final selection of a supplier: • the criticality of the product or service, • the qualification of the supplier (e.g. product portfolio, references, certificates, approvals), • the type of cooperation (e.g., sub-contracting), complexity of service provision, criticality of the supplier/importance for the own value chain, • the general quality capability of the supplier. For smaller and medium-sized companies (SMEs) it should also be considered whether they are able to fulfill the requested order in terms of their know-how and production capacities. Especially in design and production, SMEs are also being examined as to whether they have a convincing long-term market presence. In order to be able to evaluate the incoming offers in a structured manner, these are often compared in operational practice with the help of a scoring model. Such a matrix presentation is highly transparent and facilitates decision-making, in particular since it allows weighting the individual selection criteria (see Table 9.1).

9.1 Selection and Monitoring of Suppliers 223 Table 9.1 Example presentation of an assessment matrix for selection of a supplier

Price

weighting factor

Supplier 1 weighted/ unweighted

Supplier 2 weighted/ unweighted

Supplier 3 weighted/ unweighted

Supplier 4 weighted/ unweighted

0,4

4/1,6

3/1,2

5/2,0

2/0,8

Lead time

0,1

5/0,5

3/0,3

0/0

Experience of the supplier

0,3

3/0,9

6/1,8

5/1,5

6/1,8

Own experiences with the supplier

0,2

3/0,6

5/1,0

0/0

6/1,2

Total

15/3,6

17/4,3

13/3,8

excluded due to late delivery date

Rating from 6 = excellent to 0 = inadequate

The actual assignment decision is normally taken by the purchasing department. In larger companies, especially those with a group structure, supplier selection is often done by a so-called buying center in case of important tenders. This means that a team made up from diverse departments, such as Engineering, Finance, Controlling, Production, decides together. Especially in the case of high product complexity it is an established practice to let trust and previous experience decide in favour of an already known supplier, even if there are justifiable price disadvantages or deficits in the offer. Only with larger price differences that are not credible and cannot be explained by objective and measurable indicators, the higher-priced offer is considered the lowest risk. After the procurement selection decision has been taken, the contract must be prepared and, respectively, be negotiated and signed. Especially in corporate structures the authority to sign the contractual agreement (authorised signatories) must be respected as defined in the companies power of attorney regulations.

9.1.2 Supplier Evaluation and Release Before placing an order, aeronautical organisations must verify whether they consider the supplier to be technically and qualitatively able to fulfil the service. To achieve this, structured procedures for supplier evaluation and approval with transparent assessment criteria must be in place. This applies to approved design, production and maintenance organisations as well as for companies that are certified according to the EN/AS 9100 series, and regardless of the size of one’s own or the supplier’s organisation.

224

9 Material and Service Supply

Supplier quality assessment and release is normally carried out after purchasing department and the requester (production, engineering, planning) have made a pre-selection, but always before the order is placed. Approval of a supplier is made by quality management in most organisations. This is due to the fact that the focus of the assessment is directed mostly on quality and performance of the supplier in general, and not on the detailed technical requirements of a specific order. The latter is, after all, a matter for the requesting department which has the necessary expertise for that. After quality management has been assigned to carry out a supplier assessment, the release shall be based on a general QM criteria checklist. It is important that objective criteria for type and extent of the supplier assessment are written down and are being applied. The decision can be made on basis of paper documents such as a supplier questionnaire, or on basis of official approvals or ISO EN certifications. Often, however, additional supplier on-site audits or material tests are required. Regardless of the scope of assessment, potential supplier normally receives a supplier questionnaire at the beginning of the supplier evaluation process. This is the basis for first assessment, e.g. to operational size, quality and performance capabilities, aviation industry experience and certifications (e.g. EN, ISO, NADCAP) or regulatory approvals. The questionnaire might be followed by an audit, i. e., an on-site inspection at the supplier’s facilities, a trial order or material testing. The need for this can depend on: • • • •

type and extent of the (planned) cooperation, any approval and certifications of the supplier, own operational procedures for suppliers’ assessment and release, the type of evaluation: initial assessment or extension of the cooperation.

If an audit is necessary, the supplier must prove in an on-site inspection that he has controlled processes and a practiced quality system. The auditors of quality management do not explicitly evaluate actual service provision. The potential supplier must generally demonstrate that it masters its processes. If the organisation is interested in cooperating with the supplier, even though weak points have been identified, then a specific approach must be defined for such a situation. If quality management assesses the quality system of the supplier as appropriate, the supplier is released. As in all areas of industrial aviation management, there is a commitment to comprehensive documentation when it comes to supplier assessment and approval. It must be clear from the records that decisions on the selection have been made on a factually and logically basis. If for whatever reasons this cannot be ensured for certain points (e.g. due to missing data from purchasing, no certificates or audits), this must be documented in a memo so that the decision remains valid and understandable in the long-term. The same applies to situations where a supplier is selected even when there are deviations from the objectively expected decision-making behaviour (e.g. when a supplier is selected despite bad experiences and the existence of alternative

9.1 Selection and Monitoring of Suppliers 225

suppliers). Next to the results of supplier assessment and the decision basis, the scope of work must be defined and documented.1

9.1.3 Supplier Monitoring It is not enough to assess a supplier once and then approve him permanently. Quality and performance of a supplier must be monitored on a continuous basis.2 Thus, aeronautical organisations must have a system of continuous monitoring in place that motivates (or forces) suppliers to align their operational structures that a sustainable and acceptable quality level can be provided on a long-term basis and the risk of nonconforming goods is minimised. Such a supplier assessment system is normally based on two aspects: • the operational, i. e. order-related evaluation of suppliers as well as • the periodic evaluation and control of suppliers general quality and performance capability of the supplier. Primarily responsible for order-related supplier assessment is purchasing, supported by incoming goods inspection (quality control) and the requesting department. The assessment criteria in focus are, e.g.: • • • • • •

conformity of goods (via goods receipt findings or complaints), On-time delivery (OTD), results of validation of test reports and examinations of material certificates, satisfactory clarification of warranty claims, quality of quotations, and proactive cooperation, possible customer feedback.

The overall assessment of supplier performance is thus a mosaic of data from different sources and different departments. There is no universal answer with regard to type and extent of optimum criteria for supplier monitoring. EN 9100 defines that product conformity and on time delivery should be measured as a minimum.3 In any case, evaluation criteria must be objective and replicable, so that supplier assessments remain traceable at all times. In addition to ongoing order monitoring, periodic reviews of supplier’s general quality and performance are to be carried out. These assessments are the basis for renewing the initial supplier approval. Such re-qualification is based on the consolidation of results gathered from previous deliveries. Also EASA approvals or ISO EN certifications are an important criterion of the re-assessments. See EN 9100:2016, Sect. 8.4.1 See Initial Airworthiness Part 21 – 21A.139(b)(1) and 21A.239 (c); IR Continuing Airworthiness Part 145 – 145.A.75 i.c.w. 145.A.65(b), see furthermore EN 9100:2016, Sect. 8.4.1 3 See EN 9100:2016, 8.4.1.1c) 1 2

226

9â&#x20AC;&#x192; Material and Service Supply

The re-qualification periods are aligned to type and extent of service provision, but is normally between one and two years. If systematic or repeated complaints are identified, the supplier must be requested to correction. It may be necessary to carry out an audit to identify causes and to help the supplier in solving the issue. In addition, checks around the complaint areas (e.g., goods receipt, documentation, QM system) should be intensified with the next order placed or, respectively, during the next audit. If a supplier is not able to improve deliveries, finding an alternative source must be considered. This means that this supplier may not be considered in future orders, and other sources must be used alternatively. This supplier must therefore be deleted or blocked from any pick list of possible suppliers in case of electronic order placement so that ordering from that company is excluded. However, the difficulty in the aviation industry sometimes lies in monopolistic or duopolistic market structures, which can make switching to an alternative supplier very difficult. Often, a supplier cannot be blocked due to its single-source or customer-selected vendor status. In such cases it must be ensured, at least, that increased depth of incoming inspections guarantees timely identification of nonconforming deliveries.4 Operational practice has shown that, in particular, companies that are not primarily active in aviation industry sometimes tend to save on the level of detail when it comes to supplier monitoring. A sound monitoring system, however, requires relatively high capacities, not only at the beginning but also continuously. To define a company-wide consistent process of supplier assessment, a matrix in line with the structure outlined in TableÂ 9.2 can be helpful.

9.2

Material Control and Handling

9.2.1 Material Tracking (Traceability) Aeronautical organisations are always confronted with the challenge of assuming responsibility for quality assurance and integration of products they procure from suppliers worldwide and at all levels in the supply chain. This is all the more valid, since there are obligations under aviation legislation to ensure conformity of parts and materials as well as ensuring traceability to the source of supply or production.5 By way of material tracking the organisation must always be able to ensure provision of appropriate parts by:6

See LBA (German Aviation Authority) (2002), p. 10 See IR Continuing Airworthiness 145.A.42 (a)(5) and GM 21A.139 (b) (1) 6 See EN 9100 series 8.5.2; 4 5

9.2 Material Control and Handling 227 Table 9.2 Exemplary basic structure for clustering supplier performance 90–100 %

70–80 %

60–70 %

Below 60 %

description of supply performance

Delivery and provision of products & services is completely in accordance with requirements

Product is satisfactory, however deliveries occasionally show defects (Packaging damage, missing certifications, etc.)

Product corresponds not entirely with the specification, there are larger deficiencies, which require reworking (transport damages, deficiencies due to improper workmanship, exceeding tolerances, etc.)

Product has considerable deficiencies and can only be used after significant rework (e.g. faulty execution of production or maintenance, Products or parts thereof do not correspond to specification)

assessment of supplier qualitiy

sufficient supplier performance

volatile supplier performance

improvable supplier performance

insufficient supplier performance

necessary measures

none

Supplier ist requested to implement selective corrective actions necessary

Supplier is requested implement corrective actions immediatly

Supplier blocked due to substantial quality deficiencies

• ensured traceability back to serial, charge, batch or lot number – even if the part or material is installed in another part (next higher assembly). • ensuring traceability of the product history and showing differences between nominal and actual condition of the product (as built versus as designed configurations). • tracing back all products made of a same raw material or production lot, from purchasing source up to final use (delivery, scrapping).7 Organisations must therefore be in a position at all times to ensure reliable identification of parts and materials used, from the origin or manufacturer to installation, scrapping or transfer of ownership. However, not all aircraft material is affected. Therefore, every organisation must have clear criteria for which parts require traceability.

This means, e.g.: If 100 m2 sheet metal were purchased and used in production of three different aircraft fuselages, it must always be traceable in which aircraft and which parts the material is used.

228

9 Material and Service Supply

Critical parts are subject to full traceability. For parts that do not have to be traced consistently, traceability in operational practice often is only carried out starting from subassembly level. Thus, single parts such as capacitors, resistors or nuts and screws are exempt from consistent traceability. Responsibility for defining the extent of traceability lies normally with the customer, or the respective 21J design organisation. Consistent and continuous material tracking requires a defined, formal process. Such process must comply above all with the strict requirements of documentation control. The organisation must not only be able to maintain the product identification or product-accompanying documentation consistently. For appropriate traceability, the product master data and associated movement and processing must be registered. Only then it is possible to obtain information on the status quo of the product as well as on its entire previous history including the associated components (materials, subassemblies) at any time. For an aeronautical organisation, material tracking begins with the acceptance of goods, but includes tracing all the way to the original producer or source. Traceability then continues inhouse. All materials must be provided with a label documenting a clear material identification. In operational practice, two methods are mainly applied. Labelling can be based on own or supplier-provided identification. • Tracking via enclosed certificate. Unique identification characteristics for traceability is the serial number. With non-serialised parts and materials, traceability is ensured via charge, batch or lot number. • Tracking via a goods receipt number specified by the organisation at goods receipt. Both the product itself as its accompanying documentation are then labelled with a sticker identifying the goods receipt number. Using an internal number definition, it must be ensured that the numbers are carried along all the way to the final use inhouse. After a unique (external or inhouse generated, individual) ID number has been specified, material tracking continues via stock keeping and issuance of material all the way to final operational use inhouse. Where uninterrupted full traceability is demanded, it presents a considerable challenge to material control. Not only goods receipt, stored or issued to production must be traced, but also (charge) separation, packaging and preservation processes as well as subcontracting services. Accompanying documentation, respectively the copies in the case of separations, remains with the product during its entire duration (Fig. 9.1). Only immediately before assembly or installation in another component (next higher assembly) or into an aircraft, are the certificate and the tracking label removed and archived with the production or maintenance documentation. Without IT support and associated tools (e.g. barcodes, RFD or labels), complete documentation of the material flow is almost impossible. However, a consistent material tracking even in spite of extensive IT regularly causes considerable problems in practice, since in quite a few organisations different, not fully coordinated IT systems are used.

9.2 Material Control and Handling 229

Fig. 9.1 Certificate attached to supplied raw material

9.2.2 Acceptance of Goods The beginning of the inhouse material movement is the receipt of goods. Before the supplied parts enter the internal material cycle, the organisation must make sure that they fully comply with order and purchase requirements. For this reason, all parts and materials are to be subjected to an incoming inspection after receipt of goods, in which they are checked for quality and completeness. Only when the products comply with the purchase order requirements, i. e., when they show no deficiencies or discrepancies, they may be integrated into operational material flow (storage, processing, installation). The production or maintenance organisation assumes responsibility over the received parts or materials after successful completion of the goods acceptance inspection. There are only a few organisations where goods receipt do not form a bottleneck. This is less due to the fact that there are large quantities to be handled, but more so to comprehensive inspection criteria and need for clarification. In operational practice delays of one or two working days are not unusual. Especially against this background, it is important to clearly define the process of goods receipt until completion of incoming inspection. To do this, the following core elements are to be determined and documented:

230

9 Material and Service Supply

• Activities of incoming inspection, in particular (processes in goods receipt findings) or statistical preconditions for random sampling inspection. • Identification of storage and (inhouse) transportation requirements • Definition of the competences within the goods receiving area8 as well as determination of responsibility for goods declaration Since incoming inspection serves to identify insufficient performance from suppliers, this is necessarily an important activity. From an economic perspective, however, this activity does not add any value. Thus, it should be checked which products or suppliers warrant random sampling test. To reduce the number of rejections and nonconformities, similarities in findings from a supplier should identified. Goods Acceptance Process Once goods are delivered they must be directed to a specially assigned incoming goods area and registered. The registration is done either via corresponding software or a purchase journal. Registration should comprise as a minimum, the date of receipt, the supplier, the purchase-order number and a short description of the content of the delivery. Then a simple incoming check is performed. This includes comparing the compliance of purchase order with the delivered products and the enclosed delivery documentation. Ideally, a simple incoming check includes the following activities in detail:9 • Visual inspection of the packaging checking for any damages, compliance of the supplier and or manufacturer name with the label/designation, • Visual inspections of the product for obvious modifications or damages (e.g., surface damages, deformations, corrosion), • Comparison between order, delivery note and delivered products regarding quantity and accordance of the part or serial number, • Evaluation of the attached documents. These must comply with the accompanying documentation as specified in the purchase order by the customer. Next to the delivery note this covers the certificate of conformity or release certificate as well as possible other product information such as FAI report or other test reports, etc., • Random sample analysis of standard parts as well as of raw material and consumables (e.g., on basis of the material data sheets or attached test reports).

8 Responsibilities for simple incoming inspection lie normally with warehouse staff (where applicable, with specifically trained incoming inspectors); in complex components there are in addition further technical inspections carried out by the requesting sector (extended incoming inspection). 9 See partly identical, partly complementing requirements of incoming inspection that can be found under Federal Office of Aviation (2002), p. 3 et seq.; Federal Office of Aviation (2003), p. 3 et seq.; EN 9100 series Sect. 8.4.3

9.2 Material Control and Handling 231

Typical Suppliers Accompanying Documents • delivery note, incl. proof of origin v and product/material certificate • production or maintenance records • official release certificates (EASA form 1, FAA form 8130-3, TCCA form 24-0078) • certificate of conformity (CoC) or other certificates of compliance, with reference to a recognised standard, • Test or FAI reports, statistical records, other proof of origin, indicating the revision status • CofA for Export for engines or propellers from a non-EASA country

If delivery fully corresponds to the order requirements, i. e. the incoming inspection has been completed successfully, the product can then be directed into the operational material flow. Before it leaves the goods receipt area together with the supplied documentation, the product might additionally be provided with a tag/note to simplify traceability and to assign product or material to a work order, where required. Following that, the goods are transported from the goods receipt area to storage, processing or assembly. If the incoming inspection was not concluded successfully, the affected parts and material must be stored in a restricted storage area commonly known as a quarantine.10 EASA Part 21G, also EN 9100 requires a clear segregation of discrepant parts and materials from the production area, thus preventing the risk of unintentional use in production or maintenance. The product may only be removed from the quarantine area after clarification of the complaint or after a decision regarding further use. Next to the operational incoming inspection described above, final verification activities onsite are sometimes carried out at the supplier’s facility in order to avoid that discrepancies are only detected upon arrival. This procedure is used in particular for complex products with high transport costs, where there is possibly an increased risk of (partial) rejection. When the product finally arrives for final incoming inspection at the goods receipt area, only a (simple) visual check is performed to inspect, for transportation damage. To ensure traceability, documentation must be maintained all across the important activities of the goods receipt. For that reason, the delivery note as well as the certificates supplied need to be scanned or, copies must be filed as purchase records. Last but not least, any discrepancies, damage, concessions and corrective action as well as the results of complex inspection activities (e.g., incoming inspection

10 Reasons for a goods rejection or goods clearing could be: incorrect or missing accompanying documents, quality discrepancies against drawing requirements, damages, wrong part numbers or goods quantity. In the case of goods considered as suspected counterfeit parts also: serial numbers obliterated by stamps, signs of previous use, labelling unclean, new paint coat over old, modified or unusual surface, lack of required surface protection, scratches, signs of external repair attempts, or corrosion.

232

9 Material and Service Supply

reports, random samplings) must be documented.11 In this way, not only requirements for traceability are met, such information also provides an important element of supplier evaluation. ▶▶

Five Questions for Mr. Henner Gärtner, Logistics Expert for the Aviation Industry12 Which are the greatest challenges which aeronautical organisations are facing? The aviation industry is well familiar with quick responses and therefore expects very short reaction times. Hardly any understanding is given to logistics providers that a very fast external delivery to the compound of the company is followed by a long inhouse throughput time before the goods are ready for processing at the right location on-site. However, legal, regulatory or customer demands force logistics to undergo numerous process steps which are rarely perceived by outsiders: • Customs requires a detailed report on the contents of the delivery, including a check for import restrictions. • Material accounting and runtime control do not just require the identification of the article. Instead, they specifically want us to identify an article with its individual serial number. • Our inhouse customers also expect received stock items to be checked against any open short-term demands. • Critical operational situations need to be dissolved rapidly by incoming inspection, allowing newly arrived goods to be shipped to the operators worldwide as quickly as possible. • After receipt, the material required for production is distributed inside our large premises. Then order-picking needs to take place at the point of use so that the goods are finally made available to the onsite mechanics. • After all, logistics is also involved when it comes to opening the production order. The above process chain must be executed in a shrinking timeframe, , in spite of increasing demands by lawmakers, authorities and clients. Only thus, throughput times can be reduced continuously.

See EN 9120:2016, Sect. 7.5.3 Dr. Henner Gärtner is Professor of Logistics at the HAW Hamburg, University of Applied Sciences). Before that, he worked with Lufthansa Technik AG and with Lufthansa Technik Logistik Services GmbH for more than 15 years. Most recently, Prof. Gärtner was Head of the Central Goods Receipt department of the Lufthansa Technik Base in Hamburg. 11

9.2 Material Control and Handling 233

In which way can the process steps be lined up closer together? To shorten throughput times, it is most essential to consequently eliminate stock buffers. Stock is always problematic, especially if it does not accumulate in one place but are scattered throughout the process. In large companies, a view of the entire process chain is often missing, since every step in the process chain is the responsibility of another organisational unit. Each organisational unit proudly proclaims to act within his promised throughput time, for example for 97 %, 95 % or 90 % of all deliveries within the same day. This is the so-called service level, the performance promise offered to the customer. If, in the first of the above-mentioned process steps, we maintain 90 % of the service level and also achieve this in the second process step, the result is a service level of only 81 % multiplicatively. 19 % of the parts are therefore delayed at least one day, some even two days. The multiplicative effect occurring in series connections of process stepts must always be kept in mind. If a stock buffer can be eliminated completely bringing string of pearls of the process closer together in terms of time, the processing time decreases and the service level is increased. Do you have an example how to eliminate a stock buffer? At Lufthansa Technik Logistik Services GmbH, we have created a work island for a team of six employees with two different process steps. A roller conveyor not only serves as a means of transport between the two process steps, but at the same time to absorb small variations in the workloads. Once the roller conveyor and thus the maximum permissible storage buffer is full, then one of the staff must switch from one to the other process step, for which we have invested in cross-qualification. This flexible work organisation allows us keep only a minimum buffer between the two process steps . Operating figures prove us right: we were able to reduce throughput time by 70 % in the described process. In the area of material traceability, requirements of the aviation industry are more complex than in other industries. What is being done to reduce the associated effort in future? The aircraft industry spends a lot of time on the identification of components. The reason is that we are highly interested in an accurate condition monitoring of each individual part. With the A350, Airbus puts suppliers under obligation to fundamentally simplify processes around component identification. All repairable parts of an A350 are therefore labelled with an RFID tag. For the first time, we have the chance to automate the identification so that we no longer have to read the serial numbers manually with a magnifying glass. Thus, the process of receiving goods can often be substantially accelerated.

234

9 Material and Service Supply

Why would OEMs have any interest in RFID tag identification? Despite the former and current impediments with manual identification, hardly any industry knows its components in the life cycle as detailed as the aviation Industry. In addition to safety aspects, our processes need to be economically efficient. Many of the components are highly expensive, and repairing them is profitable. Until now, we are collecting many data but barely use them as resource to solve other problems apart from its original purpose. Currently, every change of a component in the aircraft is documented, classified as scheduled or unscheduled and the exact reason of removal is taken down. The data are not yet linked to other information. If we link information concerning failure rates with the operating area of the aircraft (e. g. in the desert or in humid tropical climate), then we can individualise the previous statistical runtimes (e.g. every 20,000 flight hours for component XY) and can run our flight operations even more economically. Aircraft or component-manufacturers can use our newly combined data to further optimise their products. This is a main expectation addressed to MRO operations in the context of increasing digitalisation.

9.2.3 Stock Keeping Following goods acceptance, the material is either directed towards production or maintenance processing area or is put in stock. If storage is intended, the storage instructions of the manufacturer or self-defined requirements must be strictly adhered to. EASA as well as EN 9100 have defined fundamental requirements concerning stock keeping of parts, equipment, tools and materials.13 According to these it must be ensured that: • serviceable and unserviceable parts and materials must be separately stored. This means not only a separation between serviceable and unserviceable products, but also separate storing of aviation material and non-aviation material. In practice, this is particularly causes problems for organisations that are not focused on the aviation industry (only). • no deterioration or damage on the stored parts or materials may occur. Special attention must here be paid to maintaining an appropriate room temperature (approx. 15° to 30°C) and air humidity (30 % up to 70 % ambient humidity). Storage must furthermore be free of direct exposure to the sun, noxious gases, fumes and not more than average dust formation. In everyday operation the associated processes are not always sufficiently specified. In particular, corrective measures in case of deviations from the storage conditions are not defined.

See IR Continuing Airworthiness Part 145 – 145.A.25 (d) as well as for production GM 21A.139(b)(1), EN 9100:2016, Sect. 8.5.4

9.2 Material Control and Handling 235

• access to storage facilities must be limited to authorised personnel. This is to ensure controlled goods entry and goods removal. At the same time, traceability can thus be better ensured and the standards of stock keeping can be better maintained. Freely accessible storage facilities, on the contrary, would considerably increase the risk of non-transparent and non-traceable removal from stock. • a structured procedure for compliance with the manufacturer’s specifications in the area of responsibility of stock management exists. In everyday operation there are occasional deficits in monitoring shelf-life limits with operating supplies (paints, resins, adhesives, lubricants, etc.). Here carelessness or inattention play an important role. This behaviour is encouraged by a lack of control system or a lack of structure in stock supervision. If parts or materials are requested from the warehouse for installation or dispatch, an outgoing goods inspection (rough visual check) is to be carried out. This check should determine the conformity of part or material as well as whether shelf life is exceeded. Special Storage Requirements of Selected Parts and Materials14 • Cockpit instruments as well as components with connections to pneumatic or hydraulic lines must be sealed professionally. Dehumidifying substances should be employed and monitored where required. • For engines and gearboxes special consideration must be given to the manufacturer’s preservation/conservation regulations. • When storing metallic raw materials and consumables (sheet metals, steel, light alloys) special attention must be paid to traceability, i. e., to a corresponding clear marking by the manufacturer (roller stamp). Remaining material must be provided with a material marking when returned to the warehouse. • During storage the risk of surface damage caused by scrubbing is to be minimised. Appropriate preventive measures are to be taken, e.g., by use of separating protective material or retention of the surface protection applied by the manufacturer. • Fibreglass fabrics, glass yarns and similar fibre composites must remain packed up until use and stored flat, free of heavy weights. • Powdered materials require storage in closed containers. • Batteries must be stored cool and dry in well ventilated areas on slat frames or pallets. Storage directly on stone or concrete floor is not permitted. For materials that, due to manufacturers standards, may only be stored under controlled conditions, an air temperature and humidity monitoring system must be ensured. The room climate data requires recording, so that installing only a thermometer and hygrometer in the warehouse is not sufficient without the corresponding data retention.

See above all LBA (German Aviation Authority) (2002b), p. 8 et seq.

236

9â&#x20AC;&#x192; Material and Service Supply

In addition to that, it should be determined before internal goods issue that all ADs or technical notifications of the manufacturer for that product were applied. In practice, however, these activities rarely occur as a structured element of the goods issue. Ideally a visual check or an examination of shelf life limit is made there. ADs or technical instructions by the manufacturer should usually be monitored by Engineering, hardly ever by goods issue. Sometimes an own, separate warehouse for provided material of the customer is agreed upon in customer contracts. In this case the implementation of customer-specific stock is necessary, which then may be accessible only for a limited group of staff. In addition to legal requirements for storekeeping, production and maintenance organisations see themselves furthermore confronted with complex economic challenges. They must do no less than manage the trade-off of ensuring on the one hand maximum availability of parts and materials and, on the other hand, meet the demand for minimisation of capital and storage costs. The search for an optimum provision with stocks is furthermore made difficult by the fact that in real life the theoretically determined stock level require frequent and quick corrections due to process malfunctions (e.g. order or delivery delays, incorrect orders, wrong deliveries, quality deficiencies). The identification and successful implementation of an economical optimum is thus extremely difficult.

9.2.4 Material Handling One of the core activities in material handling is the internal provision of materials, so that production staff can carry out their job orders. The following ways of provision apply: â&#x20AC;˘ Material issue: Parts and materials will normally be handed out to production staff via a controlled material issuing office. The production employee requesting for material reports his demand as well as the associated job order number to the issuing office; warehouse staff organises the corresponding material from stock, books it into the order and hands it over to the requester. â&#x20AC;˘ Open storage: In addition to controlled material issue, aeronautical organisations normally have small storage rooms for small parts (screws, rivets, wearing parts, fuels). This gives production staff simple, fast access to frequently needed small standard articles near their workplace.15 Open storage, however, always requires a certain attention from production staff, because the materials are withdrawn under their own control. Production staff is therefore responsible for maintaining traceability (by linking charge or batch number and work order)

See Kinnison (2004), p. 173

9.2 Material Control and Handling 237

• Commissioning: Commissioning means that material requirements are requested according to parts list as per work plan at a fixed time and made available at the workplace by logistics. Commissioning has thus the advantage that production staff can focus entirely on the actual execution of the job order, as provisioning and inhouse procurement are being handled for them. After taking over the part or material, production staff is responsible for it. This is valid particularly for its marking as well as for any temporary storage in the direct work area. If parts or materials are handed over to production employees by material issue office, they must ensure that the part number of the product complies with the specifications in the work order. It must also be ensured that the parts are always accompanied by a release certificate or conformity statement.16 In maintenance, a tag ensuring traceability suffices before the repairing process (e.g., an unserviceable tag). If an appropriate documentation on the part is missing, the material must be refused and quarantined, since traceability cannot be ensured. In addition to certificates, the product may also be accompanied by a material consignment note as well as, if necessary, special references on handling of sensitive or dangerous products or safety warnings and shelf life limits. After handover of the part from material issue to the worker, processing or installation of products follows according to the job order. If any temporary storage should be necessary, sensitive products are to be protected while they are not used. The documentation remains thereby physically attached to the product until this is installed into another component or into the aircraft. Only then the certificate, together with the job order, may be added to the production or maintenance records. If defects in the product occur or are identified during processing, the part must clearly be labelled as defective. Maintenance parts that cannot be used are usually marked with an unserviceable tag (see Fig. 9.2). In parallel it must be ensured that such a defective product is kept separate from serviceable parts and materials in specially marked areas, to prevent unintended use.17 This also applies in production, but even more so in maintenance where the repair of parts (i. e., unserviceable parts) is part of daily business. Occasionally, parts and materials are returned back to the warehouse. This situation can occur, e.g., when too much, incorrect or faulty material was supplied. In this case, the material is handed over to material issue with a clear identification (certificate, serviceable or unserviceable tag), so that it can be booked out of the internal order to maintain traceability. Once there, it is subsequently either re-stored in the warehouse or shipped back to the supplier.

