DASR 21.A.20 requires the applicant for a Military Type Certificate (MTC) to demonstrate compliance with the applicable Type Certification Basis (TCB), and to provide the Authority with the means by which such compliance has been demonstrated. The Acceptable Means of Compliance (AMC) accompanying this regulation requires the applicant to demonstrate compliance through either:
Compliance Demonstration Evidence (CDE) developed by a Military Design Organisation Approval (MDOA) holder (or alternative as agreed by the Authority); or
appropriate evidence of prior certification provided by a recognised Civilian Aviation Authority (CAA) or Military Aviation Authority (MAA) - collectively C/MAAs.
The latter of these two demonstration methods recognises that most Defence aircraft and design changes have previously been assessed as suitably safe (‘certified11’) by another C/MAA. It therefore makes sense for Defence to leverage that effort to the maximum practicable extent. Apart from the obvious direct benefits to Defence (eg savings in time, cost and effort through not producing or assessing CDE), it also presents opportunities for Defence to benefit from international C/MAA expertise and privileged access to design data.
However, the certification issued by an C/MAA is normally specific to their local operational context. Defence has long described this context in terms of the aircraft’s ‘CRE’, that is, its:
Configuration - the physical and functional attributes of the aircraft
Role - the way the aircraft is flown and employed
Environment - the physical and functional conditions in which the aircraft is operated.
Defence has historically found that its operational context can differ markedly to other civil and military operators, and therefore C/MAA certifications may be only partly relevant to Defence aircraft. This may affect the extent to which an applicant can rely on prior certification - and instead must develop CDE to demonstrate compliance with the TCB.
Purpose of Annex. The aim of this Annex is to assist applicants for MTCs and Major design change approvals in identifying opportunities to leverage prior certification, thereby obtaining partial or full relief from developing CDE. This Annex supports the guidance contained in Section 7.2 Type Certification, and is complemented by Annex B to Section 7 Leveraging Prior Certification.
While not the direct audience for this Annex, the content may also assist organisations managing the acquisition of, and design changes to, Defence aircraft in meeting their Smart Buyer and other obligations.
Overview of Annex. This Annex briefly summarises the concept of prior certification and its applicability to Defence aircraft acquisitions and Major design changes. It will then provide guidance on completing a CRE Assessment (CREA) to justify an application to leverage prior certification.
Finally, it will briefly explain how some minor adaptions to the CREA process can assist Defence in its Smart Buyer and other endeavours.
This Annex assumes the reader has a reasonable knowledge of prior certification, as provided through Annex B to Section 7 Leveraging Prior Certification, the DASR Type Certification Course, and AMC/GM to DASR 21.A.20. However, to ensure readers share a common context for the next section on CREA, a brief overview is provided below.
To promote efficiency and flexibility in the DASP, DASA may acknowledge that products and services from other Aviation Authorities and their respective systems are acceptable. This concept, known as Recognition, is provided for by the Defence Aviation Safety Regulation and is explored in Section 6 Recognition of other Aviation Authorities. Recognition is contingent on a DASA assessment of, amongst other things, the C/MAA’s staffing (including qualifications and training), airworthiness regulations, policies applied by the Authority, and the airworthiness authorisations issued by the Authority.
In the context of aircraft design, prior certification of a product - whether a whole aircraft, a system, an item of equipment or even a software load - by a recognised C/MAA can provide Defence with equivalent confidence in the safety of design as if we had conducted the product certification ourselves. This presents the applicant for an airworthiness authorisation with the opportunity to reduce, or perhaps even eliminate, the need to develop CDE to demonstrate that the design meets the agreed TCB.
Prior certification can only be applied to the extent that the following prerequisites are met:
the certification is within the scope, conditions and caveats specific to DASA’s recognition of the certifying C/MAA
the C/MAA is sufficiently experienced in certification of the particular design activity
the certification requirements employed by the C/MAA (primarily related to disclosure of the TCB) are understood
any safety risks associated with the C/MAA certification have been identified, and Defence has ensured those risks have been eliminated or otherwise minimised so far as is reasonably practicable
the Configuration, Role and Environment (CRE) applied to the C/MAA’s certification is understood and any deltas from the intended Defence CRE have been addressed.
The first four of these prerequisites, while sometimes challenging to verify, are largely self-explanatory. However, the fifth prerequisite, namely identifying and managing CRE deltas, is often a complex undertaking and is the subject of the remainder of this Annex.
This section introduces the concept of ‘CRE’, and then explores the differences between the as-designed CRE, the as-certified CRE, and Defence’s required CRE.
