7.1.1.1 While there is no internationally-accepted definition for Initial Airworthiness, common definitions for ‘initial’ (happening at the beginning) and ‘airworthiness’ (the fact of an aircraft being safe to fly) are helpful. After all, Initial Airworthiness does indeed focus extensively on whether a new aircraft is initially safe to fly - that is, whether it has been suitably designed and manufactured.
7.1.1.2 However, by convention, Initial Airworthiness also encompasses any design changes subsequently made to the new aircraft (including the certification of those changes) and the design of repairs. Furthermore, it includes the activities needed to ensure the design remains safe throughout its lifecycle, although this activity is often termed ‘continued’ airworthiness (not to be confused with ‘continuing’ airworthiness, per chapter 8).
7.1.1.3 This chapter presents an overview of the DASR approach to aircraft design, production and certification, which are the activities commonly associated with initial and continued airworthiness. The subsequent chapters will then explore several of these concepts in more detail.
7.1.1.4 Note this chapter is relevant only to Defence Registered aircraft; for non-Defence Registered aircraft, all initial and continued airworthiness functions are conducted per the requirements of the relevant Civil or military Aviation Authority (normally CASA).
7.1.2.1 From an Initial and Continued Airworthiness (INCA) perspective, an aircraft’s lifecycle might follow a progression something like this:
To start, an engineering organisation demonstrates its professional ability to produce an aircraft design (‘design organisation approval’).
Next, the organisation produces a new aircraft design, and an Aviation Authority certifies that the design is suitably safe (‘aircraft design and certification’).
Individual aircraft are then produced, and an Aviation Authority certifies each as conforming to the certified design (‘aircraft production and certification’).
Over the following decades of fleet operation, numerous Minor and Major design changes and repairs will be made to the aircraft (‘aircraft design changes and repairs’).
Occasionally, there may be a need for limited flying of a possibly unairworthy aircraft, either to demonstrate a new capability or to avoid grounding an important asset (‘permit to fly’).
Critically, throughout this complex lifecycyle, an engineering organisation will need to monitor for defects in the design, facilitate risk management of the design, and so on (‘type certificate holder’).
Finally, an Aviation Authority might occasionally mandate certain remediation actions in the interests of fleet safety (‘airworthiness directives’).
7.1.2.2 Each of these seven functions, and several others, is regulated under DASR Pt 21– Aircraft Design, Production and Certification. The remainder of this chapter provides a brief summary of these functions.
7.1.2.3 Design organisation approval. Deficiencies in an aircraft’s design can range from those with immediate catastrophic consequences (eg inadequate structural strength), to an erosion of safety margins (eg misleading navigation information), to an annoyance (eg a Minor human-machine interface flaw). Designing an aircraft where risks have been eliminated or otherwise minimised so far as is reasonably practicable (SFARP) is a particularly complex endeavour.
7.1.2.4 Consequently, the initial design of Defence aircraft should only be undertaken by skilled individuals within professional aircraft design organisations. DASRs make provision for DASA to issue Military Design Organisation Approval (MDOA) status to organisations who have demonstrated that they are able to maintain a design assurance system for the control and supervision of the design, and of design changes, of aircraft products, parts and appliances.
7.1.2.5 DASA’s default expectation is that a new Defence aircraft will be designed by a MDOA of suitable scope. As a matter of pragmatism, however, DASR also make provision for Defence to accept designs that have been certified by a DASA-recognised civil or military Aviation Authority (CAA/MAA), without the need for the design organisation to be a DASA-approved MDOA, within certain bounds. This approach, often called ‘prior acceptance’ is explored in Chapter 7.2, Product Certification. These same provisions apply for design changes to an extant aircraft.
7.1.2.6 MDOAs are explored in Chapter 7.6, Design and Production Organisations.
7.1.2.7 Initial aircraft design and certification. Defence periodically acquires aircraft to meet a capability need. In practice, Defence usually acquires its new aircraft as off-the-shelf designs, and then incorporates design changes to cater for Defence’s unique roles and operating environment. The entire design will meet a set of airworthiness requirements - commonly called a Type Certification Basis (TCB) - and the designer(s) will produce extensive evidence (via analysis, test and other means) to demonstrate that their design meets the TCB.
7.1.2.8 As noted in paragraph 7.1.2.5, these designs will be produced by a DASA-approved MDOA, or a design organisation whose design is certified by a DASA-recognised CAA/MAA, or sometimes both. Regardless, the final design will always be certified by DASA, signified by the issue of a Military Type Certificate (MTC)11 for the aircraft.
7.1.2.9 In the absence of a pertinent CAA/MAA certification, DASA’s certification for a new aircraft would be an immense undertaking for both DASA and the Defence acquisition organisation. More commonly, however, there will be a pertinent CAA/MAA certification, and leveraging off this certification can substantially reduce the impost on both organisations. In that case, much of the effort focuses on whether the certified design is compatible with Defence’s intended Configuration, Role and Environment (CRE). Chapter 7.2, Product Certification, explores the certification process in detail.
7.1.2.10 Aircraft production and certification. An expertly designed and certified aircraft provides the basis for safe aircraft operation. However, just as importantly, that design must be accurately implemented on the Defence aircraft.
7.1.2.11 DASR make provision for DASA to issue a Military Production Organisation Approval (MPOA) to an organisation when assured they have the ability to manufacture aircraft parts and appliances in conformity with approved data. DASR also make provision for Defence to accept an aircraft produced under the systems of a DASA-recognised CAA/MAA. This latter approach is used for most new Defence aircraft.
7.1.2.112 Following production of an individual aircraft, DASA must certify that the aircraft is in a state of airworthiness per the inherent level of safety specified on the MTC. This certification is signified by the DASA issue of a Military Certificate of Airworthiness (MCoA)22 for each individual Defence aircraft.
7.1.2.13 Aircraft production and MCoAs are explored in Chapter 7.3, Production. MPOAs are explored in Chapter 7.6, Design and Production Organisations.
7.1.2.14 Aircraft design changes and repairs. Defence aircraft will usually be in service for several decades. During this time, numerous design changes will inevitably be implemented, either to enhance military capability or to address design or obsolescence problems. These design changes are classified under DASR as either Minor of Major, differentiated by the degree of airworthiness effect of the design change.
7.1.2.15 The DASR approach for Minor and Major design changes is very similar. They will both be performed by a DASA-approved MDOA or another design organisation whose design is certified by a recognised CAA/MAA, and both should preserve the level of airworthiness of the aircraft. For Major design changes, however, DASA will usually provide a proportionate level of independent assurance, and DASA itself will usually certify the design as safe. This certification is usually via an amendment to the MTC, although occasionally a Military Supplemental Type Certificate (MSTC) may be issued. Chapter 7.2, Product Certification, explores the certification process in detail.
7.1.2.16 Throughout an aircraft’s life, degradation (damage) of the systems/structures integrity supporting safe flight may be compromised through direct (accidental impact and battle damage) overload, or insidious (fatigue, corrosion, moisture ingress, dis-bond, ultraviolet light etc) environmental sources. Repairs are those actions developed and implemented to restore damaged products to a suitably airworthy state. Similar to aircraft design changes, aircraft repairs are classified under DASR as Minor or Major, must be designed by a MDOA or other organisation agreed by DASA, and may be subjected to a proportionate level of DASA independent assurance.
7.1.2.17 Permit to fly. A Military Permit to Fly (MPTF) may be issued by DASA for an aircraft that does not meet, or has not been shown to meet, the requirements of its TCB, but is nonetheless capable of safe flight under defined conditions and for specified purposes. MPTFs are most commonly used for flight test (for aircraft development or role expansion activities), for flights where the design has not yet been certified, or for flights where the aircraft temporarily does not conform to the Type Design (eg due to unrepaired damaged, overdue maintenance, etc).