16 Depending on organisation procedures applied, this can be waived for products maintained in a closed-loop process, as a serviceable tag suffices here. 17 See IR Continuing Airworthiness Part 145 – 145.25 (d); EN 9110:2016 Sect. 8.5.4

238

9â&#x20AC;&#x192; Material and Service Supply

816(59,&($%/( /$%(/

,167$//$7,21 5(029$/ '$7$6 : 2 1R ,QVWDOOHG LQ UHPRYHG IURP

3RVLWLRQ

+RXUV

/DQGLQJ &\FOHV

3$57 5(029(' 3DUW GHVFULSWLRQ 3DUW QXPEHU 6HULDO QXPEHU 8QVFKHGXOHG 86

5HDVRQ IRU UHPRYH

2 8 6 2 7 6 6FKHGXOHG 6'

2 7LPH[ 2 6WDJJHU 2 0RGLILFDWLRQ

3(5)250

3HUIRUPHG E\ &RPSRQHQW 5HPRYHG

761

6LJQ 6WDPS

6WDWLRQ

'DWH

762

&61

&62

&RXQWU\

5HSDLU 6WDWLRQ 2UGHU QR

Fig.Â 9.2â&#x20AC;&#x192; Tag for unserviceable material

9.2 Material Control and Handling 239

9.2.5 Nonconforming Products A common occurrence is an occasional poor execution of production or maintenance work, where damage is done to the product. Defects in supplied parts and materials may also not always be detected during incoming inspection, but when they are being processed. Nonconforming products are therefore a part of everyday operation. To minimize the risk of unintentional installation or delivery of these parts or materials, nonconforming products require special treatment and control. Aeronautical organisations need transparent procedures and clear responsibilities for control of nonconforming material. Not only must defective, i. e., non-conforming products be clearly identified as such, but they must also be separately controlled. Regarding further use of nonconforming products, the following options are available:18 • Rework according to approved design data or approved standard procedures/ practice. • Scrapping • Return to the supplier (warranty) • Rejection for evaluation by the manufacturer (OEM) • Agreeing with the responsible design organisation as well as with the customer for use-as-is in the actual condition authorised by concession. In case of a correction of the defect, not only the defect itself has to be rectified. In addition appropriate corrective measures should also be taken to prevent the recurrence of the error. This requires a coordination between the certifying staff and the engineering, possibly including the planning. Under certain circumstances, the responsible design organisation and the customer may be involved in the decision-making process. The participants must then clarify whether a use-as-is or under what conditions after correction a (special) release is possible. In operational practice all organisations have a structured procedure in place for dealing with nonconformities. However, experience has shown, that especially for correcting smaller deficiencies, approved design data or approved procedures are not always applied. In these cases, rework is often carried out on the basis of personal know-how of the executing production staff. This is strictly not allowed. The risk is even higher when the organisation has no Part 21J design approval or when proximity to the responsible engineers is missing. An unapproved correction will result in an unapproved part, so airworthiness is not ensured and the part may not be operated in an aircraft or component. Last but not least, in practice, the customer is involved many times too late in the correction process. This can be observed – not surprisingly – most often when the causes for nonconformities lie in the own organisation and not in the customer specification or in the suppliers responsibility.

See EN 9100 series (2016) Sect. 8.7

240

9 Material and Service Supply

Product rework is, however, not allowd, if: • products show an irreparable defect • parts do not comply with approved design data and it is foreseeable that compliance to approved data can be achieved • parts indicate a life limit (life-limited parts) that has been exceeded, or complete history documentation cannot be provided • non-approved, irreversible changes were made to the product • parts and materials were exposed to extreme conditions (temperature, loads, contamination etc.) and could not be restored to their original condition Such products with irreversible deficiencies are to be scrapped. This has to take place in a way so that the product is made permanently unusable and is easily identifiable as such. Figure 9.3 gives an overview of permitted and inadmissible methods of scrapping.

9.2.6 Suspected Unapproved Parts and Counterfeit Parts Suspected unapproved parts are parts of doubtful origin. For these parts it cannot be ensured, that they were produced or maintained in accordance with approved or acceptable data. These can enter aviation industry operations through invalid or missing certificates, accompanying documents, or histories; this may include wrong part number markings or packaging. For this reason, it must be assumed that the parts, components or materials concerned were not produced or maintained 3HUPLWWHG VFUDSSLQJ PHWKRGV

,QDGHTXDWH VFUDSSLQJ PHWKRGV

EXUQLQJ

VWDPSLQJ

JULQGLQJ

PDUNLQJ

PHOWLQJ

SDLQW VSUD\LQJ

VDZLQJ LQWR VHYHUDO VPDOO SLHFHV

GULOOLQJ VPDOO KROHV

SHUPDQHQW GHIRUPDWLRQ GLVDVVHPEO\ RI D VLJQLILFDQW H[WHUQDO RU LQWHUQDO FRPSRQHQW

LGHQWLILFDWLRQ E\ WDJ VDZLQJ LQWR WZR SLHFHV

FXWWLQJ LQ D KROH

Fig. 9.3 Permissible and inadequate methods of scrapping aircraft material19

See LBA (German Aviation Authority) (2000), p. 2

9.2 Material Control and Handling 241

following authorised or approved procedures and then released. Since exact quality of a suspected unapproved part cannot be easily proven, it poses a potential risk to airworthiness and safe operation. In addition, there are counterfeit or bogus parts that have been knowingly placed on the market as unauthorised copy, imitation, substitute, or modified part. Counterfeit or bogus parts parts must therefore be quarantined and reported to the responsible aviation authority. The causes for unapproved parts can lie both in careless trading and in fraudulent intent. The LBA, the German-aviation authority, thus reports for example of a company residing in Florida that sold aircraft bolts as new, with all necessary certificates, in spite of evident signs of wear.20 Since suspected parts are rated a virulent risk by the authorities, their websites usually provide information and assistance for identification and reporting of such parts. The FAA goes a further step and lists under their Unapproved Parts Notifications (UPN) all those organisations by name that have brought counterfeit parts into circulation.21 For the last 10 years there have been about 10–20 reporting notifications annually. An identification of these parts is not always simple in operational practice due to high similarity with approved parts. Often original and wrong parts differ only by the applied production methods or the material used. Indications that could point to a non-approved part are (see also Fig. 9.4):22 • when the demanded or advertised prices are unusually low, and thus clearly deviate from those of the competition • market-atypical, because of clearly shorter delivery time than those offered by well-known competitors, in particular when the requested parts are generally not readily available on the market, • the supplier is not able to supply drawings, specifications, manuals, detailed information concerning maintained parts or the release certificate • when during sales negotiations impression is arised that –– unusually large quantities of parts are available, –– atypical modes of payment are demanded (e.g. cash payment) or –– unusual (foreign) accounts for money transfer are communicated. However, each of these signs is not automatically an indication of counterfeit parts. These are only hints that help heightening awareness. As preventive measures against bringing counterfeit parts in circulation in one’s own organisation, careful selection and monitoring of suppliers, are suitable as a first step. Apart from the respectability of the suppliers the existence of an effective quality management system that contain measures for the identification of unapproved and counterfeit parts should be in operational practice.23 See LBA (German Aviation Authority) (2000), p. 1 See FAA (2012), http://www.faa.gov/aircraft/safety/programs/sups/upn 22 See LBA (German Aviation Authority) (2000), p. 2 et seq. 23 EN 9100:2016 in Sect. 8.5.1.4 asks for measures against suspected unapproved parts and counterfeit parts. 20 21

242

9 Material and Service Supply

6XVSHFWHG GRFXPHQWDWLRQ

6XVSHFWHG GHILFLHQFLHV LQ SURGXFWLRQ RU PDLQWHQDQFH QRW PDQXIDFWXUHG LQ DFFRUGDQFH ZLWK DSSURYHG RU DFFHSWHG SURFHGXUHV QRW PDLQWDLQHG LQ DFFRUGDQFH ZLWK DSSURYHG RU DFFHSWHG SURFHGXUHV QRW LQ DFFRUGDQFH ZLWK SUHVFULEHG RU UHFRJQLVHG VWDQGDUGV QRW LQ DFFRUGDQFH ZLWK WKH DSSURYHG $ & W\SH

PDQLSXODWHG OLIHWLPH OLPLWV ,QDGHTXDWHO\ ILOOHG LQ GRFXPHQWDWLRQ PLVVLQJ FRPSOLDQFH GRFXPHQWV 'RFXPHQWDWLRQ GRHV QRW ILW WR SDUW RU PDWHULDO 0LVPDWFK EHWZHHQ WKH FRQGLWLRQ RI WKH SDUW PDWHULDO DQG WKH LQIRUPDWLRQ LQ WKH GRFXPHQWDWLRQ LQWHQWLRQDOO\ DOWHUHG GRFXPHQWV

6XVSHFWHG LQDGHTXDWH DSSURYDO RU DXWKRULVDWLRQ 2IILFLDO RUJDQLVDWLRQ DSSURYDO IDNHG 2UJDQLVDWLRQ ZDV QRW DSSURYHG IRU LVVXHLQJ UHOHDVH FHUWLILFDWHV ,QDGHTXDWH VFRSH RI DSSURYDO

&HUWLI\LQJ VWDII GRHV QRW H[LVW RU QDPH VLJQDWXUH LV IRUJHG

Fig. 9.4 Possible reasons for rejection of material or parts

In addition, product inspection has proven to be an effective protection against unapproved and counterfeit parts. Of greatest importance in this context is the incoming goods inspection and the qualification and awareness of goods receipt staff. Maintenance organisations must have a documented procedure in place for handling with unapproved parts. During identification the following aspects are to be considered: • identification of all places where the material may be stored • clear identification of suspicious parts as unserviceable or rejected • blocking the use of all affected material including line maintenance station material • isolation to keep the parts concerned from circulation by separate storage • preservation of evidence, • provision of information to the responsible aviation authority

9.3 Subcontracting 243

9.3 Subcontracting 9.3.1 Preparation and Monitoring of Subcontracting The aviation industry procures not only uniquely defined materials and serialised products, such as catalogue parts or standard material. Procuring covers more and more often highly specific products and services such as special production processing or engineering services. This is called subcontracting. Due to its high specification such services require detailed preparation as well as appropriate design support. External services must therefore be planned and instructed at the right time, relevant documentation must be provided, and performance and deadlines be monitored to ensure smooth entry into the organisations own value chain. This complex task is often made more difficult by lack of proximity between client and contractors. Insufficient familiarity of the supplier with aviation regulations concerning obligations and requirements may pose a quality risk, especially during the initial phase of the business relationship. A subcontractor, unlike inhouse staff, often lacks detailed knowledge with respect to project expectations and working techniques as well as implementation and fulfilment of aviation regulation requirements. In addition, the expected deliverables cannot always be specified down to the last detail in the bidding phase, making further need for coordination necessary. The starting point of a subcontracting is planning the work package together with a procedural concept. From an aviation perspective, the following questions and issues must first be clarified: • What is the subcontractor required to deliver (definition of the subcontracting work package) and under which approval is this to happen? • What is the schedule and which milestones are necessary? • How are the responsibilities distributed and how is communication between the parties to be arranged? • Which own documents are put at the disposal of the contractor (e.g., specifications, approved data, information regarding standards, templates)? • Which unfamiliar documents are put at the contractor’s disposal (e.g. CMM, IPC)? • Which documentation must the contractor provide at which milestone event? • Which test requirements are to be fulfilled by the subcontractor and which verification checkpoints are to be performed by the own organisation (client)? • Which documentation and/or certificates is the contractor to enclose with the deliverable hardware (CoC, EASA Form 1, FAI Report, etc.)? • How is monitoring of the subcontractor and his subs at all levels of production to be arranged? Once a process concept has been drawn up, including the scope of the work, and the type of outsourcing has been agreed in accordance with aviation legislation, the required activities must be displayed in a time schedule. This is normally followed by assessment and selection of suppliers that could come into question. The process

244

9 Material and Service Supply

for selecting suppliers follows the one described under Sect. 9.1.1. In the course of contract negotiations, the important questions regarding the cooperation must be defined clearly. This typically includes:24 • definition of necessary contributions or preparatory services of the client • procedure in the case of deviations from agreed service (e.g., handling design changes) and requirements concerning nonconforming products handling • characteristics in the production processes to be applied • requirements concerning design, showing of compliance including tests and inspections as well as verifications and product acceptances • conditions for further subcontracting by the contractor • type and scope of support services by the own organisation (e.g., material provision, NDT) • requirements for record keeping and long-term archiving • right of access to relevant facilities for the client and his responsible aviation authority Once these issues are clarified and the contract with the subcontractor is finalised, the client must ensure that all information as well as any resources are put at the disposal of the supplier on time for fulfilment of the order: • Work package with all design data, instructions, specifications (e.g., designs, workflows) for production or maintenance, • operational specifications of the client (operational standards/minimum quality requirements, process instructions) • Material and parts, • Dispatch, transport and storage requirements, • Resources like supervising or supporting technical staff, operating materials. Operational Monitoring of the Subcontractor Every aeronautical organisation has to supervise its own suppliers. When subcontracting, not only the suppliers quality system and the contracted end-product must be controlled by the client, but often also the process of service provision as such. While monitoring the quality system takes place separately from individual procurement orders, the actual work in production can only be supervised on a per-order basis. The extent of monitoring the service provision is based on individual conditions and capabilities of the subcontractor.25 It must be kept in mind, however, that not only control of final inspection is required but, under certain circumstances,

24 25

See Part EN 9100:2016, Sect. 8.4.3 See Sect. 11.3 (Auditing)

9.3 Subcontracting 245

supervision during the entire duration of processing the subcontract.26 In general, the following criteria affect the extent of supplier monitoring during and at the end of the contracted work:27 • The experience of the contractor with comparable work and experience with technologies and procedures to be applied. The aeronautical organisation must supervise and perhaps even control his supplier all the more, the less experience it has. In operational practice this can even reach a point where the client supports his supplier temporarily with own technical staff for service contribution onsite. • The experiences aeronautical organisation has made with its contractor. A reduction of monitoring effort can take place once the contractor has stabilized his processes. In addition, the cooperation (communication, documentation provision, etc.) of both partners must be sufficiently coordinated and proven on basis of satisfactory results. • The kind of activities that have to be carried out. The extent of monitoring depends not least on whether the service provision is characterized by a stable, simple and repeatable process (e.g., series production) or whether it concerns a complex, moderately transparent work package (e.g. in the context of an individual manufacture, a prototype or a small serial production, special process treatment). The more transparent the monitoring of service delivery and the easier it is to learn the process, the more likely it is to consider reducing monitoring/ support. • The importance of the subcontracted services for the client’s own product or its own value chain. Production of jigs and tools, e.g., is normally less subject to monitoring than processing of critical aircraft parts. This makes clear that the monitoring of a contractor can lie anywhere between only final inspection, via joint milestone reviews, up to continuous onsite support at the supplier’s premises, including provision of own staff. The responsibility for type and extent of monitoring and for any support always lies with the aeronautical organisation. In the end, it is the client who is under obligation to prove to his customer or the responsible aviation authority that with this level of supervision his products, including procured parts and services, attain sustainable airworthiness. Two distinct variants of subcontractor interaction come into question (Fig. 9.5):

This is not only required by aviation legislation. Ensuring adequate quality is also a matter of the organisations own (economic) interest. In the end, a company always aims at avoiding rework and product liability damage. For this reason as well, constant monitoring of delivered service is necessary, even with experienced suppliers in aeronautical product processing. 27 A solid reference point for the expected monitoring intensity before cooperation could be provided by official approvals (e.g., EASA or FAA) or ISO-/EN certifications of the contractor. 26

246

9 Material and Service Supply

$OWHUQDWLYHV RI VHUYLFH SURYLVLRQ RI DSSURYHG 3DUW * RU 3DUW RUJDQLVDWLRQV

,QKRXVH SURGXFWLRQ PDLQWHQDQFH

:RUN H[HFXWLRQ YLD H[WHQGHG ZRUNEHQFK

([WHUQDO SURGXFWLRQ PDLQWHQDQFH

5HOHDVH ZLWK ($6$ )RUP

5HOHDVH ZLWK &R& RU &HUWLILFDWH RQMRE FDUG

5HOHDVH ZLWK ($6$ )RUP

6HUYLFH SURYLVLRQ XQGHU WKH RUJDQLVDWLRQ FOLHQW RZQ DSSURYDO

6HUYLFHV SURYLVLRQ XQGHU WKH VXSSOLHUV RIILFLDO DSSURYDO

Fig. 9.5 Alternatives in subcontracting

1. Subcontracting to a subcontractor with own Part 21 or Part 145 approval or 2. Order execution via a supplier without any approval (extended workbench). With respect to aviation legislation, order fulfilment lies then under the supervision and sole responsibility of the officially approved organisation.28 In addition to aviation legislation differentiation of outsourcing, industry makes further distinctions between manufacturing build-to-print and service provision build-to-spec. When manufacturing build-to-print, an order is carried out exactly following the technical specifications of the client. Any unilateral modifications on part of the supplier to the product, the production process or the jigs and tools are strictly not allowed. Manufacturing documentation must therefore contain all information required for carrying out the order without any uncertainty. Build-to-print manufacturing is any form of subcontracting in line with Part 21/G production, since here work can be done solely on the basis of approved data of the responsible 21J design organisation. On the other hand, there is procurement on basis of build-to-spec. Here the client formulates roughly his requirements and leaves the details of defining product 28

See Hinsch (2009), p. 57.

9.3â&#x20AC;&#x192;Subcontracting 247

characteristics and production methods to the contractor. Build-to-spec orders occur typically when component manufacturers with or without Part 21G approvals are commissioned by the OEM not only with manufacturing. Here, the supplier is also responsible with the design or construction of the products. After generating the approved data by the OEM (Part 21J Organisation), it is usually the contractor who creates the job cards and the detailed work steps before carrying out the work package.

9.3.2 Subcontracting in the Context of the Extended Work Bench In case of subcontracting as an extended work bench the supplier becomes active on behalf of an officially approved Part 21G or Part 145 organisation. The subcontractor acts on its behalf and carries out a work package previously defined by the approved organisation and according to its specifications. In this case it is not the supplier but the aeronautical organisation that is responsible for official product release (issuing EASA Form 1). With regards to aviation legislation the aeronautical organisation remains always responsible for the quality of services provided by the extended workbench. This also includes tests and inspections performed by the supplier. Officially approved clients are obligated to carry out intensive monitoring of its subcontractors. EASA approved organisations must ensure at any time that their suppliers fulfils the technical, organisational and personnel requirements when performing the commissioned work or services. Within the framework of the extended workbench, the contractor works under the authority of and thus subject to the quality system of the client. The extended workbench concept is often applied when only individual work steps or single processes are carried out by subcontractors (e.g. machining, special processes as heat treatment, coating, etc.). However, large manufacturers in particular do not hesitate to subcontract the production of even complex components within the context of an extended workbench. Aeronautical organisations may use the extended workbench only as (supporting) addition to their own service provision. The main parts of value chain must be furnished in their own facilities by themselves. Subcontracting of substantial core activities is thus not permitted. That means that approved aeronautical organisations must essentially remain an industrial organisation and must not mutate into a distributer or sales organisation through excessive subcontracting. If the work packages are subcontracted by officially approved organisations, selected subcontractors must be classified by type of work. In this context a distinction must be made between significant and non-significant subcontracting.29 The latter are to be approved of by the responsible aviation authority, the first only need

For details see LBA (2015), p.5

248

9â&#x20AC;&#x192; Material and Service Supply

to be reported. The process of classifying subcontractors must be documented in the operating manual (POE) of a 21G organisation. Criteria for classification are:30 a) approval status of subcontractor (also 21G organisation?) b) the criticality the concerned component has for airworthiness of the aircraft c) the complexity of the work to be subcontracted d) application of new technologies or (new) special processes or test procedures e) other circumstances, such as subcontracting in countries with low industrial standards. Order Processing Before work is subcontracted, the aeronautical organisation assigning the order must define the work to be outsourced and set up a time schedule for its execution. Once a supplier has been selected, the physical processing of the service provision must be coordinated. In addition to scheduling and organizational requirements, the subcontractor must in particular be made familiar with the requirements for configuration status as well as the acceptance procedures and criteria. The client must ensure that the subcontractor has access to this and other information (e.g., production or maintenance documents) and that these are applied during processing.31 If required, before carrying out the work, subcontractor must be additionally provided with material, special equipment or tools. Subcontracting in the context of the extended workbench principally allows multilevel subcontracting (order cascading). However, it must be agreed in the associated contracts that the client is to be informed and approve further subcontracting. This is mandatory, so that the client retains full control over his subcontractors at every level. In addition the client is able to provide information to its responsible aviation authority upon request for all levels of his order cascade. Monitoring the Contractor If a supplier provides services in the context of the extended workbench, this must be monitored in a special way. The client must ensure that the service has a quality that enables him to take full responsibility for the quality and safety of all the products.32 Since the client as an EASA approved organisation bears the sole responsibility under aviation legislation, the need to monitor and control extended workbenches must be more intensive than with subcontracting to other approved aeronautical organisations. The latter, after all, prove their capabilities and qualification themselves to the aviation authority. Proper supervision and control can only be sufficiently ensured if there is a close coordination between subcontractor and client. Therefore a subcontractor must be completely integrated into the quality management system of the client. Therefore, the most important pillar is usually a certification according to EN 9100. See LBA (2015), p.5 See GM No. 2 to 21A.139(a) 32 This incidentally also applies for reasons of release from civil law liability. 30 31

9.3 Subcontracting 249

Monitoring must be based on the individual requirements of the subcontractor and the specific order. Especially in case of an extended workbench, the client must monitor and, if necessary, control the service provision. This is valid in particular for new suppliers without or with little experience in the aviation industry or in the services to be provided. These suppliers must sometimes engage in substantial expenditures to meet the special quality and safety requirements of the industry. In these cases the supplier must be supported especially in the initial phase of the supply relationship. In particular, the process of managing changes during implementation is of particular importance. Operational practice often shows instability in the communication between supplier and client.

Responsibilities of the Aeronautical Organisations in the Context of Order Processing with an Extended Workbench: • supervising and controlling supplier schedules, keeping deadlines and possible sequence of processing • conformance of activities carried out with QM-documentation, in particular compliant execution of inspections and test procedures • ensuring regular supply to the contractor of the approved production or maintenance data, other specifications, including updates during the order processing • record keeping and meeting the required archival periods • ensuring free access to the premises of the supplier for own staff and the staff of the responsible aviation authority, so that compliance with the aviation requirements can be checked at any time. Although the activities of order-specific supplier monitoring depend on the individual product or service provision as well as on the subcontractors experience and quality capabilities, the following measures must always be carried out:33 a) examination of the contractor regarding his ability to process an individual order from the criteria of qualification and capacities. In doing so, it is to ensure that work results are always in conformity with the approved data (working with sufficient process stability) b) execution of First Article Inspections at the start of an product series or introduction of a new configuration/design change c) continuous execution of incoming inspections and tests, including examination and conformity checks of the associated documentation

Similar to GM No. 2 to 21A.139 (a)

250

9 Material and Service Supply

As flanking measures to guarantee appropriate quality and performance capability of the supplier, additional quality assurance agreements are often concluded in operational practice (such as GRESS or GRAMS in the Airbus network). An aeronautical organisation can rely only on the work made by the subcontractor, if it has at least ensured that: • the supplier’s staff responsible for carrying out the work complies with the qualification requirements of the client (capabilities similar to that of the client’s own staff) • the processing and quality specifications have been clearly defined and communicated on time to the subcontractor • Records are kept that allow for audit and traceability at all times.

9.3.3 Subcontracting to Approved Aeronautical Organisations (Part 21G/Part 145) Aeronautical organisations are permitted to procure services from third parties for which they take responsibility with regard to aviation legislation (extended workbench), or they procure corresponding services from other officially approved suppliers (according to Part 21 or Part 145). Those suppliers confirm execution of work with their own release certificate (EASA Form 1, FAA Form 8130-3 or similar), Before subcontracting parts of the value chain to another approved organisation the client must here also define the required activities and represent them in a time schedule. But the legal and regulatory requirements for supplier monitoring can be reduced to a minimum. The subcontractor is, after all, subject to continuous surveillance by the authorities due to his own approval. For the client, cooperation with an officially approved subcontractor is attractive, as he can reduce, in particular, the order-independent supplier monitoring. A typical example of products that are assigned to a large extent to this kind of subcontracting are components, devices or sub-systems. It is of course also possible to assign work to certified subcontractors in form of an extended workbench. In this case the extent of monitoring can normally also be reduced, responsibility regarding aviation legislation, however, lies with the client. Monitoring by the Client In the context of subcontracting to officially approved organisations, distinction must be made between monitoring the organisational quality system and monitoring order-related service provision. Due to the subcontractor’s own EASA approval, the client can generally assume that the supplier has an efficient quality system in place which ensures that each product generated by himself or his partners complies with the approved data. Formally, however, client may not rely purely on that and is obligated to regularly carry out audits of the quality system even with his officially approved subcontractors.

9.3 Subcontracting 251

For order-specific monitoring, the client can assume that his subcontractor has adequate manufacturing processes controlled by the aviation authority due to his own official approval. This the subcontractor will have to confirm in the end with the issue of a release certificate (e.g. EASA Form 1) for products shipped to the client. After delivery, the client can rely on this official document to prove compliance with the approved design or maintenance data. Since the client can rely on the certificate of his approved supplier, it is possible and permitted for him to adjust his product-related supplier monitoring accordingly. The actual execution support is reduced to a minimum normally already shortly after the beginning of the contractual work. If services are subcontracted to aeronautical organisations outside of the European Union, then their status as an officially approved supplier in terms of aviation legislation depends on the fact of whether it is approved by the aviation authority in the country concerned. In addition, there must be a treaty or a product-related agreement between the national aviation authorities in the EASA area and the aviation authority of that state covering the acceptance of such an approval.

9.3.4 Specifics of Subcontracting Design Services In engineering as well, large work packages are outsourced and subcontracted to external engineering/design offices. The spectrum covers the entire value chain of the design process, from creating of specification via compliance verification up to creating of documentation for production or maintenance manuals. Managing such multi-layered and comprehensive subcontracting activities can only be successful if the external design services are managed in a structured way and supervised by the client. Comparable to subcontracting in production or maintenance, a distinction is made in subcontracting of designs services according to Part 21J between: • purchase from other officially approved design organisations (approved data, resp. TCs or STCs) and • purchasing from extended drawing board from service partner without 21J approval. Service provision within the framework of the extended drawing boards is subject to close definition by aviation legislation. With this form of subcontracting it must be ensured that all work having approved data as an end product must be carried out under the design assurance system of the client.34 Analogous to the extended workbench, final responsibility with regard to airworthiness lies in all cases with the approved design organisation. For this reason, the client as holder of the 21J approval must have documented procedures for monitoring external design/engineering

See IR Initial Airworthiness Part 21 – 21A.239 (c) i.c.w. 21A.243 (b); see also GM to 21A.239 (c)

252

9 Material and Service Supply

service providers. The processes for organisational monitoring and supervising the service provision as such must be described. As a minimum the procedures must regulate clearly under which circumstances the provided services are accepted. In the case where design services are subcontracted to another approved Part 21J organisation, aviation legislation also specifies the responsibility to carry out regular supplier audits. However, if the provision of approved data or the transfer of a TC or STC has been agreed, the client, unlike the extended desk, is not obliged to directly monitor the actual performance of the service. Nevertheless, this is recommended at least randomly at regular intervals – especially when outsourcing large development packages. An insufficiently structured design support may be in line with aviation legislation, but may still cause great damage from an economic perspective. One example is presented by Boeing’s extensive subcontracting to numerous design partners in the context of the Dreamliner development.35 Independently of the question, under which design assurance system the subcontracting is carried out, at the beginning of the award process the same process steps must always be fulfilled: As in case of outsourcing of manufacturing and maintenance services, the scope of design activities to be outsourced as well as technical and resource-related requirements must be clearly defined (specification of subcontracting). Only after the subcontracting is specified, the selection of the design partners can take place. Here the operational supplier evaluation and approval procedures must be taking into account.36 However, a separate release process for design services providers might be necessary – due to different requirements in production and maintenance operations. It might be helpful define a separate supplier release process. For supplier monitoring during service provision as well as for acceptance, latest specification revision is to be used.

9.3.5 Specifics for Procuring External Staff To obtain an official approval, aeronautical organisations must have sufficient human resources to plan, carry out and supervise the work in line with the scope of approval.37 In the main, this must be ensured through inhouse staff. Employing external staff is, however, principally permitted.38 Large aeronautical organisations,

Boeing CEO James McNerney expressed himself in an interview as follows: “We went too far with outsourcing, both in the production process and with the engineering work. The concept of working with a set of partners around the globe was correct, but we should have restrained ourselves a bit more. For the second version of the 787, the 787–9, we moved some engineering work back inhouse. We also examined possibilities of getting individual parts of the production back inhouse.” Schubert, C. (2011). 36 See book Sect. 9.1.2, GM to 21A.239 (c); EN 9100:2016 Sects. 8.4.1 and 7.2 37 See LBA (2002a), p. 3 et seq. 38 In maintenance, the share of external certifying staff may not exceed 50 %. This applies to each workshop and hangar just as to each shift. See AMC 145.A.30 (d). There is no comparable specification for design and production.