What is CRE ?
An aircraft operator, whether civil or military, will have a particular operational context in mind when procuring an aircraft. An aircraft design organisation will similarly have a particular operational context in mind when designing an aircraft. Alignment between these two contexts is unsurprisingly pivotal to airworthiness.
Since there is no internationally-accepted terminology for this operational context, Defence has historically defined it in terms of an aircraft’s Configuration, Role and Environment. The following paragraphs provide an overview of the factors that constitute an aircraft’s CRE:
Configuration. An aircraft’s Configuration comprises all its physical and functional attributes. It includes, amongst other things, the attributes of aircraft systems (eg avionics, fuel, oxygen, flight controls), structures (eg wings, doors, nacelle), powerplant (eg fuel, engine, exhaust), and propellers and rotors22.
Role. An aircraft’s Role encompasses how it is flown and employed. It includes flight profiles, external stores carriage, possible cargo configurations, operating weights, speed/altitude ranges, and so on. The desired Role for an aircraft often influences its Configuration and Environment.
Environment. An aircraft’s operating Environment encompasses the physical and functional conditions in which the aircraft is operated. It includes:
the physical airborne environment (for example the electromagnetic environment, the corrosive environment, moisture and gust loads)
the physical ground environment (for example landing loads, taxi loads, tie-down loads and so on)
the functional environment (for example national airspace equipage and navigation performance requirements)
Australian and Defence policies, procedures and equipment requirements (for example Australia has legislated requirements for safety risk management, Defence has specific policy requirements for aircraft crash protection).
The Role and Environment for a particular aircraft will usually remain fairly constant throughout its life. Changes to Configuration, on the other hand, are commonplace - usually to introduce new functionality or to remedy latent design/construction deficiencies.
While the vernacular of ‘CRE’ is probably unique to Defence, the underlying principles are common across civil and military aviation.
The ‘as designed’ CRE
As noted previously, aircraft designers will have a particular operational context in mind when designing a new aircraft or a change to an aircraft. For military aircraft, this is usually defined by the lead military customer, as documented in their procurement specification. For civil aircraft, this is often defined by the design company itself, after identifying the likely needs of prospective customers.
In both cases the final design will often exceed the customers’ requirements. This might be in anticipation of future customer needs, or because off-the-shelf components exceed requirements, or to incorporate generous safety margins for design/production inaccuracies.
From a customer’s perspective, identifying an aircraft’s Configuration is usually straightforward. However, identifying the Role and Environment assumed by the designer can be particularly difficult. In DASA’s experience, this is partly because designers do not explicitly employ this terminology or construct, and partly due to commercial/security considerations. Avenues to overcome these hurdles are presented later in this Annex.
The ‘as certified’ CRE
CAAs will normally certify a new aircraft against their promulgated airworthiness codes66. These airworthiness codes, inclusive of their referenced standards, implicitly include bounds on the aircraft’s Role and Environment. These bounds are reflective of the common operational context that the authors had in mind when they drafted those airworthiness codes and standards.
The concept of a unique and explicit Role and Environment is therefore irrelevant to most CAA certifications44. Consequently, if Defence wishes to identify the certified Role and Environment, it is usually sufficient to explore the relevant airworthiness code and its referenced standards. This may sometimes be straightforward (eg identifying the certification limits for electromagnetic immunity), but more often it requires deep domain knowledge (eg limits for repeated engine dust ingestion).
MAAs, on the other hand, will normally certify an aircraft against its intended operational context. They may use a standards-based approach, or a specification-based approach, or more commonly a combination of both. Because of the often unique and challenging operational context for military aircraft, MAAs will ultimately certify to the intended Role and Environment, albeit that terminology is rarely used outside Defence.
If Defence wishes to identify the MAA-certified Role and Environment, much of the information should be available in the original aircraft procurement specification . The remaining information can normally be sought directly from the MAA, through targeted requests for certification data. Where the MAA is unable to release that information, an alternate approach may be to seek MAA confirmation that the certified design does indeed meet a particular Defence Role or Environment requirement. A final approach, albeit much less-preferred, is to explore whether the MAA’s indigenous aircraft operate to a similar extreme of Role or Environment .
Importantly, neither a CAA nor MAA certification will precisely match the as-designed Role and Environment. Rather, the latter will invariably exceed the former. The C/MAA merely confirms that their requirements are met, whereas the designer may elect to exceed those requirements for their own reasons. The significance of this delta will become clear later in this Annex.
