Maintenance programs and MSG-3

An aircraft is airworthy when it is certified and when it remains in the condition the certification assumed. The maintenance program is how the operator keeps it there. It lists every scheduled task, from daily walk-round checks to heavy structural inspections years apart, with the interval and the procedure for each. For a new type, the starting point is the maintenance program the type certificate holder develops with operators and the authority. This lesson explains how that program is built using the MSG-3 method and how operators then adapt it to their own experience.

Why scheduled maintenance

Scheduled maintenance has four purposes: to keep the aircraft's inherent safety and reliability, to restore it when deterioration occurs, to obtain the information needed to adjust the program, and to do this at minimum total cost. The word inherent matters. Maintenance cannot make an aircraft safer or more reliable than its design allows. If a component fails too often, more inspections will not fix it; only a design change will. Equally, tasks that do nothing useful waste money and introduce maintenance errors, because every time a panel is opened, something can be put back wrongly.

Early maintenance programs assumed that every component wears out and must be overhauled at fixed intervals. Studies by airlines in the 1960s and 1970s showed that most complex components do not have a clear wear-out age; their failure rate is roughly constant or falls after an early period of infant mortality. Overhauling them on a schedule does not improve reliability and may make it worse. This finding led to reliability-centered maintenance and to the Maintenance Steering Group logic used by the industry, of which MSG-3, first published in 1980 and revised regularly since, is the current version.

The MSG-3 process

MSG-3 is maintained by Airlines for America, with revisions agreed by manufacturers, operators and authorities internationally. It is normally applied through a Maintenance Review Board process: an industry steering committee of operators and the manufacturer, supported by working groups for systems, powerplant, structures and zones, analyzes the design and proposes tasks and intervals. The FAA, through its Maintenance Review Board, reviews and approves the result as the Maintenance Review Board Report, following the guidance in AC 121-22. Although the process is most associated with transport category airplanes, Prairiewind Aerospace has chosen to use it for the Petrel 19 because commuter operators value a program built on recognized logic, and the FAA has agreed to run a review board for the type.

The analysis is divided by kind of item. Systems and powerplant analysis looks at functions and failures. Structural analysis looks at three sources of damage: fatigue, environmental deterioration such as corrosion, and accidental damage. Zonal analysis groups general visual inspections by area of the aircraft, and an enhanced zonal analysis looks specifically at wiring. A separate analysis covers protection against lightning and high-intensity radiated fields. The output of all these analyzes is a set of tasks with intervals, assembled into the maintenance planning document.

Systems and powerplant logic

For systems, the working group first identifies maintenance significant items: items whose failure could affect safety, could be undetectable during normal operations, could have a significant operational impact or could have a significant economic impact. For each item, it lists the functions, the functional failures, the failure effects and the failure causes. Then it applies a decision logic in two levels.

Level 1 asks a sequence of questions about the failure effect. Is the occurrence of the functional failure evident to the operating crew during the performance of normal duties? Does the failure, or secondary damage resulting from it, have a direct adverse effect on operating safety? For a hidden failure, does its combination with another failure have an adverse effect on safety? Does it have a direct adverse effect on operating capability? The answers sort the failure into one of five effect categories.

Level 2 selects tasks. The working group considers each possible task type in turn: lubrication or servicing, operational or visual check, inspection or functional check, restoration, and discard. A task is chosen only if it is applicable, meaning it addresses the failure mechanism, and effective, meaning it achieves the category's objective. For safety categories, the analysis may need a combination of tasks; if no applicable and effective task exists, the item must be redesigned. This is where maintenance analysis feeds back into design, and why the working groups begin while the design can still change.

Hidden failures deserve special attention because they hide redundancy loss. The Petrel 19's battery has a contactor that opens to isolate a module in a fault. If the contactor welds closed, nothing happens in normal flight; the failure appears only when isolation is needed. That is a category 8 failure. The working group selects a functional check of the contactor at an interval derived from the safety assessment, so that the probability of the contactor being failed when needed stays within the target. Arjun recognizes the exposure time from Lesson 4: the check interval is the exposure time in the probability calculation.

Structures

Structural analysis starts with structural significant items, the details whose failure would affect structural integrity. Each is rated for its susceptibility to fatigue, corrosion and accidental damage, and for how easily damage could be detected. Tasks are typically inspections: general visual, detailed visual or special detailed inspections using non-destructive methods such as eddy current or ultrasonics. For metallic fatigue-critical details, intervals follow from damage tolerance analysis: the inspection must find a crack before it grows to critical length.

Marcus Webb's team analyzes a lower wing skin detail at a fastener row near the motor nacelle. The code below estimates how many cycles a crack takes to grow from the smallest size that a detailed eddy current inspection reliably finds to the critical size, and sets the repeat interval so that each crack is inspected at least twice in that period.