9.3â&#x20AC;&#x192;Subcontracting 253

e.g., make extensive use of contract workers to react flexibly to fluctuating demand and to avoid in some countries the hurdles of restrictive dismissal protection legislation. Sometimes, the percentage of contract workers in overall staff lies in the double-digit range. Thus, it is not surprising that numerous temp agencies are specialised completely in the aeronautical sector. They do not only hire out lowly qualified production personnel, but also licenced mechanics and highly qualified administrative personnel (e.g., engineers, planners, business graduates). The same qualification standards must be applied to external staff as to comparable inhouse employees. The fulfilment of this requirement can only be achieved if aeronautical organisations have structured and documented procedures with regard to requirements, selection, qualification as well as the use and supervision of temporary agency workers. Such a procedure must be principally applied equally to all external staff. For personnel prescribed by aviation legislation regulations (certifying staff, work and material planners as well as design and certification engineers) a documented procedure is mandatory. Before hiring temporary staff, it is first necessary to define a requirement and qualification profile. Only in this way can be determined what tasks the temporary staff must be able to perform and which qualifications (e.g., studies, professional training, certificates, experiences, authorizations with previous employers, etc.) are required for the task at hand. Only on this basis can staff search begin and, based on it, staff selection be made. It is important to evaluate the potential contract workers regarding their abilities on basis of their qualifications. Such a structured classification serves to determine the later scope of authorisation of contract workers. In particular for functions relevant in terms of a aviation legislation, the aeronautical organisation should have written procedures in place, defining under what conditions past theoretical and practical training and experience of the contract worker can count towards acceptance. For this evaluation and classification, past qualification records of the contract worker (recommendations, CVs, reports, certificates, etc.) are to be called in and evaluated. These documents should give detailed information on type, extent and period of past activities. Such testimonies should ideally be signed by the accountable manager or by the head of quality of the previous employer. Each qualification should be individually evaluated on basis of available testimonies, and the appropriate authorisation be individually granted. Immediately after the beginning of a subcontracting relationship, each contract worker must at once be familiarised with possible hazards, industrial safety conditions and safety facilities of his work environment. Also, a briefing must take place on all work and relevant operational processes, procedures, machines and tools. In addition, usually independently of the duration of the employment, the contract worker must be made familiar with the operational QM documentation.39 The contract worker is therefore informed about where and how he can look up information regarding his processes and activities.

See AMC 145.A.30 (d)

254

9 Material and Service Supply

In summary, these measures serve to ensure that the aeronautical organisations comply with their labour law responsibilities. It is important that proof can be provided at any time that the organisation has fulfilled its protection and welfare obligations also including contract workers. For this, the requesting or hiring department usually has to make sure that every temporary worker confirms the participation in appropriate briefings in writing. In case of an casualty this may be decisive as regards liability or obligation to pay damages. Operational practice shows that this is not just a theoretical risk. At the latest when starting work, the contract worker should receive next to the briefing an authorisation letter explaining to him the extent of his authority. This separate document is to be signed by the respective contract worker, as he confirms hereby to know his own extent of authority. Only then is the employee also able to adhere to the scope of work assigned to him. The contract worker can thus take comprehensive responsibility for his operational duties. For contract workers it applies that they can be made accountable for deliberate or grossly negligent conduct, both by civil and criminal law. Liability for the contract worker with regard to aviation legislation, however, always remains with the aeronautical organisation, since contract staff always act in its name.

References ASD-STAN Standard: ASD-STAN prEN 9100-P4 – Quality Management Systems – Requirements for Aviation, Space and Defense Organisations. English version. prEN 9100:2016 (E), 2017 ASD-STAN Standard: ASD-STAN prEN-9110-P5 – Quality Maintenance Systems – Aerospace – Requirements for Maintenance Organisations. English version. 2017 ASD-STAN Standard: ASD-STAN prEN-9120-P5 Quality Management Systems – Requirements for Aviation, Space and Defence Distributors. English version. 2017 European Commission (EU): Commission Regulation laying down implementing rules for the airworthiness and environmental certification of aircraft and related products, parts and appliances, as well as for the certification of design and production organisations [Implementing Rule Initial Airworthiness]. No 748/2012 of 03/08/2012 European Commission: Commission Regulation (EC) on the continuing airworthiness of aircraft and aeronautical products, parts and appliances, and on the approval of organisations and personnel involved in these tasks [Implementing Rule Continuing Airworthiness]. No. 1321/2014, 2014 European Aviation Safety Agency – EASA: Acceptable Means of Compliance and Guidance Material to Commission Regulation (EC) to the Annexes to Regulation (EU) No 1321/2014 – Issue 2 [Implementing Rule Continuing Airworthiness]. ED Decision 2015/029/R. AMC/GM European Aviation Safety Agency – EASA: Acceptable Means of Compliance and Guidance Material to Part 21. Annex I to ED Decision 2012/020/R. Issue 2. Oct. 2012. Federal Aviation Authority: FAA Unapproved Parts Notifications (UPN). In: http://www.faa.gov/ aircraft/safety/programs/sups/upn/, accessed 22.03.2018 Kinnison, H.A.: Aviation Maintenance Management. New York u.a., 2004 Luftfahrt-Bundesamt: Aussonderung von nichtverwendbaren Luftfahrzeugteilen und Materialien. LBA Rundschreiben Nr. 01-35/001, 2000 [zurückgezogen/gelöscht] Luftfahrt-Bundesamt (2002a): Einsatz von Fremdpersonal. LBA Rundschreiben Nr. 25-23/02-0, 2002 [zurückgezogen/gelöscht] Luftfahrt-Bundesamt (2002b): Materialwesen. LBA Rundschreiben Nr. 25-25/02-0, 2002 [zurückgezogen/gelöscht]

References 255 Luftfahrt-Bundesamt: Auffinden und Melden von Teilen zweifelhafter Herkunft. LBA Rundschreiben Nr. 18-01/03-2, Braunschweig, 2003 Luftfahrt-Bundesamt (2015): Merkblatt fĂźr genehmigte Hersteller bei der Vergabe von Arbeiten an Zulieferer. Ausgabe 1. Braunschweig 2015 Schubert, C.: Der A380 ist nett, aber wir fliegen weiter. Interview mit Boeing-Chef James McNerney, FAZ Online, http://www.faz.net/artikel/C31151/flugzeughersteller-boeing-der-a380-istnett-aber-wir-fliegen-weiter-30443168.html, accessed 19.06.2011

Personnel

The high product and process complexity as well as requirements to product quality and safety formulated by aviation legislation forces aeronautical organisations to focus particularly on qualification of their staff. After an explanation of general requirements, this chapter deals with the qualification of blue-collar workers in detail, with a separate view on staff in production and in maintenance. An own section is dedicated to qualification of certifying staff. In this context, requirements with regard to qualification of administrative staff are outlined, whereby executive and operational staff are differentiated. A separate subchapter deals with design organisation personnel. An introduction to special staff qualification concludes this chapter. The focus hereby is on human factors and continuation training.

10.1

General Staff Qualification Requirements

Systematic personnel competence is one of the essential elements in ensuring high product quality and safety. Only adequately trained employees can ensure that operational processes remain stable over a long period of time and are constantly improving. To this extent, aeronautical organisations must have a conception of how each individual employee has to be qualified in order to perform the assigned tasks. The knowledge and skills to carry out a specific activity usually cannot be fully contributed by staff right from the start. Employees have to first be accordingly qualified. This means that workforce has to become prepared by acquiring knowledge and learning the skills to meet the specific requirements of the position in question. Structures and procedures to identify and assure personnel qualification must therefore be defined. Normally, a rough concept or a conceptual framework for general requirements and a process definition should already be available. Descriptions can, e.g. be determined in the quality manual or in a qualification process. It must be outlined how initial qualification and further training are continuously ÂŠ Springer-Verlag GmbH Germany, part of Springer Nature 2019 M. Hinsch, Industrial Aviation Management, https://doi.org/10.1007/978-3-662-54740-3_10

257

258

10â&#x20AC;&#x192;Personnel

ensured. The qualification concept (see Fig.Â 10.1) should be appropriate for the size of the organization. The operational size as well as type and scope of approval play important roles in determining the adequacy of a qualification system. For example, Airbus or Lufthansa Technik, with their broad range of services, must have more complex qualification systems than a medium-sized production organisation that manufactures one component type and has only a few certifying employees. Staff qualification is an important factor in ensuring the smooth running of business processes. The necessity of comprehensive personnel qualification results from different perspectives: â&#x20AC;˘ Aviation legislation: Staff must be sufficiently qualified to meet relevant requirements and/or the valid instructions to be able to assess correct work execution. The scope of qualification must ensure that risks to airworthiness is minimized by appropriately qualified personal in regards to the performed work. â&#x20AC;˘ Labour law: Qualification of the employees serves, for its own protection, hazardfree execution of the assigned tasks (occupational safety). It can also help the employer from liability claims. â&#x20AC;˘ Economically: Minimisation of errors and thus of the cost of non-quality due to inappropriate work execution. The legislator makes detailed requirements with regard to personnel qualification in the aeronautical industry. These requirements that are outlined in the Implementing Rule Initial Airworthiness Subpart F, G and J as well as in Implementing Rule Continuing Airworthiness Part M, 66, 147 and 145 and in the respectively associated AMCs and Guidance Material. The description depth of the regulations, however, leaves organisations room for maneuver as regards to implementation, as well as for aviation authorities with regards to surveillance. Organisations have to create a

7UDLQLQJ FRQFHSW REMHFWLYHV WDUJHW JURXSV VFRSH VWUXFWXUH VWDNHKROGHU 7UDLQLQJ PRGXOHV 7DUJHWHG WUDLQLQJ SODQV IRU WKHRU\ DQG SUDFWLFH LQFOXGLQJ SUHUHTXLVLWHV DQG JRDOV ([HFXWLYHV $GPLQ 3HUVRQQHO 3URGXFWLRQ SHUVRQQHO HWF 7UDLQLQJ FRQWHQW &RQWHQWV RI WKH WUDLQLQJ VOLGHV H[HUFLVHV WHDFKLQJ PDWHULDO H/HDUQLQJ VXFFHVV FRQWUROV HTXLSPHQW PDQXDOV RSHUDWLRQDO LQVWUXFWLRQV %DVLF WUDLQLQJ 2Q WKH MRE WUDLQLQJ 6XSSOHPHQWDU\ TXDOLILFDWLRQ PHDVXUHV 5HSHWLWLYH WUDLQLQJ

Fig.Â 10.1â&#x20AC;&#x192; Basic sample structure of a detailed qualification concept

10.1 General Staff Qualification Requirements 259

qualification programme that meets their individual needs by themselves. Whether compliance with the legal framework is ensured, is determined by the authority before approval is issued or extended. Aeronautical organisations without official approval usually follow the qualification requirements of EN 9100. Fundamental elements and objectives of an aviation qualification system are among other things: • determining staff skills and qualifications. On that basis personnel has to be qualified in line with requirements, • ensuring initial and continuation training. The characteristics of operational procedures and human factors are hereby to be taken into account, • the effectiveness of training measures which must be assessed within predetermined cycles, • the promotion of awareness regarding the significance of employees’ task spectrum as well as their contribution for reaching quality targets is to be ensured, • documenting training measures and individual staff qualification levels, • the certifying staff, qualified and entitled according to special requirements of the authority. To ensure transparent and comprehensible staff qualification it is necessary and mandatory to provide job descriptions as well as qualification and training plans for individual activities. These documents are to list the measures that concretely contribute to reaching the required qualification level and thus requirements of the respective position or job. These tools help to structure and standardize the job requirements according to expertise and capabilities.1 Qualification requirements hereby comprise theoretical knowledge and practical experience based on the following educational and advanced training categories: • • • •

(theoretical) basic training, on-the-job-training (practical experience), supplementing qualification measures (e.g. manufacturer trainings) continuation training.

In practice, qualification of temporary and contract workers is to be taken into particular account as well.2 Experience shows that these types of personnel need to be more intensively coached with regard to level of education, motivation, operational identification as well as familiarity with operational procedures than permanent staff members. In addition to qualification (that is the ability) the staff must also be formally allowed to perform their duties. Therefore a distinction must be drawn between qualification and authorisation: While qualification focuses on competence and

1 2

See AMC 145.A.30(e) 3 Characteristics of third party staff qualification are not detailed in this section, see Sect. 9.3.5.

260

10 Personnel

ability, authorisation describes the permission to carry out certain activities and obligations. An authorisation is issued on the basis of a proven qualification. Basic authorisations are usually given by means of job descriptions and are thus often transferred to the employee in a rather casual or very general way. Aviation authorisations requiring a formal appointment (e.g. for certifying personnel or Part 21J engineers) are often specifically assigned to an aircraft or engine type or groups of components. This is referred to by the term “scope of authorisation”.

10.2

Qualification of Production Staff

10.2.1 Production and Maintenance Staff Without Release Authorisation The requirements for qualification of production personnel without releasing authorisation are not regulated in detail either in Part 21G for production or in Part 145 for maintenance. However, this does not mean that the organisations are completely free in their decisions.3 Personnel in production and maintenance must, in principle, be capable of carrying out the assigned tasks independently and with appropriate quality. However, employees are only able to meet such responsibility, if they are sufficiently qualified and authorised to do their job. Therefore qualification and training plans, which show that production personnel without releasing authorisation is also appropriately theoretically and practically qualified and continuously trained, must be available. In addition to the basic requirements, a qualification plan defines obligatory trainings. These are for example: • • • • •

aircraft mechanic or aircraft electronic engineer qualification, product trainings, on-the-job trainings on the execution of production processes, introduction to technical documentation instructions, introduction to quality documentation (procedures and process descriptions, form sheets), • training on organisational software systems. Qualifications must be more profound, if production staff is entitled to perform tasks requiring special skills, such as inspections, borescope and double inspections, but also fork-lift truck or aircraft-tractor operation, as well as the operation of machinery, cranes or docking facilities. Further qualification requirements also depend on the production spectrum and volume. Maintenance staff, for instance, is always additionally trained in the fields of human factors, human error and human performance. The trainings must be accompanied by written tests and archived in the personal file.

See e.g. GM No. 2 to 21A.126 (A) (3) (2); GM 21A.145 (A) or AMC 145.A.30 (e).

10.2 Qualification of Production Staff 261

In order to ensure safe and compliant work execution as top priority, the organisation must adequately make sure that the employee is qualified for unsupervised work performance for aviation and labour law reasons.4 Staff must hereby demonstrate that they are able, within the framework of the (intended) scope of authorisation, to independently carry out production and maintenance work on the basis of technical and quality requirements. Such effectiveness control is to be documented. In addition to the qualification, the production personnel must be operationally authorised to carry out work on aeronautical equipment. The authorisation for production staff in an approved aeronautical organisation is hereby, in principle, limited to the organisation’s official scope of approval. Differentiations are hereby made according to production or maintenance work on: • • • •

aircraft (A-rating), engines and auxiliary power units (APUs) (B-rating), parts and appliances (C-rating), as well as specific activities within the above specified areas that can, however, only be appropriately implemented with sufficiently specialised expertise and comprehensive experience (e.g. borescope inspections or NDT, D-rating).

These ratings define the maximally possible authorisation extent the organisation may award to its production staff. Within the above mentioned restrictions by ratings, the scope of approval is usually specified in more detail based on aircraft and/or engine types or component groups (such as avionics, mechanics or paintwork). Fig. 10.2 summarises the specified basic qualifications in production and maintenance.

10.2.2 Certifying Production Staff as per Part 21G Certifying staff within a Part 21G organisation has particular responsibilities. After all, they confirm the proper execution of the work on the basis of validly approved production data after the conclusion of all work steps. The production organisation is, however, solely responsible for the qualification of certifying staff. Type and extent are based on the product and on the official scope approval and the respective production processes. The qualification for personnel authorised to work in production must hereby usually meet or be equivalent to the requirements of Part 66.5 Every Part 21G organisation must first have an operational training concept in place (see e.g. Fig. 10.1). This includes general requirements for training, depending on the complexity of the product or the scope of approval, the manufacturing processes and internal organisation as well as training structure. In particular, a

See AMC 145.A.30 (e). For detailed information on requirements for certifying staff in production see requirements of national aviation authorities 4 5

262

10â&#x20AC;&#x192;Personnel

PDQXIDFWXULQJ

PDLQWHQDQFH

DGGLWLRQDOO\ GLIIHUHQWLDWLRQ DFFRUGLQJ WR WUDGH DQG $ & W\SH

DLUFUDIW

SDUWV DQG DSSOLDQFHV

DGGLWLRQDOO\ GLIIHUHQWLDWLRQ DFFRUGLQJ WR WUDGH

HQJLQHV RU SURSHOOHUV

DGGLWLRQDOO\ GLIIHUHQWLDWLRQ DFFRUGLQJ WR HQJLQH W\SH

VXSSOHPHQWDU\ TXDOLILFDWLRQV

H J %RURVFRSLHV 1'7

3DUWO\ DOVR DFFRUGLQJ WR W\SH RU SURFHGXUH

Fig.Â 10.2â&#x20AC;&#x192; Qualification opportunities in production

structured approach with regard to continuation training is to be defined. This is to ensure that staff is always trained according to the latest technological state of the art. In addition to that, qualification requirements specifically tailored to the needs of the certifying personnel are required. Releasing or certifying staff must hereby document professional, practical experience in the specific production area for which authorisation has been requested or granted. Certifying staff must also have special knowledge in the following areas: â&#x20AC;˘ Knowledge of aviation legislation (according to module 10 of EASA Part 66), â&#x20AC;˘ Knowledge of the operational processes and procedures based on the quality documentation, â&#x20AC;˘ Documented experience in inspection within the scope of approval (in particular application of test programmes and procedures, as well as handling test documents and equipment). Human factors training is often requested by the national aviation authorities, but is only explicitly required for maintenance (Part 145) and not for production organisations (Part 21G). In addition to the actual qualification requirements for certifying staff, AMC 21A.145 (d) determines requirements with regard to type and extent of the qualification documentation. To ensure permanent fulfillment of the regulatory requirements, an internal monitoring process must be established. In this context, the archiving of

10.2â&#x20AC;&#x192; Qualification of Production Staff 263

employee data forms an important part of the quality system and is thus always subject to monitoring by the responsible authority. Fig.Â 10.3 shows that the information requiring archiving is confidential, personal data. For this reason, the organisation must ensure that, with the exception of the responsible aviation authority and the concerned certifying staff, only a very limited number of people are granted access to that data. To ensure consistent quality and quantity of personnel, the qualification concept is an integral part of the organisations QM system, and as such, is subject to monitoring by the management and the competent aviation authority.6

Â&#x2021; Â&#x2021; Â&#x2021; Â&#x2021; Â&#x2021; Â&#x2021;

Â&#x2021; 6FRSH RI DXWKRULVDWLRQ Â&#x2021; 'DWH RI ILUVW LVVXH RI DXWKRUL]DWLRQ Â&#x2021; ([SLU\ GDWH RI DXWKRUL]DWLRQ LI DSSOLFDEOH Â&#x2021; ,GHQWLILFDWLRQ 1XPEHU RI DXWKRULVDWLRQ

1DPH 'DWH RI %LUWK %DVLF 7UDLQLQJ 6SH]LILF 7UDLQLQJV &RQWLQXDWLRQ 7UDLQLQJ ([SHULHQFH

5HFRUG NHHSLQJ PLQ \HDUV DIWHU Â&#x2021; FHUWLI\LQJ VWDII KDV OHIW WKH RUJDQLVDWLRQ RU Â&#x2021; ZLWKGUDZDO RI WKH RUJDQLVDWLRQV DXWKRULVDWLRQ

RU DFF $0& $ G

DQG $0& $ M

Fig.Â 10.3â&#x20AC;&#x192; Minimum scope of information to be recorded by certifying staff

See AMC 21A.145 (d) (1) (5).

264

10â&#x20AC;&#x192;Personnel

10.2.3 Certifying Maintenance Staff in Production According to Part 145 Implementing Rule Continuing Airworthiness dedicates no less than three Parts to certifying staff in maintenance: Next to Part 145 (maintenance organisations), this is EASA Part 66 (certifying staff) as well as EASA Part 147 (training organisations requirements).7 Unlike in production according to Part 21G, Part 145 defines more requirements in a higher level of detail. Approval of mechanics in maintenance is granted by the national aviation authority (see Fig. 10.4) and not by the organisation as in production. Part 66 requires that 145-staff officially applies for release authorisation, i.Â e. that they are awarded a so-called Aircraft Maintenance Licence (AML). A prerequisite for issuing such an AML is proof of the respectively required professional practice in a 145-maintenance organisation and theoretical training in a Part 147-organisation. The release scopes granted on basis of an AML, are subdivided into the following categories (CAT) according to EASA Part 66.A.1:8 &HUWLI\LQJ 6WDII

3URGXFWLRQ RUJDQLVDWLRQV ($6$ 3DUW *

0DLQWHQDQFH RUJDQLVDWLRQ ($6$ 3DUW

,QKRXVH WUDLQLQJ SURJUDP

7UDLQLQJ SURJUDP DFF ($6$ 3DUW

2SHUDWLRQDO DXWKRULVDWLRQ Â&#x2021; %DVLF WUDLQLQJ LV RSHUDWLRQDO Â&#x2021; 2UJDQLVDWLRQ LVVXHV DXWKRULVDWLRQ RQ WKLV EDVLV Â&#x2021; 7UDLQLQJ SURJUDP UHTXLUHV DSSURYDO IURP WKH QDWLRQDO DYLDWLRQ DXWKRULW\

2IILFLDO OLFHQVH RSHUDWLRQDO DXWKRUL]DWLRQ Â&#x2021; %DVLF OLFHQVH &$7 $ % & LV JUDQWHG E\ DYLDWLRQ DXWKRULW\ Â&#x2021; 7\SH VSHFLILF DXWKRUL]DWLRQV W\SH UDWLQJ DUH LVVXHG E\ WKH FRPSDQ\

Fig.Â 10.4â&#x20AC;&#x192; Training requirements for certifying production vs. maintenance staff Organisations with a Part 147 approval have the right to train staff for officially approved maintenance organisations. In detail, this training organisations may perform: a) approved basic training,Â b) recognised type-specific training and examinations as well as d) issue training certificates. For further information on EASA Part 66 and 147 see grey box in Sect. 3.1.4. 8 With regard to the specification of the fundamental scope of authorisation of above AML see in particular IR Continuing Airworthiness â&#x20AC;&#x201C; Part 66.A.20 as well as GM 66.A.20 (a). 7

10.2 Qualification of Production Staff 265

Category A: Line Maintenance Certifying Mechanic Certifying staff according to category A is entitled to issue release certificates after minor line maintenance. Employees with a CAT A authorisation may exclusively release personally accomplished maintenance work. The authorisation extent of the CAT A licence is hereby task-oriented. This means that the certifying staff may exclusively perform maintenance work on defined (aircraft) types that is specified in their individual task list. Category B1: Maintenance Certifying Technician – Mechanical A CAT B1 licence entitles the holder to the release maintenance work on aircraft structure and engines, as well as on mechanical and electrical systems. The authorisation furthermore comprises the exchange of simple avionics replacement units. This applies to both the work that was carried out by the licence-holders themselves as well as to such performed by another person. A CAT B1 always also includes the respective CAT A licence. The AML CAT B1 is also granted type-specifically. Category B2: Maintenance Certifying Technician – Avionics CAT B2 certifying staff is entitled to release maintenance work on avionics and electrical systems that was carried out by the AML holder or by another entitled employee. The CAT B2 licence does not contain CAT A approval. To be able to perform and release simple mechanical tasks as well, a category A qualification is required. The CAT B2 licence is only granted type-specifically. Category C: Base Maintenance Certifying Engineer A category C licence entitles the holder to issue release certificates after base maintenance. CAT C employees may release aircraft as a whole for all trades and systems. The role of the base maintenance certifying engineer primarily focuses on ensuring that all necessary maintenance work is accomplished and released by accordingly authorised CAT B1 and B2 staff. The aircraft release, i. e. the issue of the certificate of release to service (CRS) then only constitutes the formal conclusion of the maintenance event. However, CAT C staff may release base maintenance events only, if staff with CAT B1 and B2 licence examined technical execution as support staff and certified this examination. A CAT C staff may perform these support tasks and the aircraft release at the same time. The qualification requirements for requesting an AML are differentiated in terms of theoretical basic expertise and practical maintenance experience. Type and scope of the necessary qualification depend on previous expertise and the respective release category. To obtain the required theoretical knowledge, up to 17 specialised modules are to be completed. These modules are specified in the appendix of EASA Part 66 and cover topics such as aerodynamics, electronic instrument systems, aviation legislation or structures and systems of aircraft etc., just like basic skills in mathematics, physics and electronics. Any previous expertise is taken into account and can reduce the number of modules to be completed. The expertise of the individual modules is to be proven by examinations with an approved Part 147 training organisation.

266

10 Personnel

In addition to expertise, certifying maintenance personnel must be fluent in English language in order to understand spoken and written procedures and technical documentation.9 The practical maintenance experience to demonstrate for an AML is defined in the Implementing Rule Continuing Airworthiness Part 66–66.A.30 and varies from one to five years, depending on prior knowledge. Criteria for the recognition of existing experiences are e.g. a previous technical training, maintenance activities on large aircraft, past activities in lower release categories or support staff experience. A CAT C licence is the only licence that can also be obtained with a technical university degree, if the applicant can demonstrate a “representative selection of work experience”10 in civil aircraft maintenance. The documentation requirements of staff qualifications for certifying as well as for support staff are more or less identical to those in production and can therefore be found at the end of the (previous) Sect. 10.2.2.11

10.3

Qualification of Administrative Staff

10.3.1 Qualification Requirements for Executive Staff Executives have a special operational responsibility because their actions not only have an impact on their direct working environment, but also because their decisions influence a large group of employees, often across several hierarchy levels. Therefore management positions require appropriate technical expertise and are of special importance. This does not only apply for economic reasons. Aviation legislation demands appropriate training as well as expertise, background knowledge and sufficient experience in aviation design, production and/or maintenance when it comes to certain executive staff members. This includes in particular fundamental expertise on the relevant legal basics.12 To show that executive staff is able to live up to their responsibility within an aeronautical organisation, they must personally demonstrate their expertise to the responsible aviation authority. Decisions are thus not only made record-based, but usually also on basis of a personal interview. Among the executive staff relevant, as per aviation legislation, the accountable manager comes firstly. This person is the responsible executive staff member (as a rule the managing director or a board member) who liaises with the responsible authority on top management level. In addition to that also some second level managers (e.g. production manager, department manager in engineering, head of quality

See IR Continuing Airworthiness EASA Part 66–66.A.20. IR Continuing Airworthiness EASA Part 66–66.A.30 (5). 11 See AMC 145.A.35 (j). 12 See IR Continuing Airworthiness Part 145–145.A.30 as well as IR Initial Airworthiness Part 21–21A.145 (c). 9

10.3 Qualification of Administrative Staff 267

management) must meet the above mentioned qualification requirements and are also interviewed by the respective aviation authority. Executive staff of the second hierarchical level are also referred to as responsible managers.

10.3.2 Qualification Requirements of Operational Administrative Staff in Production and Maintenance Next to the production staff, administration staff as well performs tasks that directly influence the airworthiness. This particularly applies to design (see Sect. 10.4), but also to production and maintenance. In addition to economic reasons, there is hence a necessity from the perspective of aviation legislation for appropriately qualified and authorised staff. The extent of employees to be qualified in production and maintenance is not precisely defined in Part 21G and Part 145. The focus here lies on staff with planning responsibility as well as quality management staff. With their actions, both groups indirectly influence airworthiness. Planning functions (e.g. production, work, material or staff planners as well as production or planning engineers) form the link between design and production or maintenance and have substantial influence on production flow. In addition to that, quality management staff must be adequately qualified, in order to be able to meet their monitoring and support function. Type and scope of administrative staff qualification is always determined by the scope of approval as well as by the type and size of the organisation (number of employees, product portfolio, process complexity, etc.). In principle, however, administrative staff in production and maintenance must be capable of understanding the official (IR, AMC, GM), regulative (e.g. EN) and technical requirements (e.g. approved data, technical standards) and to apply them accordingly.13 In practice, this includes, in particular, an awareness that deviations from approved data and other technical instructions are not permitted and no changes may be made without permission of the respective Part 21J design organisation. Administrative staff, whose actions influence airworthiness, must therefore at least demonstrate expertise in the following areas: • aviation legislation (in particular Part 145 or Subpart 21G), • quality documentation (production or maintenance organisation exposition (POE/MOE), procedure or process descriptions), • organisational structures, • human factors (only legally required in maintenance organisations).

13 The relevant wording of the Implementing Rules Certification and Airworthiness is rather vague: IR Continuing Airworthiness EASA Part 145–145.30 (e): The organisation shall establish and control the competence of personnel involved in any maintenance, development of maintenance programmes, airworthiness reviews, management and quality audits in accordance with a procedure and to a standard agreed by the competent authority. IR Initial Airworthiness Part 21–21A.145 (c): “ … staff of all levels has sufficient authorisation to fulfil the tasks transferred to them … ”

268

10 Personnel

Aviation authorities as well as the EN certification auditors expect that there will be qualification plans for the administrative staff showing that they have sufficient theoretical knowledge as well as sufficient practical experience. The qualification must hereby meet the specific requirements of the respective activity. Therefore, job descriptions, hence the definitions of the scope authorisation, should be created for all relevant activities within the organisation.14 This simplifies the allocation of qualifications and clarifies the organisational authorisations.

10.4 Specific Characteristics of Design Staff Qualification According to Part 21J The most detailed qualification requirements with regard to administrative staff are made in design organisations.15 Since many of the employees there are confronted with decisions that directly influence airworthiness of designed products, EASA demands the existence of a training concept that is considered a part of the Part 21J design insurance system and is subject to approval and monitoring by the EASA. To meet official requirements, the concept must demonstrate that selection of staff as well as their general and advanced training is based on a structured procedure. Hereby not only experience and basic knowledge, but also backgrounds and interdependencies are to be trained in order to enable employees to become fully aware of the consequences of their actions. Special attention is hereby to be directed towards the qualification of new staff. Minimum standards are to be defined for this group using qualification and on-the-job training plans. To ensure high-level qualification in the long term as well, the organisation must apply a “living” general training concept that can be adapted to current needs and changes of the organisation and the market. Guidance Material details the group of employees that should be subject to structured general and advanced training precisely. This covers all the engineering staff of the organisation who are taking decisions that affect airworthiness and environmental protection issues. In addition to members of the top management and department managers in engineering, this group also comprises employees who: • • • •

take classification decisions (major/minor), perform secondary checks (verifications), approve small designs or repairs or are responsible for creation and/or release design data (documents and information).

