AIRCRAFT OPERATORS MAINTENANCE DECISIONS SUPPORTING METHOD

A key element of exploitation processes constitutes maintenance operations and tasks. While being conducted in the proper way, they have a crucial effect on achieving the assumed by aircraft designer and operator goals. Properly conducted maintenance operations allow to meet all the technical objects readiness requirements as well as to achieve desired acceptable risk level. Maintenance system effectiveness might be generally a crucial task for company or entity responsible for the maintenance. In this context, particularly relevant become technical object maintenance procedures and tasks developed by their manufacturers. Experience of the article authors quite early shows the need of the maintenance programmes modification. Aircraft manufacturers usually are not so eager to develop and implement maintenance programme modifications. Presented situation is very much the case in aviation transport. This was the reason why authors of this article decided to prepare and develop this elaboration which might constitute the assistance and supports complex technical objects users in maintenance decision. The main purpose of this article is to present maintenance decisions’ supporting method for the aircraft operators. This article provides guidelines which include a description of risk in the context of aviation maintenance and introduction of some methodologies, tools and criteria that support identification, analysis and evaluation of risk. Authors included idea, how the aircraft preventive maintenance could be used to mitigate aircraft failure risk during flight operations. It also shows how to adopt and develop effective maintenance program using tools for adequate risk analysis, optimal interval assignments, and selection of the most effective maintenance task. Authors presented methodology and described steps of the logic diagram analysis for the aircraft systems and their components, in order to manage and adopt aircraft maintenance program to fulfil aircraft airworthiness requirements and operational availability. The whole methodology was described on the basis of the F 16 aircraft maintenance system and with reference to the maintenance data. This article might also constitute an introduction to the aircraft maintenance programme development method.


Introduction
The properties of the means of transport (including the aircraft that article concerns) are already developed at the design stage. The design runs in parallel with the analysis of RAMS (Reliability, Availability, Maintainability and Safety) and development of a maintenance strategy. As the design of the means of transport is built, changing the characteristics of the RAMS becomes more and more difficult. The operation phase however, is an important source of feedback for the manufacturer to verify the RAMS characteristics and introduce appropriate improvements.
A key element of exploitation processes constitutes maintenance operations and tasks, which being conducted in the proper way have a crucial effect on achieving the goals assumed by aircraft designers and operators. Properly conducted maintenance operations allow to meet all the technical objects' readiness requirements as well as to achieve desired acceptable/tolerable risk level. The importance of the maintenance role also results from the costs of realizing maintenance strategy and tasks. In airlines almost 9.5% of their operational costs are spent for maintenance (Lee and Mitici, 2020) but a similar occurrence is observed in other modes of transport. For example, in railways, the costs of preventive maintenance are up to 30.5% of the Life Cycle Costs of rail vehicles and are the second cost category after the costs of power or fuel (Szkoda, Satora, and Konieczek, 2020). Due to this fact, projects to improve the efficiency of the process of operation railway vehicles by changing the preventive maintenance, are amongst the core areas of the strategies pursued by rail transport companies. About seriousness of the maintenance role, as well as other aspects of its importance, it can be read among others in the works (Gill, 2017;Młynarski, Pilch, Smolnik, Szybka, and Wiązania, 2020). It could be pointed out that increase in maintenance system effectiveness can be generally a crucial task for company or entity responsible for the maintenance. As indicate Matusevych et al. (2018) it can be reached in three main interdependent directions (technical, economic, organizational) that demands to work in aspect of improvement of maintenance and repair strategy. However, it should be noted that in the case of maintenance strategy for objects (such as those that are the subject of this article), any decision must be conditioned by risk.