7.1.2.18 An MPTF may or may not entail an elevated level of risk, and is always associated with a set of flight conditions that may be approved prior to, or in conjunction with, the MPTF application. Chapter 7.5, Flight Conditions and Military Permits to Fly, explores this in more detail.
7.1.2.19 Type certificate holder. As noted earlier in this chapter, DASA issues an MTC for Defence Registered aircraft types. This MTC is issued to a suitable Commonwealth government organisation (usually the relevant Defence Systems Program Office), who are then charged with ‘holding’ the MTC.
7.1.2.20 Holding the type certificate involves undertaking certain obligations that ensure the type certificate is managed, and the level of safety inherent in the TCB is maintained. This includes, for a particular aircraft type, collecting aviation safety information (both locally and from external sources), ensuring operators are aware of extant hazards, ensuring that essential risk controls remain effective, leading local efforts to eliminate or further minimise known risks, and many other important roles.
7.1.2.21 These expansive holding responsibilities are often beyond the capacity and capability of the government organisation holding the MTC. Consequently, responsibility for the conduct of MTCH obligations is often vested with various support organisations, for example contractors, foreign project offices and other military operators. The government organisation remains accountable for all activities undertaken by those organisations.
7.1.2.22 Chapter 7.4, Continued Airworthiness, explores the MTCH role in more detail.
7.1.2.23 Airworthiness directives. In the Australian Defence context, the WHS Act and DASR place responsibility and obligation solely on the regulated community for managing the day-to-day safety of their aircraft, and for ensuring risks are eliminated or otherwise minimised so far as is reasonably practicable. DASR do, however, still make provision for DASA to mandate actions and/or impose conditions on aircraft operation in certain circumstances. This is achieved through the issue of an Airworthiness Directive (AD).
7.1.2.24 Like its civil counterpart, ADs under DASR provide a means to mandate an action in order to restore an aircraft to an acceptable level of safety, where that safety level may be otherwise compromised. However, due to Defence’s unique context, DASA issues ADs infrequently, particularly in comparison to civil aviation.
7.1.2.25 Chapter 7.4, Continued Airworthiness, explores DASR ADs in more detail.
7.1.2.26 Other. In addition to the seven common INCA functions mentioned above, DASR 21 also makes provision for a number of niche functions. Since this chapter aims to provide an overview of INCA that is consumable to a wide audience, these niche functions will not be explored here. They include: Australian Military Technical Standard Order (AUSMTSO) authorisations, restricted type certificates, restricted certificates of airworthiness, approval of parts and appliances, and the identification of parts and appliances.
Structure of these chapters
7.1.2.27 This chapter has provided a brief overview of the functions encompassed within Initial and Continued Airworthiness. The subsequent chapters explore several of these functions in greater detail, as follows:
Chapter 7.2: Product certification
Chapter 7.3: Production and military certificates of airworthiness
Chapter 7.4: Continued airworthiness (including military type certificate holders, occurrence reporting, airworthiness directives and other organisational approvals)
Chapter 7.5: Flight conditions and military permits to fly
Chapter 7.6: Design and production organisations.
7.2.1.1. Product certification authorisations represent DASA’s assurance that an individual product complies with the applicable airworthiness33 requirements. These are issued following review of compliance evidence presented by the applicant seeking product certification. Product certification authorisations covered under this chapter are MTCs, Changes to MTCs, MSTCs, and Repair Designs.
7.2.1.2. Product certification authorisations are built around four pillars of safety assurance; Organisational Capability, Compliance demonstration, Compliance Verification, and Obligations of the holder
7.2.1.3. Organisational Capability. Before an organisation can apply for a product certification, they need to be eligible. Eligibility is based on an assessment of whether the organisation is equipped/resourced to achieve a successful authorisation.
7.2.1.4. Compliance Demonstration. The applicant for a product certification authorisation must show that their product complies with the applicable airworthiness requirements.
7.2.1.5. Compliance Verification. The authority must independently verify that compliance has been achieved to the applicable airworthiness requirements. As compliance demonstration and compliance verification are intrinsically linked, a certification programme is put in place to document the means by which the applicant will demonstrate compliance and the authority will verify compliance.
7.2.1.6. Obligations of the Holder. Following issue of a certification approval, the certificate holder must continue to carry out obligations outlined under the DASRs to ensure the product certification remains safe.
7.2.1.7. The following sections expand upon these safety assurance areas for each product certification authorisation.
Overview
7.2.2.1 Scope of Section. Section 7.2.2 describes the DASR type certification process for obtaining a Military Type Certificate (MTC). Military Restricted Type Certificates (MRTCs) are not yet employed by DASA, and are not addressed herein.
7.2.2.2 Military Type Certificate. An MTC is issued by DASA to certify that a product’s type design complies with the applicable Type Certification Basis (TCB) when operated within specified conditions and limitations. Further description of the MTC authorisation can be found in Section 5.3 Annex K.
Eligibility
7.2.2.3 Applicant eligibility requirements exist to control how designs and applications are developed and presented to DASA for review and inspection. These ensure that DASA has visibility of the applicant’s organisation, understands and has confidence in the generation of compliance evidence and how the declaration of compliance is made, and has confidence in the applicant’s ability to fulfil the obligations associated with holding the MTC.
7.2.2.4 DASR 21.A.13 (Eligibility), and by extension DASR 21.A.14 (Demonstration of Capability), define which organisations can apply for an MTC under DASR 21. As per DASR 21.A.14, applicants for an MTC can be:
A DASR 21 Subpart J approved Military Design Organisation (MDO) (21.A.14(a)). Holding a DASR 21J approval provides an organisation with the eligibility to apply directly to DASA for an MTC. However, given the scope of the Australian aviation industry, development and certification of a new aircraft wholly under a DASR 21J MDO will be a rare occurrence.
An organisation demonstrating its capability through alternative procedures (21.A.14(b)). An applicant may seek DASA agreement for the use of procedures setting out the specific design practices, resources and sequence of activities necessary to comply with this DASR. This eligibility provision is ostensibly aimed at products with simple or limited scope of design, or organisations starting toward a MDO approval or limited duration of design activities. Use of this provision to demonstrate capability to apply for an MTC would only be considered by DASA by exception.
A government organisation who has an agreement in place with a design organisation that has access to the type design data (21.A.14(c)). Any government organisation applying for an MTC may demonstrate its capability by having an agreement in place, accepted by DASA, with a design organisation that has access to the necessary type design data. This is the normal provision through which DASA expects government organisations (usually the relevant CASG System Program Office (SPO)) to demonstrate their capability to apply for an MTC. The agreement with the relevant design organisation shall include detailed statements how the actions and obligations are delegated to enable the government organisation, in cooperation with the contracted organisation, to comply with the requirements of Subpart J and DASR 21.A.44 (holder obligations). AMC and GM to 21.A.14(c) provide further information on demonstration of capability under this provision.
7.2.2.5 MTC Applications by CASG SPOs (Project Offices). To be issued an MTC by DASA, a CASG project office develops a Type Continued-Airworthiness Exposition (TCAE) for DASA review. The TCAE details the CASG arrangements with the design organisation(s) that has access to the type-design data and through which the provision of holder obligation functions occur. Further guidance on holder obligations and arrangements can be found in Section 7.4.1.
7.2.2.6 CASG project offices seeking issue of an MTC are strongly encouraged to initiate early contact with DASA during the appropriate stage of the Capability Life Cycle (such as preceding, or early in, the Acquisition phase) to discuss how the DASR eligibility provisions will be met for the intended acquisition program.