See AMC 145.A.30(e) All requirements with regard to design-organisational staff qualification are regulated by IR Initial Airworthiness Part 21–21A.243 (d) and the associated Guidance Material. 14 15

10.5 Special Staff Qualifications and Authorisations 269

In order to be fully able to complete these tasks, employees in charge usually must hold an engineering degree or have undergone comparable education. This high initial qualification is required to ensure that authorised staff is able to assess correlations and consequences of their actions. In addition to that, in-depth aeronautical design expertise is required as well. This expertise generally comprises at least know-how in the areas of: • • • •

Certification Specifications, aviation legislation (EASA Part 21 & Part 145), organisational quality documentation, organisational structures and processes,

When an employee is authorised at the end of the qualification process, not only is it crucial that all qualification requirements were met, but also the respective staff member must furthermore be fully informed and aware of the individual scope of authorisation. This is the only way to prevent that tasks are executed that the individual might not be sufficiently trained for. Incidentally, the organisation must have a system where personnel qualification data is tracked and recorded.16

10.5

Special Staff Qualifications and Authorisations

In addition to the qualifications and authorisations outlined so far, staff often must also be trained for other special tasks. Only if employees have the capabilities as well as expertise and awareness to cover their entire activity spectrum, they are in a position to execute their work at full extent and with adequate quality. Typical fields of activity that require supplementing personnel qualifications and authorisations within aeronautical sector, are e.g. double inspections, support staff tasks, aircraft towing, tank and borescope inspections, engine run-ups or various ground handling activities. In addition to these highly aviation-specific staff qualifications, employees must also be qualified and authorised in less industry-specific areas. Examples are activities like welding, forklift and crane operation or also special training courses or briefings for the operation of production equipment (e.g. electrical saws, furnaces, drilling or CNC machines). The necessity of comprehensive staff qualification does not only apply to production staff. Administrative staff as well might have to be qualified and authorised

GM No. 1 to 21A.243 (D) (the 3.3) defines the following information as minimum extent: Name and date of birth, general education, experience and training, task/position within the design organisation, scope of authorisation, date of issue of the initial authorisation and as far as applicable expiration and identification number of the authorisation. Additional staff archiving requirements are equally available in above GM.

270

10 Personnel

in special fields in addition to their basic training. This applies to, e.g. training or, auditing activities as well as to ETOPS double check and verification activities. In addition to that aeronautical organisations often require specifically qualified and authorised executive staff, such as radiation protection or environmental protection officers (to monitor NDT and/or paint or galvanic shop work). It might seem somewhat strange that employees have to be qualified and authorised for obviously simple tasks (e.g. aircraft towing or crane operations). Experience has, however, shown that errors that can be rated as humanly possible are also likely to occur. Sustainable error minimisation can therefore only be reached, if staff members were generally and comprehensively qualified in their entire field of activity.

10.6

Human Factors

The term human factor is a collective for psychological, cognitive and social factors that influence interaction between human and technical systems. The focus hereby lies on human efficiency with all capabilities and limitations that affect actions in the human-to-human and human-to-machine relationship. The aeronautical industry summarises human factors as all human circumstances that influence the work results of staff members in design, production or maintenance. Consideration and integration of human performance is becoming more and more important. On the one hand there is an increasing degree of interaction between humans and technical systems, and on the other hand, task complexity is constantly increasing. To reduce the consequences of technical and human errors and to improve safety and efficiency of the entire organisation, human factor activities should focus on: • an alignment of the work environment to staff needs, • a clear and transparent allocation of tasks and responsibilities among staff members and between humans and machines and at the same time, • identifying interface risks and making them visible for employees in practice. The aeronautic industry began to approach the issue of human factors in a structured manner in the 1980’s and 1990’s. The focus was hereby, at first, exclusively directed towards flight operation. Not until a few years had passed, the aviation industry realised that also in maintenance, the risk of flight occurrences and accidents could be reduced when applying a higher level of awareness with regard to human factors. This finally resulted in the introduction of mandatory human factor training courses. These trainings are to bring the findings that contribute to an understanding of human errors up for discussion among staff members on all organisational levels. This way, both indirect and direct causes and consequences of human errors can be demonstrated at the same time, allowing for safer and more effective work execution. Fig. 10.5 presents the twelve greatest human errors (so-called Dirty Dozen) that incorrect work execution can lead to.

10.6â&#x20AC;&#x192; Human Factors 271 /DFN RI &RPPXQLFDWLRQ /DFN RI 7HDPZRUN /DFN RI $ZDUHQHVV

/DFN RI .QRZOHGJH

6WUHVV

/DFN RI $VVHUWLYHQHVV

/DFN RI 5HVRXUFHV

&RPSODFHQF\

)DWLJXH

'LVWUDFWLRQV

6RFLDO 1RUPV 3UHVVXUH

Fig.Â 10.5â&#x20AC;&#x192; Dirty Dozen17

The organisationâ&#x20AC;&#x2122;s own culture of error tolerance plays an important part when dealing with human factors. Aeronautical organisations in particular have to foster a work climate that encourages employees to openly address errors and put them up for discussion without pointing fingers at staff members who unintentionally underperformed. A punitive error culture bears risks that errors are kept secret and covered up and in the worst case are even repeated due to a lack of communication. EASA requires that the handling of human factors needs to be aligned to the organisationâ&#x20AC;&#x2122;s individual needs. The objective must hereby be the creation of organisational structures that:18 â&#x20AC;˘ take into account human efficiency, capabilities and limitations, â&#x20AC;˘ have structures in work execution that are able to minimize human error, â&#x20AC;˘ maintain training structures that regularly sharpen awareness with regard to human factors and also make weaknesses in the above specified mechanisms visible.

The Dirty Dozen is a concept developed by Gordon Dupont, employee of Transport Canada, in 1993. 18 See IR Continuing Airworthiness Part 145â&#x20AC;&#x201C;145.A.30 (e), 145.A.65 (b) as well as implicitly GM 21A.3B (b). 17

272

10 Personnel

The content of human factors trainings should not be based solely on the specifics of the organisation. It must also be oriented on the respective target group needs within the organisation. The objective of human factors training hereby is to sharpen staff awareness regarding the limitations of human efficiency. As part of the training, the knowledge and experience of the participants should be collected and used for the further development of operational processes and procedures.19 The training courses are mandatory for all maintenance staff, who influence the airworthiness of products with their decisions. This includes executive staff, such as accountable managers, production managers, shift leaders as well as administrative staff, like planners, engineers, quality management and production personnel, in particular support and certifying staff. Regarding the frequency of training courses, EASA sets a period of approximately two years, unless special organisational or external events or occurrences require higher training intensity. Mandatory human factors trainings are only required by Part 145, but not in Part 21 for design and production staff.

10.7

Continuation Training

Continuation training20 is a general, non-specific subsequent training in an aeronautical context. These trainings are mandatory for design, production and maintenance organisations with official approval and are to ensure that staff is kept up-to-date with regard to the latest findings and trends.21 Contents of such trainings courses can be flexibly determined by the organisations and should be based on their individual needs and requirements. Continuation trainings usually cover one or several of the following areas: • new legal requirements, • changes and advancements in operational structures, processes or standards, • information about product developments and innovations in the context of the relevant technologies, • human factors issues that due to inhouse or external occurrences require in-depth review, • bringing special processes and procedural occurrences that have improvement potential up for discussion, • raising employees awareness for their responsibility and importance of the job in terms of safety. Dependent on the scope of approval, also audit findings as well as current, industry-typical quality highlights (e.g. new design standards, new rules or requirements)

See AMC 145.A.30 (e). In practice often also abbreviated as “Conti” training. 21 See IR Continuing Airworthiness Part 145–145.A.35 (d); EN 9110 6.2.2 (g).

References 273

are other important sources for selecting training content and spectrum. The temporal extent of the continuation training is based on organisational requirements. Under normal conditions, one to three days are to be calculated per individual employee over a two-year period. When planning training measures, it should be taken into account that staff advancement is not the only objective. Continuation training courses always also serve to improve the organisational structure. Well-ordered collection of participant feedback thus forms another important objective of these trainings. The respective results are then – usually via the quality management – to be examined for suitability and as far as applicable should be subsequently transferred into operational practice.

References ASD-STAN Standard: ASD-STAN prEN 9100-P4 – Quality Management Systems – Requirements for Aviation, Space and Defense Organisations. English version. prEN 9100:2016 (E), 2017 ASD-STAN Standard: ASD-STAN prEN-9110-P5 – Quality Maintenance Systems – Aerospace – Requirements for Maintenance Organisations. English version. 2017 ASD-STAN Standard: ASD-STAN prEN-9120-P5 Quality Management Systems – Requirements for Aviation, Space and Defence Distributors. English version. 2017 European Commission (EU): Commission Regulation laying down implementing rules for the airworthiness and environmental certification of aircraft and related products, parts and appliances, as well as for the certification of design and production organisations [Implementing Rule Initial Airworthiness]. No 748/2012 of 03/08/2012 European Commission: Commission Regulation (EC) on the continuing airworthiness of aircraft and aeronautical products, parts and appliances, and on the approval of organisations and personnel involved in these tasks [Implementing Rule Continuing Airworthiness]. No. 1321/2014, 2014 European Aviation Safety Agency – EASA: Acceptable Means of Compliance and Guidance Material to Commission Regulation (EC) to the Annexes to Regulation (EU) No 1321/2014 – Issue 2 [Implementing Rule Continuing Airworthiness]. ED Decision 2015/029/R. AMC/GM European Aviation Safety Agency – EASA: Acceptable Means of Compliance and Guidance Material to Part 21. Annex I to ED Decision 2012/020/R. Issue 2. Oct. 2012

Quality and Safety Management

The exceptional quality and safety requirements for aeronautical organisations give quality management (QM) a special significance and make a detailed discussion indispensable here. In this context, basics of quality management are firstly looked into, before quality management systems are presented. Initially, purpose and objectives of such systems are outlined there, followed by a description of associated documentation elements. The latter comprises operational standard documentation in the form of procedure or process descriptions as well as manuals, checklists and other relevant documents in addition to the quality manual and/or the Organisation Exposition. Another focus is the safety management in Sect. 11.2, in particular because it has gained increasing importance within the aerospace industry in recent years. First, the organisational framework of a safety management system (SMS) is shown. Based on this, the associated process of risk management is explained. The conclusion of this section is an examination of the transfer of safety knowledge and the safety culture to staff. The third focus of this chapter is on monitoring. Sect. 11.3 is therefore dedicated to auditing. Firstly, the different types of audit will be explained, followed by the process of auditing. In this context, the characteristics of internal auditing and the different forms of external surveillance are portrayed. As a further monitoring instrument, Sect. 11.4 deals with internal error reporting systems in which hierarchically, unlike auditing, not only a top-down approach dominates, but operational monitoring is partly performed by the employees (buttom-up). The chapter concludes with a presentation of the substantial tasks of official authority liaison.

275

276

11.1

11 Quality and Safety Management

Quality Management Systems

11.1.1 Quality Management Basics The term quality is etymologically derived from the Latin word qualitas and literally means condition or state. The meaning of quality, however, exceeds this scope in common usage. Quality is regarded as a measure of value that expresses the ratio between the condition of a service on the one hand and the requirements of recipients of that service on the other hand. Quality thus requires compliance of expectations and predefined characteristics, whereby the measure of synchronization is defined by the customer. It is thus primarily the customer, who defines quality. Success and future sustainability of a supplier on today’s buyers’ markets, however, require quality concepts that exceed customer needs. In such highly competitive industries it does not suffice to meet technical standards or specifications and to deliver on time. The supplier must also stand out among competitors1 in terms of quality, by developing sophisticated solutions, that do not only meet the needs of their direct customers (e.g. airlines), but that also comply with the requirements of the customers clients (passengers). Quality is furthermore not only directly demanded by customers, but also by the legislator. The legislator hereby instructs every organisation irrespective of the industry to ensure appropriate product and performance quality (e.g. product liability, subsequent performance claims). Additional branch and product-specific quality requirements apply that are defined by laws, regulations or directives (e.g. Implementing Rules, ADs, Certification Specifications). The provision of continuously high product quality, however, does not only serve customer satisfaction purposes. Focusing on quality in the own value chain also directly benefits the supplier of a service itself, in particular by reducing the error frequency. This might result in improved earnings: during the production phase by reducing rework, delays, scrap as well as by avoiding reputational damage, reducing warranty or product liability cases after supply of service. To comply with the multiplicity of needs of all stakeholders, all quality requirements must first be clearly identified, allowing for adequate assessment and measurement. Table 11.1 shows examples of essential quality expectations for aeronautical organisations. After identification of these requirements, their compliance in the value creation process must be ensured via structured implementation and monitoring. The complexity is significantly reduced by the use of a quality management system, because it helps to structure the upcoming task.

See in this context KANO model.

11.1 Quality Management Systems 277 Table 11.1 Quality expectations of stakeholders Customer

The public

Organisation

function, equipment confidence safety life cycle reliability quality

safety environment protection conifdence

error reduction flexibility (set-up times) productive capacity product conformity

11.1.2 Purpose and Objectives of Quality Management Systems A quality management system (QM system) is an internal organisational and procedural concept that is to ensure quality capability and competitiveness of an organisation. The need for such a quality-oriented set of rules to organise and control complex organisational structures is based on the finding that insufficient process organisation is one of the principal reasons for the occurrence of errors and poor quality. To generate sustainable customer satisfaction and permanent market success organisations must consequently have a holistic quality management system in place. Such systems should not only involve the entire hierarchy, but should also include the planning, implementation and control of the processes along the entire value chain. ISO EN system standards are based on Deming’s PDCA cycle as shown in Fig. 11.1.2 The establishment and maintenance of a high-performance QM system is seen as a whole-company task that has to start with all core processes. The main requirements therefore apply to the following areas (Fig. 11.2): • Responsibility and commitment of the management, taking into account quality policy and objectives, including the definition of responsibilities and authorisations, • Establishment and maintenance of a process-oriented quality management system, including knowledge and handling of operational risks • Personnel qualification, operational knowledge, awareness and provision of resources including the associated documentation • Planning and execution of service provision including its release and post-delivery activities, • Process and product monitoring and measurement as well as data analysis, • Measures of error correction and risk minimization as well as continuous improvement, • Knowledge of internal and external operational factors as well as interested parties, • Collection and integration of customer requirements.

Following EN 9100:2016. p. 6

278

11â&#x20AC;&#x192; Quality and Safety Management 3ODQ GR FKHFN DFW F\FOH &RQWLQXRXV LPSURYHPHQW 2UJDQLVDWLRQ DQG LWV FRQWH[W

,QIRUPDWLRQ $FW

,PSURYHPHQW

/HDGHUVKLS

2SHUDWLRQ

3ODQ

,QSXWV

3ODQQLQJ DQG SURYLVLRQ RI QHFHVVDU\ UHVRXUFHV

&XVWRPHU VWDWLVIDFWLRQ

&XVWRPHU UHTXLUHPHQWV

&KHFN

$XGLWV 4 REMHFWLYHV SURGXFWV TXDOLW\ SURFHVV SHUIRUPDQFH

2XWSXWV 3URGXFWV VHUYLFHV

6WDNHKROGHU

Fig.Â 11.1â&#x20AC;&#x192; Main elements of an EN 9100 and ISO 9001-based QM system

In some industries, the existence of structured quality management is already standard. One example is, above all, the automotive industry with the IATF 16949 standard. In aviation, a special feature is that a distinction is made between officially approved organisations with a corresponding quality system and certified companies with a quality management system according to the standards of the EN 9100 series. While EN focuses on customer satisfaction and process orientation, EASAâ&#x20AC;&#x2122;s focus is on the safety aspect. Reasons for Implementing Quality Management Systems â&#x20AC;¢ Reduction of error costs as well as internal friction losses due to improved process controlling â&#x20AC;¢ Customers dispense with own supplier audits â&#x20AC;¢ Successful marketing tool â&#x20AC;¢ Increased product quality â&#x20AC;¢ Improved customer satisfaction â&#x20AC;¢ Consolidation of the business relationship by intensifying customer trust Â =Â >Â Improved profitability and market positioning

The starting point for the implementation of a quality management system is the written formulation of a quality policy as well as quality objectives derived from it. In this context, the management has a non-delegable responsibility in generally

&KDSWHU 3ODQQLQJ RI FKDQJHV

&KDSWHU 3ROLF\

&KDSWHU 2UJDQL]DWLRQDO UROHV UHVSRQVLELOLWLHV DQG DXWKRULWLHV

&KDSWHU 'HWHUPLQLQJ WKH VFRSH RI WKH 406

&KDSWHU 'RFXPHQWHG ,QIRUPDWLRQ

&KDSWHU &RPPXQXLFDWLRQ

&KDSWHU $ZDUHQHVV

&KDSWHU &RPSHWHQFH

&KDSWHU 5HVRXUFHV

&KDSWHU 6XSSRUW

Fig.Â 11.2â&#x20AC;&#x192; Main elements of an EN 9100 and ISO 9001-based QM system

&KDSWHU 406 DQG LWV SURFHVVHV

&KDSWHU 4XDOLW\ REMHFWLYHV DQG SODQQLQJ WR DFKLHYH WKHP

.DS 8QGHUVWDQGLQJ WKH QHHGV DQG H[SHFWDWLRQV RI LQWHUHVWHG SDUWLHV

&KDSWHU $FWLRQV WR $GGUHVV 5LVNV DQG 2SSRUWXQLWLHV

&KDSWHU /HDGHUVKLS DQG FRPPLWPHQW

&KDSWHU 8QGHUVWDQGLQJ WKH RUJDQL]DWLRQ DQG LWV FRQWH[W

&KDSWHU 3ODQQLQJ

&KDSWHU /HDGHUVKLS

&KDSWHU &RQWH[W RI WKH RUJDQL]DWLRQ

3ODQ

&KDSWHU &RQWURO RI QRQFRPIRUPLQJ RXWSXWV

&KDSWHU 5HOHDVH RI SURGXFWV VHUYLFHV

&KDSWHU 3URGXFWLRQ DQG VHUYLFH SURYLVLRQ

&KDSWHU ([WHUQDO SURYLVLRQ SURFXUHPHQW

&KDSWHU 'HYHORSPHQW

&KDSWHU 5HTXLUHPHQWV IRU SURGXFWV DQG VHUYLFHV

&KDSWHU 2SHUDWLRQDO 3ODQQLQJ DQG FRQWURO

&KDSWHU 2SHUDWLRQ

&KDSWHU 0DQDJHPHQW UHYLHZ

&KDSWHU ,QWHUQDO DXGLW

&KDSWHU 0RQLWRULQJ PHDVXUHPHQW DQDO\VLV DQG HYDOXDWLRQ

&KDSWHU 3HUIRUPDQFH HYDOXDWLRQ

&KHFN

&KDSWHU &RQWLQXDO LPSURYHPHQW

&KDSWHU 1RQFRPIRUPLW\ DQG FRUUHFWLYH DFWLRQ

&KDSWHU *HQHUDO

&KDSWHU ,PSURYHPHQW

$FW

11.1â&#x20AC;&#x192; Quality Management Systems 279

280

11 Quality and Safety Management

recognised QM systems.3 The management hereby is not only to be integrated into the quality management; in the last instance, the top management is responsible for the full functionality of the QM system. This derives from the idea that decisions that are directly taken and supervised by the management, can be implemented most effectively within the organisation. If the quality objectives of the executive management are furthermore characterised by clarity and definiteness, then they are most likely to find their way into daily routine through corporate culture and process design. A structured quality management system demands and promotes intensified focus on organisational processes, interfaces and competencies. As organisational processes are made transparent, staff members recognise their function within the relevant processes as well as within the entire value chain. This underlines the value of the work and contributes to an increasing readiness to take over responsibility and an improvement of quality awareness.

11.1.3 Documentation of a Quality Management System A quality management system can only be sustainably and effectively integrated in an organisation, if it is comprehensively documented in writing and staff has access to the appropriate documentation. Compliance demonstration to authorities or customers can only be ensured convincingly, if setup, structures and responsibilities are clearly and comprehensibly defined. QM documentation directs operations into formalistic channels and reduces the flexibility and freedom of the individual employee. However, a well-defined and structured approach is indispensable when dealing with operational complexity. This is especially true for large organisations, that are characterised by exceptional process diversity and numerous internal interfaces. The ideal quality management system must therefore be both target group-oriented and meet regulatory requirements. However, an industry-wide standardisation of the documentation of a quality management system is only applicable or feasible in rare cases, as organisations often considerably differ in terms of size, structure, performance portfolio and culture. For this reason, the aviation regulations provide only little detail with regard to the specific design and structure of the QM documentation. EASA and EN only define what must be part of a QM documentation, but not how things have to be implemented in detail within the organisation. Regarding the what, the availability of the following key elements is usually required: • documented quality objectives and a quality policy, • an operating or QM manual/exposition, documented procedures or process descriptions,

3 See e.g. EN 9100er standard series chap. 5; IR Initial Airworthiness Part 21-21A.145 (c), 21A.139 (b) (2); IR Continuing Airworthiness Part 145–145.A.70 (a).

11.1â&#x20AC;&#x192; Quality Management Systems 281

â&#x20AC;˘ documents required by the organisation to ensure effective planning, implementation and control of processes (for example, form sheets, checklists), â&#x20AC;˘ records to demonstrate compliance with regulatory and product requirements. A hierarchic pyramid document structure, whose degree of detail increases from top to bottom (see Fig.Â 11.3) has become generally accepted in practice. The highest documentation level is formed by the QM manual or organisation exposition. This is to provide the reader with an overview of the organisation in general and the quality management system in particular. Subordinated to this first level are procedural instructions or process descriptions in which the operational structures are defined in detail with the associated responsibilities. The lowest documentation level is formed by instructions, checklists or other supporting documents that specifically regulate procedures with regard to individual activities, tasks or jobs. Most organisations supplement the statutory or normative requirements with individual specifications. Their origin may be due to own quality requirements, however, these can also be the result of exaggerated audit findings or customer demands. For all standards, irrespective of their origin, there is a risk that the quantity and scope of descriptions get out of control over time. As a result, the documentation may no longer be up-to-date and there may be conflicting multiple descriptions. In any case, this reduces the acceptance of the entire system among the staff. In that regard, there is usually a conflict of objectives with regard to the different requirements of all stakeholders (see Table 11.2). Finding a solution is often difficult in practice and requires customized solutions. In any case, the reader must understand the contents of guidelines. In addition, employees must be able to find their company, department and their processes in the documentation and identify with the contents.

Â&#x2021; GRFXPHQWHG TXDOLW\ REMHFWLYHV DQG TXDOLW\ SROLF\ Â&#x2021; EDVLF RSHUDWLQJ VWUXFWXUHV 0DQDJHPHQW PDQXDO

Â&#x2021; GRFXPHQWHG SURFHGXUHV RU SURFHVV GHVFULSWLRQV Â&#x2021; 'RFXPHQWV UHTXLUHG E\ WKH RUJDQLVDWLRQ WR HQVXUH HIIHFWLYH SODQQLQJ H[HFXWLRQ DQG FRQWURO RI SURFHVVHV

3URFHVV GHVFULSWLRQV SURFHGXUHV VWDQGDUG RSHUDWLQJ SURFHGXUHV

&KHFNOLVWV FRPSOHWLRQ JXLGHV VSHFLILFDWLRQV IRUPV LQVWUXFWLRQV MRE FDUGV

Fig.Â 11.3â&#x20AC;&#x192; Structural organisation of a QM documentation

282

11 Quality and Safety Management

Table 11.2 Objectives of a quality documentation Target group

Objective of QM documentation

employees of the company

knowledge of the interdependencies between the departments information about objectives and visions transparency of processes training for new employees

customers of the company

confidence in competence and quality capability implementation of customer requirements procedure for complaints

authorities / certification body

proof of compliance definition of responsibilities and roles assignment of the processes to the requirements

Management Manual The management manual (operating manual, exposition) is the highest level of documentation of a QM system. The manual serves primarily as a framework for the entire documentation and shows how the organisation ensures implementation of standard requirements. Such a manual is only explicitly required for regulatory approvals. Organisations certified according to EN 9100 standards are no longer under obligation to keep an exposition after the revision in 2016, but most organisations continue to maintain their existing systems. The advantage of such a management tool is that it provides a comprehensive overview of the actual state of the organisation and the QM system. The exposition thus is a compressed self-representation that, as a rule, contains the following core components: • • • • •

presentation of entrepreneurial vision, quality policy and objectives, description of structural organisation and key processes, fundamental responsibilities (in particular at the highest level), definitions to the administration and change of the management manual, references on resuming documentation of the second level.

Structure, level of detail and format of the management manual are not subject to any fixed rules, but are based on specific needs of the organisation. However, it must have a structure that is easy to understand, even for outsiders, always in line with current operational status and taking into account the requirements of the applicable regulations. The extent of the manual particularly depends on the complexity of the system and the number of documentation levels. Since the manual is subordinated to further documentation levels with process descriptions, procedural instructions or even work instructions, the manual should be limited to the essentials and include additional documentation only for reference purposes. Redundancies are hereby to be strictly avoided. When creating and updating the manual, it should be taken in account that this is usually not primarily information for employees and executives, but rather an

11.1 Quality Management Systems 283

external representation of the organisation and therefore needs to meet the specific needs of customers and authorities. In the EASA region, the exposition is part of the approval basis of Part 21G, 21J as well as Part M and 145-organisations, so that changes to this document require approval of the responsible aviation authority. The preparation and maintenance of an exposition is thus mandatory for officially approved organisations. It not only describes the operational setup and structures; it is at the same time a kind of contract between the authority and the organisation, whereby the latter are under obligation to comply with the aspects as defined in the exposition. ▶▶

Exemplary Structure of a Production Organisation Exposition (POE) as per EN 9100 (additional legal elements using Part 21G as an example in italics) 1. Application area. 2. Structure of the manual. 3. Organisational structure and responsibility 4. Context of the organisation 5. Leadership 6. Planning 7. Support 8. Operation planning, project and risk management design procurement production and/or service contribution measuring and testing equipment. 8. Measurement, analysis and improvement. 9. Performance evaluation 10. Improvement 11. Legal requirements (only necessary for EASA approvals) Eligibility (21A.133) Issue of production organisation approval (21A.135) Quality systems (21A.139) Exposition (21A.143 POE) Approval requirements (21A.145) Changes to the approved production organisation (21A.147. 21A.148) Approvals and their changes (21A.151, 21A.153) Investigations (21A.157) Findings (21A.158) Obligations of holders (21A.165).

284

11 Quality and Safety Management

Regarding main official approvals, differentiations are here made between the following manuals: • Design organisation exposition according to 21A.243 for the Part 21J, • Production organisation exposition according to 21A.143 for the Part 21G, • Maintenance organisation exposition according to 145.A.70 for Part 145. Each type of above mentioned approval is based on its own specific requirements with regard to the exposition. It is highly recommended to strictly comply with official recommendations (AMC, GM) with regard to setup and structure when creating an exposition. This saves time and effort. An integration of several QM expositions of different regulations is often not desired by aviation authorities, but in principle possible (see the following gray box). As a result, organisations with multiple approvals also have to maintain several manuals. The situation is, however, different when it comes to ISO/EN standards. Here, the compilation of different rules (for example, EN 9100, OHSAS, and ISO 14001) in one QM manual is desirable and is even facilitated by the high-level structure. Whether it is an official exposition or the standard QM manual – in both cases it is permissible to refer to other documents. Such separating is typical in cases where confidential information (e.g. personal data) or data that are subject to high fluctuation are concerned (e.g. subcontractor list). Procedural and Process Descriptions The level below the management manual, in the second documentation level, where process descriptions or procedural instructions are located. While the management/operations manual gives a summarizing overview of structure and process organisation, basic operational rules as well as responsibilities, processes and procedures are described in detail on the second level. On this documentation level, the normative standards of the applicable regulations (e.g. EASA regulations, ISO, EN, environmental laws) are thus formulated as concrete action instructions and comprehensively documented as binding regulations within the organisation. Procedural instructions or process descriptions determine: • who does what, when • how individual steps in the process are triggered (input) and what results are planned (output) • which tools, documents and equipment are required for the execution, • how the execution must be documented, • who is to be informed during the execution, when, by whom, by which means, • what and when decisions are to be taken. In the description, all tasks or activities in the procedure (as far as appropriate: planning, preparatory, executing, monitoring, checking, evaluating, documenting, etc.) should be recorded with a depth of description as appropriate for the parties involved.