Defence’s required CRE
Defence procures aircraft to meet its operational needs. However, with a few rare exceptions, Defence’s intended CRE for a new aircraft will be different to other major operators of the same aircraft type. This is due to Australia’s unique location and environment, the need to multi-role our aircraft fleet, and so on.
DASR ARO.50 requires all Defence-registered aircraft to be issued with a Statement of Operating Intent and Usage (SOIU). Ideally, the SOIU should form a cornerstone of the aircraft Type Certification process, since it should contain all the Roles and Environments in which the aircraft type is intended to operate77. Practically, however, there is still variability across aircraft SOIUs, so Defence acquisition and design staff may also need to glean additional information from other sources88.
The next section explores how Defence certification programs may still be able to leverage prior certification, despite apparent differences between Defence’s required CRE and the as-certified CRE, through a CRE Assessment.
The applicant for a MTC for a new Defence aircraft is required to develop a certification programme (which should be presented as a stand-alone Certification Programme Plan (CPP)) for Authority acceptance. A central element of the CPP is the TCB for the aircraft and the proposed means of demonstrating compliance with the TCB. Both are commonly combined into a Compliance Checklist (CCL).
Unsurprisingly, applicants endeavour to leverage prior certification to the maximum practicable extent, rather than develop additional CDE. The onus is on the applicant to compare Defence’s CRE with the prior certified CRE, and draw one of three conclusions for every TCB line item:
There is no CRE delta, so prior certification can be fully claimed for that TCB line item
There is a CRE delta, but it only affects certain elements of the TCB line item, so CDE will be developed to supplement the prior certification.
There is a marked CRE delta, so CDE will be developed to fully demonstrate compliance (ie prior certification will not be used)
Note: Before starting to develop CDE, some CASG Project offices attempt to eliminate or minimise CRE deltas through various means, for example negotiating role/environment changes with aircraft operators. However, this is not a certification activity - rather it is a CASG Smart Buyer activity that endeavours to reduce certification costs and schedule. See Section 7 for further information.
Most applicants elect to produce a CRE Assessment report to summarise and justify their findings. However, this is not a regulatory requirement. Rather, the applicant must ultimately find a way to satisfy the Authority that each instance of leveraging ‘prior certification’ is justified before the Authority will agree to the CPP. The applicant will also need to define the additional CDE that will be developed, where full reliance on ‘prior certification’ cannot be supported.
CRE Assessment process
A template for conducting a CRE Assessment is provided at Appendix 1 to this Annex. At its core is a list of items where Defence has historically encountered CRE deltas to certified designs. Each line provides space for the applicant to decide whether the item is relevant to their situation, and if so to list potentially affected TCB elements.
The common CRE Assessment process is presented in steps 1 to 4 of the figure below. Steps 5 to 8 are normal design actions that are beyond the scope of this Annex, but are included for completeness.
Figure 1: Common CRE Assessment Process
Note: While the TCB is first mentioned at Step 4, the TCB would preferably be developed well before this, to help inform each step in the CRE assessment.
Guidance in completing Steps 1 to 4 is presented in the following paragraphs. Guidance on completing the green Smart Buyer step is included later in this Annex.
Step 1: Document the Defence CRE
Paragraph 28 noted that the SOIU should contain a comprehensive description of Defence’s Role and Environment, but did not provide guidance on what might be considered ‘comprehensive’. While the determination of comprehensiveness is guided by AMC to DASR 21.A.15(b), and also the SOIU, CREA and CPP templates, it ultimately is a judgement made by competent engineers.
Importantly, this step must identify any areas where Defence’s Role and Environment for the aircraft could conceivably be unusual, and then document Defence’s requirements for those areas. Conversely, as a matter of pragmatism, other areas may be omitted simply because Defence’s intended use for the aircraft is so obviously unremarkable99. The ideal balance is where we do not drown in detail, but we also do not miss any potential deltas.
The two preceding paragraphs have focused on Role and Environment, but not Configuration. This is because Configuration differences are usually identified directly in Step 3.
Step 2: Determine the CRE that was employed by the certifying C/MAA
Refer to the ‘as-certified’ CRE information earlier in this Annex for guidance on identifying and exploring the CRE employed by the certifying C/MAA.
Step 3: Compare the CREs and identify deltas
Role and Environment. While identifying Role and Environment deltas is conceptually straightforward, it can often be complex in practice. In DASA’s experience it takes professional engineering effort, and there are few if any shortcuts.
DASA offers the following guidance:
The CRE assessment is usually most effective when conducted in two phases. The first phase evaluates each line item in the Appendix 1 template, with the sole aim of identifying issues that might present a CRE delta. The second phase methodically explores each item to confirm that status.
