Best Maintenance Practices for Redundant Systems
Source: Airbus Safety First URL: https://safetyfirst.airbus.com/best-maintenance-practices-for-redundant-systems/ Published: 2023-07-13 Category: Maintenance PDF: Original PDF
Performing similar maintenance tasks on redundant systems at the same time, or by the same person during a particular maintenance check, may lead to the repetition of a maintenance error. This creates a risk of simultaneous failure of the redundant systems when the aircraft is back into service.
This article provides best practices to reduce this risk and ensure that the of of or benefits redundancy systems components on the aircraft is not compromised.
Check the latest version of this article on safetyfrst.airbus.com and on the Safety first app for iOS and Android devices.
CASE STUDY 1
Section titled “CASE STUDY 1”Event Description
Section titled “Event Description”The loss of two hydraulic systems in flight
Section titled “The loss of two hydraulic systems in flight”An A330 aircraft experienced the loss of two hydraulic systems in the cruise phase of a long-range flight. The initial HYD B RSVR LO LVL and HYD B SYS LO PR ECAM cautions were triggered, and the HYD B + Y SYS LO PR ECAM warning appeared approximately 30 minutes later. The flight crew applied the appropriate procedure and set the affected hydraulic pumps to OFF, causing the flight control system to revert to alternate law.
The flight crew diverted the aircraft and landed safely without further incident. The aircraft was kept on the ground for further inspection.
Event Analysis
Section titled “Event Analysis”The same leak in two hydraulic systems
Section titled “The same leak in two hydraulic systems”After an initial inspection, the maintenance engineer discovered signs indicating a hydraulic leak that came from the High Pressure (HP) manifold on both the blue and yellow hydraulic systems. They decided to replace both HP manifolds and sent them to Airbus for further analysis.
The hydraulic fluid leak was confirmed as coming from the check valves installed in both the blue and yellow hydraulic system HP manifolds. O-rings reserved only for transportation and storage were found installed on both selectors. The Aircraft Maintenance Manual (AMM) requests the removal of these transportation and storage O-rings before the installation of the check valves on the aircraft. These O-rings are not for operational use as they are not designed to sustain hydraulic system pressure. These transportation O-rings were damaged and were confirmed as the origin of the hydraulic fluid leak.
(fig.1) Check valves of the blue and yellow HP manifolds with their respective O-rings
A maintenance error repeated on two hydraulic systems
Section titled “A maintenance error repeated on two hydraulic systems”Maintenance records showed that the check valves were replaced a few days prior to the event. The same maintenance personnel performed the task on both the blue and yellow manifolds at the same time. They erroneously left the transportation O-rings on both check valves.
CASE STUDY 2
Section titled “CASE STUDY 2”Event Description
Section titled “Event Description”Engine fire after landing
Section titled “Engine fire after landing”An ENG 1 FIRE ECAM warning was triggered on an A320neo aircraft shortly after landing. The flight crew set the ENG MASTER lever to OFF, and pressed the ENG 1 FIRE pushbutton to discharge AGENT 1. The ECAM warning remained, so the flight crew discharged AGENT 2. The warning disappeared and the aircraft safely came to a stop at the gate without further incident.
Event Analysis
Section titled “Event Analysis”Evidence of fire
Section titled “Evidence of fire”A preliminary maintenance inspection confirmed evidence of fire found on the engine core at the 12 o’clock position. The operator decided to replace engine 1 for further investigation and repair. Fuel leaking from a fuel nozzle
Further inspection revealed that the engine fire was caused by a fuel leak from a fuel nozzle B-nut that was not torqued to the correct value specified in the AMM. The B-nuts of the other fuel nozzles were also incorrectly torqued, but they showed no sign of leaks.
(fig.2) Example of a fuel nozzle and its B-nuts on an A320neo engine
A maintenance error on engine 1 repeated on engine 2
Section titled “A maintenance error on engine 1 repeated on engine 2”A check of engine 2 enabled the operator to discover that the fuel nozzle B-nuts were also incorrectly torqued as was the case for engine 1. The correct torque was then applied to all of the engine 2 nozzle B-nuts and there were no further discrepancies.
Maintenance records revealed that the aircraft had a maintenance check 16 days prior to the event. The fuel nozzles of both engines were replaced. The same maintenance personnel performed the nozzle replacement on both engine 1 and engine 2 and improperly torqued their B-nuts.