11.1â&#x20AC;&#x192; Quality Management Systems 285

The documentation of the processes helps to make the organisation transparent and thus show employees their tasks in the value chain. Tasks and objectives of process and process descriptions are therefore: â&#x20AC;˘ regulating departmental as well as cross-departmental business processes, â&#x20AC;˘ defining responsibilities for processes, process steps and activities, â&#x20AC;˘ determining interfaces including associated inputs and outputs. In the past, procedures were primarily documented in the form of prosaic standard operating procedures. Their structure is divided into header data, purpose, area of application, procedure and responsibilities, other related documents and documentation as well as notes on changes. In officially approved quality systems, these practice-Âoriented process descriptions are still common practice today. In many organisations, however, there now is a clear trend away from text-based documentation to comprehensive process visualisation. This process-oriented approach is particularly required by EN 9100 and has been generally adopted on a broad level within the industry for quite some years now. Such a visualised standard documentation uses flow-charts to clarify staff roles within the organisation, outlines process interfaces and thus ensures greater transparency in the value chain. In addition to that, this representation form can help both new staff and external auditors to better focus on the relevant aspects with regard to organisational structure and standard documentation. Another advantage of visualized flowcharts over traditional procedures is the lower risk of redundant descriptions

6WDWH PDS

3URFHVV PDS

5HJLRQDO PDS

/HYHO RI GHWDLO

&LW\ PDS

3URFHVV GHVFULSWLRQ IORZ FKDUW

:RUN UHODWHG 'RFXPHQW

KLJK

)RUPV FKHFNOLVWV LQVWUXFWLRQV IRU FRPSOHWLRQ

,QIRER[ IRU GHWDLOHG DFWLYLW\ GHVFULSWLRQ

Fig.Â 11.4â&#x20AC;&#x192; Structure of Lufthansa Technikâ&#x20AC;&#x2122;s process-based QM system IQ MOVE

286

11 Quality and Safety Management

due to the higher transparency. Fig. 11.4 presents the different documentation levels of Lufthansa Technik’s process-based IQ MOVE quality management system. Working documents are located at the third and lowest documentation level. This level contains supporting documents that provide additional information or implementation facilitation for individual activities or work steps. These are, for example, work instructions, checklists, forms, form sheets or test instructions. This type of documentation is used where standardized processes have to be carried out, but due to complexity of implementation, they cannot be handled with required quality without additional documentation. Supporting documents are also used where activities or procedures are often executed incorrectly or incompletely. With their mandatory application, a job-appropriate execution is to be ensured. The use of third level documents can also be the result of legal requirements or customer demands. Special Characteristics of Aeronautical Process and Procedural Descriptions The EASA regulations might not determine form or degree of detail of procedural or process descriptions, however, they do refer to processes that are to be specified in writing. Using process and procedural descriptions thus is highly recommended for approved aeronautical organisations in the associated AMC.4 For approved maintenance organisations, the setting of over 50 procedures is recommended. Also for production organisations around twenty procedures are required. Extract of Recommended Procedures in Maintenance5 • Storage, marking and release of components and materials • Acceptance and release of tools and equipment • Calibration of tools and equipment • Archiving of technical documents • Rectification of findings in the course of base maintenance • Release to service • Critical tasks • Handling pool or borrowed parts in line maintenance • Qualification of employees entitled to maintenance and release authorisation • Human factors training procedures In contrast to that, the standards for design organisations are less specific and are limited to process descriptions in six main categories (e.g. change classification, control and monitoring of third party assignments, configuration management, documentation). Necessity and extent to document procedures and processes for production organisations directly results from EASA Part 21G section 21A.139. Practice, however,

4 5

See AMC No. 1 to 21A.243 (a) and/or AMC to 145.A.70 (a), Part 21/G 21A.139 (b) See AMC to 145.A.70 (a).

11.2 Safety/Risk Management Systems 287

shows that in addition to the topics specified in the EASA regulations, all key processes of the value chain should always be documented in process descriptions. This is even mandatory if the organisation holds an EN 9100 series certification.

11.2

Safety/Risk Management Systems

11.2.1 Safety and Risk Management Basics Safety management is the structured handling of safety-relevant risks in aeronautical organisations. Safety management is based on the philosophy of interpreting safety as an executive function that is embedded across the entire organisation. Safety aspects are to be systematically integrated in the value chain including all staff members. In recent years, safety management issues have continuously increased in significance in aeronautical organisations and even become part of aviation legislation.6 The methods and tools that characterise safety management are almost analogous to the ones applied in risk management and are therefore not presented twice hereinafter. Organisational safety requirements are to be implemented in the form of a Safety Management System (SMS), i. e. a formally established setup and structural concept that is to ensure the safety of the products placed on the market. It hereby is to identify safety risks; keep them under control and to eliminate whenever possible, with the help of the risk management. The system must be able to proactively track and handle both latent risks and the accumulation of low-risk product hazards. To ensure the sustainability of SMS throughout the organisation, such a system must, however, not only be based on documented structures, it must particularly be applied in daily practice. A crucial factor hereby is the lived compliance of all staff members, in particular of managers. On the one hand, this requires education and training and on the other hand, the systematic development of an internal safety culture. In summary, a SMS features the following substantial elements (see also Fig. 11.5):7 • Safety objectives and policy –– Organisational safety objectives and management commitment –– Safety responsibility of the management –– Emergency response planning –– Documentation of the SMS (safety manual). • Risk management –– Identification of risks –– Risk evaluation and control

6 7

See ICAO (2008); EASA – Annex 1 to OR.GEN.200 See ICAO (2008); EASA – Annex 1 to OR.GEN.200

288

11 Quality and Safety Management

6DIHW\ REMHFWLYHV UHVSRQVLELOLWLHV

0HDVXUHPHQW DQG PRQLWRULQJ RI ULVN WUHQG

5LVN LGHQWLILFDWLRQ

(YDOXDWLRQ DQG FRQWURO RI ULVNV

3URPRWLQJ D VDIHW\ FXOWXUH

7UDLQLQJ TXDOLILFDWLRQ Fig. 11.5 Safety management pillars

–– Monitoring and measurement of operational safety performance –– Continuous improvement of the SMS. • Safety culture and expertise –– Education and training –– Development of a safety culture.

11.2.2 Organisational Framework 11.2.2.1 Management Tasks The management must implement and maintain an SMS that meets the specific requirements of the organisation. The aeronautical organisation hereby firstly requires a comprehensible and understandable safety policy as well as measurable safety objectives that provide a framework for all safety activities. The management has to ensure that a process system is established that allows for a structured identification, analysis, evaluation and controlling of risk. When implementing an SMS, the organisation must also have an implementation plan. Furthermore, it is indispensable for the management to ensure availability of resources required for the introduction and operation of an SMS. After the system has been implemented the management is tasked with assessing the SMS regarding its efficiency in regular intervals. This task is to be assumed by a Safety Review Board, whose constitution is mandatory and includes the most

11.2 Safety/Risk Management Systems 289

important executive staff representatives.8 In the event of deviations from the safety policy or safety objectives, corrective measures must be ordered and monitored. Analog structures are to be established for a risk management system.

11.2.2.2 Safety and Risk Responsibilities To prevent scenarios where competencies are mutually pushed back and forth between executive staff or other employees, it is essential to ensure that safety management responsibilities are clearly allocated across all hierarchy levels. It consequently does not suffice to designate an SMS officer among top management, who is to ensure the successful implementation and sustainable operation of the system. Additional managers and employees are to be appointed to ensure that the objectives of the SMS are also followed at operational level.9 This demands the appointment of a safety manager, who oversees all SMS tasks and acts as interface between management and executing teams. The prime task of a safety manager thus is to manage the SMS in daily practice. Comparable to the requirements of other regulations and standards (EASA Part 21 and 145, ISO, EN) all responsible staff members are to be documented including their specific SMS responsibility and their names to be communicated throughout the organisation. This applies for safety and risk management systems. 11.2.2.3 Documentation of SMS Structures All safety structures and standards must be documented, as the written form approach is most likely to generate commitment and sustainability.10 For this reason, the organisation has to create a safety management system manual. As a kind of safety guideline for staff, this manual is to be distributed throughout the organisation and made easily accessible. At the same time, it is to provide an overview of the SMS to authorities, customers and certification bodies. The SMS manual contains at least following elements: • Safety policy and objectives, • Description of safety-relevant process structures (or references to relevant documents), • Description of safety activities as well as a general representation of facilities, • Organisational chart(s) outlining internal safety competencies, • Designation of employees responsible for safety issues including their function, • Description of reporting structures.

See AMC 2 to OR.GEN.200 (a) (3) (3). For a team leader, this might mean (as per job description) that in addition to his other tasks, he must identify, evaluate and report risks within his area/team to the Safety Manager on a semi-annual basis. In addition to that, he might have to regularly inform his employees about the latest safety developments. 10 Here, the requirements of a recognized SMS clearly go beyond those of a risk management system. The latter must be established in the operational processes, structures and documentation, but not necessarily as an independent management system. 8 9

290

11 Quality and Safety Management

The documentation of the safety management system is, however, not limited to the SMS manual. In addition to that, safety requirements must be integrated into existing process descriptions or operating instructions as well as into checklists, forms, production standards, etc. An officially approved aeronautical organisation must have an emergency response plan (ERP) in place determining, how the organisation handles major deviations from normal operation and which procedures are to be applied to re-establish normal conditions.

11.2.3 Risk Management Identification, evaluation and control as well as monitoring of safety-relevant risks form the core elements of a safety management system.11 This is also referred to as risk management that represents a continuous process (see Fig. 11.6). In practice, this is usually re-initiated on a semi-annual to annual basis. For operational risk management the organisation must establish a control committee (safety action group) that consists of staff members of all operational levels.12

11.2.3.1 Risk Identification The beginning of the risk management process is marked by the structured identification, collection and allocation of any existing or potential condition that can lead to injury, or death to people; damage to or loss of a system, equipment, or property;

$GMXVWPHQW DQG LPSURYHPHQW SURFHVVHV

&RQWLQXRXV PRQLWRULQJ

'HILQLWLRQ RI VDIHW\ SROLF\ DQG REMHFWLYHV

3ODQ ± GR ± FKHFN ± DFW F\FOH RI ULVN PDQDJHPHQW

5LVN FRQWURO

5LVN LGHQWLILFDWLRQ

5LVN DQDO\VLV HYDOXDWLRQ

Fig. 11.6 Risk & safety management as continuous process

11 EN 9100 standard series in Sect. 6.1 requires risk management and risk based thinking as well. However, the focus hereby – other than in the context of the EASA requirements – is not only safety-oriented, but particularly aims at compliance with customer requirements. 12 See AMC 2 to OR.GEN.200 (A) (3) (4).

11.2 Safety/Risk Management Systems 291

or damage to the environment.13 The identification phase is the most important stage of the overall process, as it generates the information basis for all subsequent activities. To facilitate an identification and systematisation of risks, risk categories are to be established first (e.g. market developments, supplier risks, risk in work execution or design). On this basis, the actual inventory of safety-relevant risks is then carried out on a company-wide basis as well as in every department and for all key processes. Only a broad information basis allows for an identification of all internal and external influence factors and generates a complete picture of safety-relevant risks. Following the identification, information on the individual risks is to be collected – independent of type and scope – creating the basis for risk analysis and assessment.

11.2.3.2 Risk Analysis and Evaluation After the organisation has identified all safety risks, a process must be initiated that focuses on the analysis and evaluation of these risks, allowing for a classification of risks according to impact and a determination of measures for risk handling. When analysing risks, their effects on other departments as well as the interdependencies between individual risks are to be taken into particular account. These can hold by far higher risk potentials than might first appear when merely considering individual risks. Special attention should be given to the potential risk impact and the likelihood of occurrence of each risk, as these details are best suited to provide a comprehensive risk assessment. Both quantitative and qualitative parameters can be used when assessing and classifying risks. In this context, stakeholders sometimes criticise that the majority of the risks cannot be accurately assessed, but only classified at best. The fact that assessments are often based on a subjective view of the responsible employees, is partly seen as a disadvantage. However, it should be pointed out that the evaluation parameters generally only need to be known approximately to determine the necessity and type and extent of countermeasures. It is, of course, important that all organisational risks are identified and assessed subject to the same parameters and methods in the sense of a uniform approach. However, at the end of the day it is above all crucial that the persons responsible for risk are aware of the urgency of the need for action and the possibility of mitigating the risk by active countermeasures has been made transparent. In practice, it has proved helpful to classify the safety risks according to Fig. 11.6 using a risk matrix with three to five risk clusters. The boundaries between the clusters are also referred to as risk thresholds. When they are exceeded or drop below a certain level, this does not only result in the assignment to a new risk cluster. Internal risk significance and urgency of the need for action are to be adapted at the same time.

ICAO (2009).

292 ▶▶

11 Quality and Safety Management

Four Questions for Peter Kohberg,14 Expert on Practice-Oriented Risk Management Activities in the Aeronautical Industry, on Handling Risks in Production and Maintenance: What are the most common weaknesses in the area of risk management? The problem is that too many organisations have failed to establish an adequate risk management or use systems that are too selective or reactive. Too often, risk management systems are not operated with the necessary consistency. Organisations can only work well, when their risks, both throughout the organisation as a whole and in the value chain processes, are managed proactively, systematically, comprehensively and sustainably. This includes more than a mere regular risk review. The organisation must consistently focus its structures on possible risks and their avoidance, amongst other things, by taking them into account in objectives, documentation, form sheets, employee qualification/training or intensification of audit and monitoring activities. However, the necessary continuity and consistent application of such risk-oriented methods and measures is highly underdeveloped in practice. These deficits prompted the authors of the EN 9100 to accentuate the issue in the 2016 revision much more than in previous issues. The term “risk” is used 60 times here. How can risks be appropriately be identified and evaluated? Risk identification is to determine the status of a project, process or activity under uncertainty. Risk identification must be systematic to ensure that all significant aspects have been identified in relation to the risks involved. Checklists, analyses, calculations, reviews or brainstorming are used in this context. Risks must be described in a structured format that at least comprises a risk description, cause, probability and effects. However, in some cases the challenge is not identification of risks, but rather the assessment of their impact. In daily practice, the need for the most precise measurability and quantification is often observed. However, these factors are not that important in production and maintenance. This applies all the more as exact assignments of cost or occurrence are usually not possible. Dividing risks into groups using a scoring model or a risk matrix (see Figs. 11.7 or 11.8), e.g. into low, medium, high, very high, catastrophic is often sufficient and effective for everyday business. Finally, a simple risk classification can also be used to derive sound statements about the nature, extent and prioritization of appropriate risk-minimizing measures.

Peter Kohberg used to be Head of Quality Management at Fairchild Dornier. Subsequently, he worked as an aviation consultant and EN 9100 auditor for many years. He is now primarily holding aeronautical training courses. 14

11.2â&#x20AC;&#x192; Safety/Risk Management Systems 293 ,PSDFW RQ SDVVHQJHUV

,PSDFW RQ WKH DLUFUDIW

2SHUDWLRQDO HIIHFWV

1R LPSDFW RQ IOLJKW FUHZ

,QFRQYHQLHQFH

1R LPSDFW RQ RSHUDWLRQDO VHFXULW\

(UURU RI HYHU\GD\ EXVLQHVV GDPDJH Âź

6OLJKW LQFUHDVH LQ ZRUNORDG

3K\VLFDO GLVFRPIRUW

6OLJKW UHGXFWLRQ LQ IXQFWLRQDO HIILFLHQF\

2FFDVLRQDO PLVWDNHV RI WKH RSHUDWLRQDO HYHU\GD\ OLIH GDPDJH EHWZHHQ Âź DQG Âź

3K\VLFDO GLVFRPIRUW RU D VLJQLILFDQW LQFUHDVH LQ ZRUNORDG

3K\VLFDO GLVWUHVV SRVVLEO\ LQFOXGLQJ LQMXULHV

6LJQLILFDQW UHGXFWLRQ LQ IHDWXUHV

5DUH PLVWDNHV WKDW DUH DVVRFLDWHG ZLWK VLJQLILFDQW FRVWV GDPDJH EHWZHHQ Âź DQG Âź

3K\VLFDO VXIIHULQJ RU H[FHVVLYH ZRUNORDG LPSDLUPHQW

6HULRXV RU IDWDO LQMXULHV WR D VPDOO QXPEHU RI SDVVHQJHUV

&RQVLGHUDEOH UHGXFWLRQ RI IXQFWLRQV RU VDIHW\ PDUJLQV

9HU\ UDUH HUURUV WKDW DUH DVVRFLDWHG ZLWK VLJQLILFDQW FRVWV GDPDJH EHWZHHQ Âź DQG Âź

)DWDOLWLHV RU LQFDSDFLWDWLRQ

0XOWLSOH IDWDOLWLHV

8VXDOO\ ORVV RI WKH DLUFUDIW

([LVWHQFH GDPDJH JUHDWHU Âź

,PSDFW RQ FUHZ PDUJLQDO

VOLJKW

UHOHYDQW

GDQJHURXV

FDWDVWURSKLF

Fig.Â 11.7â&#x20AC;&#x192; Risk matrix (following EASA AMC 25.1309, except last column)

What are the most effective risk management tools? In addition to brainstorming, the FMEA or the fault tree analysis (FTA), are useful risk identification tools. For risk assessment in production and maintenance, a cause-and-effect diagram according to Ishikawa generally proves to be helpful and sufficient. Such a fishbone diagram supports the dissection of a problem into individual causes. The problem (effect) and influences (causes) are hereby presented (see Fig.Â 11.9). This model also subdivides main and secondary causes and thus facilitates a targeted determination of root cause. In addition to the Ishikawa method, risks can also be assessed using the 4D, 5D or 8D report that consists of 4, 5 or 8 process steps. Those D-Reports outline the nature of the nonconformity, responsibilities and measures taken. The D-method ensures that by using a systematic approach and consistent documentation of individual solution steps, problem causes are determined, and by taking preventive measures cases of repetition can mostly be prevented. Another evaluation method is the aforementioned FMEA. All methods are similar in terms of procedure. The analysis is carried out according to the 6W-method (What ?, When ?, Where ?, Who ?, WhyÂ ?, How?) on the basis of which causes can be divided into individual aspects. All tools mentioned above can also be supplemented by the 5W-method (5x for each question a more detailed â&#x20AC;&#x153;Whyâ&#x20AC;?) in order to determine underlying causes.

11â&#x20AC;&#x192; Quality and Safety Management

([LVWHQWLDO ULVNV

PHGLXP

ORZ

SUREDELOLW\

KLJK

294

6LJQLILFDQW ULVNV

6XVWDLQDEOH ULVNV ORZ

PHGLXP

KLJK

HIIHFW RI GDPDJH 5LVNV WKDW DUH UHODWLYHO\ OLNHO\ WR RFFXU DQG DW WKH VDPH WLPH FDXVH FDWDVWURSKLF GDPDJH PXVW EH VWULFWO\ DYRLGHG :KHQ LGHQWLI\LQJ VXFK ULVNV WKHUH LV DQ LPPHGLDWH QHHG IRU DFWLRQ 5LVNV WKDW FDQ FDXVH VLJQLILFDQW GDPDJH LQ WKH FDVH RI D PHGLXP SUREDELOLW\ RI RFFXUUHQFH PXVW EH PRQLWRUHG FULWLFDOO\ 7KHUH LV DQ XUJHQW QHHG IRU DFWLRQ 5LVNV LQ WKLV DUHD DUH SUHGRPLQDQWO\ ORZ ULVNV WKDW WKH FRPSDQ\ FDQ FRSH ZLWK ,Q VRPH FDVHV WKHVH DUH ULVNV WKDW KDYH WR EH ERUQH LQ GDLO\ EXVLQHVV 7KHUH PD\ EH D QHHG IRU DFWLRQ KHUH Fig. 11.8â&#x20AC;&#x192; Risk matrix from an economic viewpoint

What are the challenges when deriving and implementing measures? Derivation of measures is initially not the problem, as employees usually know the weaknesses in the value chain and have solid solution competence. Too often, however, the financing of measures or their consistent and sustainable processing is an issue. If risks are not threatening, measures often come to nothing after four to six weeks, because the person in charge has to solve higher-priority or more urgent problems elsewhere. If a structured follow-up of risk or QM-related open items is missing, the corresponding activities fizzle out completely, until the next risk occurs.

11.2 Safety/Risk Management Systems 295 &DXVH 0DFKLQH

6LQJOH FDXVH

(IIHFW 0HWKRGV

6LQJOH FDXVH

3UREOHP

6LQJOH FDXVH

0DQ 3RZHU

6LQJOH FDXVH

0DWHULDO

6LQJOH FDXVH

(QYLURQPHQW

Fig. 11.9 Ishikawa or fishbone diagram (generic representation)

11.2.3.3 Risk Controlling After risks were identified, analysed and evaluated, risk control measures are to be determined. The objective hereby is to actively mitigate risk in the sense of organisation’s safety policy and objectives. For risk management, the following strategies may be considered individually or in combination: Risk avoidance: The action, which is responsible for the origin of the risk, basically refrain. Thus an organisation can avoid the danger, but must also refrain from any chances. Risk minimisation: With the help of this strategy risks are to be reduced, by own control measures to an acceptable measure. Risk shifting: The objective is a transfer of risks whether actual or contractual, in parts or in full to a third party (e.g. customer, supplier or insurance). The risk itself remains, however, the party bearing the risk changes. Risk acceptance: Accepting risks is based on the perception that certain risk can neither be avoided nor minimised or that the costs of a conscious risk are out of all proportion to the benefit. The strategy chosen for handling dangers is determined to a large extent by the individual risk tolerance of the organisation concerned. Due to the possible consequences of their actions as well as subject to the legal framework aeronautical organisations are highly safety-oriented; their approach can therefore be classified as risk-averse.

11.2.4 Safety and Risk Monitoring The effectiveness of control measures can only be objectively and systematically assessed, if appropriate activities are comprehensively and consistently monitored and measured. Constant monitoring of operational safety objectives and

296

11â&#x20AC;&#x192; Quality and Safety Management

actual risk situations is thus necessary and assessment indicators, such as KPIs that indicate the progress made with regard to target achievement, must exist. Information hereby required can be operational data, surveys or audit results. If deviations from objectives are measured, countermeasures are to be developed and implemented. Monitoring must hereby not only focus on the development of safety-relevant risks themselves, but also comprise the performance of the safety management system itself. For this purpose, aeronautical organisations must have a documented process that controls the effectiveness of the SMS and ensures its continuous improvement and compliance with regulatory safety requirements (compliance monitoring). It must describe how deviations, weaknesses or potential for improvement can be identified and controlled within the framework of ongoing monitoring. For this purpose, after detection of system weaknesses, action measures are to be derived and instructed by the management. To establish a cycle here as well, the implementation and effectiveness of the measures is to be assessed and to be reported back to the management.

11.2.5 Promoting Safety Expertise and Culture The definition of operational safety objectives and an appropriate alignment of organisational structures alone does not suffice to ensure sustainable success of a safety management system. The safety idea must be anchored in the minds of the employees and be an integral part of everyday business life. This succeeds best if the employees develop a problem awareness for the operational sources of error and potential dangers. In order to adequately translate the safety requirements and the safety culture into operation, staff must therefore be qualified under safety aspects and a training concept is to be prepared and implemented. Important elements can for example be Human Factors trainings or lessons learned events. In practice, safety trainings are often criticised, as they bind personnel capacity and always tight financial resources. In the long run, however, such investments always pay off (If you think safety is expensive, try an accident!). From an economic perspective, systematic staff qualification contributes to a minimisation of working errors and thus to a reduction of error costs due to inappropriate work execution. In addition to that, safety training can facilitate the release of implementing staff and their executives from liability from a legal view. The establishment of an appropriate safety level can hereby neither be achieved overnight, nor by training and qualification measures alone. There must be a continuous sensitisation of the employees for safety-oriented behaviour. It is therefore important for organisations to apply effective communication structures that are not only used to achieve safety objectives, but also support the development of a safety culture. This can, for example, succeed, when safety-relevant issued are addressed in team meetings, mailings or internal publications. It should become clear in any case that the top management demands and promotes appropriate debate; the success of

11.3 Auditing 297

a safety management system crucially depends on the executive staff’s acceptance and assertiveness: They must fully support the safety culture, or even better live it.

11.3 Auditing The management of process and interface complexity, while simultaneously taking into account high regulation density, is one of the key challenges for aeronautical organisations. However, it is necessary to comply with operational requirements, especially external regulations, during service provision. The latter includes, e.g. EASA Part 21 or 145, the associated AMC and the Guidance Material, the EN 9100, design and customer specifications, etc. Their compliance must be continuously monitored. This happens mainly through audits. An audit (from Latin audire, i. e. hear) is defined as systematic, independent evaluation that serves to assess products, activities, procedures and processes as well as the entire QM systems regarding their compliance with defined requirements or standards. Audits therefore serve the purpose of checking whether • The QM documentation sufficiently and comprehensively outlines the requirements of the regulations to be audited • the internal documentation is effectively implemented and complied with. As a result, it has to be demonstrated that the processes are stable, compliant and capable of achieving the operational quality objectives. At the same time, audits can be used to identify weak points and potential for improvement as well as monitor the related implementation measures. The audit thus serves to supervise and correct the entire QM system. The audit is hereby not only an essential quality management element, but a management tool as well. With audits, the management can resort to an instrument for structured and independent analysis that provides information on the effectiveness and performance of processes and QM system. At the same time, they support the detection of weaknesses and target deviations in daily operation. Audits are furthermore useful tools to draw the attention of all stakeholders to quality requirements. In case of own audits, i. e. internal or supplier audits, it is important that auditors are sufficiently qualified to perform their tasks. The quality of results and thus the audits’ effectiveness crucially depend on the auditors’ qualification. In addition to sound training, audit experience is a key success factor. If the performance of internal audits is outsourced, the auditor should be able to demonstrate aeronautical experience, typically on EN 9100 and/or profound audit experience according to EASA Part 21 or 145. In addition to the auditors’ qualification, their independence and neutrality must be ensured in order to obtain objective audit results. When audits are performed by external parties, this requirement is usually met. When it comes to internal audits, it must be ensured that auditors do not audit their own work environment or department.

298

11 Quality and Safety Management

11.3.1 Auditing Types Depending on the objectives of an audit, it can focus on different aspects. For this reason three substantial kinds of audit are differentiated (See also Fig. 11.7): • System audit, • Process audit, • Product audit. According to EASA regulations, the requirement to perform system audits is mandatory for officially approved organisations, the same applies to EN 9100. For auditing practice, however, it has been shown that the different types of audit can only rarely be carried out in clear segregation, so that overlaps arise. The system audit is used to examine the whole operational quality management system with regard to effectiveness and functionality. The investigation includes a comparison of the underlying rules (regulations, directives, contracts, joint procedures, internal specifications, etc.) with the organisation’s documentation (QM manual, procedures and process, work instructions, etc.) and their compliance in daily practice. In the context of a system audit, QM documentation efficiency and compliance is usually assessed onsite at the auditees’ workplace. Examples for system audits are EASA monitoring audits, EN certification audits, or some supplier audits. The procedural or process audit serves the purpose of assessing the effectiveness of processes, procedures or also individual aspects of the QM system. The process audit does hereby not only focus on the question to what extent the respective processes or its specific elements comply to the applicable requirements, but also to what extent they are effectively implemented. At the same time, the process audit is to be seen and used as process improvement instrument. System and process audits therefore primarily differ in their scope. Process and procedural audits focus on individual aspects of a QM system. Examples of process audits are the examination of the production planning, the auditing of the supplier evaluations and requalification, or a review of special processes (for example, gluing process, electroplating, etc.). The product audit is used to examine and evaluate finished products with regard to their compliance with technical specifications and customer requirements. Audit focus is the product quality in the form of design, function and safety. In addition to the actual product properties, usually a supplementary check is carried out to determine whether the essential production steps are effectively, conclusively and completely embedded in the value chain. The product audit also includes additional requirements, e.g. for storage, labelling, packaging or documentation. In practice, product audits are often performed by customers, e.g. supplier qualification. The first article inspection (FAI) as well is special form of product auditing.

11.3 Auditing 299

11.3.2 Internal Auditing Necessity and Responsibility The EASA as well as the EN 9100 regulations require aeronautical organisations to perform internal audits.15 Internal audits are used to check whether the documented processes and procedures meet the requirements and whether they are implemented in practice. At the same time, organisations can identify existing weaknesses of the QM system and, if necessary, stimulate and carry out improvements. Internal audit is an instrument for the top management that provides information on the effectiveness and performance of its QM system. In addition to that, the internal audit is an opportunity to identify target deviations. To underline the meaning of such a monitoring system and to increase sustainability, the results of the monitoring activities are to be regularly reported to the Top Management, respectively the Accountable Manager. Both EASA and EN regulations therefore require a management feedback procedure.16 If planned results are not achieved, corrections and rework measures must be taken to re-establish compliance with standards, thus ensuring system, process or product conformity. Internal audits mentioned here must essentially be systematic? because the effectiveness of the QM system can only be assessed in this way. However, it also makes sense to combine elements of a process audit, e.g. linked to elements of a product audit to reduce the degree of abstraction. This also enhances understanding and acceptance on part of auditees. In large organisations internal audits are usually carried out by their own audit staff, and thus by the organisation itself. External auditors are only used on a selective basis. However, the situation is different in small and medium-sized enterprises, where support from external auditors is common practice for cost and know-how reasons. Organisations with this size can often only meet the principle of auditors neutrality and independence when obtaining external expertise. In maintenance, however, the subcontracting of internal audits to third parties is subject to strict limits. Maintenance organisations with:17 • more than 500 maintenance-entitled employees must, in principle, have an own internal body that is exclusively dedicated to auditing. • with less than 500 maintenance-entitled staff must perform audits using own personnel, however, the organisation don’t need to concentrate these people in a single department and auditors don’t need be solely responsible for auditing.

