Mechanical Systems Integrity Program (MSIP)

Effective Date: 01 February 2019

Version in effect: 2 (revised 13 May 2021)

Reference: TAM Part 3, Chapter 4, Annex B

OPI/Telephone: DTAES 7-8 / 819-939-4820

Alternate format

1. Purpose

1.1 This Technical Airworthiness Authority (TAA) Advisory provides clarification and guidance on how to comply with Department of National Defence (DND) requirements for a Canadian aircraft Mechanical Systems Integrity Program (MSIP).

2. Applicability

2.1 This TAA Advisory is applicable to all DND-owned fixed and rotary wing aircraft. For Unmanned Aircraft Systems and leased aircraft, TAA guidance must be sought to determine if this advisory is applicable.

3. Related Material

3.1 Definitions

3.1.1 The definitions for most of the airworthiness-related terms in this document can be found in the TAM Glossary. The definitions listed below are not in the TAM Glossary:

  1. Safety-critical mechanical system: A mechanical system in which proper recognition, control, performance or tolerance is essential to safe system, and hence safe aircraft, operation. Emergency systems such as fire extinguishing, supplemental oxygen and evacuation systems are included.
  2. In-Service difficulty: Failure or malfunction of, or defect in, an aircraft system or component that affects, or if not corrected, is likely to affect the safety of an aircraft, its occupants or any other person.
  3. Latent failure: A failure which is not detected and/or annunciated when it occurs.
  4. Flammable: With respect to a fluid or gas, means susceptible to readily igniting or to exploding.

3.2 Regulatory References

  1. C-05-005-001/AG-001 – Technical Airworthiness Manual (TAM)
  2. TAA Advisory 2018-01Integrity Monitoring Requirements for Aircraft Electrical Wiring Interconnection Systems (EWIS)
  3. C-05-005-P12/AM-001 – AEPM Engineering Process Manual, Part 11 – Airworthiness Monitoring and Reporting, Monitoring of Airworthiness and Aviation Safety Documents (AASD) Within Weapon System Management (WSM) Organizations

3.3 Non-regulatory References

  1. The Nimrod Review, An Independent Review into The Broader Issues Surrounding the Loss of the RAF Nimrod MR2 Aircraft XV230 In Afghanistan in 2006, by Charles Haddon-Cave
  2. National Transportation Safety Board, Safety Report on the Treatment of Safety-Critical Systems in Transport Airplanes, Safety Report NTSB/SR-06/02
  3. DTAES 5 Tech Notes related to flammable fluid lines inspections on the RCAF’s CC130J (TN 56-16-04, available internally, within DND, at AEPM RDIMS #1623302) and CH147F (TN 56-16-05, available internally, within DND, at AEPM RDIMS #1627031)
  4. U.S. Department of Defense Standard of Practice MIL-STD-1798C– Mechanical Equipment and Subsystems Integrity Program (MECSIP), 8 Aug 2013 (available internally, within DND, at AEPM RDIMS #1852224)
  5. United Kingdom Defence Safety Authority System Integity Handbook Guidance Document in Support of Regulatory Article 5721 (System Integrity Management) v7.1 (available internally, within DND, at AEPM RDIMS #1877300)
  6. ATA MSG-3 – Operator/Manufacturer Scheduled Maintenance Development (Volume 1 – Fixed Wing Aircraft), 2015
  7. C-17-010-002/ME-001 – Aircraft Electrical and Electronic Wiring, Volume 1 of 10 (book 2 of 2) – EWIS
  8. Guidance documents for acceptable separation and support of flammable fluid lines:
    1. C-12-010-040/TR-011 – Standard Repair Procedures, Rigid Fluid Tubing Repair and Replacement
    2. MIL-H-5440H – Requirements for Hydraulic Systems, Aircraft, Design and Installation
    3. FAA Advisory Circular (AC) 43.13-1B – Acceptable Methods, Techniques, and Practices, Aircraft Inspections and Repair
    4. FAA AC 25-8 – Auxillary Fuel System Installations
  9. Mechanical Systems Standard Zonal Analysis Procedure (SZAP) Checklist, created by DTAES 7-8, available internally, within DND, at AEPM RDIMS #1892083
  10. Technical Annual Airworthiness Report (AAR(Tech)) Template, controlled by DTAES 4, available internally, within DND, at AEPM RDIMS #500715

4. Discussion

4.1 The TAM (reference 3.2.a) identifies the mandated MSIP requirements. This section of the advisory identifies historical justification for MSIP, details on the focus of MSIP and MSIP measures of success.