APPLYING BEST PRACTICES
Section titled “APPLYING BEST PRACTICES”Operators and approved maintenance organizations should identify when there is the risk of errors being repeated in identical maintenance tasks during a particular maintenance check. This will allow for application of the following best practices to prevent simultaneous failures in redundant systems.
Stagger the scheduling
Section titled “Stagger the scheduling”When possible, avoid scheduling similar maintenance tasks on redundant systems at the same time. This reduces the risk of having a simultaneous failure of the redundant systems as a result of a repeated maintenance error. Assign different people to redundant systems
If it is not possible to stagger the scheduling of similar maintenance tasks, then a different person or team should carry out the task on each redundant system or component. This reduces the probability of repeating a potential maintenance error made by the same person or team.
Additional inspection and cross-check
Section titled “Additional inspection and cross-check”Identify the task as one that requires an additional inspection , cross-check, and dual signature verification that the task was completed correctly and in accordance with the maintenance procedures.
Test one system at a time
Section titled “Test one system at a time”If a system test or engine run is necessary, the maintenance personnel should ensure that only one of the redundant systems or engines is tested at a time, unless the task provides other specific instructions. This reduces the risk of simultaneous failures or unexpected behavior of the systems/engines during the test. Always follow the maintenance procedures
As a general rule, strictly adhering to the maintenance procedures reduces the risk of introducing human errors during maintenance tasks.
Regulatory requirements
Section titled “Regulatory requirements”ETOPS operations
Section titled “ETOPS operations”For ETOPS operations, requirements and guidelines shall be applied. For example:
● US 14 CFR Part 121 section 121.374, “Continuous airworthiness maintenance program (CAMP) for two-engine ETOPS - Limitations on dual maintenance.”
● FAA AC 120-42, “MAINTENANCE REQUIREMENTS FOR TWO-ENGINE ETOPS AUTHORIZATION - Dual Maintenance” paragraph ● EASA AMC 20-6 (AMJ 120-42/IL 20). “4. CONTINUING AIRWORTHINESS MANAGEMENT EXPOSITION” chapter.
EU and UK regulations
Section titled “EU and UK regulations”EU and UK regulations also request that operators establish procedures that prevent the risk of repeating errors on identical systems (independently of the type of operations):
● EU Part-145: Item 145.A.48(c)(3) and its AMC1 145.A.48(c)(3) & GM1 145.A.48(c)(3) ● UK CAA Part-145: Item 145.A.48(c) and its AMC 145.A.48(c) & GM 145.A.48(c).
Further information can be found in the following documents available on the Airbusworld/A220World portals:
-
OIT 999.0097/16 “BEST PRACTICES FOR SIMULTANEOUS MAINTENANCE ON REDUNDANT ITEMS”
-
OIT AI/SE 999.0044/99 “DUAL SYSTEM MAINTENANCE RECOMMENDATIONS”
-
The introduction section of the Aircraft Maintenance Manual (AMM) & A220 Aircraft Maintenance Publication (AMP) provides general recommendations related to the risk of human error during maintenance tasks.
Contributors:
Section titled “Contributors:”Marco FAITA Customer Support Programme
Jean Philippe JACQ Product Safety Management
Arturo MARTINEZ-GRACIDA Human Factor in Maintenance
Cyril MONTOYA Product Safety Enhancement Manager
Prosper PRÉAU Continuing Airworthiness Expert Airworthiness & Certification,
Performing similar maintenance tasks on redundant systems at the same time, or by the same person during a particular maintenance check, may lead to the repetition of a maintenance error. This creates a risk of simultaneous failure of the redundant systems when the aircraft is back into service.
There are a range of safeguards or best practices that can be applied to prevent repetition of a maintenance error. These include staggered scheduling of the task, using different personnel to carry out the task, performing an additional cross-check inspection, and requiring a dual signature to verify that the task was correctly carried out and in accordance with the maintenance procedures. Where possible, and unless otherwise specified, carry out a test of one system or one engine run at a time.
In all cases, it is important to correctly apply the maintenance procedures.
With Thanks to Ian GOODWIN from Product Safety, JeanFrancois BOURCHANIN from Flight Controls Engineering Support, Denis DURAND from A320 Propulsion Systems
Safety first, 2023. Safety first is published by Airbus S.A.S. 1, rond point Maurice Bellonte - 31707 Blagnac Cedex/France.