In DASA’s experience the first phase is best conducted as a workshop, comprising experienced representatives from the Military Air Operator (MAO), Air Warfare Centre, DASA, CASG, and other relevant domain experts. The second phase is normally a project office activity.
The second phase should avoid delving too deeply into issues that may only have a trivial safety effect. Defence has limited resources, and must focus its effort on identifying and managing sources of elevated safety risk.
It can be tempting during this step to source additional evidence from the aircraft designer to confirm the as-designed aircraft does in fact encompass Defence’s Role and Environment, even though the as-certified aircraft does not. However, this approach can muddy the application of prior certification. Rather, the additional evidence is best identified and sourced in Step 5 of the CRE assessment process.
This step is complete only when Defence has certainty over CRE deltas. If Defence only suspects there is a CRE delta, then further authoritative data should be sought. Proceeding to Step 4 prior to this certainty can lead to Defence wasting resources by implementing unnecessary modifications or generating superfluous CDE.
Conversely, based on previous DASA experience, DASA offers the following cautions:
The CRE comparison activity should not be levied onto a foreign C/MAA or foreign program office or aircraft designer, because it will almost certainly be unsuccessful1010. At most, Defence should present targeted questions to the C/MAA on elements of CRE.
The activity should not be completed in isolation by engineers. Some CRE deltas can be obscure, and are only revealed after deeper exploration by operational and other stakeholders.
The methodical CRE exploration should not be relegated to an inexperienced project engineer or contractor. Identifying and managing CRE deltas can be a substantial contributor to safety, and needs to be tackled with commensurate skill and diligence.
Configuration. Identifying Configuration deltas is usually straightforward. Configuration deltas commonly result from either a unique Defence capability requirement, or are a security pre-requisite of the originating customer1111.
Step 4: Explore the effect a CRE delta will have on TCB line items
As described in paragraph 31, prior certification can only be leveraged for a particular TCB item to the extent that the certification is relevant to Defence’s particular CRE. Otherwise, the applicant would normally need to develop CDE to cover the gap1212.
Role and Environment. This step methodically identifies every TCB line item that will be affected by a particular Role and Environment delta. For example, if Step 3 concludes that Defence will conduct higher sink rate landings than the C/MAA certification currently covers, the analyst must identify every affected TCB item. These will range from the obvious (eg TCB items covering undercarriage strength) to the obscure (eg TCB items covering ICA for crash-rated seats).
The engineers completing this process must have a deep understanding not only of each TCB item, but also the standards that underpin each TCB item. Most often, this depth of knowledge will only be resident in a DASA-approved Military Design Organisation (MDO), although there is no regulatory requirement for an MDO to complete this step.
Completion of this step will ideally result in two artefacts, although only the latter is a prerequisite for proceeding to Step 5:
A CREA report, usually based on the template at Appendix 1, which documents the affected TCB line items for every identified CRE delta. This can be a particularly useful artefact for through-life support, as will become evident in Section 6.
A Compliance Checklist (CCL) which lists every TCB line item and identifies where ‘prior certification’ will contribute partly or fully to demonstrating compliance.
Configuration. Where a Configuration delta exists, the outcome is usually unambiguous. That is, relief through prior certification usually cannot be applied, so new CDE must be developed to support Type Certification of those systems or equipment. This activity will be performed by a MDO or other organisation accepted by the Authority. The template at Appendix 1 is not normally used for Configuration deltas; rather they are addressed directly in the CPP.
DASR 21.A.97 states that the approval of a Major design change requires compliance to be demonstrated with the Authority-approved TCB. Since Defence mostly procures off-the-shelf designs that have been certified by a recognised C/MAA, leveraging ‘prior certification’ has the potential to markedly reduce the CDE to be developed by design organisations.
This section examines the role of CRE assessments in certifying design changes, and separately covers:
Major design changes1313 to Defence aircraft that possess a quality CREA that has been well documented and iteratively improved over time
Major design changes to Defence aircraft that do not possess a quality CREA
Minor design changes to Defence aircraft
Major design changes - for aircraft with a quality CREA
An existing CREA is primarily useful where the C/MAA certification basis for the Major design change is largely equivalent to the Defence TCB, and the change does not introduce a marked change to the Defence SOIU (and, therefore, the CRE which underpinned the original CREA). Where these assumptions do not hold, a new CREA will probably be needed (see paragraph 55).