7.2.2.7 The eligibility assessment will focus on the arrangement between CASG and supporting design organisation(s), and address how the arrangements comply with the requirements of DASR 21 Subpart J. Since a CASG project office scope of responsibility is usually limited to a single application, and does not include the through-life holder responsibilities, the CASG project office eligibility information is not required to be delivered as a single document and can instead be contained within Project or Acquisition documentation. The documentation requires review by DASA prior to the project office becoming eligible to act as an applicant. However, the CASG project office must include a transition plan to manage delivery of the Type Design to the MTC holder, and where the MTC holder organisation is being created, include plans for assessment of eligibility of the MTC holder, by DASA.
7.2.2.8 Additional guidance with respect to MTC applicant eligibility when CASG project offices wish to leverage recognition provisions is as follows:
Application will be exclusively based upon an aircraft type-design that has been certified by a recognised CAA/MAA. In this situation, the project office, in conjunction with any associated design organisation(s), can gain eligibility by demonstrating its ability to conduct the required certification programme activities (develop CPP, conduct applicability assessment against Defence context, develop the Defence TCB, and provide a declaration of compliance), rather than demonstrate full adherence to the DASR 21 Subpart J requirements.
Application will be based on a design that has not been certified, but was developed using a design system (organisation, people, processes, data, and tools) external to the DASR, and where that system is used to produce designs for certification by a recognised CAA/MAA. In this situation, the DASA recognition framework44 must be leveraged by the project office to assist in demonstrating to DASA that the arrangements with the external DO provides an acceptable equivalence to the DASR 21 Subpart J requirements. Activities to meet the eligibility requirements should be completed prior to initial engagement with DASA and throughout certification programme activities. The project office is to address the following expectations in their respective eligibility submission:
Confirm that the external design organisation is normally oversighted by a CAA/MAA recognised by DASA55.
Confirm that the external design organisation has appropriate technical scope and expertise for the intended design(s).
Confirm that the systems, processes and personnel used in developing other designs for certification by the parent CAA/MAA will be used in the design development or holder activities associated with the ADF design.
Confirm that the design organisation is able to provide an attestation of compliance against the Defence TCB for any provided design product.
Note: In some circumstances, the PO or MTC holder may wish to allow the external design organisation to engage directly with DASA for Defence TCB agreement, development and conduct of the CCP, and provision of a declaration of compliance to the Defence TCB. In this case, the eligibility documentation shall demonstrate that the external design organisation systems and process are sufficiently similar to the DASR 21J requirements to support such delegation.
Confirm any expected oversight by the DO’s parent CAA/MAA is appropriate.
Confirm where applicable, arrangements for DASA oversight are in place.
Articulate how the recognition arrangements as per paragraphs 7.2.2.8.(b)(iii), (iv) and (v) will be monitored and ensured during the design development and submission process66.
Certification Programme
7.2.2.9 Overview. Under DASR 21, a certification programme is required for all applications for an MTC, and the certification programme requires formal acceptance by DASA.
7.2.2.10 The certification programme provides the details necessary to understand the design activity and how certification will be achieved for that activity. A stand-alone document that presents the certification programme for formal DASA acceptance is termed a Certification Program Plan (CPP).
7.2.2.11 Two CPP templates are published on the DASA Website (one for MTCs and one for major changes/MSTCs), which provide detailed guidance on the structure and content of a certification programme. This section should be read in conjunction with the MTC CPP template.
7.2.2.12 The organisation(s) involved in the development and submission of a certification program for an MTC application will vary depending upon the acquisition arrangements. GM1 21.A.15(b) provides further guidance based on some common acquisition scenarios.
7.2.2.13 Contents of a Certification Programme. DASR 21.A.15(b) outlines the requirements for content of a certification programme for an MTC. Certification programmes must be tailored to meet the requirements of the certification activity.
7.2.2.14 The certification programme should be presented as a CPP containing the information required by DASR 21.A.15(b) and the supporting AMC. The MTC CPP template published by DASA will assist in meeting the required outcomes.
7.2.2.15 Two key outcomes are achieved through the development and DASA acceptance of the certification programme:
Applicant development and DASA agreement of the Defence TCB for the MTC77.
Formalising and agreement on the approach to be taken for demonstrating compliance against the Defence TCB, and the DASA Level of Involvement (LoI) in compliance demonstration activities.
7.2.2.16 Proposed Compliance Demonstration Items (CDIs). DASR 21.A.15(b)(5) requires that the CPP proposes a breakdown of the certification programme into meaningful groups of compliance demonstration activities and data, and a proposal for the means of compliance and related compliance documents.
7.2.2.17 A CDI is a meaningful group of compliance demonstration activities and data that can be considered, in isolation, for the purpose of performing the risk assessment that allows DASA to determine its LoI.
7.2.2.18 Applicants should follow AMC 21.A.15(b)(5) when proposing the CDIs, and the DASA MTC CPP template contains further guidance and tabular templates for presenting proposed CDIs.
7.2.2.19 Proposed DASA LoI. As outlined in AMC 21.A.15(b)(6), the Authority’s LoI is a list of activities and data, in which the Authority retains the verification of compliance demonstration (e.g. review and acceptance of compliance data, witnessing of tests, etc.), as well as the depth of the verification. The depth of the verification for individual compliance reports, data, test witnessing, etc., may range from spot checks to extensive reviews. DASA will respond to those retained compliance demonstration activities and data with corresponding comments or a ‘statement of no objection’. DASR 21.A.15(b)(6) requires that the CPP proposes the DASA LoI associated with compliance demonstration activities, noting that LoI should normally be proposed at the CDI level. As per DASR 21.A.15(b)(6), the DASA LoI must address the likelihood of an unidentified non‐compliance with the TCB requirements and the potential impact of that non‐compliance on safety (ie a risk-based determination). In practice, this is achieved through taking into consideration:
any novel or unusual features of the certification project, including operational, organisational and knowledge management aspects
the complexity of the design and/or demonstration of compliance
the criticality of the design or technology and the related safety risks, including those identified on similar designs
the performance and experience of the design organisation of the applicant in the domain concerned.
7.2.2.20 AMC 21.A.15(b)(6) contains a step-by-step process and extensive information that applicants should follow when determining the proposed DASA LoI. The DASA MTC CPP template also includes complementary guidance and tables. The three main steps that culminate in determining the DASA LoI are:
Step 1: Identification of the likelihood of an unidentified non-compliance. This includes taking into consideration novelty, complexity and the performance of the design organisation. Refer to Section 3.2 of AMC 21.A.15(b)(6) for details.
Step 2: Identification of the ‘risk class’. This includes determining whether the potential impact of the non-compliance within a compliance demonstration activity (ie CDI) is critical or non-critical. This is then combined with the likelihood of an unidentified non-compliance (step 1) to determine the risk class. Refer to Sections 3.3-3.4 of AMC 21.A.15(b)(6) for details.
Step 3: Determination of the DASA LoI. Based on the qualitative risk class identified for each compliance demonstration activity (ie CDI), the applicant should propose a DASA LoI. Refer to Section 3.5 of AMC 21.A.15(b)(6) for details.
7.2.2.21 DASA will determine the depth and extent of its inspections for each CDI, based on the information provided in the certification programme and the applicant’s proposal. DASA determination of LoI will be confirmed as part of DASA’s acceptance of the CPP. Note that the depth and extent of DASA LoI may change throughout the project in order to account for changes that affect the basis of the initial LoI determination.
7.2.2.22 Certification Programme Acceptance. DASA acceptance of the certification programme is required for all MTC applications. Early engagement with DASA, and agreement on the key certification programme content, will reduce schedule and resource risks for the project. Delaying presentation of certification programmes to DASA until after compliance demonstration has commenced may result in delays, additional work, or additional resources, due to DASA:
determining that the proposed airworthiness requirements or means of compliance are unsuitable for the certification activity
identifying a need for a LoI in compliance demonstration activities that have already been completed, therefore resulting in a need to repeat the compliance demonstration
identifying LoI that requires travel (eg for compliance demonstration being completed overseas) and insufficient time is available to organise funding and travel prior to the planned activity, resulting in a need to delay the activity
identifying a need for data access that was not accounted for prior to contracting or establishing government to government agreements for the activity, resulting in a need for contract changes or alternate workarounds.