Editor: Yannick Malinge, Chief Product Safety Officer.
Editorial team: Guillaume Estragnat, Vanessa Sadi, Gwyneth Duggan, Javier Martinez Marina, Tim Roach.
- Reference: X00D16031905.
Photos by Airbus.
来源：Airbus Safety First 网址：https://safetyfirst.airbus.com/best-maintenance-practices-for-redundant-systems/ 发布日期：2023-07-13 类别：维修
在同一维护工作中对冗余系统执行相似的维修任务，或由同一维修人员在特定维修检查期间执行，可能导致维修差错重复发生。这会在飞机重新投入运营时产生冗余系统同时失效的风险。
本文提供最佳实践以降低这一风险，并确保飞机上冗余系统组件的冗余特性不受影响。
请在 safetyfirst.airbus.com 以及 iOS 和 Android 版 Safety first 应用上查看本文的最新版本。
案例研究 1
Section titled “案例研究 1”飞行中两套液压系统失效
Section titled “飞行中两套液压系统失效”一架 A330 飞机在远程飞行的巡航阶段发生了两套液压系统失效。初始触发了 HYD B RSVR LO LVL（液压 B 油箱低油量）和 HYD B SYS LO PR（液压 B 系统低压）ECAM 咨询信息，约 30 分钟后出现 HYD B + Y SYS LO PR（液压 B+Y 系统低压）ECAM 警告。飞行机组执行了相应程序，将受影响的液压泵设置为 OFF（关断），导致飞控系统进入备用法则。
飞行机组将飞机改航并安全着陆，未发生进一步事故。飞机留在地面接受进一步检查。
两套液压系统中的同一处渗漏
Section titled “两套液压系统中的同一处渗漏”初步检查后，维修工程师发现迹象表明，蓝色和黄色液压系统的高压（HP）液压管路上均存在液压渗漏。他们决定更换两套高压液压管路，并将其送交空客进行进一步分析。
经确认，液压渗漏来自安装在蓝色和黄色液压系统高压液压管路上的单向活门。两套选择器上均发现了仅用于运输和储存的 O 型圈。**Aircraft Maintenance Manual (AMM) 要求在飞机上安装单向活门前拆除这些运输和储存用 O 型圈。**这些 O 型圈不适用于运行状态，因为其设计无法承受液压系统压力。这些运输用 O 型圈已损坏，经确认是液压渗漏的来源。
（图 1） 蓝色和黄色高压液压管路的单向活门及其各自的 O 型圈
同一维修差错在两套液压系统上重复发生
Section titled “同一维修差错在两套液压系统上重复发生”维修记录显示，单向活门在事件前几天刚进行过更换。同一位维修人员在同一时间对蓝色和黄色液压管路执行了维修工作。他们错误地在两个单向活门上都留下了运输用 O 型圈。
案例研究 2
Section titled “案例研究 2”着陆后发动机失火
Section titled “着陆后发动机失火”一架 A320neo 飞机在着陆后不久触发了 ENG 1 FIRE（1 发失火）ECAM 警告。飞行机组将 ENG MASTER（发动机主电门）杆设置为 OFF（关断），并按压 ENG 1 FIRE（1 发失火）按钮以释放 AGENT 1（灭火剂 1）。ECAM 警告仍然存在，因此飞行机组释放了 AGENT 2（灭火剂 2）。警告消失，飞机安全滑行至廊桥，未发生进一步事故。
初步维修检查确认在发动机核心机 12 点钟位置发现失火痕迹。运营商决定更换 1 号发动机以进行进一步调查和修理。燃油喷嘴燃油泄漏
进一步检查发现，发动机失火是由燃油喷嘴 B 型螺母未按 AMM 规定的正确力矩拧紧而导致的燃油泄漏引起。其他燃油喷嘴的 B 型螺母同样力矩不正确，但未显示泄漏迹象。
（图 2） A320neo 发动机上燃油喷嘴及其 B 型螺母示例
1 号发动机上的维修差错在 2 号发动机上重复发生
Section titled “1 号发动机上的维修差错在 2 号发动机上重复发生”对 2 号发动机的检查使运营商发现，燃油喷嘴 B 型螺母同样未按正确力矩拧紧，与 1 号发动机情况相同。随后对 2 号发动机所有喷嘴 B 型螺母施加了正确力矩，未再发现其他不符项。