In this context, particularly relevant become technical object maintenance procedures and tasks developed by their manufacturers. Such procedures are usually prepared during object design phase and they mainly result from predicted and prognostic data. As an example, they may rely on the assumed environmental conditions of the object operations (if any of these conditions are taken under consideration). In result, technical object users and maintainers during its operations quite early notice the need of the maintenance programme modification. For example, authors Tsagkas et al. (2014) analyze twelve cases of deviations from prescribed procedures during scheduled/unscheduled maintenance checks, carried out by an aircraft maintenance organization in Greece. As indicated in work (Pogačnik, Duhovnik, and Tavčar, 2017), aircraft maintenance and repair organizations require the continuous improvement of processes and the elimination of non-value-added activities during maintenance. However, how the practical experience of the article authors shows, object manufacturers usually are not so eager to develop and implement maintenance programme modifications. Such modifications require quite an effort and result in heavy workloads and financial outlays (Samaranayake and Kiridena, 2012). In result, cost of these modifications, in many cases are covered by object operators. This might lead to the situation, when it is irrational to go on with object operations. Presented situation is very much the case in aviation transport. However, its formal confirmation is very difficult, as it is hardly documented. Contrary, the literature reports rather problems of pressure exerted on aircraft manufacturers by their customers (Ward, McDonald, Morrison, Gaynor, and Nugent, 2010). How to solve this problem is the responsibility of the operators of the mentioned means of transport. They have to face and try to find the solution of the two fundamental problems: − frequent maintenance procedures changes development, − rational changes selection, which are presented to the manufacturer and then implemented. This was the reason why authors of this article decided to prepare and develop this elaboration which constitutes the assistance and supports complex technical objects users in maintenance decision. The main goal of this article is to present maintenance Szrama, S., Gill, A., Archives of Transport, 59(3), 93-111, 2021 95 decisions supporting method for the aircraft operators. For the case study maintenance system of the most advanced Polish Air Force multirole aircraft: F-16C/D block 52+ was selected.

Literature review
Developed and proposed by authors method belongs to the group of methods called RBM (risk-based maintenance), where we utilize the approach based on the risk management principles. RBM methods are usually applicable for the transport systems. Malfunctions or improper operations of the system elements might generate hazards which result in serious losses such as loss of health or human lives, significant system damage, degradation of the natural environment. We may underline the particular relevance of these systems and their elements, which substantiates the RBM approach. We could have noticed development of the RBM methods in years 2000-2016 (Gill, 2017;Khan and Haddara, 2004), but also nowadays significant attention is being concentrated on this issue and its applicability. There have been tens of publications indexed in the worldwide databases for the last five years concerning problematic aspects of the RBM. For examples there were 31 articles in Web of Science, in the Scopus database we may find 102 publications (62 articles and 36 conference papers). All these publications are concerned with various economy branches and transport systems i.e.: − railway transport e.g.: (Kaewunruen,  Kaewunruen et al., 2021) − manufacturing systems e.g.: (Ratnayake and Antosz, 2017) − medical applications e.g.: (Vala, Chemweno, Pintelon, and Muchiri, 2018) Even though maintenance based on risk has already been confirmed and acknowledged, hardly you may find the applications of this in the air transport. Partially, in compliance with the RBM concept might be considered hazards analysis method, used in order to communicate about the risk while performing maintenance tasks. As an example, could be an article (Aust and Pons, 2019) dealing with the application of the Bow-tie method in identification of hazards and their sources and consequences during visual inspection in engine maintenance. This approach provides a better understanding of the risks in visual inspection during aircraft maintenance and a new understanding of the importance of certain controls in the workflow. However, this is not the maintenance programme planning based on risk. Similarly, indirect aspects of the RBM could also be found in the (Ayse, 2019) publication. It presents the concept of the application of the elements of the risk management in the maintenance process by optimization of the human performance while minimizing both failures and errors by aircraft maintenance technicians. Due to the fact that errors made by aircraft maintenance technicians will cause aircraft accidents or incidents or near miss incidents, we may conclude, that this is one of the steps in the risk management methodology (the so-called risk monitoring). Problematic aspects of the safety in aircraft maintenance were also presented by Shukri et al. (2016). Alike (Aust and Pons, 2019) they underline risk communication relevance in aircraft maintenance processes. In research paper "The potential risk of communication media in conveying critical information in the aircraft maintenance organization: a case study" authors stress the significance of the verbal and written communication in conveying critical information concerning aircraft safety and airworthiness. The communication media used to convey the critical information between departments at an aircraft maintenance organization have potential 96 Szrama, S., Gill, A., Archives of Transport, 59(3), [93][94][95][96][97][98][99][100][101][102][103][104][105][106][107][108][109][110][111]2021 risk in misunderstanding of the information. Although this aspect in not connected with RBM, it provides an inducement for our method to be relatively simple and comprehensible for people who apply it. Taking into consideration all capabilities (and benefits) of the risk-based maintenance application, which were mentioned above, we would like to point out the relevant research gap indicating the lack of these types of methods applicable for aviation transport.