7.2.2.23 DASA acceptance of a certification programme can be achieved incrementally, if some aspects are unknown at the beginning of the project or are expected to change throughout the project. A caveated acceptance may be possible to achieve agreement with DASA on specific aspects of the programme prior to full details being known. For an initial or caveated acceptance, the following is required:
identification of the applicant and any design organisations involved
broad detail on the design and aircraft intended use
an initial proposal for the TCB, including identification of the Primary Certification Code and identification of whether any TCB tailoring (including Military Certification Review Items (MCRIs)) will be required. Note: the TCB does not have to be fully defined at this point.
broad detail on the certification approach (i.e. whether there will be reliance on prior certification, or whether compliance demonstration evidence with be developed specifically for the DASA certification).
7.2.2.24 Where an incremental approach is taken to developing and achieving acceptance of the certification programme, the scope of acceptance intended by each version must be clearly understood and documented. A point at which the next update is required must be identified, this may be date based or linked to a specific project stage or milestone.
7.2.2.25 DASA acceptance of the certification programme will be agreed by formal communication, which will include confirmation of the DASA LoI for the activity, and any caveats on DASA acceptance.
7.2.2.26 Certification Programme Updates. In accordance with DASR 21.A.15(c), the certification programme is to be updated when there are changes to any of the content required under DASR 21.A.15(b). Key aspects that require the certification programme to be re-accepted by DASA are:
any changes that may impact on DASA LoI, such as:
change to the design or intended use
change to compliance demonstration approach (including the means of compliance)
change to the CRE Assessment (CREA) or its outcomes for a program that is leveraging prior certification
change to design organisation resources or approvals
any changes to the proposed TCB (except those achieving separate agreement via an MCRI)
significant changes to schedule that may impact on DASA LoI activities
7.2.2.27 Changes to the certification programme can be presented as an update to the original CPP, or via a supplement, depending on the scope of the changes.
7.2.2.28 Applicants should engage early with DASA (nominally DIA) staff and remain closely engaged with CPP development and subsequent amendment, heeding advice to prevent nugatory drafting and rewriting. The DASR Form 31 can be used to notify DASA of an upcoming certification project, to initiate discussions. A face-to-face session, before any CPP drafting occurs, is strongly recommended for for complex programs.
Type Certification Basis
7.2.2.29 Contents of a TCB. The TCB is an agreed set of airworthiness requirements that a product must be compliant with in order to obtain an MTC. The following DASR and concepts apply to the contents of a TCB:
DASR 21.A.16A (Airworthiness Codes). This regulation requires that DASA shall approve the use of Airworthiness Codes88 and other detailed specifications that may be used to demonstrate compliance of products, parts and appliances. As noted in GM 21.A.16A, rather than define a Defence-unique Airworthiness Code, DASA has elected to recognise the Airworthiness Codes prescribed by several other CAAs and MAAs that have been demonstrated to achieve safe flight, and then prescribe supplementation as required. The Defence Aviation Safety Design Requirements Manual (DASDRM) identifies the Airworthiness Codes recognised by DASA.
DASR 21.A.16B (Special Conditions). This regulation requires that DASA shall approve any special detailed technical specification (‘special conditions’) if the related Airworthiness Code or specifications do not contain adequate or appropriate safety standards. As per 21.A.16B, the need for special conditions may arise due to:
novel or unusual design features (relative to the design practices on which the applicable Airworthiness Code is based)
intended use of the product is unconventional
experience from other similar products in service or products having similar design features or newly identified hazards have shown that unsafe conditions may develop
applicable airworthiness codes do not exist for the concerned product class or do not address the requested kind of operations.
In the Defence context, special conditions are required when the primary Airworthiness Code selected may contain deficiencies against contemporary airworthiness requirements and / or may not account for Defence’s unique CRE. DASA uses the Defence Aviation Safety Design Requirements Manual (DASDRM) to define those 'essential' design requirements and standards that must be applied as special conditions to supplement Airworthiness Codes due to deficiencies in the Codes or to account for the Defence CRE. The DASDRM also defines a number of ‘recommended’ design requirements and standards for which compliance is not prescribed, but which should be applied where reasonably practicable.
DASR 21.A.17A (Type Certification Basis). This regulation defines the scope of the Defence TCB. The airworthiness requirements specified in the TCB include:
the applicable requirements from the DASA recognised Airworthiness Code selected as a basis for the Defence aircraft certification (the Primary Certification Code (PCC))
the applicable ‘essential’ requirements prescribed in the Defence Aviation Safety Design Requirements Manual (DASDRM)
any supplementation or tailoring agreed to by DASA.
7.2.2.30 Development of a Defence TCB. Development of a Defence TCB is a joint activity between the applicant and DASA and is guided by the DASR listed above and the Defence Aviation Safety Design Requirements Manual (DASDRM). TCB agreement is obtained through acceptance of the certification programme in accordance with DASR 21.A.15(b).
7.2.2.31 The TCB for a new Defence aircraft type should be developed and agreed as early as practicable in the aircraft acquisition life-cycle. While a DASA‐agreed TCB should be pursued prior to entering into an acquisition contract, this will not always be possible. In those cases, the acquisition project office may elect to present a draft TCB for DASA assessment as a cost and schedule risk reduction measure.
7.2.2.32 In most cases, DASR and the DASDRM allow the Defence TCB to be based on the recognised design standards used by the parent CAA/MAA under which the aircraft was initially designed and certified.
7.2.2.33 The TCB for a Defence aircraft must be consistent with Defence’s intended role and operating environment for the aircraft. In the aircraft Type Certification domain, CRE is a pivotal concept. Where an ab-initio Type Certification programme is proposed for a Defence aircraft, defining the CRE is essential to ensure that the basis of certification is consistent with the intended Defence use of the aircraft.
7.2.2.34 Where the Defence Type Certification programme intends to leverage prior certification from a recognised CAA/MAA to any extent, a CRE Assessment (CREA) is required to confirm the applicability of that prior certification to the intended Defence use. Areas where the prior certification is not entirely applicable to the Defence CRE must be addressed through further compliance demonstration evidence, inclusion of additional requirements in the TCB, or tailoring of requirements for the TCB. Further guidance on leveraging prior certification is contained in Annex B to Section 7.2, and further guidance on the conduct of a CREA is contained in Annex C to Section 7.2.
7.2.2.35 Tailoring the PCC. During a certification program, there may be a need to tailor the PCC when seeking an MTC. This tailoring may be required to supplement the PCC for a specific technology area, to specify later amendments of requirements or to otherwise account for the Defence CRE.
7.2.2.36 Tailoring of the PCC may be required to address a range of situations, such as CRE differences, special conditions, new means of compliance or any other certification issues that require clarification or interpretation.
7.2.2.37 Tailoring of the PCC can be achieved by directly including additional requirements or standards in the Defence TCB, or through use of a Military Certification Review Item (MCRI).
7.2.2.38 Annex A to Section 7.2 provides further guidance on tailoring the PCC, including when an MCRI is required and the MCRI categories adopted and employed by DASA, when Operator agreement is required to support PCC tailoring and how that agreement should be achieved, and illustration of the process involved in obtaining DASA agreement for tailoring.
Compliance Demonstration
7.2.2.39 Overview. Compliance demonstration evidence comprises of reports, engineering tool outputs, drawings, specifications, calculations, analysis etc. and provides a record of the means by which compliance with the applicable TCB is demonstrated. The applicant shall demonstrate compliance with the type‐certification basis either:
through compliance demonstration evidence developed by a MDOA holder (or alternative as agreed by DASA); or
through appropriate evidence of prior certification provided by another CAA / MAA.
