Continued airworthiness

Certification is a prediction. The safety assessment estimates failure rates, the structural analysis predicts fatigue lives, and the flight tests sample a few hundred hours of a fleet that will fly millions. Continued airworthiness is the system that checks those predictions against experience and corrects the design, the maintenance or the operation when they turn out to be wrong. It involves the type certificate holder, the operators, the maintenance organizations, the technicians and the authority, each with defined responsibilities. This lesson follows the Petrel 19's first two years in service with Kivalliq Air Link, and shows how a small reliability signal becomes a design change.

Who is responsible for what

The type certificate holder is responsible for the design throughout its life. It must provide instructions for continued airworthiness, collect and analyse reports of failures, malfunctions and defects, report certain occurrences to the authority, and develop corrective action when an unsafe condition is found. The operator is responsible for the airworthiness of each aircraft it operates: maintaining it to an approved program, keeping records, reporting service difficulties and ensuring that all mandatory actions are done on time. The maintenance organization and the technician are responsible for the work they perform and certify. The authority oversees all of them and issues airworthiness directives when an unsafe condition exists.

Instructions for continued airworthiness

The instructions for continued airworthiness are the maintenance documentation the type certificate holder supplies: the maintenance manual, the illustrated parts catalogue, wiring diagrams, the structural repair manual, component maintenance manuals, and the maintenance planning document with recommended tasks and intervals. The airworthiness limitations section is a mandatory part, approved by the authority, that lists life-limited parts, mandatory replacement times and structural inspection intervals. Operators may change most maintenance tasks with approval, but cannot relax an airworthiness limitation.

For the Petrel 19, the airworthiness limitations include the safe life of the main landing gear, the inspection thresholds and intervals for critical structural details, and two new kinds of limit: a maximum calendar life and cycle count for battery modules, and a maximum number of high-voltage connector mating cycles. The battery limits come from the qualification tests and will be revised as fleet experience accumulates. That revision process is part of continued airworthiness too.

Reporting

Information drives the whole system. Canadian operators and maintenance organizations report service difficulties to TCCA, which publishes them in its Web Service Difficulty Reporting System; anyone can search it, which lets operators of the same type learn from each other. The type certificate holder must also report failures, malfunctions and defects that have resulted or could result in an unsafe condition. Reports of accidents and some incidents also go to the Transportation Safety Board, as Lesson 11 describes.

Most reports are minor: a sticking door latch, a cracked fairing, a sensor that reads high. Their value is in aggregation. A single failed actuator means nothing; ten failures in a hundred aircraft over six months may mean a design problem. The type certificate holder therefore runs a fleet-wide reliability analysis that combines service reports, warranty returns, shop findings and operator data.

Reliability programs

Larger operators run their own reliability programs, approved as part of their maintenance program, and the type certificate holder runs one for the fleet. A reliability program defines measures such as unscheduled removals per thousand flight hours, pilot reports per hundred departures and dispatch reliability; sets alert levels from historical data; reviews results each month; and investigates any measure that exceeds its alert level. The investigation may lead to a change in the maintenance program, a service bulletin, a training change or a design change.

In the Petrel 19's second year, Tomasz Wierzbicki, who moved from aerodynamics to lead the in-service engineering team, sees removals of the propeller pitch actuator rising. The code below shows the method he uses: the alert level is the mean removal rate over the previous twelve months plus two standard deviations.

# Reliability monitoring for the fleet: unscheduled removals of the propeller pitch actuator.
# Alert level = mean + 2 standard deviations of the removal rate over the previous 12 months.
import statistics as st
fleet_hours = [1800, 1850, 1900, 1950, 2000, 2050, 2100, 2150, 2200, 2250, 2300, 2350]
removals    = [2, 1, 3, 2, 2, 1, 2, 3, 2, 2, 1, 2]
rate = [1000 * r / h for r, h in zip(removals, fleet_hours)]   # per 1000 flight hours
mean, sd = st.mean(rate), st.stdev(rate)
alert = mean + 2 * sd
print(f"12-month mean {mean:.3f} per 1000 fh, sd {sd:.3f}, alert level {alert:.3f}")
mtbur = sum(fleet_hours) * 2 / sum(removals)   # two actuators per aircraft
print(f"MTBUR {mtbur:,.0f} actuator hours")
new = [(2400, 2), (2450, 4), (2500, 5)]
for h, r in new:
    x = 1000 * r / h
    print(f"month with {h} fh and {r} removals: {x:.3f}  {'above alert' if x > alert else 'normal'}")

12-month mean 0.931 per 1000 fh, sd 0.342, alert level 1.615
MTBUR 2,165 actuator hours
month with 2400 fh and 2 removals: 0.833  normal
month with 2450 fh and 4 removals: 1.633  above alert
month with 2500 fh and 5 removals: 2.000  above alert

The twelve-month mean is 0.931 removals per thousand flight hours, with a standard deviation of 0.342, giving an alert level of 1.615. The mean time between unscheduled removals is 2,165 actuator hours. A month with two removals in 2,400 flight hours is normal. Two later months, with four removals in 2,450 hours and five in 2,500, are above alert. One high month could be chance; two in succession make Tomasz open an investigation.