Extant CREAs are usually used in one of two ways. The most common is for straightforward design changes where ‘prior certification’ is reasonably expected to entirely support Defence’s own certification (ie no new CDE should be required). In this case, a two-step approach is normally applied by the applicant:
Step 1: Use the CREA to confirm the particular aircraft systems/functions relevant to the change are not affected by Defence’s unique Role and Environment.
Step 2: Confirm the design change does not introduce any new Role and Environment deltas1414.
Provided both steps are positively confirmed, and Defence’s aircraft configuration matches the C/MAA-certified configuration, then the applicant should be justified in claiming full relief from developing CDE.
A variation on the above approach is where the CREA is used to identify where partial ‘prior certification’ might be applied. For example, the design organisation might create the CCL for a design change, and then use the CREA to identify CCL line items that were noted as being affected by Defence’s unique Role and Environment. The CREA would then help the applicant determine whether the particular Role and operating Environment attribute was relevant to this particular design change.
CREA maintenance. For a CREA to be used per paragraphs 51 to 53, the CREA must be maintained throughout the aircraft’s lifecycle. This includes not only adding CREA items as new deltas are identified, but also amending items where the CRE delta is reduced or no longer exists (eg if a design change eliminates a CRE delta, or the C/MAA changes what they are certifying to).
Major design changes - for aircraft lacking a quality CREA
Where a quality CREA does not yet exist for the aircraft, an applicant wishing to leverage ‘prior certification’ will need to apply the process in Section 5, covering the scope of the particular design change.
Minor design changes
DASA issues Recognition certificates for recognised C/MAAs, which are available on the DASA recognition web page. These certificates, and DASR M.A.304(d), allow Continuing Airworthiness Management Organisations (CAMOs) to directly consume certain Minor design changes, provided the resulting design change is compatible with Defence’s CRE. AMC to DASR M.A.304(d) requires the CAMO to establish procedures to assess and process data intended for consumption. A starting point for these procedures would be the guidance presented above at paragraphs 51 to 53.
For Minor design changes that cannot be consumed under M.A.304(d), for reasons including CRE deltas, an approval under DASR 21 is required. The Initial Airworthiness DASRs do not specifically mention prior certification in relation to ‘Minor’ design changes. However, a MDO’s Design Organisation Handbook must describe how their design assurance system accounts for the acceptability of the parts or appliances designed by partners or subcontractors. Where these parties are not MDOs, the application of ‘prior certification’ (including CRE assessments per paragraph 55) may contribute to a pragmatic solution.
This Annex has naturally focused on the direct contributions that CREAs make to aircraft type certification. This last section is presented as a service to CASG, exploring some ways that CRE assessments can contribute to CASG’s cost, schedule and capability aims.
Minimising CRE deltas
DASA has long advised aircraft acquisition project offices to conduct CRE assessments early in the project lifecycle, well before acquisition contracts are signed. By identifying potential CRE deltas early, CASG can explore a wider array of options for minimising the deltas, resulting in potential cost, schedule and capability benefits. For example, upon identifying a potential CRE delta, CASG might:
expand the acquisition contract to modify the aircraft so it fully meets Defence’s required Role and Environment
include requirements in the contract for the aircraft designer or C/MAA to develop or disclose CDE that shows the design already encompasses Defence’s needs
allocate project funding to develop additional evidence to confirm the aircraft exceeds designer or C/MAA expectations (eg fund structural fatigue tests or targeted EMI testing)
seek MAO concurrence with operational limitations or changes to the SOIU, to eliminate or minimise CRE deltas
make provision for expanded Instructions for Continuing Airworthiness (eg add inspections or maintenance) so the design remains safe for the proposed Defence use.
While each of these avenues can be pursued after contract signature, they can become markedly more difficult and expensive. If left too late, opportunities to eliminate a CRE delta might become impractical, potentially obliging a MAO to accept a capability reduction or to retain an elevated level of risk.
Other uses for CRE assessments
CASG projects have previously found CRE assessments to be useful for issues beyond type certification. One such use is to identify areas where a new aircraft and its support systems may not be entirely compatible with Defence’s systems and legal obligations. Once identified, the project can work through resolving the incompatibilities. Candidates might include:
aeronautical data
electronic flight bags
mission planning systems
compatibility of aircraft operating and maintenance procedures and publications with Defence’s standard training and doctrine
compatibility with night vision lighting systems, on the ground or on other aircraft
long-term health effects due to RADHAZ, HAZCHEM, etc
airfield limitations
compatibility with Defence’s common ground support equipment
extended operation of aircraft systems on the ground.