7.2.2.40 The agreed certification programme will include details of how compliance demonstration is being achieved for each project. Where difficulty arises in meeting the agreed certification programme activities or outcomes, engagement with DASA as early as practicable is recommended. This phase may identify issues in compliance demonstration evidence against the agreed Defence TCB that require equivalent safety finding arguments, processing of exceptions underpinned by an Airworthiness Issue Paper (AwIP) or equivalent, or introducing new interpretations or means of compliance. In these cases an MCRI, and an AwIP as required, should be raised and submitted by the applicant for DASA consideration.
7.2.2.41 Leveraging Prior Certification. Defence is rarely the prime customer for new aircraft, so most acquisitions will be based on an aircraft design that has or will be certified by another CAA/MAA. DASR 21.A.20 enables an applicant for an MTC to leverage prior certification from a recognised CAA/MAA99 to gain relief from developing compliance demonstration evidence.
7.2.2.42 The fundamental principle of leveraging prior certification is that any requisite Authority review of evidence; testing, or witnessing of testing; or inspections (refer DASR 21.A.33(b)) have already been performed by a competent Authority (ie a CAA/MAA recognised by DASA). Therefore, duplicate effort in terms of DASA also conducting inspections / analyses / tests is unnecessary. However, as per DASR AMC 21.A.20, in order to leverage the prior certification, the applicant for the MTC must ensure:
the certification is within the scope, conditions and caveats specific to DASA Recognition of the certifying CAA/MAA
the CAA/MAA is sufficiently experienced in certification of the particular design activity
the certification requirements employed by the CAA/MAA are understood and any deltas from the Defence TCB have been addressed
the CRE applied to the prior certification is understood and any deltas from the intended Defence CRE have been addressed
any safety risks associated with the CAA / MAA certification have been identified, and have been eliminated or otherwise minimised So Far As is Reasonably Practicable (SFARP) for the Defence CRE.
7.2.2.43 Annex B to Section 7.2 provides additional guidance on the AMC 21.A.20 requirements for leveraging prior certification, and discusses common issues encountered with leveraging prior certification. Annex C to Section 7.2 provides further guidance on the conduct of a CREA to support relief from presenting CDE when leveraging prior recognition.
7.2.2.44 Structures and Propulsion System Specific Guidance. Guidance on the conduct of structures and propulsion system CREAs when leveraging prior certification can be found in GM1 21.A.20 and Chapter 6.6.2. Guidance to support AMC 21.A.41 (Structural and Propulsion System Critical Parts and Airworthiness Limitations (AUS)) can be found in Chapter 6.6.2.
MTC Application, Issuance and Type Certificate Data Sheet (TCDS)
7.2.2.45 Application. Upon completion of all activities identified within the CPP, including development of compliance demonstration evidence and completion of DASA LoI, the applicant provides the required declaration of compliance (refer DASR 21.A.20(d)) and formally applies to DASA for issuance of an MTC. The exact format of the application for an MTC will differ depending upon each project, and should be agreed within the CPP.
7.2.2.46 Issuance. Upon receipt of the application, DASA assures itself that agreed certification programme activities have been completed, and will issue the MTC.
7.2.2.47 For acquisitions of new aircraft types, the Defence Aviation Authority (Defence AA) will generally elect to convene an Airworthiness Board (AwB). Aircraft acquisition AwBs, including applicant and DASA submission of documents to support the AwB, are separate to the DASR type certification process outlined within this section. AwBs are discussed further in Section 6.1.2 and Section 13.
7.2.2.48 Type Certificate Data Sheet (TCDS). A TCDS will accompany each MTC. The TCDS contains all information (or reference thereto) about the type certification of the product including the TCB, the type design, operating limitations, the Aircraft Flight Manual (AFM), Instructions for Continuing Airworthiness (ICA), Airworthiness Limitations (AwLs), Certification Maintenance Requirements (CMRs), critical parts list (if applicable) and any other data necessary for the continued safe operation of the product.
7.2.2.49 DASA will develop and issue the TCDS concurrently with the MTC.
DASA Assurance
7.2.2.50 DASA independent safety assurance activities occur throughout the type certification process, and will vary in nature, scope and depth based on each individual project. Key DASA assurance activities for obtaining an MTC include:
DASA acceptance of the certification programme (refer ‘Certification Programme’ section above).
DASA agreement of the TCB, including tailoring (refer ‘Type Certification Basis’ section above).
DASA LoI in compliance demonstration activities. The term LoI describes DASA’s involvement in the verification of compliance demonstration. DASA LoI can include review of compliance data and information; testing, or witnessing of compliance testing; or inspections (refer DASR 21.A.33(b)). Depending upon the design, DASA LoI may occur over an extended duration and include on-site witness activities. DASA LoI will have been defined in the certification program (refer ‘Certification Programme’ section above). In all cases, DASA LoI activities should be successfully completed prior to the applicant’s declaration of compliance.
DASA assurance activities related to leveraging prior certification. These activities can be broadly described as DASA review of the evidence and artefacts that support the applicant’s claims that prior CAA/MAA certification can be leveraged (refer below for more detailed information).
DASA assurance activities related to the final application. These activities typically include review / evaluation of compliance artefacts submitted as part of the final application, and issue of the MTC and TCDS.
7.2.2.51 DASA Assurance when Leveraging Prior Certification. Where the certification programme indicates that an applicant is proposing to leverage prior certification from a recognised CAA/MAA, then DASA assurance activities will focus on the criteria outlined in AMC 21.A.20. The guidance outlined in Annex B to Section 7.2 provides an indication of the considerations that DASA will examine as part its assurance activities.
7.2.2.52 For certain aspects, the CPP will only be providing a proposal for how the applicant intends to address the criteria for leveraging prior certification outlined in AMC 21.A.20. For example, the applicant may need to conduct further activities to confirm that the CAA/MAA is sufficiently experienced in certification of the particular design activity, conduct further analysis to show that the design is compliant for the Defence CRE, and conduct sovereign assessments for safety risk decisions or risk retention made by an MAA. Therefore, DASA will typically request the applicant provide relevant documentation prior to, or as part of, the final application.
7.2.2.53 Note that while leveraging prior certification may provide relief from the need to develop new compliance demonstration evidence, it does not provide relief from the need to present compliance demonstration evidence to DASA. As such, DASA may request to review evidence that supported the prior certification where it is deemed necessary. Where it is not possible for the applicant to provide this evidence to DASA, for example due to limitations on access to OEM data, this will be negotiated between the applicant and DASA on a case-by-case basis.
MTC Holder Obligations
7.2.2.54 MTC holder obligations are outlined in DASR 21.A.44. Refer to Section 7.4.1 for detailed guidance on MTC holder obligations.
Overview
7.2.3.1 Scope of Section. Section 7.2.3 primarily describes the DASR type certification process for major changes to the type certificate and obtaining a Military Supplemental Type Certificates (MSTC). Minor changes to the type certificate are only briefly addressed herein.
7.2.3.2 Change to a Type Certificate. As defined by DASR 21.A.41, the type certificate includes:
The Type Design, which includes1010:
The drawings and specifications, and a listing of those drawings and specifications, necessary to define the configuration and the design features of the product shown to comply with the applicable TCB;
Information on materials and processes and on methods of manufacture and assembly of the product necessary to ensure the conformity of the product;
An approved Airworthiness Limitations Section (ALS) of the ICA as defined by the applicable airworthiness codes; and
Any other data allowing by comparison the determination of the airworthiness of later products of the same type.
Operating Limitations
The TCDS
The applicable TCB
Any other conditions or limitations prescribed for the product in the applicable airworthiness requirements.