# Simplified MSG-3 style interval for a structural inspection task:
# choose the interval so that a detectable crack is inspected at least twice
# before it reaches critical length (inspection threshold and repeat interval).
import math
a_det, a_crit = 2.5, 25.0     # mm: reliably detectable crack, critical crack
C, m = 2.0e-7, 3.0            # crack growth law da/dN = C*(dK)^m, illustrative
ds, Y = 110.0, 1.12           # stress range MPa per flight cycle, geometry factor
def cycles(a0, a1, steps=4000):
    N = 0.0; a = a0; da = (a1 - a0) / steps
    for _ in range(steps):
        dK = Y * ds * math.sqrt(math.pi * (a + da / 2) / 1000)
        N += da / (C * dK**m); a += da
    return N
life = cycles(a_det, a_crit)
for k in (2, 3):
    print(f"detectable-to-critical {life:,.0f} cycles; repeat interval with {k} chances: {life/k:,.0f} cycles")
fc_per_day = 6
print(f"at {fc_per_day} cycles a day, the 2-chance interval is about {life/2/fc_per_day:.0f} days")

detectable-to-critical 13,134 cycles; repeat interval with 2 chances: 6,567 cycles
detectable-to-critical 13,134 cycles; repeat interval with 3 chances: 4,378 cycles
at 6 cycles a day, the 2-chance interval is about 1094 days

The crack takes 13,134 cycles to grow from 2.5 mm to 25 mm. Dividing by two gives a repeat interval of 6,567 cycles, so a crack that is just missed on one inspection still has a second chance of being found before it becomes critical; dividing by three gives 4,378 cycles. At six flight cycles a day, the two-chance interval is about three years. The inspection threshold, the time to the first inspection, is set separately from the fatigue analysis of crack initiation, divided by a scatter factor.

The Paris law relates crack growth per cycle to the stress intensity range. The numbers in the example are illustrative; in a real analysis the material constants come from tests, the stress spectrum from the loads analysis and the operator's usage, and the detectable crack size from the probability of detection of the chosen inspection method. Short flights with many cycles per day, typical of Kuskokwim Air Link, use up crack growth life faster in calendar terms, which is why the interval is expressed in cycles.

Corrosion is managed through a corrosion prevention and control program, with tasks set to keep corrosion at or below a level that can be repaired within allowable limits. Accidental damage, from ground equipment, hail, gravel or careless maintenance, is managed by inspections whose intervals depend on how likely damage is and how quickly it could become critical. Composite structure, used in the Petrel 19's tail and control surfaces, requires attention to impact damage that may be barely visible on the surface but significant inside.

Zonal analysis and wiring

Zonal analysis divides the aircraft into zones, such as the nose landing gear bay, the battery compartment or a section of the wing, and sets a general visual inspection for each zone at an interval suited to its contents and environment. A zonal inspection looks for obvious damage, leaks, loose fittings and chafing, and catches many problems that no individual system task would find. It also allows the working group to consolidate many small system tasks into one inspection of a zone, which keeps the program efficient.

Wiring receives particular attention since accident investigations in the 1990s found that degraded wiring had contributed to fires and system failures that the original programs did not anticipate. The enhanced zonal analysis asks whether a zone contains wiring near combustible materials or near both primary and backup systems, and whether contamination such as fluids or dust is likely. For the Petrel 19, every zone with high-voltage cabling gets a detailed inspection of insulation, clamps and separation, and the battery compartment gets a stand-alone task at each A-check. Teresa Nakamura argues that on an aircraft whose propulsion depends on electrical power, the wiring is as important as the engine mounts, and the working group agrees.

From the review board report to the operator's program

The approved review board report sets minimum initial tasks and intervals. Each operator then develops its own program. A Part 135 operator of aircraft type certificated for ten or more passenger seats, such as the Petrel 19, must maintain them under a continuous airworthiness maintenance program, which incorporates the review board tasks, the airworthiness limitations, any airworthiness directives and tasks specific to its operation. Kuskokwim Air Link's program adds tasks for gravel runway operations and cold-weather servicing.

Programs evolve. As operators gain experience, their reliability programs show which tasks find problems and which never do. Intervals can be escalated with evidence, typically sampling of findings from aircraft at the existing interval, and tasks that are not effective can be removed. MSG-3 itself encourages this through its link to reliability data. The airworthiness limitations, however, are not escalated through this process; they can be changed only by the type certificate holder with authority approval.

Packaging is the final step. Tasks with similar intervals are grouped into checks: daily, weekly, A-checks every few hundred flight hours and C-checks every year or two. For a small operator with no spare aircraft, packaging matters as much as the analysis; Kuskokwim Air Link wants tasks spread so that each check fits into an overnight stop. The working group arranges intervals in multiples that allow phased checks, so that the aircraft never needs to be out of service for a week.