4.2 The Haddon-Cave report (reference 3.3.a) identified a number of contributing factors to the 2006 Royal Air Force (RAF) Nimrod accident. Among the more notable factors were the following:

  1. There was an assumption by those involved that the Nimrod was safe because it had successfully flown for 30 years.
  2. There was a four-fold increase in the number of reported fuel coupling leaks; however, there was no emphasis on trend analysis, so it was not noticed or actioned.
  3. In the original system safety analysis, a fuel leak was assumed to be improbable. However, 38 related events were occuring each year. This would be classified as a frequent occurrence.
  4. Fuel system functional tests were not performed under pressure, which reduced the likelihood of a leak being detected during maintenance.
  5. No sampling was performed on the fuel seals to detect deterioration even though the manufacturer recommended replacement every five years.
  6. The maintenance manuals lacked proper guidance on how to replace the fuel coupling seals.

These deficiencies highlight how implementation of an in-service monitoring program for mechanical systems could result in an enhanced level of safety. 

4.3 A number of high profile civil accidents, such as the McDonnell Douglas MD 80 horizontal stabilizer screw jack failure and the Boeing 737 rudder Power Control Unit (PCU) failures, are examples of system design deficiencies which only became apparent in-service. The National Transportation Safety Board published a report (reference 3.3.b) as a result of these accidents and the TWA 800 center wing tank explosion. One of the recommendations put forward was the establishment of a program for the monitoring and ongoing assessment of safety-critical systems throughout the life cycle of the aircraft.

4.4 The application of industry best practices or lessons learned is important during the design, manufacturing and maintenance phases. Specifically, the routing, clamping and chafing of hydraulic fluid or fuel lines have been an issue and, in some cases, have resulted in the loss of aircraft and crew. In 1994, Sea King CH12425 crashed, killing two crew members and seriously injuring two others. The crash was caused by the chafing of a main engine fuel line against a drain line, resulting in a fuel leak, which led to an on-board fire (FSIR available from DFS). In 1998, the fire on board Labrador CH11305 that resulted in the loss of the aircraft and killed six crew members was likely initiated as a result of chafing on the main fuel line of the #2 engine (FSIR available from DFS). In 2012, Hercules CC130342 experienced an on-board fire resulting in a Category A occurrence. This fire was due to routing and clamping deficiencies in a modification of the aircraft to install ground test connections to the auxiliary hydraulic system (FSIR available from DFS). Chafing between the hydraulic pump motor power wire and a pressurized hydraulic flexible hose caused electrical arcing between the wire and the hose resulting in a pin-hole breach of the flexible hose, release of hydraulic fluid under high pressure, and initiation of the fire.

4.5 Relatively new RCAF fleets are not immune either. Reference 3.3.c details two DND inspections of a CC130J and a CH147F, which revealed flammable fluids lines concerns. It is possible that the discovery of these problem areas prevented future accidents for these fleets.

4.6 Two examples of allied nations currently using aircraft mechanical systems integrity monitoring programs are the U.S. and the U.K. References 3.3.d and 3.3.e provide sources of information on how the U.S. and the U.K. address aircraft mechanical systems integrity monitoring, and are meant to be used for reference purposes only:

  1. The U.S. DoD MECSIP (reference 3.3.d) is a large-scale mechanical systems-specific integrity monitoring program established for each U.S. aircraft fleet. The U.S. MECSIP program approach is to create “an organized and disciplined engineering and management process to ensure the integrity (e.g., durability, safety, reliability, and supportability) of mechanical systems and equipment is achieved in development and maintained throughout the system’s operational service life.” MECSIP covers the entire aircraft lifecycle: design phase, in-service phase, fleet life extensions when required, and fleet retirement. More information on what systems the U.S. MECSIP classifies as safety-critical is provided in reference 3.3.d.
  2. The U.K. DSA has published a System Integrity Guidance Handbook (reference 3.3.e), which covers all aircraft systems that are not related to structures or propulsion. It is an example of how mechanical systems monitoring has been grouped into a higher-level aircraft monitoring concept.