See IR Continuing Airworthiness Part 145–145.A.65 (c) as well as IR Initial Airworthiness Part 21 –21A.139 (b) (2) and 21A.239 (a) as well as EN 9100:2016 Sect. 5.3 in conn. with 9.2 16 See IR Continuing Airworthiness EASA Part 145–145.A.65 (C) (2); IR Initial Airworthiness Part 21–21A.139 (b) (2) and 21A.239 (a) (3); EN 9100 series (2016) Sect. 5.3 17 See AMC (145.A.65 (c) (1) (11.) 15

300

11 Quality and Safety Management

It must hereby be made sure that staff may not audit own departments and auditors report to a quality manager, who oversees the entire organisation. • with less than 10 maintenance-mechanics must fully outsource their internal auditing to approved specialists, who are not part of the organisation. Audit Planning Since internal monitoring requires several annual audits a year, a structured planning of annual audit activities is necessary. They have to be carried out on the basis of an audit programme and according to a defined annual audit schedule. This procedure structures the internal monitoring and ensures that all relevant elements of the value chain and the QM system are regularly recorded by audits. The starting point of all audit activities is marked by the audit programme that defines audit basis and thus determines, • where (in which areas, departments, processes), • in which intervals and at what extent as well as • by which audit type the organisation or the supplier are monitored. EASA regulations do not specifically regulate the general intensity of audit activities for design and production organisations. However, some reference points as to type and scope of appropriate audit activities are provided by the maintenance AMCs.18 The audit programme references available there, can partially also used as guideline for design and production organisations: • Audits must provide an overview of processes for every product line offered by the organisation (components, engines, aircraft maintenance, non-destructive testing). • Audits are to be accomplished in all shifts, if two or three shift systems applied in the organisation. • It is recommended to connect process audits with a product audit. The processes and compliance with requirements is to be examined based on a concrete event or task (aircraft, engine or part). • Audit intervals: –– every 12 months the processes of every product line, –– every 24 months all other relevant processes are to be assessed by an audit, –– auditing intervals of line maintenance stations are oriented on their flight-operational significance, however, may not exceed 24 months. When planning audits, it should furthermore be ensured that results of previous audits are taken into account in order to possibly intensify the audit focus established in the context of previous nonconformities. 18

See AMC 145.A.65 (c)(1)

11.3 Auditing 301

Based on the audit programme, an annual audit plan is created which defines the specific audit activities in the relevant period. The annual audit plan thus specifies which processes and procedures are to be examined in which organisational unit and at what time. Such comprehensive annual planning guarantees that all relevant areas, departments and processes are audited. Audit programme and annual audit plan are often combined in one document, especially in small and medium-sized companies. In many organisations the annual audit plan is approved by the management. Audit Preparation Before a concrete audit commences, it needs to be prepared. The (lead) auditor must hereby plan the upcoming audit. In this context an audit plan is to be created, which usually includes the following contents: • • • • •

Scope and objectives, processing and duration, contact persons, audit-relevant documentation, applicable regulations.

In addition to that, applicable tools and methods (check lists, inspections, interviews) are to be determined and previous audit results to be checked. The audit must be communicated in advance to the affected department and, if necessary, explained in a preparatory meeting with regard to type and scope. This procedure allows the audited department to optimally prepare for the event. At the same time, it is possible for the auditor to update his own knowledge or gain an insight into the specifics of the department. Both sides can equally use the preparatory meeting to coordinate personnel resources and documentation requirements, ensuring that everything is available on the day of audit. When scheduling the audit, department-specific needs should also be taken into account to avoid disruptions in the operational business that may result from the audit in the selected period. In case of internal audits preliminary meetings additionally eliminate suspicions of being spied on and increase acceptance. An in-depth interview offers the auditor the opportunity to explain the benefits of the audit to the affected area. Audit Execution The audit usually starts with an auditor briefing. This again outlines the procedure and objectives of the audit. In addition short-term changes are coordinated if necessary. Results or issues of the preceding audit might be integrated as well. The responsible executive staff and employees to be audited participate in the briefing. The introduction is to create a positive, trusting atmosphere motivating the audited staff to constructively cooperate and eliminate fears or nervousness in advance. During the actual audit execution, processes are to be discussed onsite and to be compared with the respective QM documentation. It is advisable to always make a concrete reference to the product by auditing on a selected component, engine or related documentation. At the same time, the practical relevance clarifies that

302

11 Quality and Safety Management

the audit serves no purpose in itself, but a vital element in the process of bringing airworthy products to the market.19 Based on the discussion’s direction, the auditor determines depth and scope of the investigation. Should deviations be identified, further proceedings depend on their kind and extent. Not every deviation constitutes a formal non-conformity. In case of accidental deviations (individual cases), for example, it is usually sufficient to remind the employee onsite once again to comply with the regulations and specifications. In contrast to this, severe or systematic deviations from the target condition must be documented with objective evidence using protocols. The audit can only be successfully executed, if the audited department constructively contributes to the investigation. The auditor must therefore at all times maintain an open-minded atmosphere and be able to motivate staff to share relevant details. In addition to simple and understandable questions, the question technique influences answers. Best results can usually obtained using open questions, e.g.: • How is material tracking ensured from the time of material issue? • Which measures ensure that sufficient staff is available for the individual trades in every shift? • Which measures are taken, once job card errors have been identified? The audit usually ends with a de-briefing, where the auditor presents his observations and results, underlining positive impressions. However, main focus of such a concluding meeting should be on bringing nonconformities up for discussion whose elimination is coordinated in further proceedings. Following up on Internal Audits In follow-up to the audit, results are documented in an audit report. In order to ensure clarity, completeness and readability, the reports are usually prepared on the basis of forms in operational practice. Reports usually comprise the following contents: • • • • •

basic information (execution period, auditor, participants), summary of the audit, nonconformities, potentials for improvement, recommendations, strengths, possible corrective measures, schedule and responsibility to eliminate audit findings.

This report is prepared by the auditor, possibly in coordination with the head of the audited department. In follow-up to the audit, responsibilities and corrective measures including schedules are to be defined for the identified nonconformities. It is also necessary to check whether there are any serious nonconformities similar to those in other organisational units. The respective departments are in charge of the

See AMC 145.A.65 (c) (1) 5.

11.3 Auditing 303

root cause analysis as well as for the identification and implementation of countermeasures. Processing is usually based on a 4D or 8D report. The responsibility for monitoring timely implementation as well as an examination of the effectiveness of the measures lies with the auditor. Depending on the size of the organisation, audit reports are to be submitted to the top management, either individually or in form of a management summary.20 The respective reports should be be signed by management. To promote the sustainability of monitoring activities, audit results (e.g. nonconformities) must be analysed on a regular (at least annual) cumulated basis and to be submitted to the management. Only by applying such systematic evaluation, specifics in nonconformities in individual areas or across an organisation can be identified, assessed and counter measures be taken by the management. In addition to the results of the internal auditing, the periodic summary evaluations should include occurrence reports as well as recommendations and objections from external audits.

11.3.3 External Auditing In addition to internal audits, external audits also play an important role as an operational monitoring tool. With external audits the QM system should be monitored by suppliers (second party audits). External audits are furthermore be used by aviation authorities or neutral third parties (e.g. certification bodies) to assess the organisation’s compliance with certain regulations. The end of such third party audits is usually marked by an approval, a certification or a renewal. Customer and Supplier as well as Regulatory Audits Design, production and maintenance organisations must not only perform own surveillance, they are also supervised by their aviation authorities as well as by other aeronautical organisations. External audits are often system audits, whereby the focus is based on the kind of cooperation. A main factor hereby is the type and extend of service contribution, i. e. whether the aeronautical organisations works for the specific customer as: • officially Part 145 or 21G approved contractors for maintenance or production activities on complete aircraft, on engines or components, • an extended work bench subcontractor, • supplier of services (e.g. test laboratory or engineering service provider), • supplier of raw materials and supplies, • supplier of non-aircraft/non-product related products and services.

The necessity of involving the respective management staff into monitoring, results from IR Initial Airworthiness Part 21–21A.239 (a) (3) for Subpart J and 21A.139 (b) (2) for Subpart G as well as from IR Continuing Airworthiness Part 145–145 A.65 (c) (2) for maintenance. 20

304

11 Quality and Safety Management

A special external auditing form is the regulatory audit. Auditing is hereby performed by staff of the responsible aviation authority. These audits are the basis for approval as design, production or maintenance organisation. Audit contents are here based on the type and scope of approval. External audits by customers, sometimes even by authorities are often suspected of industrial espionage. This is difficult to prove. However, this risk can never be fully excluded, as every external auditor is granted insight into procedures or processes and sometimes receives copies of associated documentation. Formally, these documents are required for the auditor, allowing him to perform his work. However, in practice it can be assumed that such information is in fact shared with competitors, allowing them to improve their processes. When it comes to the disclosure of QM documentation the following guideline thus applies: “As little as possible, as much as necessary”. Certification Audit on the Basis of EN 9100 Series21 In a certification audit, the existence and effectiveness of the QM system is checked against the audited quality standards If compliance with the required quality standards can be proven, a certificate will be issued or an existing one extended following the audit. Certifications in the aviation industry are mostly based on the industry standard EN 9100, EN 9110 or EN 9120.22 Certification audits are offered by accredited certification bodies (e.g. TÜV, SGS, DNV-GL, AirCert). The audit is hereby performed by certified auditors in line with the audit process represented in Fig. 11.9. The extent of the audit and the number of audit days is specified in the EN 910423 on a strictly tabular basis and depends on the number of staff, the number of the organisations sites and as well as on possible exclusions (e.g. design). For organisations planning to introduce EN 9100 certification, it is advisable to perform an internal audit analysing actual conditions in a first step and to compare these results to the EN 9100 requirements (gap analysis). If there is little or no EN 9100 experience, the audit should be carried out by an external consultant. With such an internal audit, the company itself can check whether all necessary certification requirements have been substantially implemented before the external certification process begins. Should significant deficits be detected, these can be discussed with a consultant. In case of initial certifications a Stage I audit is to be carried out that is used to examine the general status of the quality system with regard to fulfilment of EN requirements. The Stage 1 audit is at the same time used to plan scheduling and focus of the main audit.24 The Stage 1 audit should be seen as a chance, because the auditor provides information on weaknesses and thus possible nonconformities in the main audit (Areas of Concern). For further information for certification as per EN 9100:2016 are available with Hinsch (2018). For further information on certification as per EN 9100 standard series, see Sect. 3.2. 23 See EN 9104:2013 Sect. 8.1.3, Tab. 2 24 See EN 9101:2010 (2011), Sect. 4.3.2. p. 22 et seq. 21 22

11.4 Occurrence Reporting Systems 305

The focus of the main audit (Stage 2 audit) evaluation of the structural and procedural organisation as well as the operational documentation including its application in everyday operations. The main audit is performed onsite in the organisation and constitutes about 80 per cent of the entire certification activities. All operating areas and locations of the previously defined scope are checked – irrespective of whether they provide services for aviation or not. In addition, the process performance is determined in each audit via so-called PEARs (Process Effectiveness Assessment Reports). Just like every audit, the certification audit as well ends with a de-briefing and the following report preparation. If the auditor did not identify any nonconformities, the certifying body issues the certificate in the weeks after the main audit. If nonconformities were found during the audit, they have to be eliminated in the follow-up (up to 8 weeks after the audit). If the auditor is unable to evaluate the effectiveness of the nonconformities by means of paper situation, a follow-up audit is necessary to evaluate the corrective measures. Certifications of the EN 9100 standard series are valid for a limited period only. EN 9100 certifications are to be maintained e.g. by an annual surveillance audit and by a re-certification audit to be performed on a tri-annual basis. With these audits the organisation must demonstrate that the standards requirements are still fully and efficiently implemented. These re-audits are less intensive and complex as the initial certification.25

11.4

Occurrence Reporting Systems

Aeronautical production and maintenance organisations must have an internal occurrence reporting system in place that records and assesses safety-relevant occurrences.26 The organisation must have a documented and practiced process (see roughly Fig. 11.10). Severe incidents must not only be recorded and analysed internally, but also be communicated to aviation authority, customers and (if necessary) also to the responsible Part 21J design organisation. The objective of occurrence reporting is to identify and eliminate factors that can endanger flight safety. At the same time, such a system should help to use learning curve effects to avoid similar mistakes in the first place. Continuous, superordinate analysis of all occurrences facilitates the identification of error patterns and trends, so that such an occurrence reporting system also requires the detection and initiation of comprehensive corrective measures. To ensure the success of occurrence reporting, it is necessary that its setup and structure allow all staff members to report incidents. Fig. 11.13 provides an example of an intranet-based input mask.

The certification extent is determined by EN 9104:003 (2011). This requirement results from the main section 21A for design (21.A.3A (b)), Subpart 21G (21A.165 (e)) for production and Part 145 (145.A.60 (b)) for maintenance 25 26

306

11â&#x20AC;&#x192; Quality and Safety Management

4XDOLW\ DXGLW

6\VWHP DXGLW

3URFHVV DXGLW

3URGXFW DXGLW

$VVHVVPHQW RI D 40 V\VWHP VWUXFWXUHV IUDPHZRUN UHVSRQVLELOLWLHV IRU HIIHFWLYHQHVV DQG FRPSOLDQFH ZLWK WKH XQGHUO\LQJ UHJXODWRU\ IUDPHZRUN

$VVHVVPHQW RI SURFHGXUHV DQG ZRUN SURFHVVHV IRU HIIHFWLYHQHVV DQG FRPSOLDQFH WDNLQJ LQWR DFFRXQW WKH UHOHYDQW UHJXODWLRQV

$FWXDO WDUJHW FRPSDULVRQ RI D SURGXFWV LQ DFFRUGDQFH ZLWK WKH VSHFLILHG TXDOLW\ FKDUDFWHULVWLFV FXVWRPHU UHTXLUHPHQWV WHFKQLFDO FKDUDFWHULVWLFV

Fig.Â 11.10â&#x20AC;&#x192; Audit types

At the same time, an occurrence reporting has to become part of the corporate culture so that it can be â&#x20AC;&#x153;livedâ&#x20AC;?. The organisation must hereby have a culture of error tolerance that identifies own weaknesses and risks as improvement potential. Ideally, a culture of the organisationâ&#x20AC;&#x2122;s fault and not individual failure is practiced not only in the external communication, but also internally. A non-punitive error culture can significantly contribute to minimising cover-ups of working errors, which at a later stage could put airworthiness at risk. Cassandra effects must be prevented to ensure the success of a reporting system: in no case must the messenger of bad news, who is not directly associated with the cause, bear the consequences. To communicate this to employees as well, mostly anonymous or independent reporting systems are often used in practice, that underline that the person reporting the incident usually plays no more than a secondary role in its processing. To ensure acceptance of an occurrence reporting, it is necessary to make the results of occurrence reports accessible to the staff, so that they can see what their messages have triggered or caused. There must also be a feedback loop. This is the only way to ensure that the system is taken seriously as a part of the entire error culture and that employees can be motivated to permanently support the error identification process. Practice shows that not all reports have direct relevance with regards to aviation legislation. Occurrence reporting therefore generally differentiates between internal occurrences and such that are to be communicated externally. The latter are constituted, if incidents were identified that have or could have resulted in a state of uncertainty that could put flight safety at significant risk.27

IR Continuing Airworthiness Part 145â&#x20AC;&#x201C;145.A.60 (a).

11.4â&#x20AC;&#x192; Occurrence Reporting Systems 307

,QWURGXFWRU\ WDON

*HWWLQJ WR NQRZ HDFK RWKHU FKHFNLQJ WKH JHQHUDO RSHUDWLRQDO DXGLW FDSDELOLW\

FD Â± PRQWK 6WDJH DXGLW

'RFXPHQW UHYLHZ SODQQLQJ RI WKH PDLQ DXGLW GHWHUPLQDWLRQ RI RUJDQLVDWLRQV JHQHUDO DXGLWDELOLW\

FD Â± PRQWK

6WDJH DXGLW PDLQ DXGLW

'HWDLOHG H[DPLQDWLRQ RI 406 VWUXFWXUH SURFHVVHV DQG GRFXPHQWDWLRQ PHDVXUHPHQW DQG HYDOXDWLRQ RI SURFHVV SHUIRUPDQFH ZLWK 3($5 IRUPV

FD Â± ZHHNV

LI QHFHVVDU\ IROORZ XS DXGLW

&KHFNLQJ WKH FRUUHFWLRQ RI DQ\ ILQGLQJV IURP WKH PDLQ DXGLW

DIWHU RU \HDUV 6XUYHLOODQFH RU UHFHUWLILFDWLRQ DXGLW 0DLQWDLQLQJ WKH FHUWLILFDWLRQ

Fig.Â 11.11â&#x20AC;&#x192; Overview of the EN 9100 standard series audit process

In such cases, the responsible authority is to be informed of the incident within 72Â hours. Examples of reportable incidents are:28 â&#x20AC;¢ damage to primary or secondary structures or an engine, as far as airworthiness can be endangered (e.g. serious tears, deformations, fractures, corrosion), â&#x20AC;¢ severe leakage (hydraulic oil, fuel, hot-air) that can result in structural damage, 28 See AMCs on Airworthiness of Products, Parts and Appliances, 20-8 II and III occurrence reporting

308

11â&#x20AC;&#x192; Quality and Safety Management

,GHQWLILFDWLRQ RI IDLOXUHV LQFLGHQW

&RQVROLGDWHG HYDOXDWLRQ

5HSRUW

&RQVROLGDWLRQ RI ILQGLQJV

$QDO\VLV

LQFO ,GHQWLILFDWLRQ RI ODWHQW DQG DVVRFLDWHG ULVNV

0RQLWRULQJ HIIHFWLYHQHVV $FWLRQV

SODQ LPSOHPHQW

Fig.Â 11.12â&#x20AC;&#x192; Occurrence reporting process steps

&RPSRQHQW 3URGXFWLRQ ,QFLGHQW 5HSRUWLQJ &RPSR QHQW

&RPSRQHQW *URXS 6\VWHP

&RPSRQHQW WLWOH

3DUW QXPEHU

'DWH RI LGHQWLILFDWLRQ

'HWDLOHG LQIRUPDWLRQ RQ WKH LQFLGHQW

LQFO LQLWLDWHG PHDVXUHV

,QFLGHQW

'RFXPHQ WDWLRQ

7RROV

5HSRUWLQJ 3HUVRQ

'RFXPHQW W\S

7RRO

1DPH

'RFXPHQW QXPEHU

LQFO 5HY 6WDWXV

6HFWLRQ &KDSWHU 3DJH

7RRO QXPEHU

'HSDUWPHQW

7HOHSKRQH

Fig.Â 11.13â&#x20AC;&#x192; Input mask of an occurrence reporting (example)

11.5 Authority Liaison 309

• • • •

design deficiencies, emergency system failures, non-execution of airworthiness instructions, in production organisations all incidents concerning approved parts that are subject to deviations from design data and can pose a threat to airworthiness.

If the cause for the occurrence can also be a design deficiency, the design organisation concerned must be informed as well. In maintenance, the customer is to be additionally informed. In severe cases, the external report must be supplemented by a technical investigation.

11.5

Authority Liaison

Just like every organisation has customer contact person, aeronautical organisations additionally require an organisational unit that maintains contact with relevant aviation authorities. In practice, this task is usually taken over by quality management. The substantial responsibilities of authority liaison comprise: • • • •

applying for or extending approvals and maintaining scope of approval, preparing, organising and following up on authority audits, focal point for official requests, representing the organisation in official committees (usually large-scale organisations only).

The authority liaison’s spectrum of tasks is quite comparable to a customer contact person, as the substantial task of both is to gather the requirements of their stakeholders. In addition to that, both authority as well as customer liaison take over a channeling interface function, by initiating and supporting the internal implementation of regulatory requirements as well as by providing feedback to authorities (and/ or customers). The more comprehensive the range of services and the more international the business relations of an aeronautical organisation are, the more complex the authority liaison is. Multinational organisations, such as Airbus or Lufthansa Technik, that offer their services world-wide and additionally have own production sites and customers in many countries, have own organisational units for authority liaison. In contrast to that, small aeronautical organisations such as a 21G production organisation that exclusively produces valves for Airbus or BAE Systems in London, will only maintain contact to the British Aviation Authority (CAA). The tasks related with authority liaison can then be performed by the quality manager in personal union. The cooperation with the authorities differs culturally and organisationally depending on the country and above all the legal requirements vary. Coordination is especially required with non-EASA states to ensure that the work carried out respectively the products being sold are not only recognised by EASA but also by national aviation authorities of the respective customer.

310

11 Quality and Safety Management

For the recognition of aeronautical organisations or their provision of services by non-EASA states, two procedures are in principle applied, which are determined by the respective authority: • If work is to be accomplished on an aircraft that is registered in a non-EASA state, some aviation authorities require unrestricted compliance with their national aviation legislation. An official (partial) acknowledgment of EASA approvals is not constituted in this case. Accordingly, these authority check compliance with the entire national regulations during their audits. • Many states in principle recognise EASA approvals and design certifications as well as EASA release and conformity certificates, however, they demand compliance with additional requirements for their national approval (e.g. as regards to personnel qualification, acknowledgment of foreign release certificates). Such delta requirements are usually summarised in a regulatory supplement. These are to be taken into account in addition to the EASA requirements, if the customer desires approval or release in compliance with the respective countries legislation. During authority audits, only the compliance with the delta requirements is verified, since EASA is responsible for verifying compliance with the remaining standards. Thus, as surveillance redundancy is avoided, the supplement facilitates the work of authorities and aeronautical organisations.

References ASD-STAN Standard: ASD-STAN prEN 9100-P4 – Quality Management Systems – Requirements for Aviation, Space and Defense Organisations. English version. prEN 9100:2016 (E), 2017 ASD-STAN Standard: ASD-STAN prEN-9110-P5 – Quality Maintenance Systems – Aerospace – Requirements for Maintenance Organisations. English version. 2017 ASD-STAN Standard: ASD-STAN prEN-9120-P5 Quality Management Systems – Requirements for Aviation, Space and Defence Distributors. English version. 2017 European Commission (EU): Commission Regulation laying down implementing rules for the airworthiness and environmental certification of aircraft and related products, parts and appliances, as well as for the certification of design and production organisations [Implementing Rule Initial Airworthiness]. No 748/2012 of 03/08/2012 European Commission: Commission Regulation (EC) on the continuing airworthiness of aircraft and aeronautical products, parts and appliances, and on the approval of organisations and personnel involved in these tasks [Implementing Rule Continuing Airworthiness]. No. 1321/2014, 2014 European Aviation Safety Agency – EASA: Acceptable Means of Compliance and Guidance Material to Commission Regulation (EC) to the Annexes to Regulation (EU) No 1321/2014 – Issue 2 [Implementing Rule Continuing Airworthiness]. ED Decision 2015/029/R. AMC/GM European Aviation Safety Agency – EASA: Acceptable Means of Compliance and Guidance Material to Part 21. Annex I to ED Decision 2012/020/R. Issue 2. Oct. 2012 European Aviation Safety Agency – EASA: Acceptable Means of Compliance and Guidance Material to Annex I Part Organisation Requirements (OR) Subpart General Requirements Section 1. Köln 2003 Hinsch, M.: Quality Management in Aviation Industry – A guideline for the Aerospace Standard EN 9100:2016. Berlin, Heidelberg. Planned publication Dec. 2018 ICAO: Safety Management Manual R2. Document 9859, Montréal 2008 ICAO: Framework for the State Safety Programme (SSP) – Appendix 1 to Chapter 8. 2nd Edition, Montréal 2009

Annex

Following are the original version of EASA Part 21/G (Production Organisations) and Part 21/J (Design Organisations) of the Implementing Rule Initial Airworthiness and Part 145 (Maintenance Organisations) of the Implementing Rule Continuing Airworthiness. The purpose is to provide readers with a basic insight into aviation legislation. For legally binding information it is essential to use the latest version. Moreover, these requirements are not sufficient in operational practice because in addition the Guidance Material and the AMC are to be considered.

Part 21G Production Organisation Approval for Products, Parts and Appliances Section A – Technical Requirements 21.A.131 Scope This Subpart establishes: (a) the procedure for the issuance of a production organisation approval for a production organisation showing conformity of products, parts and appliances with the applicable design data; (b) the rules governing the rights and obligations of the applicant for, and holders of, such approvals. 21.A.133 Eligibility Any natural or legal person (‘organisation’) shall be eligible as an applicant for an approval under this Subpart. The applicant shall:

311

312 Annex

(a) justify that, for a defined scope of work, an approval under this Subpart is appropriate for the purpose of showing conformity with a specific design; and (b) hold or have applied for an approval of that specific design; or (c) have ensured, through an appropriate arrangement with the applicant for, or holder of, an approval of that specific design, satisfactory coordination between production and design. 21.A.134 Application Each application for a production organisation approval shall be made to the competent authority in a form and manner established by that authority, and shall include an outline of the information required by point 21.A.143 and the terms of approval requested to be issued under point 21.A.151. 21.A.135 Issue of Production Organisation Approval An organisation shall be entitled to have a production organisation approval issued by the competent authority when it has demonstrated compliance with the applicable requirements under this Subpart. 21.A.139 Quality System (a) The production organisation shall demonstrate that it has established and is able to maintain a quality system. The quality system shall be documented. This quality system shall be such as to enable the organisation to ensure that each product, part or appliance produced by the organisation or by its partners, or supplied from or subcontracted to outside parties, conforms to the applicable design data and is in condition for safe operation, and thus exercise the privileges set forth in point 21.A.163. (b) The quality system shall contain: 1. as applicable within the scope of approval, control procedures for: (i) document issue, approval, or change; (ii) vendor and subcontractor assessment audit and control; (iii) verification that incoming products, parts, materials, and equipment, including items supplied new or used by buyers of products, are as specified in the applicable design data; (iv) identification and traceability; (v) manufacturing processes; (vi) inspection and testing, including production flight tests; (vii) calibration of tools, jigs, and test equipment; (viii) non conforming item control; (ix) airworthiness coordination with the applicant for, or holder of, the design approval; (x) records completion and retention; (xi) personnel competence and qualification; (xii) issue of airworthiness release documents; (xiii) handling, storage and packing; (xiv) internal quality audits and resulting corrective actions;

Annex 313

(xv) work within the terms of approval performed at any location other than the approved facilities; (xvi) work carried out after completion of production but prior to delivery, to maintain the aircraft in a condition for safe operation; (xvii) issue of permit to fly and approval of associated flight conditions. The control procedures need to include specific provisions for any critical parts. 2. An independent quality assurance function to monitor compliance with, and adequacy of, the documented procedures of the quality system. This monitoring shall include a feedback system to the person or group of persons referred to in point 21.A.145(c)(2) and ultimately to the manager referred to in point 21.A.145(c)(1) to ensure, as necessary, corrective action. 21.A.143 Exposition (a) The organisation shall submit to the competent authority a production organisation exposition providing the following information: 1. a statement signed by the accountable manager confirming that the production organisation exposition and any associated manuals which define the approved organisation's compliance with this Subpart will be complied with at all times; 2. the title(s) and names of managers accepted by the competent authority in accordance with point 21.A.145(c)(2); 3. the duties and responsibilities of the manager(s) as required by point 21.A.145(c)(2) including matters on which they may deal directly with the competent authority on behalf of the organisation; 4. an organisational chart showing associated chains of responsibility of the managers as required by point 21.A.145(c) (1) and (2); 5. a list of certifying staff as referred to in point 21.A.145(d); 6. a general description of man-power resources; 7. a general description of the facilities located at each address specified in the production organisation's certificate of approval; 8. a general description of the production organisation's scope of work relevant to the terms of approval; 9. the procedure for the notification of organisational changes to the competent authority; 10. the amendment procedure for the production organisation exposition; 11. a description of the quality system and the procedures as required by point 21.A.139(b)(1); 12. a list of those outside parties referred to in point 21.A.139(a). 13. if flight tests are to be conducted, a flight test operations manual defining the organisation’s policies and procedures in relation to flight test. The flight test operations manual shall include: (i) a description of the organisation’s processes for flight test, including the flight test organisation involvement into the permit to fly issuance process;

314 Annex

(ii) crewing policy, including composition, competency, currency and flight time limitations, in accordance with Appendix XII to this Annex I (Part 21), where applicable; (iii) procedures for the carriage of persons other than crew members and for flight test training, when applicable; (iv) a policy for risk and safety management and associated methodologies; (v) procedures to identify the instruments and equipment to be carried; (vi) a list of documents that need to be produced for flight test. (b) The production organisation exposition shall be amended as necessary to remain an up-to-date description of the organisation, and copies of any amendments shall be supplied to the competent authority. 21.A.145 Approval Requirements The production organisation shall demonstrate, on the basis of the information submitted in accordance with point 21.A.143 that: (a) with regard to general approval requirements, facilities, working conditions, equipment and tools, processes and associated materials, number and competence of staff, and general organisation are adequate to discharge obligations under point 21.A.165; (b) with regard to all necessary airworthiness, noise, fuel venting and exhaust emissions data: 1. the production organisation is in receipt of such data from the Agency, and from the holder of, or applicant for, the type-certificate, restricted type-certificate or design approval, to determine conformity with the applicable design data; 2. the production organisation has established a procedure to ensure that airworthiness, noise, fuel venting and exhaust emissions data are correctly incorporated in its production data; 3. such data are kept up to date and made available to all personnel who need access to such data to perform their duties; (c) with regard to management and staff: 1. a manager has been nominated by the production organisation, and is accountable to the competent authority. His or her responsibility within the organisation shall consist of ensuring that all production is performed to the required standards and that the production organisation is continuously in compliance with the data and procedures identified in the exposition referred to in point 21.A.143; 2. a person or group of persons have been nominated by the production organisation to ensure that the organisation is in compliance with the requirements of this Annex I (Part 21), and are identified, together with the extent of their authority. Such person(s) shall act under the direct authority of the accountable manager referred to in point (1). The persons nominated shall be able to show the appropriate knowledge, background and experience to discharge their responsibilities;