7.2.3.3 A change to any aspect of the items listed above is considered a change to the type certificate, and must be undertaken in accordance with DASR 21 Subpart D or E.
7.2.3.4 Note that DASR M.A.304(d) allows for the Operator to directly consume data for minor changes that has been approved within the framework of Authorities recognised by DASA. Under this pathway, the requirements of DASR 21 are not applicable. Direct consumption of data is subject to a suitability assessment (see AMC and GM to DASR M.A.304(d)) in accordance with the scope, conditions and caveats of the relevant recognition certificate. Data for major changes cannot be directly consumed via recognition, and must be processed in accordance with DASR 21 Subpart D or E. Refer to Section 8.2 for further information on the direct consumption of data via recognition. Consumption of data for minor changes via recognition is not discussed any further within this section.
Classification
7.2.3.5 In accordance with DASR 21.A.91, all changes to the type certificate must be classified as minor or major.
7.2.3.6 A minor change is defined as a change that has no appreciable effect on the mass, balance, structural strength, reliability, operational characteristics, or other characteristics affecting the airworthiness of the product. All other changes are defined as major. Guidance on classification of changes to type certificates, including examples of changes that should be classified as major, can be found in DASR GM 21.A.91.
7.2.3.7 DASR 21J MDO approval holders will typically have the privilege to classify changes that are within the scope (e.g. technology or platform types) of their terms of approval. As noted in DASR GM 21.A.91, DASA should be consulted for clarification wherever there is doubt as to the classification of a change. Furthermore, when the strict application of the DASR GM 21.A.91 paragraph 3.4 criteria results in a major classification, the applicant may request reclassification, if justified, and DASA can take the responsibility in reclassifying the change.
Processing of Minor Changes
7.2.3.8 Minor changes to the type certificate must be undertaken in accordance with DASR 21 Subpart D, and can be approved by DASA or a DASR 21J MDO approval holder with the necessary privilege and scope. DASA expects that in the Defence context, minor changes to type certificates undertaken in accordance with DASR 21 Subpart D will be developed and approved by a DASR 21J MDO1111.
Processing of Major Changes
7.2.3.9 Changes that are classified as major can be processed and approved as a:
major change to the existing MTC under DASR 21 Subpart D, or
a MSTC under DASR 21 Subpart E.
7.2.3.10 The decision to apply for a major change (DASR 21 Subpart D) versus a MSTC (DASR 21 Subpart E) will depend upon the specific context. Under the DASR construct, both these authorisations will be issued to the government MTC holder. The default approach is usually issue a major change to the existing MTC, however, as discussed in the following sub-section, there may be cases where an MSTC is more appropriate.
Use of Military Supplemental Type Certificates (MSTCs)
7.2.3.11 The reasons for using an MSTC are different in the Defence context from in the civilian context. This sub-section provides guidance on when an MSTC should be used under the DASR.
7.2.3.12 Civil use of Supplemental Type Certificates (STCs). In the civil context, STCs are generally used for commercial purposes. They are used where a designer (either the OEM or another designer) alters the aircraft to provide a new capability that they can sell separately to the original Type Certificate. Of note, designers who are not the holder of the original Type Certificate can only ever apply for STCs for design changes that are classified as major, as it is not possible to apply for a major change to a certificate you do not hold.
7.2.3.13 Major changes to the Type Certificate are limited to changes done by the Type Certificate Holder, and are mostly (though not always) mandatory Service Bulletins and Airworthiness Directives to address safety issues identified in service as part of the holder obligations (eg DASR 21.A.3A).
7.2.3.14 Use of MSTCs Under DASR. Under the DASR the reasons for using an MSTC are different to the civil context. The following are the reasons that an MSTC (as opposed to a major change to the MTC) would be used under the DASR:
Sub-fleet: An MSTC may be used to manage a sub-fleet. This would be where there is one or more aircraft in the fleet that are intended to be configured or operated in a significantly different manner to the remainder of the fleet. Note, sub-fleets can also be managed via major changes to the MTC, so an MSTC may be used but is not the only option for management of sub-fleets.
Significant Change to the TCB: An MSTC may be used to manage a change that involves a distinct change to the TCB. Generally this will be the result of reliance on prior certification which has adopted a different PCC than that used for the original MTC. While the change to the PCC may be able to be managed via MCRI(s), it may reduce the complexity of ongoing management of the authorisations by covering the change under an MSTC.
Large and Complex Changes: An MSTC may be used for large and complex changes. While the process for review and approval of a major change or an MSTC is the same, use of an MSTC provides greater visibility, and as a result greater clarity, of the precise nature and scope of the change. MSTCs are often understood by Defence Operators as being a change of more significance, which warrants greater operational consideration.
Management Reasons: An MSTC may be used for ease of management from the perspective of the MTC holder. This may be required to provide alignment between the DASR authorisations and authorisations being leveraged via recognition. It may be simpler for an MTC holder to manage their obligations if the Defence authorisations are aligned with the OEM authorisations.
7.2.3.15 Note that when changes are applied to the MTC for a platform that also has MSTC(s), the compatibility of the change with the existing MSTC(s) must be explicitly addressed. Under the civil system, a change to the Type Certificate does not need to explicitly consider compatibility with potential STCs. It is the Operator’s responsibility to consider the impact of change to the Type Certificate against any STCs applied to their aircraft, and to engage the STC holder as required. However, in the DASR context, the MTC and MSTCs are frequently more integrated and less able to be clearly separated from each other. In addition, the MTC and MSTCs are all held by the same organisation so separating consideration of the MTC and MSTCs is unnecessary and adds confusion for no benefit. As such, it is not appropriate to progress a major change to the MTC without considering the impact on existing MSTCs.
Eligibility
7.2.3.16 Applicant eligibility requirements exist to control how designs and applications are developed and presented to DASA for review and inspection. These ensure that DASA has visibility of the applicant’s organisation, understands and has confidence in the generation of compliance evidence and how the declaration of compliance is made, and has confidence in the applicant’s ability to fulfil the obligations associated with holding the relevant authorisation.
7.2.3.17 Major Change to the MTC. In accordance with DASR 21.A.92, only the MTC holder can apply for a major change to the MTC. However, as noted by DASR GM 21.A.92(a), this includes any organisation acting on behalf of the MTC holder. DASA considers it appropriate for a design organisation to act as the applicant for a major change (on behalf of the MTC holder) where:
the agreement between the MTC holder and design organisation required by DASR 21.A.14(c) permits,
the TCAE reflects the agreement and arrangements under which such applications may occur, and
the proposed design change is within the scope of the design organisation’s approval.
7.2.3.18 In all cases, the MTC holder must sign the final application for the major change (ie Form 31A) to confirm that they have been consulted on, and have no objection to, the major change, and will carry out holder responsibilities.
7.2.3.19 During sustainment, additional design organisations may be engaged by the MTC holder to support new modifications or reflect expanding design support agreements. In these cases, the MTC holder should inform DASA of the proposed support arrangements and define additional oversight requirements to support specific applications.
7.2.3.20 MSTC. In accordance with DASR 21.A.112A, any organisation that has demonstrated, or is in the process of demonstrating, its capability under DASR 21.A.112B shall be eligible as an applicant for an MSTC. The DASR 21.A.112B demonstration of capability requirements are essentially the same as those of DASR 21.A.14 (refer to the ‘Eligibility’ guidance in Section 7.2.2, and relevant AMC and GM for further information).
7.2.3.21 However, as noted by DASR GM 21.A.115, DASA will issue all MSTCs to the relevant government MTC holder organisation. This means that, in effect, all applications for MSTC are being made on behalf of the MTC holder who will be the eventual holder of the MSTC. Applicants for MSTCs must be able to demonstrate that they are acting on behalf of the MTC holder.
7.2.3.22 Major Change or MSTC Applications by CASG Project Offices. In some cases, the CASG project office may act as the applicant for a major change or MSTC for larger or more complex modifications to an existing aircraft, such as for a mid-life upgrade program or significant capability upgrades.
7.2.3.23 Since only the MTC holder can apply for major changes to the existing MTC, the CASG project office would be considered to be applying for the approval on behalf of the MTC holder. For MSTC applications, the CASG project office could be considered the applicant under the DASR 21.A.112B(c) exception clause. In either case, the eligibility assessment will focus on the arrangement between CASG and supporting design organisation(s), and address how the arrangements comply with the requirements of DASR 21 Subpart J.
7.2.3.24 Also refer to the ‘MTC Applications by CASG SPOs (Project Offices)’ guidance in Section 7.2.2 for further information, including guidance on applicant eligibility when CASG project offices wish to leverage recognition provisions.
7.2.3.25 CASG project offices seeking to apply for a major change or MSTC are strongly encouraged to initiate early contact with DASA during the appropriate stage of the Capability Life Cycle (such as preceding, or early in, the Acquisition phase) to discuss how the DASR eligibility provisions will be met for the intended program.
Certification Programme
7.2.3.26 Overview. Under DASR 21, a certification programme is required for all changes to type certificates and MSTCs. The certification programme provides the details necessary to understand the design activity and how certification will be achieved for that activity. A stand-alone document that presents the certification programme for formal DASA acceptance is termed a CPP.
7.2.3.27 For MSTC and ‘complex’1212 major change programs, the certification programme must be presented to DASA for formal acceptance prior to the final application and declaration of compliance, and it is recommended that it be presented as a CPP. For other certification activities, the certification programme may be documented through the design pack or final application, and does not require formal DASA acceptance. Table 7.1 summarises the certification programme requirements for different design activities.
|
Certification Activity |
DASR Reference |
Formal DASA Acceptance Required? |
Comments |
|
Application for an MSTC
|
Yes |
Certification programme should be presented as a CPP containing the information required by 21.A.93(b) and the supporting AMC. The DASA major change/MSTC CPP template will assist in meeting the required outcomes. |
|
|
Application for a ‘complex’ major change |
Yes |
||
|
Application for a ‘simple’ major change |
Yes |
Certification programme can be provided with the final application for approval of the change. |
|
|
Minor change to type-certificate |
No |
|
Table 1: Certification Programme Requirements for Design Change Activities
7.2.3.28 Two CPP templates are published on the DASA website (one for MTCs and one for major changes/MSTCs), which provide detailed guidance on the structure and content of a certification programme. This section should be read in conjunction with the major change/MSTC CPP template.
7.2.3.29 The organisation(s) involved in the development and submission of a certification program for a major change or an MSTC application will vary depending upon the platform support arrangements. As noted above, the design organisation that supports the MTC holder functions may act as the applicant on behalf of the MTC holder in certain circumstances. In these cases, the design organisation will usually develop the CPP and engage with DASA for formal acceptance when required.
7.2.3.30 Simple Major Changes. For ‘simple’1414 major changes, the certification programme may be presented with the final application (ie with the Form 31a pack). This approach introduces a risk that if DASA identifies issues with the certification programme, or with the decision to treat the change as simple, there may be a requirement for rework of compliance demonstration activities, resulting in a delay to the program. As such, this approach should only be followed where the change is straightforward; for example, OEM Service Bulletins that have received CAA/MAA certification. If there is doubt as to whether a change would meet the definition of ‘simple’, DASA Type Certification section should be contacted for advice.
7.2.3.31 Contents of a Certification Programme. DASR 21.A.93(b) outlines the requirements for content of a certification programme for a major change or an MSTC.
7.2.3.32 Certification programmes must be tailored to meet the requirements of the certification activity. If a change has been assessed as ‘simple’, then there is no need to do a full breakdown of the programme into CDIs or to provide a detailed LoI proposal, as the LoI must be assessed as nil to meet the definition of a simple change. For changes that rely on prior certification, the breakdown of the programme into CDIs is only required for areas that are not able to fully leverage prior certification (ie where additional compliance demonstration evidence is being developed).
7.2.3.33 For ‘complex’ major changes and MSTC, the certification programme should be presented as a CPP containing the information required by DASR 21.A.93(b) and the supporting AMC and GM. The major change/MSTC CPP template published by DASA will assist in meeting the required outcomes.
7.2.3.34 Further Guidance. Refer to the certification programme information in Section 7.2.2 for further guidance on proposal of CDIs and DASA LoI, as well as certification programme acceptance and updates.
Certification Basis
7.2.3.35 For all changes to a product, the design organisation must identify the areas affected by the change and the corresponding certification basis (airworthiness requirements) for those areas. The applicable airworthiness requirements will depend upon the nature of the change, and can be generalised as follows:
Substantial changes. Some changes are so extensive that a new type certificate is required (refer DASR 21.A.19), and therefore would require an entirely new TCB to be established. Substantial changes for an existing aircraft type are unlikely within the Defence context.
Significant (major) changes. For major changes that are categorised as significant1515 under DASR 21.A.101, then the latest amendment level of the airworthiness requirements referenced in the TCB should be used for the change.
Non-significant (major) changes. For major changes that are not categorised as significant, then the DASR 21.A.101(b) exception clause allows the existing airworthiness requirements in the TCB to be used for the change. DASR 21.A.101(b) also allows the existing airworthiness requirements to be used for a significant change in cases where use of the latest amendment of the airworthiness requirements referenced in the TCB would not contribute materially to the level of safety, or is impractical.
Minor changes. Minor changes, by definition, do not affect the airworthiness of the product. This means that it is appropriate to use the existing airworthiness requirements in the TCB for the change (refer DASR 21.A.95(b)(1) and DASR AMC 21.A.95).
7.2.3.36 As stated above, using the existing airworthiness requirements in the TCB is usually considered adequate for minor changes and non-significant major changes. However, as noted in DASR GM 21.A.93(b)(2), Australia’s WHS Act levies additional obligations on designers, namely to exercise ‘reasonable knowledge’ when determining that any risk inherent in designs has been minimised SFARP. Updates (later amendments) to applicable standards may provide insight into hazards and potential controls that are not identified in the existing TCB. The requirements prescribed in the DASDRM also provide a source of requirements and standards that can assist engineers to satisfy their obligation to exercise reasonable knowledge of hazards and associated controls in aircraft design.
7.2.3.37 The certification programme for the change should identify the proposed certification basis (ie existing or latest amendment level, with justification as required) and any ‘reinvestigations’ required1616.
7.2.3.38 Changed Product Rule. DASR 21.A.101 is commonly referred to as the ‘changed product rule’ and is used by applicants and DASA to establish the certification basis for major changes and MSTCs. The primary decision under the changed product rule is whether the latest amendment of the airworthiness requirements referenced in the TCB must be used (ie significant major change), or whether the nature of the major change allows the existing airworthiness requirements to be used (ie non-significant major change). If an applicant elects to comply with the latest amendment for a major change that could otherwise be categorised as non-significant, then the change will be compliant with DASR 21.A.101(a) and no further justification would be required.
7.2.3.39 DASR GM 21.A.101 contains extensive guidance and a step-by-step process for applicants to follow in order to establish the proposed certification basis for the major change. A summary of the changed product rule criteria and outcomes is shown below in Table 7.2. Table 7.2 is taken from Appendix B to GM 21.A.101, and only provides a brief summary of the extensive guidance and step-by-step process contained in DASR GM 21.A.101. A number of the Appendices to GM 21.A.101 refer to the EASA GM 21.A.101, including Appendix A of EASA GM 21.A.101 which provides examples of changes that EASA, the FAA and other Authorities considered to be ‘substantial’, ‘significant’ and ‘non-significant’.