4.7 The focus of Canada’s MSIP is on reducing the occurrence of mechanical system in-service difficulties through preventive maintenance and appropriate system health monitoring activities. Maintenance inspections are the primary means for detecting in-service degradation. The preventative maintenance schedule and associated inspection tasks contained therein are, as a result, critically important to maintain the level of safety established at initial certification. The preventative maintenance schedule and tasks are initially developed without the benefit of in-service experience; it may therefore be necessary to amend the preventative maintenance schedule and tasks as a result of operating experience. It is common to discover new failure modes and unanticipated degradation as a result of in-service experience throughout the life of the aircraft.

4.8 The MSIP measures of success are:

  1. Adoption of appropriate design standards for initial certification and in-service design changes for mechanical systems;
  2. Incorporation of best practices for aircraft preventative inspection programs; and
  3. Ability to identify, track, and remedy mechanical systems in-service difficulty trends.

5. Action/Method of Compliance

5.1 MSIP covers three phases of an aircraft fleet’s lifecycle:

  1. Initial Aircraft Procurement Phase
  2. In-Service Phase
  3. Estimated Life Expectancy (ELE) Extension Phase (if applicable)

 

5.2 Initial Aircraft Procurement Phase: When new DND aircraft fleets are procured, the fleet sustainment program must include an aircraft mechanical systems integrity monitoring program, either as a standalone program, or integrated within a larger aircraft systems monitoring program. The TAM (reference 3.2.a) Part 3, Chapter 4, Annex B, Para 2 identifies those systems which are considered Mechanical Systems, which is reproduced in sub-para a. below:

  1. TAM-identified Mechanical Systems:
    1. Fuel, including fuel tanks, pumps, lines, etc.;
    2. Hydraulic, including reservoirs, pumps, lines, etc.;
    3. Oxygen, including reservoirs, pumps, lines, regulators, etc.;
    4. Environmental control;
    5. Flight Controls, including pulleys, cables, rods, attachment points, etc.;
    6. Propellers and rotor blades;
    7. Pitot-static;
    8. Undercarriage/landing gear mechanism (non-structural aspect);
    9. Wheels, tires and brakes;
    10. Pneumatic (bleed air, anti or de-icing, pressurization, etc.);
    11. Fire protection, fire walls, detection/extinguishing, lines, etc.;
    12. Transmission/drive components;
    13. Aircraft interior, seats, ejection seats and restraints; and
    14. Aircraft stores suspension equipment (pylons, racks, launchers, non-releasable stores, etc.).
  2. The maintenance program developed for the new aircraft acquisition must be robust enough, in terms of aircraft mechanical systems. This includes the identification and tracking of the following:
    1. Safety-critical components and systems;
    2. Life-limited components;
    3. Appropriate overhaul requirements (based on approved System Safety Analysis techniques and standards);
    4. Appropriate inspection requirements for components and aircraft zonal areas; and
    5. Corrosion prevention and control programs.
  3. A Standard Zonal Analysis Procedure (SZAP), as per ATA MSG-3 (reference 3.3.f), is required to be carried out by DND personnel prior to first aircraft delivery to confirm proper installation of mechanical systems including routing and clearance of lines and fittings. Any request to waive this requirement must have prior approval by the TAA. The EWIS Integrity Monitoring Program (TAM (reference 3.2.a) Part 3, Chapter 4, Annex D, and TAA Advisory 2018-01 (reference 3.2.b)) includes the requirement for and Enhanced Zonal Analysis Procedure (EZAP), so concurrent inspection of mechanical systems and EWIS is highly recommended. References g and h provide further guidance regarding flammable fluid lines.