Annex 315

3. staff at all levels have been given appropriate authority to be able to discharge their allocated responsibilities and that there is full and effective coordination within the production organisation in respect of airworthiness, noise, fuel venting and exhaust emission data matters; (d) with regard to certifying staff, authorised by the production organisation to sign the documents issued under point 21.A.163 under the scope or terms of approval: 1. the knowledge, background (including other functions in the organisation), and experience of the certifying staff are appropriate to discharge their allocated responsibilities; 2. the production organisation maintains a record of all certifying staff which shall include details of the scope of their authorisation; 3. certifying staff are provided with evidence of the scope of their authorisation. 21.A.147 Changes to the Approved Production Organisation (a) After the issue of a production organisation approval, each change to the approved production organisation that is significant to the showing of conformity or to the airworthiness and characteristics of noise, fuel venting and exhaust emissions of the product, part or appliance, particularly changes to the quality system, shall be approved by the competent authority. An application for approval shall be submitted in writing to the competent authority and the organisation shall demonstrate to the competent authority before implementation of the change, that it will continue to comply with this Subpart. (b) The competent authority shall establish the conditions under which a production organisation approved under this Subpart may operate during such changes unless the competent authority determines that the approval should be suspended. 21.A.148 Changes of Location A change of the location of the manufacturing facilities of the approved production organisation shall be deemed of significance and therefore shall comply with point 21.A.147. 21.A.149 Transferability Except as a result of a change in ownership, which is deemed significant for the purposes of point 21.A.147, a production organisation approval is not transferable. 21.A.151 Terms of Approval The terms of approval shall identify the scope of work, the products or the categories of parts and appliances, or both, for which the holder is entitled to exercise the privileges under point 21.A.163. Those terms shall be issued as part of a production organisation approval. 21.A.153 Changes to the Terms of Approval Each change to the terms of approval shall be approved by the competent authority. An application for a change to the terms of approval shall be made in a form and

316 Annex

manner established by the competent authority. The applicant shall comply with the applicable requirements of this Subpart. 21.A.157 Investigations A production organisation shall make arrangements that allow the competent authority to make any investigations, including investigations of partners and subcontractors, necessary to determine compliance and continued compliance with the applicable requirements of this Subpart. 21.A.158 Findings (a) When objective evidence is found showing non compliance of the holder of a production organisation approval with the applicable requirements of this Annex I (Part 21), the finding shall be classified as follows: 1. a level one finding is any non-compliance with this Annex I (Part 21) which could lead to uncontrolled non-compliances with applicable design data and which could affect the safety of the aircraft; 2. a level two finding is any non-compliance with this Annex I (Part 21) which is not classified as level one. (b) A level three finding is any item where it has been identified, by objective evidence, to contain potential problems that could lead to a non-compliance under point (a). (c) After receipt of notification of findings according to point 21.B.225, 1. in case of a level one finding, the holder of the production organisation approval shall demonstrate corrective action to the satisfaction of the competent authority within a period of no more than 21 working days after written confirmation of the finding; 2. in case of level two findings, the corrective action period granted by the competent authority shall be appropriate to the nature of the finding but in any case initially shall not be more than three months. In certain circumstances and subject to the nature of the finding the competent authority may extend the three months period subject to the provision of a satisfactory corrective action plan agreed by the competent authority; 3. a level three finding shall not require immediate action by the holder of the production organisation approval. (d) In case of level one or level two findings, the production organisation approval may be subject to a partial or full limitation, suspension or revocation under point 21.B.245. The holder of the production organisation approval shall provide confirmation of receipt of the notice of limitation, suspension or revocation of the production organisation approval in a timely manner. 21.A.159 Duration and Continued Validity (a) A production organisation approval shall be issued for an unlimited duration. It shall remain valid unless: 1. the production organisation fails to demonstrate compliance with the applicable requirements of this Subpart; or

Annex 317

2. the competent authority is prevented by the holder or any of its partners or subcontractors to perform the investigations in accordance with point 21.A.157; or 3. there is evidence that the production organisation cannot maintain satisfactory control of the manufacture of products, parts or appliances under the approval; or 4. the production organisation no longer meets the requirements of point 21.A.133; or 5. the certificate has been surrendered or revoked under point 21.B.245. (b) Upon surrender or revocation, the certificate shall be returned to the competent authority. 21.A.163 Privileges Pursuant to the terms of approval issued under point 21.A.135, the holder of a production organisation approval may: (a) perform production activities under this Annex I (PartÂ 21); (b) in the case of complete aircraft and upon presentation of a satement of conformity (EASA Form 52) under point 21.A.174, obtain an aircraft certificate of airworthiness and a noise certificate without further showing; (c) in the case of other products, parts or appliances, issue authorised release certificates (EASA Form 1) without further showing; (d) maintain a new aircraft that it has produced and issue a certificate of release to service (EASA Form 53) in respect of that maintenance; (e) under procedures agreed with its competent authority for production, for an aircraft it has produced and when the production organisation itself is controlling under its POA the configuration of the aircraft and is attesting conformity with the design conditions approved for the flight, to issue a permit to fly in accordance with point 21.A.711(c) including approval of the flight conditions in accordance with point 21.A.710(b). 21.A.165 Obligations of the Holder The holder of a production organisation approval shall: (a) ensure that the production organisation exposition furnished in accordance with point 21.A.143 and the documents to which it refers, are used as basic working documents within the organisation; (b) maintain the production organisation in conformity with the data and procedures approved for the production organisation approval; (c) 1. determine that each completed aircraft conforms to the type design and is in condition for safe operation prior to submitting statements of conformity to the competent authority; or 2. determine that other products, parts or appliances are complete and conform to the approved design data and are in a condition for safe operation before issuing an EASA Form 1 to certify conformity to approved design data and condition for safe operation;

318 Annex

3. additionally, in the case of engines, determine that the completed engine is in compliance with the applicable emissions requirements on the date of manufacture of the engine; 4. determine that other products, parts or appliances conform to the applicable data before issuing an EASA Form 1 as a conformity certificate. (d) record all details of work carried out; (e) establish and maintain an internal occurrence reporting system in the interest of safety, to enable the collection and assessment of occurrence reports in order to identify adverse trends or to address deficiencies, and to extract reportable occurrences. This system shall include evaluation of relevant information relating to occurrences and the promulgation of related information; (f) 1. report to the holder of the type-certificate or design approval, all cases where products, parts or appliances have been released by the production organisation and subsequently identified to have possible deviations from the applicable design data, and investigate with the holder of the type-certificate or design approval in order to identify those deviations which could lead to an unsafe condition; 2. report to the Agency and the competent authority of the Member State the deviations which could lead to an unsafe condition identified according to point (1). Such reports shall be made in a form and manner established by the Agency under point 21.A.3A(b)(2) or accepted by the competent authority of the Member State; 3. where the holder of the production organisation approval is acting as a supplier to another production organisation, report also to that other organisation all cases where it has released products, parts or appliances to that organisation and subsequently identified them to have possible deviations from the applicable design data; (g) provide assistance to the holder of the type-certificate or design approval in dealing with any continuing airworthiness actions that are related to the products parts or appliances that have been produced; (h) establish an archiving system incorporating requirements imposed on its partners, suppliers and subcontractors, ensuring conservation of the data used to justify conformity of the products, parts or appliances. Such data shall be held at the disposal of the competent authority and be retained in order to provide the information necessary to ensure the continuing airworthiness of the products, parts or appliances; (i) where, under its terms of approval, the holder issues a certificate of release to service, determine that each completed aircraft has been subjected to necessary maintenance and is in condition for safe operation, prior to issuing the certificate; (j) where applicable, under the privilege of point 21.A.163(e), determine the conditions under which a permit to fly can be issued; (k) where applicable, under the privilege of point 21.A.163(e), establish compliance with points 21.A.711(c) and (e) before issuing a permit to fly to an aircraft.

Annex 319

Part 21/J Design Organisation Approval Section A – Technical Requirements 21.A.231 Scope This Subpart establishes the procedure for the approval of design organisations and rules governing the rights and obligations of applicants for, and holders of, such approvals. 21.A.233 Eligibility Any natural or legal person (‘organisation’) shall be eligible as an applicant for an approval under this Subpart (a) in accordance with points 21.A.14, 21.A.112B, 21.A.432B or 21.A.602B; or (b) for approval of minor changes or minor repair design, when requested for the purpose of obtaining privileges under point 21.A.263. 21.A.234 Application Each application for a design organisation approval shall be made in a form and manner established by the Agency and shall include an outline of the information required by point 21.A.243, and the terms of approval requested to be issued under point 21.A.251. 21.A.235 Issue of Design Organisation Approval An organisation shall be entitled to have a design organisation approval issued by the Agency when it has demonstrated compliance with the applicable requirements under this Subpart. 21.A.239 Design Assurance System (a) The design organisation shall demonstrate that it has established and is able to maintain a design assurance system for the control and supervision of the design, and of design changes, of products, parts and appliances covered by the application. This design assurance system shall be such as to enable the organisation: 1. to ensure that the design of the products, parts and appliances or the design change thereof, comply with the applicable type-certification basis, the applicable operational suitability data certification basis and environmental protection requirements; and 2. to ensure that its responsibilities are properly discharged in accordance with: (i) the appropriate provisions of this Annex I (Part 21); and (ii) the terms of approval issued under point 21.A.251; 3. to independently monitor the compliance with, and adequacy of, the documented procedures of the system. This monitoring shall include a feed-back

320 Annex

system to a person or a group of persons having the responsibility to ensure corrective actions. (b) The design assurance system shall include an independent checking function of the showings of compliance on the basis of which the organisation submits compliance statements and associated documentation to the Agency. (c) The design organisation shall specify the manner in which the design assurance system accounts for the acceptability of the parts or appliances designed or the tasks performed by partners or subcontractors according to methods which are the subject of written procedures. 21.A.243 Data (a) The design organisation shall furnish a handbook to the Agency describing, directly or by cross- reference, the organisation, the relevant procedures and the products or changes to products to be designed. If flight tests are to be conducted, a flight test operations manual defining the organisation’s policies and procedures in relation to flight test shall be furnished. The flight test operations manual shall include: (i) a description of the organisation’s processes for flight test, including the flight test organisation involvement into the permit to fly issuance process; (ii) crewing policy, including composition, competency, currency and flight time limitations, in accordance with Appendix XII to this Annex I (Part 21), where applicable; (iii) procedures for the carriage of persons other than crew members and for flight test training, when applicable; (iv) a policy for risk and safety management and associated methodologies; (v) procedures to identify the instruments and equipment to be carried; (vi) a list of documents that need to be produced for flight test. (b) Where any parts or appliances or any changes to the products are designed by partner organisations or subcontractors, the handbook shall include a statement of how the design organisation is able to give, for all parts and appliances, the assurance of compliance required by point 21.A.239(b), and shall contain, directly or by cross-reference, descriptions and information on the design activities and organisation of those partners or subcontractors, as necessary to establish this statement. (c) The handbook shall be amended as necessary to remain an up-to-date description of the organisation, and copies of amendments shall be supplied to the Agency. (d) The design organisation shall furnish a statement of the qualifications and experience of the management staff and other persons responsible for making decisions affecting airworthiness and environmental protection in the organisation. 21.A.245 Approval Requirements The design organisation shall demonstrate, on the basis of the information submitted in accordance with point 21.A.243 that, in addition to complying with point 21.A.239:

Annex 321

(a) the staff in all technical departments are of sufficient numbers and experience and have been given appropriate authority to be able to discharge their allocated responsibilities and these, together with the accommodation, facilities and equipment, are adequate to enable the staff to achieve the airworthiness, operational suitability and environmental protection objectives for the product; (b) there is full and efficient coordination between departments and within departments in respect of airworthiness, operational suitability and environmental protection matters. 21.A.247 Changes in Design Assurance System After the issue of a design organisation approval, each change to the design assurance system that is significant to the showing of compliance or to the airworthiness, operational suitability and environmental protection of the product, shall be approved by the Agency. An application for approval shall be submitted in writing to the Agency and the design organisation shall demonstrate to the Agency, on the basis of submission of proposed changes to the handbook, and before implementation of the change, that it will continue to comply with this Subpart after implementation. 21.A.249 Transferability Except as a result of a change in ownership, which is deemed significant for the purposes of point 21.A.247, a design organisation approval is not transferable. 21.A.251 Terms of Approval The terms of approval shall identify the types of design work, the categories of products, parts and appliances for which the design organisation holds a design organisation approval, and the functions and duties that the organisation is approved to perform in regard to the airworthiness, operational suitability and characteristics of noise, fuel venting and exhaust emissions of products. For design organisation approval covering type-certification or ETSO authorisation for Auxiliary Power Unit (APU), the terms of approval shall contain in addition the list of products or APU. Those terms shall be issued as part of a design organisation approval. 21.A.253 Changes to the Terms of Approval Each change to the terms of approval shall be approved by the Agency. An application for a change to the terms of approval shall be made in a form and manner established by the Agency. The design organisation shall comply with the applicable requirements of this Subpart. 21.A.257 Investigations (a) The design organisation shall make arrangements that allow the Agency to make any investigations, including investigations of partners and subcontractors, necessary to determine compliance and continued compliance with the applicable requirements of this Subpart.

322 Annex

(b) The design organisation shall allow the Agency to review any report and make any inspection and perform or witness any flight and ground test necessary to check the validity of the compliance statements submitted by the applicant under point 21.A.239(b). 21.A.258 Findings (a) When objective evidence is found showing non-compliance of the holder of a design organisation approval with the applicable requirements of this Annex I (Part 21), the finding shall be classified as follows: 1. a level one finding is any non-compliance with this Annex I (Part 21) which could lead to uncontrolled non-compliances with applicable requirements and which could affect the safety of the aircraft; 2. a level two finding is any non-compliance with this Annex I (Part 21) which is not classified as level one. (b) A level three finding is any item where it has been identified, by objective evidence, to contain potential problems that could lead to a non-compliance under point (c) After receipt of notification of findings under the applicable administrative procedures established by the Agency, 1. in case of a level one finding, the holder of the design organisation approval shall demonstrate corrective action to the satisfaction of the Agency within a period of no more than 21 working days after written confirmation of the finding; 2. in case of level two findings, the corrective action period granted by the Agency shall be appropriate to the nature of the finding but in any case initially shall not be more than three months. In certain circumstances and subject to the nature of the finding the Agency may extend the three months period subject to the provision of a satisfactory corrective action plan agreed by the Agency; 3. a level three finding shall not require immediate action by the holder of the design organisation approval. (d) In case of level one or level two findings, the design organisation approval may be subject to a partial or full suspension or revocation under the applicable administrative procedures established by the Agency. The holder of the design organisation approval shall provide confirmation of receipt of the notice of suspension or revocation of the design organisation approval in a timely manner. 21.A.259 Duration and Continued Validity (a) A design organisation approval shall be issued for an unlimited duration. It shall remain valid unless: 1. the design organisation fails to demonstrate compliance with the applicable requirements of this Subpart; or 2. the Agency is prevented by the holder or any of its partners or subcontractors to perform the investigations in accordance with point 21.A.257; or

Annex 323

3. there is evidence that the design assurance system cannot maintain satisfactory control and supervision of the design of products or changes thereof under the approval; or 4. the certificate has been surrendered or revoked under the applicable administrative procedures established by the Agency. (b) Upon surrender or revocation, the certificate shall be returned to the Agency. 21.A.263 Privileges (a) The holder of a design organisation approval shall be entitled to perform design activities under this Annex I (Part 21) and within its scope of approval. (b) Subject to point 21.A.257(b), the Agency shall accept without further verification the following compliance documents submitted by the applicant for the purpose of obtaining: 1. the approval of flight conditions required for a permit to fly; or 2. a type-certificate or approval of a major change to a type-certificate; or 3. a supplemental type-certificate; or 4. an ETSO authorisation under point 21.A.602B(b)(1); or 5. a major repair design approval. (c) The holder of a design organisation approval shall be entitled, within its terms of approval and under the relevant procedures of the design assurance system: 1. to classify changes to the type-certificate and repairs as ‘major’ or ‘minor’; 2. to approve minor changes to type-certificate and minor repairs; 3. to issue information or instructions containing the following statement: ‘The technical content of this document is approved under the authority of DOA ref. EASA. 21J. [XXXX].’; 4. to approve minor revisions to the aircraft flight manual and supplements, and issue such revisions containing the following statement: ‘Revision No [YY] to AFM (or supplement) ref. [ZZ] is approved under the authority of DOA ref. EASA. 21J. [XXXX].’; 5. to approve the design of major repairs to products or Auxiliary Power Units for which it holds the type-certificate or the supplemental type-certificate or ETSO authorisation; 6. to approve the conditions under which a permit to fly can be issued in accordance with point 21.A.710(a)(2), except for permits to fly to be issued for the purpose of point 21.A.701(a)(15); 7. to issue a permit to fly in accordance with point 21.A.711(b) for an aircraft it has designed or modified, or for which it has approved under point 21.A.263(c)(6) the conditions under which the permit to fly can be issued, and when the design organisation itself is controlling under its Design Organisation Approval the configuration of the aircraft and is attesting conformity with the design conditions approved for the flight. 21.A.265 Obligations of the Holder The holder of a design organisation approval shall:

324 Annex

(a) maintain the handbook in conformity with the design assurance system; (b) ensure that this handbook is used as a basic working document within the organisation; (c) determine that the design of products, or changes or repairs thereof, as applicable, comply with applicable requirements and have no unsafe feature; (d) except for minor changes or repairs approved under the privilege of point 21.A.263, provide to the Agency statements and associated documentation confirming compliance with point (c); (e) provide to the Agency information or instructions related to required actions under point 21.A.3B; (f) where applicable, under the privilege of point 21.A.263(c)(6), determine the conditions under which a permit to fly can be issued; (g) where applicable, under the privilege of point 21.A.263(c)(7), establish compliance with points 21.A.711(b) and (e) before issuing a permit to fly to an aircraft.

PartÂ 145 Maintenance Organisation Approvals Section A â&#x20AC;&#x201C; Technical Requirements 145.A.10 Scope This Section establishes the requirements to be met by an organisation to qualify for the issue or continuation of an approval for the maintenance of aircraft and components. 145.A.15 Application An application for the issue or change of an approval shall be made to the competent authority in a form and manner established by such authority. 145.A.20 Terms of Approval The organisation shall specify the scope of work deemed to constitute approval in its exposition (Appendix IV to Annex I (Part-M) contains a table of all classes and ratings). 145.A.25 Facility Requirements The organisation shall ensure that: (a) Facilities are provided appropriate for all planned work, ensuring in particular, protection from the weather elements. Specialised workshops and bays are segregated as appropriate, to ensure that environmental and work area contamination is unlikely to occur. 1. For base maintenance of aircraft, aircraft hangars are both available and large enough to accommodate aircraft on planned base maintenance; 2. For component maintenance, component workshops are large enough to accommodate the components on planned maintenance.

Annex 325

(b) Office accommodation is provided for the management of the planned work referred to in point (a), and certifying staff so that they can carry out their designated tasks in a manner that contributes to good aircraft maintenance standards. (c) The working environment including aircraft hangars, component workshops and office accommodation is appropriate for the task carried out and in particular special requirements observed. Unless otherwise dictated by the particular task environment, the working environment must be such that the effectiveness of personnel is not impaired: 1. temperatures must be maintained such that personnel can carry out required tasks without undue discomfort. 2. dust and any other airborne contamination are kept to a minimum and not be permitted to reach a level in the work task area where visible aircraft/component surface contamination is evident. Where dust/other airborne contamination results in visible surface contamination, all susceptible systems are sealed until acceptable conditions are re-established. 3. lighting is such as to ensure each inspection and maintenance task can be carried out in an effective manner. 4. noise shall not distract personnel from carrying out inspection tasks. Where it is impractical to control the noise source, such personnel are provided with the necessary personal equipment to stop excessive noise causing distraction during inspection tasks. 5. where a particular maintenance task requires the application of specific environmental conditions different to the foregoing, then such conditions are observed. Specific conditions are identified in the maintenance data. 6. the working environment for line maintenance is such that the particular maintenance or inspection task can be carried out without undue distraction. Therefore where the working environment deteriorates to an unacceptable level in respect of temperature, moisture, hail, ice, snow, wind, light, dust/ other airborne contamination, the particular maintenance or inspection tasks must be suspended until satisfactory conditions are re-established. (d) Secure storage facilities are provided for components, equipment, tools and material. Storage conditions ensure segregation of serviceable components and material from unserviceable aircraft components, material, equipment and tools. The conditions of storage are in accordance with the manufacturer's instructions to prevent deterioration and damage of stored items. Access to storage facilities is restricted to authorised personnel. 145.A.30 Personnel Requirements (a) The organisation shall appoint an accountable manager who has corporate authority for ensuring that all maintenance required by the customer can be financed and carried out to the standard required by this Part. The accountable manager shall: 1. ensure that all necessary resources are available to accomplish maintenance in accordance with point 145.A.65(b) to support the organisation approval. 2. establish and promote the safety and quality policy specified in point 145.A.65(a).

326 Annex

3. demonstrate a basic understanding of this Annex (Part-145). (b) The organisation shall nominate a person or group of persons, whose responsibilities include ensuring that the organisation complies with this Part. Such person(s) shall ultimately be responsible to the accountable manager. 1. The person or persons nominated shall represent the maintenance management structure of the organisation and be responsible for all functions specified in this Part. 2. The person or persons nominated shall be identified and their credentials submitted in a form and manner established by the competent authority. 3. The person or persons nominated shall be able to demonstrate relevant knowledge, background and satisfactory experience related to aircraft or component maintenance and demonstrate a working knowledge of this Part. 4. Procedures shall make clear who deputises for any particular person in the case of lengthy absence of the said person. (c) The accountable manager under point (a) shall appoint a person with responsibility for monitoring the quality system, including the associated feedback system as required by point 145.A.65(c). The appointed person shall have direct access to the accountable manager to ensure that the accountable manager is kept properly informed on quality and compliance matters. (d) The organisation shall have a maintenance man-hour plan showing that the organisation has sufficient staff to plan, perform, supervise, inspect and quality monitor the organisation in accordance with the approval. In addition the organisation shall have a procedure to reassess work intended to be carried out when actual staff availability is less than the planned staffing level for any particular work shift or period. (e) The organisation shall establish and control the competence of personnel involved in any maintenance, development of maintenance programmes, airworthiness reviews, management and/or quality audits in accordance with a procedure and to a standard agreed by the competent authority. In addition to the necessary expertise related to the job function, competence must include an understanding of the application of human factors and human performance issues appropriate to that person's function in the organisation. ‘Human factors’ means principles which apply to aeronautical design, certification, training, operations and maintenance and which seek safe interface between the human and other system components by proper consideration of human performance. ‘Human performance’ means human capabilities and limitations which have an impact on the safety and efficiency of aeronautical operations. (f) The organisation shall ensure that personnel who carry out and/or control a continued airworthiness non-destructive test of aircraft structures and/or components are appropriately qualified for the particular non-destructive test in accordance with the European or equivalent Standard recognised by the Agency. Personnel who carry out any other specialised task shall be appropriately qualified in accordance with officially recognised Standards. By derogation to this point those personnel specified in points (g) and (h)(1) and (h)(2),

Annex 327

(g)

(h)

(i) (j)

qualified in category B1 or B3 in accordance with Annex III (Part-66) may carry out and/or control colour contrast dye penetrant tests. Any organisation maintaining aircraft, except where stated otherwise in point (j), shall in the case of aircraft line maintenance, have appropriate aircraft rated certifying staff qualified as category B1, B2, B3, as appropriate, in accordance with Annex III (Part-66) and point 145.A.35. In addition such organisations may also use appropriately task trained certifying staff holding the privileges described in points 66.A.20(a)(1) and 66.A.20(a)(3) (ii) and qualified in accordance with Annex III (Part-66) and point 145.A.35 to carry out minor scheduled line maintenance and simple defect rectification. The availability of such certifying staff shall not replace the need for category B1, B2, B3 certifying staff, as appropriate. Any organisation maintaining aircraft, except where stated otherwise in point (j) shall: 1. in the case of base maintenance of complex motor-powered aircraft, have appropriate aircraft type rated certifying staff qualified as category C in accordance with Part-66 and 145.A.35. In addition the organisation shall have sufficient aircraft type rated staff qualified as category B1, B2 as appropriate in accordance with Part-66 and 145.A.35 to support the category C certifying staff. (i) B1 and B2 support staff shall ensure that all relevant tasks or inspections have been carried out to the required standard before the category C certifying staff issues the certificate of release to service. (ii) The organisation shall maintain a register of any such B1 and B2 support staff. (iii) The category C certifying staff shall ensure that compliance with paragraph (i) has been met and that all work required by the customer has been accomplished during the particular base maintenance check or work package, and shall also assess the impact of any work not carried out with a view to either requiring its accomplishment or agreeing with the operator to defer such work to another specified check or time limit. 2. in the case of base maintenance of aircraft other than complex motor-powered aircraft have either: (i) appropriate aircraft rated certifying staff qualified as category B1, B2, B3, as appropriate, in accordance with Annex III (Part-66) and point 145.A.35 or, (ii) appropriate aircraft rated certifying staff qualified in category C assisted by support staff as specified in point 145.A.35(a)(i). Component certifying staff shall comply with the provisions of Article 5(6) of Regulation (EU) No 1321/2014. By derogation to points (g) and (h), in relation to the obligation to comply with Annex III (Part-66), the organisation may use certifying staff qualified in accordance with the following provisions: 1. For organisation facilities located outside the Community territory certifying staff may be qualified in accordance with the national aviation regulations of

328 Annex

the State in which the organisation facility is registered subject to the conditions specified in Appendix IV to this Part. 2. For line maintenance carried out at a line station of an organisation which is located outside the Community territory, the certifying staff may be qualified in accordance with the national aviation regulations of the State in which the line station is based, subject to the conditions specified in Appendix IV to this Part. 3. For a repetitive pre-flight airworthiness directive which specifically states that the flight crew may carry out such airworthiness directive, the organisation may issue a limited certification authorisation to the aircraft commander and/or the flight engineer on the basis of the flight crew licence held. However, the organisation shall ensure that sufficient practical training has been carried out to ensure that such aircraft commander or flight engineer can accomplish the airworthiness directive to the required standard. 4. In the case of aircraft operating away from a supported location the organisation may issue a limited certification authorisation to the commander and/ or the flight engineer on the basis of the flight crew licence held subject to being satisfied that sufficient practical training has been carried out to ensure that the commander or flight engineer can accomplish the specified task to the required standard. The provisions of this point shall be detailed in an exposition procedure. 5. In the following unforeseen cases, where an aircraft is grounded at a location other than the main base where no appropriate certifying staff are available, the organisation contracted to provide maintenance support may issue a one-off certification authorisation: (i) to one of its employees holding equivalent type authorisations on aircraft of similar technology, construction and systems; or (ii) to any person with not less than five years maintenance experience and holding a valid ICAO aircraft maintenance licence rated for the aircraft type requiring certification provided there is no organisation appropriately approved under this Part at that location and the contracted organisation obtains and holds on file evidence of the experience and the licence of that person. (k) If the organisation performs airworthiness reviews and issues the corresponding airworthiness review certificate for ELA1 aircraft not involved in commercial operations in accordance with M.A.901(l), it shall have airworthiness review staff qualified and authorised in accordance with M.A.901(l)1. (l) If the organisation is involved in the development and processing of approval of the maintenance programme for ELA2 aircraft not involved in commercial operations in accordance with M.A.201(e)(ii), it shall have qualified staff who shall be able to show relevant knowledge and experience. All such cases as specified in this point must be reported to the competent authority within seven days after issuing such certification authorisation. The organisation issuing the one-off authorisation shall ensure that any such maintenance that could affect flight safety is re-checked by an appropriately approved organisation.

Annex 329

145.A.35 Certifying Staff and Support Staff (a) In addition to the appropriate requirements of points 145.A.30(g) and (h), the organisation shall ensure that certifying staff and support staff have an adequate understanding of the relevant aircraft and/or components to be maintained together with the associated organisation procedures. In the case of certifying staff, this shall be accomplished before the issue or re-issue of the certification authorisation. (i) ‘Support staff’ means those staff holding an aircraft maintenance licence under Annex III (Part-66) in category B1, B2 and/or B3 with the appropriate aircraft ratings, working in a base maintenance environment while not necessarily holding certification privileges. (ii) ‘Relevant aircraft and/or components’, means those aircraft or components specified in the particular certification authorisation. (iii) ‘Certification authorisation’ means the authorisation issued to certifying staff by the organisation and which specifies the fact that they may sign certificates of release to service within the limitations stated in such authorisation on behalf of the approved organisation. (b) Excepting those cases listed in points 145.A.30(j) and 66.A.20(a)3(ii) the organisation may only issue a certification authorisation to certifying staff in relation to the basic categories or subcategories and any type rating listed on the aircraft maintenance licence as required by Annex III (Part-66), subject to the licence remaining valid throughout the validity period of the authorisation and the certifying staff remaining in compliance with Annex III (Part-66). (c) The organisation shall ensure that all certifying staff and support staff are involved in at least 6 months of actual relevant aircraft or component maintenance experience in any consecutive 2-year period. For the purpose of this point ‘involved in actual relevant aircraft or component maintenance’ means that the person has worked in an aircraft or component maintenance environment and has either exercised the privileges of the certification authorisation and/or has actually carried out maintenance on at least some of the aircraft type or aircraft group systems specified in the particular certification authorisation. (d) The organisation shall ensure that all certifying staff and support staff receive sufficient continuation training in each two year period to ensure that such staff have up-to-date knowledge of relevant technology, organisation procedures and human factor issues. (e) The organisation shall establish a programme for continuation training for certifying staff and support staff, including a procedure to ensure compliance with the relevant points of 145.A.35 as the basis for issuing certification authorisations under this Part to certifying staff, and a procedure to ensure compliance with Annex III (Part-66). (f) Except where any of the unforeseen cases of point 145.A.30(j)(5) apply, the organisation shall assess all prospective certifying staff for their competence, qualification and capability to carry out their intended certifying duties in

330 Annex

accordance with a procedure as specified in the exposition prior to the issue or re-issue of a certification authorisation under this Part. (g) When the conditions of points (a), (b), (d), (f) and, where applicable, point (c) have been fulfilled by the certifying staff, the organisation shall issue a certification authorisation that clearly specifies the scope and limits of such authorisation. Continued validity of the certification authorisation is dependent upon continued compliance with points (a), (b), (d), and where applicable, (c). (h) The certification authorisation must be in a style that makes its scope clear to the certifying staff and any authorised person who may require to examine the authorisation. Where codes are used to define scope, the organisation shall make a code translation readily available. ‘Authorised person’ means the officials of the competent authorities, the Agency and the Member State who has responsibility for the oversight of the maintained aircraft or component. (i) The person responsible for the quality system shall also remain responsible on behalf of the organisation for issuing certification authorisations to certifying staff. Such person may nominate other persons to actually issue or revoke the certification authorisations in accordance with a procedure as specified in the exposition. (j) The organisation shall maintain a record of all certifying staff and support staff, which shall contain: 1. the details of any aircraft maintenance licence held under Annex III (Part66); and 2. all relevant training completed; and 3. the scope of the certification authorisations issued, where relevant; and 4. particulars of staff with limited or one-off certification authorisations The organisation shall retain the record for at least three years after the staff referred to in this point have ceased employment with the organisation or as soon as the authorisation has been withdrawn. In addition, upon request, the maintenance organisation shall furnish the staff referred to in this point with a copy of their personal record on leaving the organisation. The staff referred to in this point shall be given access on request to their personal records as detailed above. (k) The organisation shall provide certifying staff with a copy of their certification authorisation in either a documented or electronic format. (l) Certifying staff shall produce their certification authorisation to any authorised person within 24 hours. (m) The minimum age for certifying staff and support staff is 21 years. (n) The holder of a category A aircraft maintenance licence may only exercise certification privileges on a specific aircraft type following the satisfactory completion of the relevant category A aircraft task training carried out by an organisation appropriately approved in accordance with Annex II (Part-145) or Annex IV (Part-147). This training shall include practical hands on training and theoretical training as appropriate for each task authorised. Satisfactory completion of training shall be demonstrated by an examination or by workplace assessment carried out by the organisation.