Aircraft maintenance strategy
In accordance with Commission Regulation (EU) No 1321/2014 (2014) the aircraft owner is responsible for the continuing airworthiness of an aircraft and shall ensure that no flight takes place unless: 1. The aircraft is maintained in an airworthy condition, and; 2. Any operational and emergency equipment fitted is correctly installed and serviceable or clearly identified as unserviceable, and; 3. The airworthiness certificate remains valid, and; 4. The maintenance of aircraft is performed in accordance with the maintenance programme. There are some aircraft maintenance strategies used in aviation. Among them the most common is the failure management strategy known as Reliability-Centered Maintenance RCM, which consists of specific scheduled maintenance tasks selected on the basis of the actual reliability characteristics of the equipment, and they are performed at fixed, predetermined intervals. The objective of these tasks is to prevent deterioration of the inherent safety and reliability levels of the system. According to RCM methodology, maintenance activities may be assigned to four categories: ˗ Corrective maintenance; ˗ Preventive maintenance ˗ Modifications of the object: ˗ No maintenance activities The four basic forms of preventive maintenance offered by RCM (Naval Air Systems Command, 2005; SAE, 2002) include: 1. Scheduled on-condition inspection: a scheduled task used to detect a potential failure. 2. Scheduled restoration (or rework or hard time restoration):a scheduled task that restores the capability of an item at or before a specified interval (age limit), regardless of its condition at the time, to a level that provides a tolerable probability of survival to the end of another specified interval. 3. Scheduled discard (or hard time discard):a scheduled task that entails discarding an item at or before a specified age limit regardless of its condition at the time. 4. Scheduled failure-finding inspection: a scheduled task used to determine whether a specific hidden failure has occurred. The objective of a failure-finding inspection is to detect a functional failure that has already occurred, but is not evident to the operating crew during the performance of normal duties. In some cases, it may not be possible to find a single task which on its own is effective in reducing the risk of failure to a tolerably low or acceptable level. In these cases, it may be necessary to employ a "combination of tasks" such as "on-condition inspection" and "scheduled discard". If no task is found to be applicable and effective, default strategies are introduced, which include: ˗ no scheduled maintenance (no preventive maintenance, run to failure) ˗ redesign When it is technically unfeasible to perform an effective scheduled maintenance task, and when failure will not affect safety, the "no-scheduled-maintenance" or "run-to-failure" strategy will be accepted. Selection of the "no-scheduled-maintenance" option means that the risk level of the failure and its consequence is accepted. In cases where the failure has a safety effect and there is no effective scheduled maintenance task, "redesign" is mandatory. In fact, the decision depends on the seriousness of the consequences. Maintenance Steering Group-3 (Air Transport Association of America, 2007), on the other hand, considers the same failure management strategies as those used by RCM, but has made some modifications. For example, the term "on-condition inspection" has been changed to "inspection/functional check". This was due to the fact that some maintenance engineers believe that "on-condition" means don't do anything or neglect to do anything until a failure occurs. The above interpretation of "on-condition" maintenance may cause operational surprises which could not only prove very costly, but also jeopardize the safety of an aircraft and its occupants (Civil Aviation Safety Authority, 2001). To prevent such an interpretation, MSG 3 changed the term. For the same reason, the term "failure-finding inspection" has been changed to "operational/visual inspection". The types of maintenance strategies and activities recommended by ( Redesign (for safety effect) It is evident that no default strategy is considered and the "no-scheduled-maintenance" option is missing. Nevertheless, MSG-3 guides that "where failure has no safety effect and no form of an applicable and effective scheduled maintenance task(s) has been found, no scheduled maintenance is allowed to be selected (no task has been generated)". Figure 1 shows the chain of events from cause, via failure, to consequences in aircraft maintenance system, and includes an illustration of the role of preventive maintenance. The process of failure begins with an initiating event (hazard source), which affects the system, i.e., changes the status, availability and/or airworthiness of the aircraft. In this case it is the internal leak of the right-hand integrated servoactuator of the horizontal stabilizer. If the failure and its modes, cannot be managed at an early stage of their occurrence, they will lead to a number of undesired events and undesired consequences. The consequences comprise of the all events causing any type of loss. This might be any type of injury or loss of life, environmental disaster, high repair costs, aircraft loss, mission ground aborts etc. Maintenance barriers are used in order to prevent or mitigate the risk. Such a barrier is taken to reduce the probability/chance of the undesired events to happen, or to reduce their impact and consequences if they occur. Barriers in accordance with (Modarres, 2006) can be viewed as obstacles that perform the function of containing, removing, preventing, mitigating, controlling, or warning against hazards activations. A similar understanding of barriers is given e.g., by (Sklet, 2006) and concluded by (Gill, 2017) a few years later. Preventive maintenance (Figure 1) acts as a preventive barrier whose aim is to mitigate the consequences of failure or reduce the risk of hazard activation to a level which is acceptable to the user. In this case scenario the main goal of the preventive maintenance is to eliminate the failure completely, and, if this is impossible, to mitigate the probability/chance of the occurrence of failure and/or its consequences to an acceptable level. As shown in Figure 1, maintenance acts as a preventive barrier in order to preserve the main functions of the aircraft system. In the middle block maintenance acts also as a preventive barrier to preserve the function of a protective device, or to assure the availability of a protective function. In this scenario this could be for instance the end-of-runway inspection which is the inspection of the aircraft just before take-off and its main goal is to assure airworthiness of the aircraft and its systems. This inspection is also called "last chance", as it is the latest moment to prevent undesired event to happen in the air.

Hazard Analysis and risk of failures
Mathematical model of the risk value in most of the cases comprises several components, which values (levels) are being set in the process of risk analysis conducted in accordance with specified criteria. According to the typical risk modelsprovided for instance in (FAA, 2009; ICAO, 2018; Maklakovs, Tereščenko, and Šestakovs, 2019; Pamplona and Alves, 2020; Rios Insua, Alfaro, Gomez, Hernandez-Coronado, and Bernal, 2018; Sklet, 2006; Vincoli, 2014)their components usually belong to two groups. The first group expresses so called hazard activation/materialization, while the second components group expresses the losses concerned with hazard activation (Kadziński, 2013). Each individual risk model component might be presented and described using various formulas. We took advantage of the concept presented in the elaboration of (Modarres, 2006): The most important part of risk analysis is risk identification. Only those risks which have been identified can be managed in a systematic and conscious way. However, identification is not enough. There is also a need for action, using risk evaluation to take the appropriate operational and maintenance decisions regarding risk reduction and control, thus ensuring that the aircraft stays in a safe condition. Risk management is a systematic approach introduced to identify, analyze, and control areas or events with a potential for causing undesired event (Kadziński, 2013). Through risk management, the risks associated with aircraft item failures are assessed and systematically managed to mitigate them to an acceptable level. Risk management can further be described as the act or practice of controlling risk process which usually incorporates: risk analysis, risk evaluation and risk mitigation. Aircraft Preventive Maintenance Tasks can be seen as a reliability and risk management methodology which could be applicable and effective to the ability of those tasks to prevent or eliminate a failure, or at least reduce the probability of failure occurrence to an acceptable level, or reduce or mitigate the consequences of failure (the impact of failures).

Maintenance strategy selection
In accordance with the RCM strategy the only reason for performing any kind of maintenance is not to avoid failures, but to avoid, or at least to reduce, the consequences of failure (Rios Insua et  In what way does each failure matter (failure consequences)? 6. What can be done to prevent each failure (proactive tasks and tasks interval)? 7. What should be done if a suitable preventive task cannot be found (default actions)? The RCM analysis of the aircraft maintenance strategy may be performed as a sequence of activities or steps, including study preparation, system selection and identification, functional failure analysis, critical item selection (significant item selection), data collection and analysis, Failure Mode Effect and Criticality Analysis (FMECA), selection of maintenance actions, determination of maintenance intervals, preventive maintenance analysis, treatment of non-critical items, implementation and in-service data collection and updating (Rausand, 1998). In Figure 2 authors proposed decision-making diagram of the maintenance strategy comprising RCM methodology and risk mitigating analysis. This diagram could be used to logically develop Preventive Maintenance (PM) decisions and recommendations. It might also be used for developing the final maintenance intervals. This working logic accomplishes this by responding to the nature of the failure mode rather than classification of the item as Functionally or Structurally Significant Item (FSI) or (SSI). The failure mode analysis includes selection of the specific workcard tasks that address the failure mode. The selection establishes a cross reference between the failure mode and the workcard task that allows analysis of the current inspection requirements. Aircraft maintenance system complex analysis must be conducted thoroughly and for every aircraft system and its item. That is why it is convenient to use international standard code system, not to omit any of the aircraft systems. One of the most common and used for the both civilian and military aviation is the Air Transport Association of America (ATA) standard code. The logic flow starts with Aircraft System Selection in accordance with Air Transport Association of America standard code ( The next step is to determine the Work Unit Code (WUC) for the specific aircraft item. This code consists of alphabetic and numeric characters to identify the system, subsystem and component which was worked in Figure 3. The WUC determination procedure is the process implemented to assure that every aircraft system item and its failure modes will be considered. The Aircraft System Item Selection step means selection of the items for a system which have WUC.
Choosing the specific aircraft system item, we may determine the item's data which is the following step of the logic diagram. On the basis of the aircraft maintenance support system, we are able to get information about the item, like: class of the item (either SSI or FSI), function of the item The following step of the proposed procedure is to link the common data for an item, such as WUC, nomenclature, etc. to the specific data applicable to each of the item's failure modes. In this step we must determine all the failure modes for the selected item. Failure mode analysis for FSIs is the development of FMEA data for significant failure modes. For SSIs, it is the development of durability of flaw growth characteristics data for significant control points. A control point is treated as being synonymous to a failure mode. In this step we should determine what was the cause of the failure. We must also specify failure mode effects for the aircraft system/subsystem. Following the "Decision making diagram" from Figure 2 we encounter "Risk model Selection", "Risk assessment" and "Risk Evaluation" and finally Riskbased preventive maintenance requirement assessment".

Aircraft maintenance risk model
For the research purposes authors created their own risk model, in order to assess and evaluate risk measure. Proposed risk model could also be successfully adopted for the aircraft maintenance strategy verification and development. Such a risk model will be utilized to assess safety level of the aircraft maintenance system strategy on the basis of the logic diagram presented in Figure 2.
In this model risk of the aircraft system item failure mode activation could be calculated as presented in equation 2: where: Rmaircraft item failure risk of the m-type failure (m = 1, 2,…, l); FMRmfailure mode ratio for the m-type failure; Pprobability (frequency) of the scenario/adverse situation; Sjj-th value of severity of the consequences in the scenario/adverse situation. As a result, P could be calculated as follows: where N is the number of aircraft system items on the aircraft. For the whole aircraft fleet, the PTotal could be calculated as follows: where ACthe total number of aircraft in the whole fleet. Probability or frequency of the hazard risk activation meaning as an aircraft item failure could be classified in accordance with MIL-STD-882E System Safety and shown in Table 2.
In accordance with Safety Investigations and Reports AFI91-204 USAF (Department Of The Air Force -Headquarters Air Force Safety Center, 2020) one may classify mishaps and events by total direct mishap cost and the severity of injury/occupational illness. Classification consists of 5 categories A to E and for instance Class A mishap is an event resulting in one or more of the following: − direct mishap cost totaling $2,000,000 or more. − a fatality or permanent total disability. − destruction of an aircraft − permanent loss of primary mission capability of an aircraft. As a result, hazard activation severities could be classified in accordance with Table 3. Risk assessment criteria could be formulated in accordance with the information presented in Table 4. The next step in the formal risk assessment process is the risk evaluation. We propose to classify risks into three categories: acceptable, tolerable and unsafe. Criteria and descriptions to classify risks into the risk categories are presented in Table 5. Unsafe category in risk category (Table 5) describes the risks that being activated have their conse- 102 Szrama, S., Gill, A., Archives of Transport, 59(3), [93][94][95][96][97][98][99][100][101][102][103][104][105][106][107][108][109][110][111]2021 quences in safety of the aircraft operations. In aviation it is very common to use index describing "Loss rate per 100k Flight Hours" to determine the required safety acceptable, tolerable and unacceptable level. This is the goal the safety management personnel want to reach. Unsafe category could also be determined as a number of Class A mishaps per 100k FH or Unit of Time.

SEVERITY CATEGORIES Description Value Hazard Activation Consequences Criteria
Catastrophic 10000 Could result in one or more of the following: death, permanent total disability, irreversible significant environmental impact, or monetary loss equal to or exceeding $10M.
Critical 500 Could result in one or more of the following: permanent partial disability, injuries or occupational illness that may result in hospitalization of at least three personnel, reversible significant environmental impact, or monetary loss equal to or exceeding $1M but less than $10M.

Marginal 20
Could result in one or more of the following: injury or occupational illness resulting in one or more lost work day(s), reversible moderate environmental impact, or monetary loss equal to or exceeding $100K but less than $1M.
Negligible 10 Could result in one or more of the following: injury or occupational illness not resulting in a lost work day, minimal environmental impact, or monetary loss less than $100K. ▪ Can lead directly to a marginal or negligible mishap, or ▪ Places the system in a condition where only one independent functioning interlock, barrier or human action remains to prevent, preclude the potential occurrence of a catastrophic or critical hazard.

ME-DIUM
1.0E-08 ≤ R < 1.0E-07 ▪ Influences a marginal or negligible mishap, reducing the system to a single point of failure, or ▪ Places the system in a condition where two independent functioning interlocks, barriers or human actions remain to prevent, preclude the potential occurrence of a catastrophic or critical hazard.
LOW R < 1.0E-08 ▪ Influences a catastrophic or critical mishap, but where three independent functioning interlocks or human actions remain, or ▪ Would be a causal factor for a marginal or negligible mishap, but two independent functioning interlocks or human actions remain. ▪ A software degradation of a safety critical function that is not categorized as high, serious, or medium safety risk. ▪ A requirement that, if implemented, would negatively impact safety; however, code is implemented safely.

Risk mitigation idea
The next steps "Task Data" and "Workcard Inspection and Servicing Tasks" are related to the specific failure mode of the aircraft selected item. It depends on the failure modes and their effects and consequences. If the risk is acceptable, we may decide that the preventive maintenance is unnecessary and "no maintenance action" is required. If the safety criteria set by the organization are not complied with, it is recommended to implement preventive maintenance. This could be based on the "on condition" or "condition monitoring" type of maintenance. If such a type of maintenance is selected there is no time limit for the specific item. Airworthiness of the considered system is based on the results of the preventive maintenance. This could be either operational checkout, visual inspection or non-destructive testing (NDT). Preventive maintenance may also be the combination of the actions. For instance, as a part of departing procedure pilots are required to perform so called "Build-in Test" of the flight control system. In case of the operational anomalies of the system, digital flight control computer signalizes the crew about them as a "Flight Controls Caution Light" and FLCS fault code displayed on the Multifunctional Displays MFDs. For the failure modes which could not be detected on the basis of the operational checkouts usually the NDT or visual inspection is required. Such inspection is implemented into the maintenance program as a part of the either preflight, thruflight or end-of-runway inspections. There is a requirement for the crew chief performing previously mentioned inspection to visually inspect the condition of the aircraft system item.
There might be the question raised: "What if the implemented maintenance actions and tasks will not work as a risk mitigating barrier and do not mitigate the risk activations?" In this case scenario we may have to change the maintenance strategy of the selected aircraft system item, and implement "scheduled discard (or hard time discard)" strategy. It means that instead of "on-condition or condition monitoring", the "time change" strategy will be used.
As a result, the aircraft item will be treated as a TCI, with predetermined replacement interval. This solution would allow to mitigate risk activation by performing "remove and replace" procedure set at the time intervals allowing to mitigate risk of failure of the aircraft system item. Properly selected maintenance actions and tasks implemented into the maintenance program work as a risk mitigating barrier (Figure 1). . As a result, the flight controls system was selected which corresponds with ATA 27 Code. The next step is to find the Work Unit Code for the selected system. In our case WUC which is assigned to FLCS in accordance with PL16-16CJ-06 (Lockheed Martin Corporation, 2018) is 14000. The next step is to determine the Work Unit Code (WUC) for the specific aircraft item. For the research purposes the Integrated Actuator, Horizontal Tails was selected which is described by 14BB0 WUC. For the next step, being the System Item Data, we may determine: − Class of the item -ISA is the Functionally Significant Item FSI, − Function of the item in the system -for ISA, classified as FSI, its function is to: transfer hydraulic directional control to horizontal stabilizer assemblies as directed by the flight control computer, − Mean Flight Time Between Failures (MFTBF) -let us assume its MFTBF is 1500FH, − Maintenance Data Summary (total maintenance actions on the item -for instance 170, Flight Hours between maintenancefor instance 600FH), Horizontal ISA is not a Time Change Item (TCI), etc. In the following step of the logic diagram, we must determine all the failure modes for the selected item. Failure mode analysis (PN-EN IEC 60812:2018-12, 2018) for the Horizontal ISA being the FSI item is the development of FMEA data for significant failure modes.