维修记录显示，飞机在事件发生前 16 天进行过一次维修检查。两个发动机的燃油喷嘴均已更换。同一位维修人员执行了 1 号和 2 号发动机的喷嘴更换工作，并错误地对 B 型螺母施加了不当力矩。
应用最佳实践
Section titled “应用最佳实践”运营人和经批准的维修机构应识别在特定维修检查期间相同维修任务中存在差错重复的风险。这将有助于应用以下最佳实践，以防止冗余系统同时发生故障。
尽可能避免在同一时间对冗余系统安排相似的维修任务。这可降低因维修差错重复而导致冗余系统同时失效的风险。为冗余系统指派不同的人员
如果无法对相似维修任务进行交错排程，则应安排不同的人员或团队在每个冗余系统或部件上执行任务。这可降低同一人员或团队重复潜在维修差错的概率。
附加检查与交叉检查
Section titled “附加检查与交叉检查”识别需要附加检查、交叉检查和双重签署验证的任务，以确保任务正确完成并符合维修程序。
一次仅测试一个系统
Section titled “一次仅测试一个系统”如果需要进行系统测试或发动机试车，维修人员应确保每次仅测试一个冗余系统或发动机，除非任务提供了其他具体说明。这可降低测试期间系统/发动机同时失效或异常行为的风险。始终遵循维修程序
作为一般原则，严格遵守维修程序可降低维修任务中引入人为差错的 risk。
ETOPS 运营
Section titled “ETOPS 运营”对于 ETOPS 运营，应应用相关要求和指南。例如：
● 美国 14 CFR 第 121 部第 121.374 节，“双发 ETOPS 持续适航维修方案（CAMP）——双维修限制。”
● FAA AC 120-42，“双发 ETOPS 授权维修要求——双维修”相关段落
● EASA AMC 20-6（AMJ 120-42/IL 20）。“4. 持续适航管理 exposition”章节。
欧盟与英国法规
Section titled “欧盟与英国法规”欧盟和英国法规还要求运营人建立程序，以防止在相同系统上重复 errors（无论运营类型如何）：
● 欧盟 Part-145：第 145.A.48(c)(3) 条及其 AMC1 145.A.48(c)(3) 与 GM1 145.A.48(c)(3)
● 英国 CAA Part-145：第 145.A.48(c) 条及其 AMC 145.A.48(c) 与 GM 145.A.48(c)。
更多详细信息可在 Airbusworld/A220World 门户网站上查阅以下文件：
-
OIT 999.0097/16 “冗余项目同时维修最佳实践”
-
OIT AI/SE 999.0044/99 “双系统维修建议”
-
《 aircraft Maintenance Manual》（AMM）与 A220 《飞机维修出版物》（AMP）引言部分提供了与维修任务中人为差错风险相关的一般性建议。
Marco FAITA 客户支援项目组
Jean Philippe JACQ 产品安全管理
Arturo MARTINEZ-GRACIDA 维修人为因素
Cyril MONTOYA 产品安全改进经理
Prosper PRÉAU 持续适航专家 适航与认证部
在特定维修检查期间，同时对冗余系统执行相似的维修任务，或由同一人员执行，可能导致维修差错的重复。这会在飞机恢复运行时造成冗余系统同时失效的风险。
可采用一系列保护措施或最佳实践来防止维修差错的重复。这些措施包括任务的交错排程、使用不同人员执行任务、进行附加交叉检查，以及要求双重签署以验证任务已正确执行并符合维修程序。在可能的情况下，除非另有规定，否则每次仅执行一个系统测试或一次发动机试车。
在所有情况下，正确应用维修程序至关重要。
特别感谢产品安全部的 Ian GOODWIN、飞行控制工程支援部的 JeanFrancois BOURCHANIN 以及 A320 推进系统部的 Denis DURAND。
Safety first，2023 年。Safety first 由空中客车公司出版。
地址：1, rond point Maurice Bellonte - 31707 法国布拉尼亚克。
编辑：Yannick Malinge，首席产品安全官。
编辑团队：Guillaume Estragnat、Vanessa Sadi、Gwyneth Duggan、Javier Martinez Marina、Tim Roach。
20192534。参考编号：X00D16031905。
照片由空中客车公司提供。