5.3 In-Service Phase: As per Para 3 of the TAM (reference 3.2.a), Part 3, Chapter 4, Annex B, a mechanical systems integrity program will be maintained during aircraft in-service life by the Type Certificate Holder (TCH) of each aircraft fleet. It is acknowledged that the maintenance program may be Weapon System Manager (WSM)-controlled or controlled by a member of the Weapon System Support Network (WSSN). It is also acknowledged that mechanical systems monitoring may be integrated within a larger-scope fleet monitoring program. Data collection methods are also flexible to the differing fleet sustainment (in-service support) constructs. In broad terms, the following items must be part of any fleet’s in-service MSIP:

  1. Maintain a component tracking monitoring program with the timely capability to determine in-service difficulty trends;
  2. Ensure the fleet maintenance program is updated to remedy unforeseen mechanical systems in-service difficulties. Such unforeseen in-service difficulties include the following:
    1. Unanticipated failures or new failure modes are discovered, especially where there is either no inspection task or the task is ineffective;
    2. Component or system failure rates are significantly higher than those assumed in the original aircraft system safety analysis;
    3. Unanticipated consequences of failures, such as cascade effects or secondary damage to other systems or structure, may result;
    4. Latent failures affect crew reaction, or lack thereof. The flight crew’s ability to cope with failures depends on correctly identifying that a failure has occurred. A lack of annunciation will increase the hazard severity for safety-critical functions; and
    5. Other unanticipated mechanical systems failures.
  3. Capability to search effectively for mechanical systems in-service difficulty trends in the fleet’s Maintenance Electronic Record Keeping Systems (ERKS);
  4. Creation and execution of Corrective Action Plans to improve aircraft safety and airworthiness related to aircraft mechanical systems; and
  5. When practical (such as during an on-aircraft second line periodic inspection), carry out a MSIP SZAP, as per paragraph 5.2.c of this advisory, if one was not completed when the fleet was acquired. The TCH should ensure that any modifications completed during the aircraft fleet’s in-service phase do not compromise the proper installation of any mechanical systems, including routing and clearance of lines and fittings, and interactions with electrical wiring.

5.4 Estimated Life Expectancy (ELE) Extension Phase (if applicable): In certain cases, a DND aircraft fleet needs to extend the fleet ELE beyond the original set service life when the aircraft fleet was acquired. In such cases, the Original Equipment Manufacturer (OEM) of the aircraft likely did not conduct engineering analysis on the aircraft systems and components beyond the original ELE. The following must be considered when planning an ELE extension to a DND aircraft fleet:

  1. Review of life-limits for safety-critical mechanical systems components that were previously not assigned a retirement or overhaul life. It can be assumed that when the OEM designed the aircraft, some safety-critical components not normally removed from the aircraft would not fail during the life of the aircraft, effectively assigning the planned aircraft operating life as the components’ life limit. However, with an ELE extension, the durability of all of these components must be re-evaluated in order to decide on one of the following options:
    1. The component’s life can be extended to the new ELE date;
    2. The component requires a maintenance inspection to be created and carried out to determine if the component’s life can be extended to the new ELE date;
    3. The component requires a new part replacement interval to be created and implemented; and
    4. The component needs to be repaired and/or overhauled in order to last to the new ELE.
  2. Ensure continuation of the in-service phase aircraft mechanical systems integrity monitoring program until the end of the new ELE;
  3. Review of components that may become obsolete or unsupportable before the new ELE is reached;
  4. Identify if a design change certification basis is required for the ELE and make appropriate findings of compliance; and
  5. Consult with other country users of the same aircraft fleet, if such countries have undergone a similar ELE extension or have been using the aircraft fleet longer than DND has.

5.5 WSM Organization MSIP Reporting Requirements: TCHs are to provide MSIP updates in their Technical Annual Airworthiness Report (AAR(Tech)), as per references 3.2.c and 3.3.j.

5.6 MSIP Compliance Timelines: All fleets will be required to comply with MSIP (in accordance with reference 3.2.a, Part 3, Chapter 4, Annex B), as per the details of the letter issued to fleet Senior Design Engineers by DTAES 4. 

Page details

Date modified: