Atch 4c) JALC_AVIATION_CSI_MGMT_HDBK_16MAR2011.pdf

Aviation Critical Safety Item

Management Handbook

16 March 2011

THIS PAGE INTENIONALLY LEFT BLANK

NAVAIR Public Release 11-515 Distribution Statement A – Approved for public release; distribution is unlimited

Downloaded from http://www.everyspec.com

CHANGE RECORD

Change Number Section Page Description Date

TABLE OF CONTENTS

CHAPTER 1 GENERAL INFORMATION ................................................ 1-1

1.1. Policy Basis for CSI ..........................................................................1-1

1.2. Purpose ...........................................................................................1-3

1.3. Scope ..............................................................................................1-3

1.4. Organization of the Handbook ..........................................................1-4

1.5. Terminology ....................................................................................1-4

1.6. Feedback.........................................................................................1-6

CHAPTER 2 CSI DETERMINATION AND IDENTIFICATION ................ 2-1

2.1. CSI Determination Responsibilities ....................................................2-1

2.2. CSI Determination Timing and Triggers .............................................2-2

2.3. CSI Applicability ...............................................................................2-2

2.3.1. Types of Items .........................................................................2-2

2.3.2. Level of Criticality Determinations ..............................................2-3

2.3.3. Types of Equipment Impacted by CSI Determinations .................2-4

2.4. CSI Determination Criteria ................................................................2-5

2.5. CSI Determination Considerations .....................................................2-6

2.5.1. Failure Modes, Effects, and Criticality .........................................2-6

2.5.2. Failure Compensating Design Features .......................................2-7

2.5.3. Dependent Failures ...................................................................2-8

2.5.4. Latent/Hidden Failures ..............................................................2-8

2.5.5. Potential for Foreign Object Damage (FOD) and Things Falling Off

Aircraft (TFOA) ........................................................................2-9

2.5.6. Prime Contractor/OEM CSI Determinations ............................... 2-10

2.6. Criticality Determinations for Standard Parts, Common Use Items, FAA Certificated Systems, and COTS ..................................................... 2-10

2.6.1. Criticality Determinations for Standard Parts ............................. 2-11

2.6.2. Common Use Item Coordination .............................................. 2-12

2.6.3. FAA Certificated Platforms/Subsystems/Equipment.................... 2-14

2.6.3.1. Background ....................................................................... 2-14

2.6.3.2. Types of FAA Certifications ................................................. 2-14

2.6.3.3. Applicability of CSI Policies to FAA Certificated Aircraft and

Equipment ........................................................................ 2-15

2.6.3.4. New Aircraft Procurement and Repair, Overhaul .................. 2-16

2.6.3.5. Example of FAA-Certificated Engine/Non-Certificated Rotorcraft

........................................................................................ 2-18

2.6.4. Commercial Products .............................................................. 2-18

2.7. DCMA Role in Criticality Determinations ........................................... 2-18

2.8. Documenting Criticality Determinations ........................................... 2-19

2.8.1. Criticality Codes ...................................................................... 2-19

2.8.2. Acquisition Method Code (AMC)/Acquisition Method Suffix Code

............................................................................................. 2-19

2.8.3. Cross-Service and Service-Specific CSI Lists .............................. 2-20

2.8.3.1. Cross Service CSI List ........................................................ 2-20

2.8.3.2. Service-Specific CSI Lists.................................................... 2-20

2.9. CSI Identification ........................................................................... 2-21

2.9.1. Serialization and Marking ......................................................... 2-21

2.9.2. Drawings and Technical Data................................................... 2-22

2.9.3. Critical Characteristics ............................................................ 2-23

CHAPTER 3 SOURCING ...................................................................... 3-1

CHAPTER 4 QUALITY MANAGEMENT ................................................. 4-1

4.1. Quality Management in Solicitations and Contracts .............................4-1

4.2. Frozen Planning ...............................................................................4-2

4.3. Configuration Management ...............................................................4-2

4.3.1. Engineering Change Proposals (ECP) ..........................................4-3

4.3.2. Common Use Items, including Standard Parts .............................4-4

4.4. Inspection of Critical Characteristics ..................................................4-4

4.4.1. Conflicting Critical Characteristics ...............................................4-5

4.4.2. Nonconforming Material ............................................................4-5

4.5. CSIs from Unapproved Sources .........................................................4-7

4.6. Installation of CSIs ...........................................................................4-7

4.7. Prime Contractor/OEM CSI Processes ................................................4-8

4.8. Government Contract Quality Assurance ............................................4-9

4.8.1. GCQA for Prime Contractor/OEM Manufacturers ........................ 4-10

4.8.1.1. GCQA for In-Service CSIs Manufactured by a Prime

Contractor/OEM ................................................................ 4-10

4.8.1.2. GCQA for New CSIs Manufactured by a Prime Contractor/OEM ..

........................................................................................ 4-11

4.8.2. GCQA for Alternate Sources ..................................................... 4-12

4.8.3. GCQA for CSIs Obtained from Surplus Sources and Distributors

............................................................................................. 4-12

4.9. CSI Testing ................................................................................... 4-12

4.9.1. First Article Test ...................................................................... 4-12

4.9.2. Production Lot Test ................................................................. 4-13

4.9.3 Product Verification Test .......................................................... 4-14

4.10. Product Quality Deficiency Report ................................................. 4-14

4.10.1. When to Submit a CSI PQDR ................................................. 4-14

4.10.2. PQDRs for Common Use CSIs ................................................ 4-15

4.11. Quality Assurance Considerations for CSI Reverse Engineering ....... 4-15

CHAPTER 5 DISPOSAL ....................................................................... 5-1

5.1. Mutilation of CSIs ............................................................................5-1

5.2. Contract Disposal Clause ..................................................................5-1

5.3. One Time Manufacturing Authority ....................................................5-2

CHAPTER 6 MANAGEMENT AND OVERSIGHT .................................... 6-1

6.1. Source Reciprocity and Coordinated MRB Delegation ..........................6-1

6.2. CSI List Accessibility .........................................................................6-1

6.3. Requests for Engineering Support .....................................................6-2

6.4. Acquisition Program Technical Reviews and Assessments ...................6-3

6.5. CSI Training ....................................................................................6-3

CHAPTER 7 CSI CONTRACT PROVISIONS.......................................... 7-1

7.1. CSI Procurement Restrictions............................................................7-1

7.2. Contract Criticality Identifier .............................................................7-1

7.3. Testing Requirements ......................................................................7-2

7.4. Quality Management Requirements ...................................................7-3

7.4.1. Quality Sys ...............................................................................7-3

7.4.2. Quality Assurance Provisions (QAPs) ..........................................7-3

7.4.3. Calibration ................................................................................7-4

7.4.4. Audits ......................................................................................7-4

7.4.5. Warranty ..................................................................................7-4

7.5. Engineering/Technical Requirements .................................................7-4

7.5.1. Configuration Management ........................................................7-4

7.5.2. Technical Data Requirements ....................................................7-5

7.5.3. Frozen Planning Requirements ...................................................7-5

7.5.4. Serialization and Marking ...........................................................7-6

7.5.5. Level of Inspection ....................................................................7-7

7.5.6. Control of Nonconforming Material .............................................7-7

7.5.7. Disposal of Nonconforming Material ...........................................7-8

7.5.8. Notification of Delivered Nonconforming CSIs .............................7-8

7.5.9. Sourcing and Procurement ........................................................7-8

7.5.10. Records Retention ...................................................................7-8

7.6. Supplier Notifications .......................................................................7-9

7.6.1. Relocation of Manufacturing/Repair Facilities ..............................7-9

7.6.2. Subcontractor Removal .............................................................7-9

7.6.3. Business Status Change .......................................................... 7-10

7.7. Government Contract Quality Assurance .......................................... 7-10

7.7.1. Government Inspection at Source ............................................ 7-10

7.7.2. Product Assurance Specialist (PAS) Guidance ............................ 7-11

7.8. Other Contracting Methods ............................................................. 7-11

7.8.1. Procurement of Surplus Materials ............................................. 7-11

7.8.2. Performance Based Logistics (PBL) .......................................... 7-12

7.8.3. Licensing Agreements ............................................................. 7-12

7.8.4. Commercial Acquisition ........................................................... 7-12

7.8.5. Distributors............................................................................. 7-13

TABLE OF APPENDICES

Appendix I Multi-Service/Defense Agency ...................................................... I-1 Appendix II Acronyms ................................................................................. II-1 Appendix III FAQ about Aviation CSIs ......................................................... III-1

TABLE OF EXHIBITS

Exhibit A Common Use Item Coordination .................................................... A-1 Exhibit B CSI Websites ................................................................................ B-1 Exhibit C Critical Characteristics ................................................................... C-1 Exhibit D Examples of CSI Contract Requirements/Clauses ............................ D-1 Exhibit E Checklist for Companies Relocating Manufacturing Facilities ............. E-1 Exhibit F Example of CSI Quality Assurance ................................................... F-1 Exhibit G Example Surplus Procurements Clauses .......................................... G-1 Exhibit H Commercial Contract Clause .......................................................... H-1

1-1

CHAPTER 1

GENERAL INFORMATION

Aviation Critical Safety Items (CSIs) are defined by Public Law 108-136, Section 802, and Defense Federal Acquisition Regulation Supplement (DFARS) 209.270 as “a part, an assembly, installation equipment, launch equipment, recovery equipment, or support equipment for an aircraft or aviation weapon system if the part, assembly, or equipment contains a characteristic any failure, malfunction, or absence of which could cause—

1) a catastrophic or critical failure resulting in the loss of or serious damage to the aircraft or weapon system;

2) an unacceptable risk of personal injury or loss of life; or

3) an uncommanded engine shutdown that jeopardizes safety.”

Several factors contributed to the establishment of CSI as a distinct category of supply items. The Department of Defense (DoD) has repeatedly received defective, suspect, improperly documented, unapproved, and fraudulent replenishment parts used in safety-critical applications. DoD and the defense industry recognized that unless processes were established and rigorously followed the potential for these parts to contribute to aviation mishaps and hazards was unacceptable.

In response, DoD acquisition organizations, program offices, functional specialties, supply centers, contract management offices, and contractors established and applied their own approaches for managing critical items.

Although they all had the same intent (i.e., to ensure the quality of safety-critical parts), the proliferation of terms, policies, and procedures created unacceptable risks caused by gaps in policies and confusion about which policies applied in a given situation. Consequently, the term ‘Aviation CSI’, the Public Law, and implementing policies and processes described in this Handbook were established to standardize terminology, definitions, criteria, and management procedures across the military Services and defense agencies.

1.1. Policy Basis for CSI

The military Services’ CSI policies, processes, and common terminology are founded in Public Law 108-136, Section 802, and DFARS 209.270. In addition to establishing the term ‘Critical Safety Item’ (defined above), they also define

1-2

‘Design Control Activity’ (DCA) with respect to an aviation critical safety item as “the systems command of a military department that is specifically responsible for ensuring the airworthiness of an aviation system or equipment in which the item is to be used.” (In this Handbook the term ‘Engineering Support Activity’ (ESA) is synonymous with the term DCA.) Most importantly, however, these policies establish that:

1) the head of the DCA is responsible for identifying CSIs and managing the procurement, modification, repair, and overhaul of aviation CSIs;

2) the head of contracting activities for aviation CSIs may enter into contract for procurement modification, repair, or overhaul only with sources approved by the DCA; and

3) CSIs delivered and services performed on CSIs meet all technical and quality requirements specified by the DCA.

Public Law 108-136, Section 802, directs Section 2319 of title 10, United States Code (USC) to be amended to reflect the aviation CSI requirements passed by the law. Approximately three years after the aviation CSI law passed, another law (Public Law 109-364) was passed to expand CSI coverage to include ‘ship critical safety items’. These provisions also direct amendment of Section 2319 of title 10, USC to reflect ship CSI requirements. Upon revision, Section 2319 of title 10, USC will then address both aviation and ship CSI requirements.

However, this Handbook will only address aviation CSI guidance.

To implement the aviation CSI Public Law, the military Services and defense agencies worked together to develop an instruction under the auspices of the former Joint Aeronautical Logistics Commanders (JALC). The JALC organization included the highest levels of leadership from each Service’s aviation acquisition community and representatives from Defense Logistics Agency (DLA), Defense Contract Management Agency (DCMA), Federal Aviation Administration (FAA), National Aeronautics and Space Administration, and Department of Homeland Security. The CSI Instruction was issued by all Services and defense agencies under their respective regulation structures. Specifically, it was issued as SECNAVINST 4140.2, AFI 20-106, DA Pam 95-9, DLAI 3200.4, and DCMA INST CSI (AV) and is included in its entirety as Appendix I of this Handbook. The instruction is entitled “Management of Aviation Critical Safety Items”, and is hereafter referred to as the Multi-Service/Defense Agency CSI Instruction or Appendix I. To supplement the instruction and provide implementing guidance, the JALC also sponsored the development of this Handbook.

On 11 March 2010, the JALC reorganized into the Joint Aeronautical Commanders Group (JACG). The JACG includes the same senior membership as the former JALC, and sponsorship of this Handbook continues.

1-3

Policies and guidance are continually under review and revision. The user is strongly advised to ensure the Multi-Service/Defense Agency CSI Instruction (Appendix I) and this Handbook are the most current versions issued. Contact the appropriate Service/Defense Agency CSI Point of Contact (POC) if there is any uncertainty. A list of CSI POCs is provided in Section 1.6.

This Handbook provides implementing guidance for the Multi-Service/Defense Agency CSI Instruction (included as Appendix I) to the degree that such guidance is common across the Services and defense agencies. Often, Service/defense agency-specific policies or guidance differ across agencies or may provide additional information to supplement the guidance provided here.

The existence of such policies is noted in the text, where applicable. The user is again strongly advised to contact the appropriate Service/defense agency CSI POC to identify and access these policies.

1.2. Purpose

This Handbook is a guide for Government engineers, logisticians, contracting officers, quality assurance specialists, and other supply chain management personnel involved in the life cycle acquisition and management of aviation CSIs.

It provides amplifying information and examples to help explain CSI policies and translate the Multi-Service/Defense Agency CSI Instruction into Government procedures and recommended contract requirements. This guide does not provide step-by-step implementing procedures. For detailed procedures, see Service/defense agency-specific guidance.

This guide applies to DoD aviation entities and is not intended as direction to prime/Original Equipment Manufacturer (OEM) Contractors or alternate suppliers.

Prime/OEMs and alternate suppliers should refer to CSI provisions specified in their respective contracts and contact their Administrative Contracting Officer (ACO) or Procurement Contracting Officer (PCO) to resolve any ambiguities, conflicts, or concerns.

1.3. Scope

This document applies to aviation CSIs used in fixed and rotary wing aircraft, unmanned air vehicles, Aircraft Launch and Recovery Equipment (ALRE), aviation weapons and equipment, and associated aviation support equipment. CSIs are found on many different types of equipment in the aviation environment. These will be described and discussed in Chapter 2, Criticality Determinations and Identification. Also refer to Service-specific implementing policies and guidance

1-4 to specifically define the types of systems and equipment that should be addressed.

Additionally, this Handbook applies to Foreign Military Sales (FMS) aircraft when they are still in active use in the DoD inventory or if the U.S. military is providing engineering expertise via an FMS case.

However, this Handbook does not apply to aircraft, subsystems, or equipment certified, operated, or maintained in accordance with FAA regulation, unless required by the cognizant ESA. The Handbook does apply to those portions of commercial aircraft or subsystems which have been modified or maintained to meet unique military requirements. Additional guidance regarding CSI policies as they apply to commercial aircraft or subsystems is provided in Sections 2.6.3 and 2.6.4.

1.4. Organization of the Handbook

This document is structured to supplement the policies and procedures of the Multi-Service/Defense Agency CSI Instruction. It is organized into chapters that parallel the Instruction’s Section E, Procedures.

Chapter 3 formerly addressed the topic of Sourcing for CSIs. However, the issues to be addressed became so expansive that separate JACG Source Approval and Management Handbooks were developed. A link to the current version of the JACG Source Approval and Management Handbook is included in Chapter 3.

Several appendices are included to maximize the utility of the Handbook. The Multi-Service/Agency Instruction is incorporated in its entirety as Appendix I, a list of acronyms is found in Appendix II, and Appendix III provides explanation of CSI Management key points and issues presented in the form of Frequently Asked Questions (FAQ). Appendix III, FAQ, is strongly recommended as a resource for concise explanations of CSI policies and procedures.

Additionally, a set of Exhibits provide the user with job aids such as checklists, reference lists, forms, examples of recommended contract language, etc.

1.5. Terminology

Throughout the Handbook, the acronym CSI refers to aviation CSIs, exclusively.

1-5

Public Law 108-136 and DFARS 209.270 use the term ‘Design Control Activity (DCA)’, defined in Section 1.1, above. However, the Multi-Service/Defense Agency CSI Instruction and this Handbook use the term ‘Engineering Support Activity’ (ESA) as synonymous with the term DCA.

Note that paragraph E.1.b. of the Multi-Service/Defense Agency CSI Instruction provides a summary of the Public Law and DFARS definition of the term ‘CSI’ and, alternatively, Enclosure (1), Definitions, of the Instruction amplifies the definition established in the Public Law to provide specific criteria. The CSI definition issued by the Public Law takes precedence over all others.

The term ‘common use item’ is used in this Handbook to refer to an item used in multiple platforms (e.g., the same part used in an F-15 and an F-18, the same item used in an H-53 and an H-60. etc.), across Services (e.g., Army; Navy; and Air Force H-60s: Air Force and Marine Corps C-130s, etc), or both.

Criticality determinations and other actions taken on aviation CSIs used by more than one Service must be coordinated with all using Services as contingencies arise. Procedures for this coordination process are outlined in Section 2.6.2 of this Handbook. A common use item may be a standard part or one that is unique to an aviation system or military Service.

The term ‘standard part’ refers to a part manufactured and inspected in complete compliance with:

x an established U.S. Government specification or standard (e.g., a military or federal specification, Army-Navy Aeronautical Standard (AN), etc.);

x a U.S. ratified international standardization agreements [e.g. NATO STANAGS (Standardization Agreement), etc]; or x a non-Government specification or standard published by a broadly-recognized professional society, industry association, or consensus standards development organization [e.g., SAE (Society of Automotive Engineers), ASME (American Society of Mechanical Engineers), ANSI (American National Standards Institute), AIA (Aerospace Industries Association), etc] which either includes design or manufacturing criteria, test and acceptance criteria, and uniform identification requirements; or establishes specific performance criteria, test and acceptance criteria, and uniform identification requirements.

Other acronyms and terms used in this Handbook are defined in the Multi- Service/Agency Instruction included as Appendix I.

1-6

1.6. Feedback

Users are encouraged to submit comments, questions, and lessons learned to their Service or defense agency point of contact responsible for updates to this Handbook.

SERVICE ORGANIZATION PHONE

Army AMCOM 256-313-8981 Army AMCOM 256-313-8966 Navy NAVAIR 301-342-2219 Navy NAVAIR 301-342-2241 Navy NAVAIR 301-757-2505

USAF AFMC 937-257-5448

DLA DSCR 804-279-4628

DLA DLA HQ 703-767-1519

DCMA DCMA 816-468-5433

x12

2-1

CHAPTER 2

CSI DETERMINATION AND IDENTIFICATION

Identifying an item as ‘CSI’ helps ensure the item will receive appropriate management throughout its life cycle. DoD acquisition laws and regulations establish a preference for competitive procurements. The volume of spare and repair part procurements constrains DoD’s ability to evaluate potential suppliers or their products prior to parts delivery. It is common for suppliers with limited knowledge of a critical item’s function, application, design intent, failure modes and effects, or critical features to seek and obtain Government contracts. CSI designation helps DoD to prioritize products based on criticality to a system’s safe operation and helps to establish prospective supplier and part assessment requirements based on that priority. The CSI designation helps prioritize Government quality assurance resources and determines the approval authority necessary for changes or deviations to specified requirements. (See Service-specific policies and guidance regarding delegation of approval authority for minor deviations and changes.) A CSI determination also triggers specific disposal procedures for items that are beyond their useful life or performance limits or are defective, suspect, or unapproved.

2.1. CSI Determination Responsibilities

The cognizant military Service ESA (or ESAs for common items) is responsible for criticality determinations. The ESA is the military Service organization assigned responsibility and authority to perform and approve engineering and quality assurance actions necessary to evolve detail design disclosures for systems, subsystems, equipment, and components exhibiting attributes essential for products to meet specific military requirements. For the purpose of this Handbook, the ESA is the Service’s Aircraft Airworthiness Authority and Design Control Activity.

Prime contractors, OEMs, or other parties may provide recommendations regarding criticality determinations for individual items, but the cognizant ESA engineer is responsible for the official determination.

During initial provisioning, cataloging, or approval of an Engineering Change Proposal (ECP) or Design Change Notice (DCN), the cognizant Service logistics organization verifies that the criticality determination has been accomplished by the ESA cognizant engineer and verifies that the determination is recorded in appropriate databases.

2-2

To help prevent delays in procuring newly identified CSIs, at least one approved source of supply or repair/overhaul must be identified for each CSI at the time the criticality is determined or as soon afterwards as practical. (See paragraph E.1.b. of the Multi-Service/Defense Agency CSI Instruction, Appendix I.) The prime contractor or OEM may be the only approved source known at the time the determination is established. Additional information on sources of CSIs and the source approval process is provided in the JACG Source Approval and Management Handbook [Future link to JACG Source Approval and Management Handbook].

2.2. CSI Determination Timing and Triggers

For systems/subsystems under development or modification, the criticality of repairable and consumable parts (i.e., replenishment items) must be established by the cognizant Service ESA early enough to allow adequate support and manufacturing planning for CSIs.

For in-service items, criticality determinations should be initiated or validated when there are:

x changes to an item’s configuration;

x changes to manufacturing or repair/overhaul processes;

x changes to sources of supply or repair/overhaul;

x requests for deviation x significant changes in operating concepts or conditions x product quality deficiency reports (PQDRs) x engineering investigations.

See Service-specific policies requirements and processes regarding the performance of criticality determinations supporting PQDRs and engineering investigations.

2.3. CSI Applicability

2.3.1. Types of Items

Aviation CSI policy is intended to ensure required quality standards are consistently met by suppliers of CSI parts and services throughout a platform’s life cycle. As such, the CSI designation is generally applied to repairable and consumable parts (i.e., replenishment items). In some cases, the ESA may wish to include critical airframe structures such as bulkheads, spars, and ribs that are produced and assembled once, even though there is no expectation that they

2-3 would be replaced or repaired, overhauled, or otherwise maintained on a recurring basis.

2.3.2. Level of Criticality Determinations

The focus on repairable and consumable parts also helps define the appropriate levels of work breakdown structure to which determinations should be applied.

How “far down” do we go? Do we assess every piece-part of every assembly?

Do we always stop at the assembly level?

The appropriate level of detail or decomposition for criticality determinations is primarily a function of the maintenance concept for the system or equipment, but may be influenced by other factors. Clear boundaries that would apply in every context cannot be defined.

Unless otherwise directed by the Service ESA, critical items should be identified at the lowest level at which items will be procured or replenished by the Government. For example, if nuts, bolts, bearings, blades, and other piece-parts of an assembly will be replaced at any DoD or DoD contracted maintenance level, then these items (and their next higher assembly) should be assessed as potential CSI candidates.

At the other extreme, if assemblies or subassemblies will be maintained solely by their removal and replacement (i.e., the item is considered a throwaway item (SM&R code PAOZZ), then CSI determinations should be completed only to the assembly or subassembly level. It is not required to go any lower level to perform determinations on individual components. For example, electronics subsystems, such as avionics or mission systems, are often remove/replace at the “box” level. The CSI determination would be made for the box part number, without delving into the individual electronic components inside the box.

Applying CSI designations only to the assembly or major subsystem level raises concerns that the actual safety-critical components that make up the assembly are being overlooked. In these cases, the focus of CSI practice would shift to emphasize the supplier’s CSI management processes. Specifically, the Government would evaluate the supplier’s methods for identifying the subsystem or assembly’s critical parts and managing their manufacturing and supply sources. Prime contractor and OEM CSI management processes of interest are discussed in Section 4.7.

Questions are also asked regarding the level at which determinations should be rolled “upward.” Generally, assemblies with CSI subcomponents should be designated CSI when DoD acquires both the complete assembly and the components to repair and overhaul it. This does not imply that every

2-4 subcomponent of a critical assembly is CSI. Only those subcomponents individually assessed to be relevant to the safety-critical nature of the assembly should be designated CSI.

The basis of CSI determinations on repairable and consumable parts and maintenance concepts underscores the importance of effective working relationships among logistics and engineering communities. Logisticians are responsible for life cycle support concepts that ultimately define spare parts and for providing these concepts to engineers who are then responsible for identifying CSIs and approving their sources. This relationship is particularly meaningful during the acquisition, development, and initial production stages of new platforms. There must be continual communication and exchange of information to meet the challenge of conducting criticality determinations while there are constant design and supportability updates in the late development/early production environment.

2.3.3. Types of Equipment Impacted by CSI Determinations

CSIs are not limited to aircraft components necessary to keep the aircraft flying.

Refer to Service-specific direction and guidance to help define the types of equipment to which CSI policies apply. Examples of equipment that may contain CSIs include:

x propulsion, transmission, and power system items, such as high speed rotating components, bearings, propellers, etc.;

x landing and braking system components, such as nose wheel steering, wheels and hubs, brake pistons and assemblies, etc.;

x critical air vehicle subsystems, such as embedded, portable and engine fire suppression equipment, refueling equipment, armament/stores, etc.;

x flight control components, such as linkages, actuators, yokes, flight controls surfaces, etc.;

x support equipment, such as bomb loaders, engine hoists, external power units, etc.;

x aircraft launch and recovery systems, such as aircraft catapults, arresting gear, jet blast deflectors, holdback bars, etc.;

x escape systems and parts, such as ejection seats, parachutes, canopy release and fracturing systems, etc.;

x life support system equipment, such as oxygen delivery systems, acceleration protection systems, laser eye protection, etc.;

x survival and rescue gear, such as life vests and flotation devices, emergency radios and beacons, helmets, etc.

2-5

2.4. CSI Determination Criteria

Safety is the primary driver of CSI policies and processes. Failure consequence is the primary factor in determining an item’s criticality. DoD’s CSI strategy is intended to minimize the risk of death, injury, or illness to personnel resulting from preventable, improperly manufactured, assembled, repaired, inspected, or procured aviation components. While the focus is on personnel safety, defective CSIs can also cause significant damage to weapon systems and equipment.

Consequently, factors relating to ‘damage’ are also considered in CSI principles.

Both safety and damage factors are reflected in Public Law 108-136 which defines CSIs as parts that contain a characteristic any failure, malfunction, or absence of which could cause— x a catastrophic or critical failure resulting in the loss of or serious damage to the aircraft or weapon system;

x an unacceptable risk of personal injury or loss of life; or x an uncommanded engine shutdown that jeopardizes safety.

MIL-STD-882D, Standard Practice for System Safety, establishes guidance on mishap severity categories. As summarized in Table 2.1, below, MIL-STD-882D guidance has been adapted for CSIs. Consistent with CSI emphasis on personnel safety, both Catastrophic (Category I) and Critical (Category II) personnel safety related criteria apply to CSI determinations; however, only the Catastrophic (Category I) damage criterion (loss exceeding $1 million) is applied. MIL-STD- 882D encourages programs to tailor damage criteria to correspond to system-specific levels of concern. Where a program has established ‘catastrophic damage’ criteria to be other than $1 million, CSI criticality determinations for that program should be consistent with the tailored damage criteria. See MIL-STD- 882D for more information about mishap severity categories and establishing tailored criteria.

Table 2.1. CSI Selection Criteria Description Consequence Severity

Category CSI Failure Consequences

Catastrophic

I

Failure could result in x death, x permanent total disability, x loss exceeding $1M

Critical

II

Failure could result in x Permanent partial disability, x Injuries or occupational illness resulting in hospitalization of at least 3 personnel

2-6

2.5. CSI Determination Considerations

2.5.1. Failure Modes, Effects, and Criticality

A Failure Modes and Effects Analysis (FMEA) is a risk investigation technique for systematically identifying the ways (i.e., modes) in which a system, equipment, or item may fail and the consequences of those failures. FMEA results are used to prioritize failures with the most severe consequences. An extension of the FMEA is a Failure Modes, Effects, and Criticality Analysis (FMECA), which provides a severity assessment for a specific hazard or consequence. Both FMEAs and FMECAs are used to identify, prioritize, and reduce the likelihood of failures with high severity consequences. Results of these analyses:

x Facilitate decisions to reduce an item’s failure probability or consequence severity through changes to design or design margins x Introduce physical or functional redundancies x Improve manufacturing process controls x Mandate testing or inspections x Incorporate failure detection systems or specified maintenance disciplines x Establish operational limits x Establish other similar safeguards.