Verification of the presented methodology
Archives of Transport, 59(3), [93][94][95][96][97][98][99][100][101][102][103][104][105][106][107][108][109][110][111]2021 In this step we should determine what was the cause of the failure, for instance: hydraulic cylinder or seal rupture. We must also specify failure mode effects for the aircraft system/subsystem. In our scenario it could be: degraded hydraulic pressure available for control of affected horizontal stabilizer, and potential 50% loss of hydraulic supply pressure for horizontal tail movement. As a result, we may expect potential loss of hydraulic system B resulting in a 50% reduction in primary flight controls and loss of power to gun, landing gear, in-flight refuel and brakes i.e., most of the systems using hydraulic power from system B. As a consequence, aircraft mission must be aborted. Failure should be evident to the crew as a "HYD PRESS" warning light meaning Hydraulic Pressure Indicator for System B. The first step in formal risk assessment is identification of the set of failure modes that may affect normal flight operation. In Table 6 FMEA analysis for the Horizontal ISA is presented, comprising failure modes, their causes and consequences for the aircraft crew and system itself. The following step in the presented in Figure 2 logic diagram is the "Risk model selection". Authors of this article presented their own Risk Model in section 4. In order to calculate Rm, we must determine, on the basis of the maintenance support system, FMRm. This could be calculated on the basis of the equation 3. Let us assume that the total number of failures of the horizontal ISA was 170. The number of each failure mode were as following: FM1 -7, FM2 -6, FM3 -15, FM4 -55, FM5 -56, FM6 -31. FMRm for each failure mode were presented in Table 7. Assuming that MFTBF for the selected horizontal ISA was 1500 FH, and knowing that there are 2 of the ISAs on the aircraft, P could be calculated in accordance with equation 6 and resulted as 1,3E-03. Looking at the table 2, Probability (Frequency) Levels, we may determine that the probability of failure of the horizontal ISAs for one aircraft is "Likely to occur sometime in life cycle of an aircraft" and described as "Occasional". But if we have the fleet of 100 aircraft, the probability results as 1,3E-01, what means that the probability is "Likely to occur often in the life cycle of an aircraft", described as "Frequent" and "Continuously experienced for the whole aircraft fleet". As far as the severity is concerned, it is being different for each failure mode and this could be determined on the basis of the information provided in Tables 3 and 6: FMEA analysis for the aircraft horizontal ISA, and Severity Categories. In Table 8 there were presented results of the FMR, P, Sj, Rm and RTotal calculations in accordance with equations 3, 4, 6 and 7. The following step of the risk analysis is the risk evaluation. In our case scenario the total risk of the horizontal ISA failure, concerning all failure modes, was calculated and equal 4,5. Evaluating the category of risk we compare the value of the calculated total risk in relation to the 100k Flight Hours. In this case our risk could be presented as a 4.5E-05. Let us assume that the "unsafe" category of risk set by our organization was the R<1.0E-05. It means that our risk level is HIGH and risk category is unacceptable meaning UNSAFE. As a result of the risk assessment and risk evaluation processes we found out that the risk of failure of the horizontal ISA for our aircraft fleet is unacceptable, and following the next step of the logic diagram from Figure 2, being the "Risk-based preventive maintenance requirement assessment" we may conclude that the preventive maintenance for the selected aircraft item is absolutely necessary, to mitigate the risk of failure. If the answer to the question "Is preventive maintenance required" is "Yes", we should follow to the next step "Task Data". This is the step where we must implement some maintenance actions into the maintenance strategy to mitigate the risk of aircraft system item failure. General idea of the risk mitigation idea in the aircraft maintenance program was presented in subchapter "Risk mitigation idea". This is the process of analyzing possible maintenance options we may implement into the maintenance program. At this step we should link recommended task of maintenance to either workcard inspection or servicing task (Figure 2). This will allow for linking of the maintenance program requirement inspections with the failure mode under analysis. In our case scenario it is the Technical Order (TO) Scheduled Inspection and Maintenance Requirements PL1F-16CJ-6 (Lockheed Martin Corporation, 2020). This document contains complete requirements for accomplishing scheduled maintenance on this aircraft during its entire service life. As a result of the analysis, we decided to implement some additional tasks for the crew chief to inspect the condition of the ISA like: "Check/Inspect Horizontal Stabilizer Servoactuator drain holes for fluid leakage" while performing prefight, thruflight, postflight and end-of-runway inspection. In order to mitigate the risk level of the failure of the item we may also specify a requirement for the inspection during the nearest aircraft major inspection meant as "Phased Inspection", "Programmed Depot Maintenance (PDM)", "Periodic Maintenance" or "Major Isochronal Inspection". In considered case scenario this could be the visual inspection during Phased Inspection. The complete workcard inspection might be like this: 106 Szrama, S., Gill, A., Archives of Transport, 59(3), [93][94][95][96][97][98][99][100][101][102][103][104][105][106][107][108][109][110][111]2021 "Inspect left and right horizontal stabilizer integrated servoactuators for: A. Wear washers worn more than approximately half of original thickness, gouged, or deformed. If worn or damaged reference to specific T.O. B. Integrated servoactuators, fittings, and mountings for cracks, cleanliness, leakage, and security; electrical connectors for security, chafing, and discoloration." These actions implemented into the maintenance program will not affect the probability (frequency) of the ISA failure. This would require the redesign of the horizontal ISA or its components. These actions will have a positive effect on the severity of the ISA failure. In Table 9 were presented results of the implemented maintenance actions on the total risk of the aircraft system item. In relation to the 100k FH the total risk results as 2.8E-06. Comparing our result to the risk level criteria presented in table 4, we find that our risk is classified as "Serious", and the category of the risk is "Tolerable".