Alert levels are a screening tool, not a statistical proof. Setting the level at two standard deviations above the mean means that some false alerts are expected, perhaps a few a year across many measures, and the investigation must sort real trends from noise. Setting the level too high hides real problems; too low, and engineers spend their time chasing nothing. The operator and the type certificate holder agree the method in advance so that nobody adjusts the alert level after the data arrive.

From signal to correction

Tomasz's team pulls the removed actuators and sends them to the supplier for teardown. Most of the units show wear in a seal, and the wear is worst on aircraft that operate on gravel runways. Dust is entering past a boot that was qualified for paved-runway operation. The investigation then asks three questions. Is there an unsafe condition? What is the cause? What is the correction?

The safety assessment classified the loss of one propeller's pitch control as major, not hazardous, because the propeller fails to a safe pitch and the aircraft can continue on the other unit. A seal failure does not by itself create an unsafe condition, so the correction can follow a normal path rather than an emergency one. The supplier redesigns the boot, the type certificate holder issues a service bulletin recommending replacement at the next scheduled actuator removal, and the maintenance planning document adds an inspection of the boot at each A-check for aircraft on gravel operations. If the teardowns had shown a failure that could lead to an uncommanded pitch change, the outcome would have been different: the authority would likely have issued an airworthiness directive.

This distinction is the core of continued airworthiness judgment. Most reliability problems are economic and are corrected by service bulletins and maintenance program changes. A smaller number are safety problems that the authority makes mandatory. The decision between them rests on the same failure condition classification used in certification, which is one reason the safety assessment remains a living document after the type certificate is issued.

Ageing and changing fleets

Continued airworthiness also deals with change over time. Structures age; wiring insulation degrades; corrosion appears in places nobody expected. Operators use aircraft in ways the designers did not anticipate, such as more cycles per day or more operations from contaminated runways. Over decades, ownership changes, records are lost, and parts from different sources are mixed. Programs for ageing aircraft, such as widespread fatigue damage evaluation for transport aeroplanes and supplemental inspections for older small aircraft, address these effects, and the type certificate holder updates its instructions as evidence accumulates.

The Petrel 19 adds the ageing of electrical systems. Battery capacity falls with cycles and calendar time, and the range available on battery power for a go-around or a diversion falls with it. The instructions therefore include a capacity check at defined intervals, and the flight manual performance data account for an end-of-life battery. Kenji Watanabe sees this as a new kind of continued airworthiness task, one that affects performance rather than structural integrity, and asks the team to treat battery health data with the same rigour as structural inspection findings.

Defects, deferrals and the minimum equipment list

Day to day, continued airworthiness is mostly about defects found on the line. A pilot reports that a cabin temperature sensor reads high; a AME finds a chafed wire bundle during a walk-round; a battery module shows a cell imbalance warning. Each defect must be recorded, assessed and either rectified before the next flight or deferred under an approved procedure. The minimum equipment list, approved for the operator and based on the type certificate holder's master minimum equipment list, states which items may be inoperative for dispatch, for how long and under what conditions. An item not on the list must be fixed before flight.

The master minimum equipment list for the Petrel 19 is one of the most negotiated documents in the program. Kivalliq Air Link wants to be able to dispatch with one battery module isolated, because a remote station may wait days for a spare. The safety assessment shows that with one module isolated the aircraft still meets its go-around and diversion requirements at reduced weight, so the item is allowed for a limited number of flight days with a weight restriction and a crew procedure. Sam Littlechild flies the reduced-capability configuration to confirm that the procedure works and that the cockpit indications are clear. Without such provisions a theoretically airworthy aircraft can be commercially useless; with too many, an aircraft can accumulate deferrals until its safety margins have quietly gone. Repeated deferral of the same item is itself a reliability signal that the operator's program must watch.

Repairs and alterations in service

Damaged aircraft are repaired, and operators modify aircraft for new missions. Repairs must follow approved data: the structural repair manual, a repair scheme approved by the type certificate holder, or data approved by the authority or a delegate. Major repairs and alterations need approval and documentation; minor ones can be done to acceptable data. Each repair must be assessed for its effect on the aircraft's damage tolerance, because a repair can change the load path and create a new fatigue-critical location that the original inspection program does not cover.

In Canada, repairs and modifications are classified as major or minor under CAR 571, and major ones need technical data approved under CAR Part V; the work is recorded in the technical records and, for major repairs and modifications, reported as required by the standard.