FMEAs and FMECAs are invaluable design and support management tools, as are other risk assessment techniques (e.g., hazard risk assessments, fault tree analysis, etc). When a probability is added to a FMECA, that analysis becomes a Subsystem Hazard Analysis (SSHA) or a System Hazard Analysis (SHA), depending on the system level being considered. Failure probability estimates using these approaches, however, typically assume that an item will be manufactured, tested and inspected, installed, used, maintained, and repaired as specified. If there are deviations to any of these conditions, the failure probability estimates are invalid and safety can be compromised in a way that is difficult or impossible to predict. One of the primary objectives of CSI policies is to ensure … not simply assume … that prospective suppliers of products with catastrophic or severe failure consequences have the technical capability, discipline, and integrity to repeatedly produce conforming CSIs.

FMECAs are typically performed during a system’s design and development phase, as part of reliability centered maintenance or maintainability analysis, or when the performance of fielded equipment needs to be improved. FMEA and FMECA results, ground rules, and assumptions need to be understood before the results are applied to CSI determinations. A FMECA may have been conducted only to the assembly level with a determination that failure could be catastrophic.

Detailed analysis to identify which of the replaceable components in the

2-7 assembly had safety critical implications might not have been accomplished or the results not made available to the customer. Further informal or formal analysis would be required to identify the DoD replaceable CSIs in the assembly.

Similarly, FMECAs normally address multiple significant functions of equipment, including safety, operations, economics, environmental impacts, etc. The FMECA determination of a Catastrophic (or Category (CAT) I) failure might not relate to a safety concern but to the inability of the equipment to perform an essential mission-oriented function or other non-safety consequence. A review of the specific FMECA criteria and results would be appropriate to establish which CAT I failures should be classified as CSIs. Any contracts for development of new CSIs or analysis of current CSIs should include requirements for delivery of the data needed to support a criticality determination.

2.5.2. Failure Compensating Design Features

Criticality determinations should take into account whether certain features were designed into the system to compensate for system, subsystem, or component-level failures that could result in catastrophic or critical consequences. These compensating features could be included in the design at any indenture level that would 1) nullify the effects of a malfunction or failure, 2) control or deactivate items to halt generation or propagation of failure effects, or 3) activate backup or standby items or systems. Examples of failure compensating design provisions that might impact a CSI determination include:

x Non-identical or functional redundancy, where primary systems are backed-up by systems composed of different items or technologies (e.g., battery backup to a generator) that allow continued and safe operation. Items comprising functionally redundant systems may be considered for exclusion from CSI designation.

x Safety or relief devices such as monitoring or alarm provisions which permit effective operation (e.g., through human intervention) or limit damage. Items comprising systems with these types of features may be considered for exclusion from CSI designation.

x Identical or physical redundancy, where primary systems are backed up by systems composed of the identical items. Items comprising physically redundant systems should be seriously considered for CSI designation. In this case, a failure that affects one item could also simultaneously affect multiple redundant items. An example would be a part with a critical non-conformance installed into an assembly, where the assembly has a physically identical redundant system. If multiple parts from the same manufacturing lot have the same non-

2-8 conformance, there would be a high probability of a part with the same critical non-conformance being installed in both redundant systems, leading to the failure of both systems. Items that are functionally redundant but non-identical would not be subject to this failure scenario.

2.5.3. Dependent Failures

A dependent failure is defined as a failure caused by the failure of an associated item. As applied to CSI determinations, if failure of one item causes failure of another item or items in an unstoppable chain of events (i.e., a domino effect) causing one of the consequences described in Section 2.3. above, then it should be designated as CSI. In contrast, if failure of an item does not cause one of the results in Section 2.3. unless another item fails or malfunctions and is not directly caused by the item in question (i.e. a secondary or dual independent failure), do not designate the item CSI. Exceptions to this rule involve survival equipment and safety systems used in emergency situations where the item is placed in operation only when the platform has experienced a catastrophic failure.

Examples of Dependent Failures:

Failure of a lubrication pump could lead to loss of lubrication in a main shaft engine bearing, leading to failure of the bearing. Bearing failure will then lead to engine component misalignment, vibration, or major engine rotors/disks may seize, etc. Therefore, the lubrication pump should be designated CSI.

An aircraft’s rudder may have three or more hinges. If one of the hinges fails, the remaining hinges would be overloaded and result in the rudder departing the aircraft. Therefore, the hinges should be designated CSI.

2.5.4. Latent/Hidden Failures

A latent or hidden failure is defined as a failure that is inherently undetected when it occurs. If a latent and/or hidden failure of an item could cause a catastrophic or critical consequences (as discussed in Section 2.3.), then it should be designated as CSI. Latent/hidden failures may occur and remain undetected because 1) the effects of the failure on the system are masked by other components, or 2) the existence of one failure mode masks the existence of a second failure mode, or 3) the system is not normally operating. When analyzing the impact of latent/hidden failures, engineers should consider mitigating actions such as annunciation of the failure to the crew or inspections mandated by technical publications when completing the criticality analysis.