Conclusions
The main goal of this article is to present maintenance decisions supporting method on the example of Polish Air Force multirole aircraft: F -16C / D block 52+.
Maintenance system effectiveness might be generally a crucial task for company or entity responsible for the maintenance. In this context, particularly relevant become technical object maintenance procedures and tasks developed by their manufacturers. Experience of the article authors quite early shows the need of the maintenance programmes modification, but the aircraft manufacturers usually are not so eager to develop and implement maintenance programme modifications. Such modifications require quite an effort and result in heavy workloads and financial outlays. In result, cost of these modifications, in many cases are covered by object operators. This might lead to the situation, when it is irrational to go on with object operations.
Presented situation is very much the case in aviation transport. This was the reason why authors of this article decided to prepare and develop this elaboration which might constitute the assistance and supports complex technical objects users in maintenance decision. Developed and proposed method belongs to the group of methods called RBM (risk-based maintenance). Even though maintenance based on risk has already been confirmed and acknowledged, hardly you may find the applications of this in the air transport. Partially, in compliance with the RBM concept might be considered hazards analysis method, used in order to communicate about the risk while performing maintenance tasks. Additionally, we have indicated a few examples of methods that can indirectly qualify as RBM in air transport. Taking into consideration all capabilities (and benefits) of the risk-based maintenance application, which were mentioned above, we would like to point out the relevant research gap indicating the lack of these types of methods applicable for aviation transport. This article provides guidelines which include a description of risk in the context of aviation maintenance and introduction of some methodologies, tools and criteria that support identification, analysis and evaluation of risk. Authors included idea, how the aircraft preventive maintenance could be used to mitigate aircraft failure risk during flight operations. It also shows how to adopt and develop effective maintenance program using tools for adequate risk analysis, optimal interval assignments, and selection of the most effective maintenance task. Authors presented methodology and described steps of the logic diagram analysis for the aircraft systems and their components, in order to manage and adopt aircraft maintenance program to fulfill aircraft airworthiness requirements and operational availability. The original contribution of this work is the developed risk model (including criteria and descriptions to classify risks), in order to assess and evaluate risk measure. It seems likely that the proposed risk model could also be successfully adopted for the aircraft maintenance strategy verification and development. The analytical considerations presented in the work are theoretical, which is emphasized in the assumptions in chapter 5 -Verification of the presented methodology. All the most important input data for the verification of the proposed model, such as: MFTBF, Maintenance Data Summary, the total number of failures are estimated data (assumed by the authors). Unfortunately, in most of the cases aircraft and its components' reliability data such as MTBF, etc is regarded as protected data, and usually neither operators nor manufacturers are eager to share such data. Situation becomes even more difficult as far as the military aircraft are concerned. In this case, such information is treated as either sensitive of even restricted. We took into consideration our assumption that the proposed method must be practical, and feasible. In order to meet this demand, the operator should take advantage of the flight data he might be able to get access to. In most of the cases this would be the parameter he should be able to acquire. Such extremely detailed information considering each scenario of an adverse event is probably beyond reach.
We have decided to analyze only independent failures due to the fact that from the proposed method point of view it is irrelevant what are the corresponding or dependant failures. What is the most relevant, it is the source of the failure (the initial failure) and the results (severity), consequences of the failure, taking into consideration the worst-case scenario. As a result of the presented methodology and its verification presented in chapter 5, we found out that proposed methodology works as assumed. We were able to confirm our assumptions and calculations. Even though we decided to change the aircraft maintenance strategy and maintenance program, our risk activation was classified as tolerable. It means that we should implement risk communication and risk monitoring methods. This will allow to continue aircraft operations with the awareness that we should monitor the risk activations level.
One of the weaknesses of proposed method is the high sensitivity of the model and the significant influence of subjective parameters on the final results. By changing the Severity parameter for one of the Failure Mode, the risk category can change from Unacceptable to Tolerable, without changing Probability of the failure. Future works on this topic is the development of a specific maintenance program using the developed method.