Annex 331

(o) The holder of a category B2 aircraft maintenance licence may only exercise the certification privileges described in point 66.A.20(a)(3)(ii) of Annex III (Part-66) following the satisfactory completion of (i) the relevant category A aircraft task training and (ii) 6Â months of documented practical experience covering the scope of the authorisation that will be issued. The task training shall include practical hands on training and theoretical training as appropriate for each task authorised. Satisfactory completion of training shall be demonstrated by an examination or by workplace assessment. Task training and examination/ assessment shall be carried out by the maintenance organisation issuing the certifying staff authorisation. The practical experience shall be also obtained within such maintenance organisation. 145.A.36 Records of Airworthiness Review Staff The organisation shall record all details concerning the airworthiness review staff and maintain a current list of all the airworthiness review staff together with their scope of approval as part of the organisation's exposition pursuant to point 145.A.70(a)6. The organisation shall retain the record for at least three years after the staff referred to in this point have ceased employment (or engagement as a contractor or volunteer) with the organisation or as soon as the authorisation has been withdrawn. In addition, upon request, the maintenance organisation shall provide the staff referred to in this point with a copy of their personal record on leaving the organisation. The staff referred to in this point shall be given access on request to their personal records. 145.A.40Â Equipment, Tools and Material (a) The organisation shall have available and use the necessary equipment, tools and material to perform the approved scope of work. 1. Where the manufacturer specifies a particular tool or equipment, the organisation shall use that tool or equipment, unless the use of alternative tooling or equipment is agreed by the competent authority via procedures specified in the exposition. 2. Equipment and tools must be permanently available, except in the case of any tool or equipment that is so infrequently used that its permanent availability is not necessary. Such cases shall be detailed in an exposition procedure. 3. An organisation approved for base maintenance shall have sufficient aircraft access equipment and inspection platforms/ docking such that the aircraft can be properly inspected. (b) The organisation shall ensure that all tools, equipment and particularly test equipment, as appropriate, are controlled and calibrated according to an officially recognised standard at a frequency to ensure serviceability and accuracy. Records of such calibrations and traceability to the standard used shall be kept by the organisation.

332 Annex

145.A.42 Acceptance of Components (a) All components shall be classified and appropriately segregated into the following categories: 1. Components which are in a satisfactory condition, released on an EASA Form 1 or equivalent and marked in accordance with Subpart Q of Annex I (Part-21) to Regulation (EU) No 748/2012. 2. Unserviceable components which shall be maintained in accordance with this section. 3. Unsalvageable components which are classified in accordance with point 145.A.42(d). 4. Standard parts used on an aircraft, engine, propeller or other aircraft component when specified in the manufacturer's illustrated parts catalogue and/or the maintenance data. 5. Material both raw and consumable used in the course of maintenance when the organisation is satisfied that the material meets the required specification and has appropriate traceability. All material must be accompanied by documentation clearly relating to the particular material and containing a conformity to specification statement plus both the manufacturing and supplier source. 6. Components referred to in point 21A.307(c) of Annex I (Part-21) to Regulation (EU) No 748/2012. (b) Prior to installation of a component, the organisation shall ensure that the particular component is eligible to be fitted when different modification and/or airworthiness directive standards may be applicable. (c) The organisation may fabricate a restricted range of parts to be used in the course of undergoing work within its own facilities provided procedures are identified in the exposition. (d) Components which have reached their certified life limit or contain a non-repairable defect shall be classified as unsalvageable and shall not be permitted to re-enter the component supply system unless certified life limits have been extended or a repair solution has been approved according to Annex I (Part-21) to Regulation (EU) No 748/2012. (e) Components referred to in point 21A.307(c) of Annex I (Part-21) to Regulation (EU) No 748/2012 shall only be installed if considered eligible for installation by the aircraft owner in its own aircraft. 145.A.45 Maintenance Data (a) The organisation shall hold and use applicable current maintenance data in the performance of maintenance, including modifications and repairs. ‘Applicable’ means relevant to any aircraft, component or process specified in the organisation's approval class rating schedule and in any associated capability list. In the case of maintenance data provided by an operator or customer, the organisation shall hold such data when the work is in progress, with the exception of the need to comply with point 145.A.55(c).

Annex 333

(b) For the purposes of this Part, applicable maintenance data shall be any of the following: 1. Any applicable requirement, procedure, operational directive or information issued by the authority responsible for the oversight of the aircraft or component; 2. Any applicable airworthiness directive issued by the authority responsible for the oversight of the aircraft or component; 3. Instructions for continuing airworthiness, issued by type-certificate holders, supplementary type-certificate holders, any other organisation required to publish such data by Annex I (Part-21) to Regulation (EU) No 748/2012 and in the case of aircraft or components from third countries the airworthiness data mandated by the authority responsible for the oversight of the aircraft or component; 4. Any applicable standard, such as but not limited to, maintenance standard practices recognised by the Agency as a good standard for maintenance; 5. Any applicable data issued in accordance with point (d). (c) The organisation shall establish procedures to ensure that if found, any inaccurate, incomplete or ambiguous procedure, practice, information or maintenance instruction contained in the maintenance data used by maintenance personnel is recorded and notified to the author of the maintenance data. (d) The organisation may only modify maintenance instructions in accordance with a procedure specified in the maintenance organisation's exposition. With respect to those changes, the organisation shall demonstrate that they result in equivalent or improved maintenance standards and shall inform the type-certificate holder of such changes. Maintenance instructions for the purposes of this point means instructions on how to carry out the particular maintenance task: they exclude the engineering design of repairs and modifications. (e) The organisation shall provide a common work card or worksheet system to be used throughout relevant parts of the organisation. In addition, the organisation shall either transcribe accurately the maintenance data contained in points (b) and (d) onto such work cards or worksheets or make precise reference to the particular maintenance task or tasks contained in such maintenance data. Work cards and worksheets may be computer generated and held on an electronic database subject to both adequate safeguards against unauthorised alteration and a back-up electronic database which shall be updated within 24Â hours of any entry made to the main electronic database. Complex maintenance tasks shall be transcribed onto the work cards or worksheets and subdivided into clear stages to ensure a record of the accomplishment of the complete maintenance task. Where the organisation provides a maintenance service to an aircraft operator who requires their work card or worksheet system to be used then such work card or worksheet system may be used. In this case, the organisation shall establish a procedure to ensure correct completion of the aircraft operators' work cards or worksheets.

334 Annex

(f) The organisation shall ensure that all applicable maintenance data is readily available for use when required by maintenance personnel. (g) The organisation shall establish a procedure to ensure that maintenance data it controls is kept up to date. In the case of operator/ customer controlled and provided maintenance data, the organisation shall be able to show that either it has written confirmation from the operator/customer that all such maintenance data is up to date or it has work orders specifying the amendment status of the maintenance data to be used or it can show that it is on the operator/customer maintenance data amendment list. 145.A.47 Production Planning (a) The organisation shall have a system appropriate to the amount and complexity of work to plan the availability of all necessary personnel, tools, equipment, material, maintenance data and facilities in order to ensure the safe completion of the maintenance work. (b) The planning of maintenance tasks, and the organising of shifts, shall take into account human performance limitations. (c) When it is required to hand over the continuation or completion of maintenance tasks for reasons of a shift or personnel changeover, relevant information shall be adequately communicated between outgoing and incoming personnel. 145.A.48 Performance of Maintenance The organisation shall establish procedures to ensure that: (a) after completion of maintenance a general verification is carried out to ensure that the aircraft or component is clear of all tools, equipment and any extraneous parts or material, and that all access panels removed have been refitted; (b) an error capturing method is implemented after the performance of any critical maintenance task; (c) the risk of multiple errors during maintenance and the risk of errors being repeated in identical maintenance tasks are minimised; and, (d) damage is assessed and modifications and repairs are carried out using data specified in point M.A.304. 145.A.50 Certification of Maintenance (a) A certificate of release to service shall be issued by appropriately authorised certifying staff on behalf of the organisation when it has been verified that all maintenance ordered has been properly carried out by the organisation in accordance with the procedures specified in point 145.A.70, taking into account the availability and use of the maintenance data specified in point 145.A.45 and that there are no non-compliances which are known to endanger flight safety. (b) A certificate of release to service shall be issued before flight at the completion of any maintenance.

Annex 335

(c) New defects or incomplete maintenance work orders identified during the above maintenance shall be brought to the attention of the aircraft operator for the specific purpose of obtaining agreement to rectify such defects or completing the missing elements of the maintenance work order. In the case where the aircraft operator declines to have such maintenance carried out under this point, point (e) is applicable. (d) A certificate of release to service shall be issued at the completion of any maintenance on a component whilst off the aircraft. The authorised release certificate ‘EASA Form 1’ referred to in Appendix II of Annex I (Part-M) constitutes the component certificate of release to service except if otherwise specified in point M.A.502(b) or M.A.502(e). When an organisation maintains a component for its own use, an EASA Form 1 may not be necessary depending upon the organisation’s internal release procedures defined in the exposition. (e) By derogation to point (a), when the organisation is unable to complete all maintenance ordered, it may issue a certificate of release to service within the approved aircraft limitations. The organisation shall enter such fact in the aircraft certificate of release to service before the issue of such certificate. (f) By derogation to points (a) and 145.A.42, when an aircraft is grounded at a location other than the main line station or main maintenance base due to the non-availability of a component with the appropriate release certificate, it is permissible to temporarily fit a component without the appropriate release certificate for a maximum of 30 flight hours or until the aircraft first returns to the main line station or main maintenance base, whichever is the sooner, subject to the aircraft operator agreement and said component having a suitable release certificate but otherwise in compliance with all applicable maintenance and operational requirements. Such components shall be removed by the above prescribed time limit unless an appropriate release certificate has been obtained in the meantime under points (a) and 145.A.42. 145.A.55 Maintenance and Airworthiness Review Records (a) The organisation shall record all details of maintenance work carried out. As a minimum, the organisation shall retain records necessary to prove that all requirements have been met for the issue of the certificate of release to service, including subcontractor's release documents, and for the issue of any airworthiness review certificate and recommendation. (b) The organisation shall provide a copy of each certificate of release to service to the aircraft operator, together with a copy of any specific repair/modification data used for repairs/modifications carried out. (c) The organisation shall retain a copy of all detailed maintenance records and any associated maintenance data for three years from the date the aircraft or component to which the work relates was released from the organisation. In addition, it shall retain a copy of all the records related to the issue of airworthiness review certificates and recommendations for three years from the date of issue and shall provide a copy of them to the owner of the aircraft.

336 Annex

1. The records under this point shall be stored in a manner that ensures protection from damage, alteration and theft. 2. Computer backup discs, tapes etc. shall be stored in a different location from that containing the working discs, tapes etc., in an environment that ensures they remain in good condition. 3. Where an organisation approved under this Annex (Part-145) terminates its operation, all retained maintenance records covering the last three years shall be distributed to the last owner or customer of the respective aircraft or component or shall be stored as specified by the competent authority. 145.A.60 Occurrence Reporting (a) The organisation shall report to the competent authority, the state of registry and the organisation responsible for the design of the aircraft or component any condition of the aircraft or component identified by the organisation that has resulted or may result in an unsafe condition that hazards seriously the flight safety. (b) The organisation shall establish an internal occurrence reporting system as detailed in the exposition to enable the collection and evaluation of such reports, including the assessment and extraction of those occurrences to be reported under point (a). This procedure shall identify adverse trends, corrective actions taken or to be taken by the organisation to address deficiencies and include evaluation of all known relevant information relating to such occurrences and a method to circulate the information as necessary. (c) The organisation shall make such reports in a form and manner established by the Agency and ensure that they contain all pertinent information about the condition and evaluation results known to the organisation. (d) Where the organisation is contracted by a commercial operator to carry out maintenance, the organisation shall also report to the operator any such condition affecting the operator's aircraft or component. (e) The organisation shall produce and submit such reports as soon as practicable but in any case within 72Â hours of the organisation identifying the condition to which the report relates. 145.A.65 Safety and Quality Policy, Maintenance Procedures and Quality System (a) The organisation shall establish a safety and quality policy for the organisation to be included in the exposition under point 145.A.70. (b) The organisation shall establish procedures agreed by the competent authority taking into account human factors and human performance to ensure good maintenance practices and compliance with the applicable requirements established in 145.A.25 to 145.A.95. The procedures under this point shall: 1. ensure that a clear work order or contract has been agreed between the organisation and the organisation requesting mainÂtenance to clearly establish the maintenance to be carried out so that aircraft and components may be released to service in accordance with 145.A.50; and,

Annex 337

2. cover all aspects of carrying out maintenance, including the provision and control of specialised services and lay down the standards to which the organisation intends to work. (c) The organisation shall establish a quality system that includes the following: 1. Independent audits in order to monitor compliance with required aircraft/ aircraft component standards and adequacy of the procedures to ensure that such procedures invoke good maintenance practices and airworthy aircraft/ aircraft components. In the smallest organisations the independent audit part of the quality system may be contracted to another organisation approved under this Part or a person with appropriate technical knowledge and proven satisfactory audit experience; and 2. A quality feedback reporting system to the person or group of persons specified in point 145.A.30(b) and ultimately to the accountable manager that ensures proper and timely corrective action is taken in response to reports resulting from the independent audits established to meet point (1). 145.A.70 Maintenance Organisation Exposition (a) ‘Maintenance organisation exposition’ means the document or documents that contain the material specifying the scope of work deemed to constitute approval and showing how the organisation intends to comply with this Annex (Part-145). The organisation shall provide the competent authority with a maintenance organisation exposition, containing the following information: 1. A statement signed by the accountable manager confirming that the maintenance organisation exposition and any referenced associated manuals define the organisation's compliance with this Annex (Part-145) and will be complied with at all times. When the accountable manager is not the chief executive officer of the organisation then such chief executive officer shall countersign the statement; 2. the organisation's safety and quality policy as specified by point 145.A.65; 3. the title(s) and name(s) of the persons nominated under point 145.A.30(b); 4. the duties and responsibilities of the persons nominated under point 145.A.30(b), including matters on which they may deal directly with the competent authority on behalf of the organisation; 5. an organisation chart showing associated chains of responsibility between the persons nominated under point 145.A.30(b); 6. a list of certifying staff, support staff and, if applicable, airworthiness review staff and staff responsible for the development and processing of the maintenance programme, with their scope of approval; 7. a general description of manpower resources; 8. a general description of the facilities located at each address specified in the organisation's approval certificate; 9. a specification of the organisation's scope of work relevant to the extent of approval; 10. the notification procedure of point 145.A.85 for organisation changes; 11. the maintenance organisation exposition amendment procedure;

338 Annex

12. the procedures and quality system established by the organisation under points 145.A.25 to 145.A.90 and any additional procedure followed in accordance with Annex I (Part M); 13. a list of commercial operators, where applicable, to which the organisation provides an aircraft maintenance service; 14. a list of subcontracted organisations, where applicable, as specified in point 145.A.75(b); 15. a list of line stations, where applicable, as specified in point 145.A.75(d); 16. a list of contracted organisations, where applicable. (b) The exposition shall be amended as necessary to remain an up-to- date description of the organisation. The exposition and any subsequent amendment shall be approved by the competent authority. (c) Notwithstanding point (b) minor amendments to the exposition may be approved through an exposition procedure (hereinafter called indirect approval). 145.A.75 Privileges of the Organisation In accordance with the exposition, the organisation shall be entitled to carry out the following tasks: (a) Maintain any aircraft and/or component for which it is approved at the locations identified in the approval certificate and in the exposition; (b) Arrange for maintenance of any aircraft or component for which it is approved at another organisation that is working under the quality system of the organisation. This refers to work being carried out by an organisation not itself appropriately approved to carry out such maintenance under this Part and is limited to the work scope permitted under procedures laid down in point 145.A.65(b). This work scope shall not include a base maintenance check of an aircraft or a complete workshop maintenance check or overhaul of an engine or engine module; (c) Maintain any aircraft or any component for which it is approved at any location subject to the need for such maintenance arising either from the unserviceability of the aircraft or from the necessity of supporting occasional line maintenance, subject to the conditions specified in the exposition; (d) Maintain any aircraft and/or component for which it is approved at a location identified as a line maintenance location capable of supporting minor maintenance and only if the organisation exposition both permits such activity and lists such locations; (e) Issue certificates of release to service in respect of completion of maintenance in accordance with point 145.A.50; (f) If specifically approved to do so for ELA1 aircraft not involved in commercial operations, 1. perform airworthiness reviews and issue the corresponding airworthiness review certificate, under the conditions specified in point M.A.901(l), and 2. perform airworthiness reviews and issue the corresponding recommendation, under the conditions specified in point M.A.901(l) and M.A.904(a)2 and (b).

Annex 339

(g) Develop the maintenance programme and process its approval in accordance with point M.A.302 for ELA2 aircraft not involved in commercial operations, under the conditions specified in point M.A.201(e)(ii), and limited to the aircraft ratings listed in the approval certificate. 145.A.80Â Limitations on the Organisation The organisation shall only maintain an aircraft or component for which it is approved when all the necessary facilities, equipment, tooling, material, maintenance data and certifying staff are available. 145.A.85 Changes to the Organisation The organisation shall notify the competent authority of any proposal to carry out any of the following changes before such changes take place to enable the competent authority to determine continued compliance with this Part and to amend, if necessary, the approval certificate, except that in the case of proposed changes in personnel not known to the management beforehand, these changes must be notified at the earliest opportunity: 1. the name of the organisation; 2. the main location of the organisation; 3. additional locations of the organisation; 4. the accountable manager; 5. any of the persons nominated under point 145.A.30(b); 6. the facilities, equipment, tools, material, procedures, work scope, certifying staff and airworthiness review staff that could affect the approval. 145.A.90 Continued Validity (a) An approval shall be issued for an unlimited duration. It shall remain valid subject to: 1. the organisation remaining in compliance with Annex II (Part- 145), in accordance with the provisions related to the handling of findings as specified under point 145.B.50; and 2. the competent authority being granted access to the organisation to determine continued compliance with this Part; and 3. the certificate not being surrendered or revoked. (b) Upon surrender or revocation, the approval shall be returned to the competent authority. 145.A.95 Findings (a) A level 1 finding is any significant non-compliance with requirements laid down in this Annex (Part-145) which lowers the safety standard and hazards seriously the flight safety.

340 Annex

(b) A level 2 finding is any non-compliance with requirements laid down in this Annex (Part-145) which could lower the safety standard and possibly hazard the flight safety. (c) After receipt of notification of findings according to point 145.B.50, the holder of the maintenance organisation approval shall define a corrective action plan and demonstrate corrective action to the satisfaction of the competent authority within a period agreed with this authority.

Index

A A rating, 29 ACARS, 203 Acceptable Means of Compliance See AMC Acceptance Test Procedure, 102 accountable manager, 30, 163, 192 Advisory Circular, 22 Advisory Circular Joint, 22 aircraft painting, 210 aircraft maintenance licence, 30, 211, 264–265 CAT A, 265 CAT B, 265 CAT C, 265 aircraft painting, 208 Airworthiness Directive, 112, 130, 210 Airworthiness Directives Publishing Tool, 131 airworthiness review certificate, 35 Alternative Method of Compliance, 134 AMC, 15, 20, 22, 96 AML See aircraft maintenance licence AOG, 205 applicable design data, 85 approval process (repairs), 97 requirements, 19, 146 requirements 21G, 162 requirements 21J, 48–49 requirements Part 145, 191, 193 approved data, 17, 85, 105, 249 maintenance, 191, 210, 215 production, 62 APU health monitoring, 125 Archiving maintenance records, 32 assembly, 160 ATA systematics, 60 ATP See acceptance test procedure auditing, 297

audit plan, 301 audit programme, 300 external audit, 303 finding, 302–303 internal audit, 299 intervals, 300 process audit, 298 product audit, 298 system audit, 298 authorisation, 260–261

B B rating, 29, 217 BASA agreements, 41 base maintenance, 193, 208 black label unit, 105 bogus parts See counterfeit parts build-to-print, 246 build-to-spec, 246

C C rating, 29 Cabin Logbook, 203 CAMO, 33, 112, 120, 125 CAMO +, 33 CAMO-T, 36 certificates, 151, 187, 231 CoC, 153, 172 CRS, 153, 206 EASA Form 1, 153, 156, 172, 215, 218– 219, 251 EASA form 52, 153 material certificates, 153 certification process See Type-certification (Process) certification programme, 50, 53 Certification Specification, 20, 50, 54, 59, 63, 65, 69, 81, 95, 100, 105 certifying staff, 30, 261

341

342 Index classification minor, 97 CofA for export, 231 completion center, 182 compliance checklist, 81 compliance document, 78, 105 compliance verification, 102 component approval, 104 construction, 102 defect monitoring, 125 design, 185 maintenance, 197, 213–214 maintenance manual, 28 qualification, 104 risk classification, 100 showing of compliance, 104 specification, 100 substantiation data, 104 component development, 99 condition monitoring, 122 configuration management, 103 continuation training, 272 continuing airworthiness, 33, 54, 64, 111

D D rating, 29 DAL See design assurance level declaration of compliance, 54 deferral of defects, 201, 205 design, 47 classification major, 66 classification minor, 66 classification, 54 components, 99 major, 54 minor, 54 minor changes, 95 project management, 85 review, 62, 90 specification, 55 subcontracting, 251 type design, 62 design assurance level, 74, 101 design assurance system, 18, 48–51 Design Organisation Exposition, 48 design organisation, 16, 195 designated representative, 41 Dirty Dozen, 270

E EASA, 5, 23 Basic Regulations, 12 Part 145, 28 Part 147, 31 Part 66, 31, 264, 266 Part M, 33, 111 Part T, 35 regulations, 11 subpart, 12 Subpart 21G, 23 Subpart 21J, 16 emergency AD, 131 EN 9100 series, 36, 304 engine maintenance, 217 assembly, 218 disassembly, 218 hard time limits, 218 modules, 218 on-wing, 217 run up, 219 test flight, 219 engine manual, 218 engine overhaul, 197 Engineering Order, 146, 198 environmental requirements, 54 equipment qualification See component qualification ERP systems, 169 ETSO DDP, 107 parts, 106 evaluation programme, 82 extended workbench, 246–247

F FAA, 10, 41–42, 241 approvals, 42 repair station, 45 FAI See first article inspection FAL See final assembly line FAR See Federal Aviation Regulation Federal Aviation Regulation, 21, 41, 43 final assembly line, 178 first article inspection, 173, 249 FMEA, 104 FOD, 179 functional checks, 209 Functional Hazard Assessment, 73 functional tests, 205, 215

Index 343

G ground handling, 199 Guidance Material, 15

H heavy maintenance See base maintenance homebase, 197, 202 human factors, 32, 200, 260, 270

I ICAO, 9 Implementing Rule, 12, 23 Continuing Airworthiness, 28, 190, 258 Initial Airworthiness, 16 incoming goods inspection, 225, 229, 231, 249 Industry Steering Committee, 114 interchangeability, 103, 108

J JAA See Joint Aviation Authorities JAR See Joint Aviation Regulation job card system, 31, 138, 198 Joint Aviation Authorities, 7 Joint Aviation Regulations, 21 Joint Aviation Requirements, 7, 41

L life limited parts, 215, 240 lifecycle monitoring, 123 line maintenance, 193, 201 line maintenance control center, 197

M maintenance, 189 backshops, 197 base maintenance layover, 209 closed-loop, 215 control center, 195, 199, 202 data, 31, 205 documentation, 62, 64, 120, 144, 211 equipment pooling, 216 finding, 215 ground support equipment, 197 hard time, 122 line maintenance ramp / hangar, 202, 205 line maintenance – terminal, 202 management, 111 on-condition, 122 organisation exposition, 33 organisation, 28, 196

overhaul, 190 planning, 31, 198 planning document, 117 process disruptions, 200 programme, 112–114, 118 quality controls, 210 records, 219 Review Board Report, 114 schedule, 194 support shops, 213 task-oriented, 122 test flight, 212 unscheduled, 195, 200, 205 working group, 114 management manual, 282 manufacturer notifications, 120, 134 material goods acceptance, 228 goods receipt, 229 handling, 236 identification, 228, 231, 237 provision, 236 storage, 231 tracking, 226 Means of Compliance See MoC Minimum Equipment List, 205 MoC, 70, 77, 96, 102, 104 modification, 208, 210 MPD See maintenance planning document MRB Report See Maintenance Review Board Report MSG-3, 114, 116 MTBF, 104

N narrow bodies, 182 national approval, 16 national aviation authorities, 8 NDT See non-destructive testing non-destructive testing, 197, 214, 218 nonconforming products, 239

O occurrence reporting, 25, 32, 34, 305 OEM, 160, 172 Office of Airworthiness, 53–54, 65, 70, 79, 96, 105 operating documentation, 62, 64 operating instructions, 83 operational regulations, 69 outstations, 197, 205

344 Index

P PMA parts, 107 PO/DO arrangement, 25, 148, 165 post certification, 187 Preliminary System Safety Assessment, 74 preservation, 228 production, 159 aircraft, 174 aircraft handover, 181 archiving, 187 assembly, 178 control, 169 documents, 62 flow, 177 fuselage barrel, 174 ground test, 180 monitoring, 179 Movingline Single Aisle, 177 planning, 168 sequence, 177 service partner, 180 special processes, 171 test flight, 180 VIP aircraft, 181 production organisation exposition, 23 production unit, 105 propeller maintenance See engine maintenance PSSA See Preliminary System Safety Assessment

Q QEC See quick engine change kit QM documentation, 164, 262 QM manual See management manual QM system, 162 QTP See qualification test plan QTP See qualification test procedure QTR See Qualification Test Report qualification (staff) 21J staff, 268 administrative staff, 267 concept, 258, 261, 268 employee, 257 executive staff, 266 on-the-job-training, 259 records, 263 qualification test plan, 61 qualification test procedure, 105 qualification test report, 105 quality

assurance, 172 controls, 172 management system, 37 objectives, 278 policy, 278 process descriptions, 282, 284

R receipt of goods, 229 red label unit, 105 redlining procedure, 186 reliability management, 112, 124, 126 monitoring, 125 reporting, 128 repair approval, 52 major, 98 minor, 98 repair design, 96 risk management, 287, 290 RTCA, 61, 105

S SAE, 72 safety assessment, 71 culture, 296 emergency response plan, 290 information bulletin, 134 management system, 287 sampling programme, 125 SB See Service Bulletin scrapping, 216, 240 Service Bulletin, 210 Service Information Letter, 135 Service Letter, 135 serviceable limits, 122 showing of compliance, 49â&#x20AC;&#x201C;51, 69, 76, 78, 95, 97, 107 verification, 79 spare parts, 216 spec. See design SSA See System Safety Assessment standard parts, 31 statement of conformity, 151 STC See Supplement Type-certificate stock keeping, 234 storage requirements, 235 Structure Repair Manual, 29 subcontracting, 243

Index 345 substantiation data, 78, 105 supplier, 166–167 approval, 225 evaluation, 223, 225 external staff, 252 monitoring, 225–226, 241, 244, 247–248, 250 QM-system, 224, 244, 248, 250 questionnaire, 224 release, 223 selection, 222 specification, 222 support staff, 30, 210 suspected unapproved parts, 241 System Safety Assessment, 75

T technical documentation, 142 Technical Logbook, 195 temporary staff, 253 test procedure, 63 TOP requirements, 146, 170, 192 traceability, 63, 79, 96, 226, 231, 237 troubleshooting, 195, 204 type definition documents, 84

type design definition documents, 62 type investigation programme, 54, 65 type-certificate changes, 52 supplemental, 49, 52 type-certificate See type-certification type-certification, 51, 67, 81–82, 84, 105 Applicant’s Declaration of Compliance, 82 declaration of commitment, 84 general description, 69 process, 66, 68, 81 simplified process, 95 supplemental, 187 type investigation report, 84

U unapproved parts notifications, 241 unserviceable tag, 237

V visual inspection, 230

W wide body, 183