2-9

Examples of a Latent/Hidden Failure:

A tilt rotor aircraft has two engines and an interconnecting drive system to drive the rotors in the case of engine failure. While both engines are operating normally, the interconnecting drive system could fail without detection or safety-critical consequences. However, if one engine and/or drive system became inoperative with a failed interconnecting drive system, the consequences would be catastrophic. Therefore, components of the interconnecting drive system should be assessed for CSI designation.

In another example, an aircraft has a backup pneumatic landing gear extension system. When the normal hydraulic landing gear system is operating normally, the pneumatic system could fail without warning to the pilot and would be unavailable if the normal hydraulic system failed, thus resulting in serious damage to the aircraft and possible injury to the aircrew. In this example, components of the pneumatic landing gear extension system should be assessed for CSI designation.

2.5.5. Potential for Foreign Object Damage (FOD) and Things Falling Off Aircraft (TFOA)

Do not designate items as CSI if a FOD-induced failure is the sole basis for a CSI designation. An exception to this is the latent failure of FOD Prevention systems.

Latent failure of a FOD Prevention system could lead to a situation where a pilot enters a FOD rich environment (such as a dust storm) expecting the system to work, leading to engine failure or failure of another CSI assembly.

An example of a FOD-induced failure is failure of the fasteners retaining an aircraft nose panel (or any fuselage structure forward of the engine(s)), causing the panel to release without safety-critical consequences, unless ingested by the engine (thereby causing engine failure). In this case of a FOD-induced failure, the fasteners would not be deemed CSI.

Similarly, if fasteners retaining external structures or devices (such as a pods, tanks, or doors) should fail (creating a TFOA scenario) without safety-critical consequences to the aircraft, aircrew, or passengers, then they generally should not be designated CSI. Consideration of catastrophic or critical consequences to personnel on the ground is often cited as a basis for possible CSI determinations in this scenario. However, in most cases, these factors were found to be beyond the scope of the meaning and intent of CSI determinations and management policies. Exceptions to this rule involve inadvertent release or detachment of ordnance or other devices that contain explosive material. In these cases, a CSI designation might be appropriate.

2-10

2.5.6. Prime Contractor/OEM CSI Determinations

Provisions should be included in appropriate acquisition program Statements of Work to ensure CSIs are identified, documented, and approved by ESA technical authorities in sufficient time to influence critical down-stream processes such as initial provisioning, supply support, and manufacturing planning. Specifically, provisions should be made for delivery of an initial list of criticality determinations to be reviewed at the Critical Design Review. The list should continue to evolve as the design and supportability analyses reach final stages of maturity, culminating at the Physical Configuration Audit (PCA). Based on the PCA, a final CSI list should be documented and approved by the ESA prior to the Full Rate Production Decision Review.

Requirements and milestones guiding CSI identification during System Development and Demonstration are discussed in the Defense Acquisition Guidebook, Section 4.4.21., and paragraph 3.3.10.3 of the Air Vehicle Joint Service Specifications Guide (JSSG) 2001B. Technical Data Packages (TDP) (drawings and associated documentation) for CSIs must be approved prior to provisioning and submitted to the appropriate technical data repositories.

CSIs identified by the prime contractor/OEM should be considered recommendations submitted for review and approval by the cognizant ESA engineer(s). Differences between contractor and Government criticality determinations are common due to divergent definitions, scope, and interpretations of criteria. A Government-contractor team approach to identifying CSIs is strongly encouraged to minimize discrepancies and possible down-stream cost and/or schedule impacts.

Differences often arise between the Government and the Prime/OEM CSI designations on in-service items. Those differences can result from systems fielded before the current CSI policies were established or through field experience. Items reviewed in these cases may be designated as CSIs by the Government without involvement from the Prime/OEM. Items designated as CSIs in this fashion will be managed as CSIs by the Government. Any contracts to sources other than the Prime/OEM must list all CSI requirements. Quality management of CSIs under these circumstances is discussed further in Section

4.1. Refer to Service-specific policy and guidance for resolution of CSI discrepancies between the Government and Primes/OEMs and for contracting to Primes/OEMs for items for which they are the sole or primary source of supply.

2.6. Criticality Determinations for Standard Parts, Common Use Items, FAA Certificated Systems, and COTS

2-11

2.6.1. Criticality Determinations for Standard Parts

The term ‘standard part’ refers to a part manufactured and inspected in complete conformance with x an established U.S. Government specification [e.g., a military or federal specification, Army-Navy Aeronautical Standard (AN), etc.];

x a U.S. ratified international standardization agreement (e.g., NATO STANAG, etc.); or x a non-Government specification or standard published by a broadly-recognized professional society, industry association, or consensus standards development organization (e.g., SAE, ASME, ANSI, AIA, etc.) which either includes design or manufacturing criteria, test and acceptance criteria, and uniform identification requirements; or…