Table 2: Establishing Certification Basis for Changed Products
7.2.3.40 Significant major changes shall also comply with the relevant ‘essential’ design requirements defined in the DASDRM (refer DASR AMC 21.A.101).
7.2.3.41 Note that for major changes, DASR 21.A.101(e) is a further exception clause that allows applicants to propose an alternative to the airworthiness requirements in the TCB. DASA may agree to the use of an alternative set of airworthiness requirements provided the alternative provides at least an equivalent level of safety to the existing TCB.
7.2.3.42 The process and justification used to comply with DASR 21.A.101 should be included within the certification programme, and the DASA major change/MSTC CPP template contains specific headings to include this information.
7.2.3.43 When applicants believe that the major change under consideration may be significant, or have questions about application of DASR 21.A.101, then engagement with DASA as early as practicable is recommended.
7.2.3.44 Tailoring the TCB. During a certification program, there may be a need to tailor the TCB when seeking a major change approval. This tailoring may be required to supplement the PCC for a specific technology area, to specify later amendments of requirements or to otherwise account for the Defence CRE.
7.2.3.45 Tailoring of the TCB may be required to address a range of situations, such as CRE differences, special conditions, new means of compliance or any other certification issues that require clarification or interpretation.
7.2.3.46 Tailoring of the TCB can be achieved by directly including additional requirements or standards in the Defence TCB, or through use of a MCRI.
7.2.3.47 Annex A to Section 7.2 provides further guidance on tailoring the TCB, including when an MCRI is required and the MCRI categories adopted and employed by DASA, when Operator agreement is required to support TCB tailoring and how that agreement should be achieved, and illustration of the process involved in obtaining DASA agreement for tailoring.
Reclassification of Changes Requiring TCB Tailoring
7.2.3.48 Occasionally, changes to type certificates that would otherwise be classified as minor, are required to be classified as major only because of the need to tailor the TCB. This section outlines an approach to enable these changes to be reclassified to minor, once the TCB tailoring has been agreed. This approach will allow greater use of DASR 21J MDO privileges, and reduce DASA assurance in areas where there is not a clear safety benefit.
7.2.3.49 Reclassification Justification. DASR GM 21.A.91 states that any changes that require an adjustment of the TCB, other than electing to comply with a later amendment of a requirement, must be classified as major. However, it also states that when the strict application of the classification criteria for a design change results in a major classification, the applicant may request re-classification, if justified, and DASA can take the responsibility in re-classifying the change.
7.2.3.50 DASA has identified that, for changes that are classified as major solely due to a need to tailor the TCB, continuing to process these as major changes once the tailoring of the TCB has been agreed imposes additional administrative burden without commensurate safety benefit, and can result in a delay to the introduction of safety improvements or capability upgrades. As such, DASA considers it appropriate for these changes to be re-classified to minor, as allowed by DASR GM 21.A.91, and either directly consumed (if subject to prior certification) or approved by a DASR 21J approved organisation holding appropriate privileges.
7.2.3.51 Reclassification Process (Figure1). Reclassification is only possible once the tailoring of the TCB has been agreed. An applicant may submit the requests for TCB tailoring and reclassification concurrently, allowing a single DASA response, or the reclassification request may be submitted after the tailoring has been agreed. Requests for reclassification are to be submitted via Letter or Minute to DASA via the DIA Type Certification mailbox (dasa.typecert@defence.gov.au). Requests must be submitted by an organisation that meets the eligibility requirements to apply for a major change under DASR 21 Subpart D (ie the MTC holder or a design organisation that provides MTC holder functions as part of establishing holder capability).1717
7.2.3.52 The applicant must provide confirmation that the design would meet the requirements to be classified as minor if not for the tailoring of the TCB. This may be provided as an assessment from a DASR 21J approved organisation that has privileges to classify changes, or by providing evidence of approval as a minor change under the system of a recognised CAA/MAA with an equivalent classification system.
Figure 1: Process for reclassification when TCB tailoring is required
Compliance Demonstration
7.2.3.53 Compliance demonstration evidence comprises of reports, drawings, specifications, calculations, analysis etc. and provides a record of the means by which compliance with the TCB requirements applicable to the change / MSTC is demonstrated. The applicant shall demonstrate compliance with the applicable TCB requirements either:
through compliance demonstration evidence developed by a MDOA holder (or alternative as agreed by DASA); or
through appropriate evidence of prior certification provided by another CAA / MAA.
7.2.3.54 Refer to the ‘Compliance Demonstration’ evidence guidance in Section 7.2.2 for further information.
Application, Approval / Issue and TCDS Update
7.2.3.55 Application. Upon completion of all activities identified within the certification programme, including development of compliance demonstration evidence and DASA LoI, the applicant provides the required declaration of compliance (refer DASR 21.A.20(d)) and formally applies to DASA for approval of a major change, or issuance of an MSTC, using the DASR Form 31A.
7.2.3.56 Issuance. Upon receipt of the application, DASA assures itself that agreed certification programme activities have been completed, and will approve the major change or issue the MSTC.
7.2.3.57 TCDS. As required, DASA will develop and issue the TCDS update concurrently with the major change approval or MSTC issuance.
DASA Assurance
7.2.3.58 DASA independent safety assurance activities occur throughout the type certification process, and will vary in nature, scope and depth based on each individual project. Key DASA assurance activities for obtaining a major change or MSTC include:
DASA acceptance of the certification programme (refer ‘Certification Programme’ section above).
DASA agreement of the TCB, including tailoring (refer ‘Certification Basis’ section above).
DASA Level of Involvement (LoI) in compliance demonstration activities. The term LoI describes DASA’s involvement in the verification of compliance demonstration. DASA LoI can include review of compliance data and information; testing, or witnessing of compliance testing; or inspections (refer DASR 21.A.33(b)). Depending upon the design, DASA LoI may occur over an extended duration and include on-site witness activities. DASA LoI will have been defined in the certification program (refer ‘Certification Programme’ section above). In all cases, DASA LoI activities must be successfully completed prior to the applicant’s declaration of compliance.
DASA assurance activities related to leveraging prior certification. These activities can be broadly described as DASA review of the evidence and artefacts that support the applicant’s claims that prior CAA/MAA certification can be leveraged (refer to the ‘DASA Assurance’ guidance in Section 7.2.2 for more detailed information).
DASA assurance activities related to the final application. These activities typically include review / evaluation of compliance artefacts submitted as part of the final application, approval of the major change or issue of the MTC, and update of the TCDS as required.
Holder Obligations
7.2.3.59 Given the DASR only allows the MTC holder to be the applicant for a major change to an existing MTC, there are no separate DASR holder obligations for major changes, and the MTC holder must undertake the obligations laid out in DASR 21.A.44 for the MTC, including and all major changes thereto.
7.2.3.60 Obligations for holders of an MSTC are laid out in DASR 21.A.118A . However, given DASA’s policy of issuing all MSTCs to the government MTC holder organisation, and the fact that the DASR 21.A.118A obligations are essentially the same as those ofDASR 21.A.44, the MTC holder simply needs to continue to undertake all obligation laid out in DASR 21.A.44 for the MTC and all MSTCs they hold.
7.2.3.61 Refer to Section 7.4.1 for detailed guidance on the DASR 21.A.44 MTC holder obligations.
Overview
7.2.4.1 Data that is used to accomplish repairs needs to be approved by a suitable and competent organisation. Data may be approved through a repair design approval process where DASA is the certifying authority, or through a process where recognition is used. These two broad pathways are covered by DASR M.A.304, which provides the requirements for data that is used to carry out repairs and modifications:
DASR M.A.304(a) and (b) allow data to be used that has been approved by DASA, and by a Design Organisation approved under DASR 21, respectively. In both cases DASA is the certifying authority and the requirements of DASR 21 Subpart M (Repairs) are applicable.
DASR M.A.304(d) allows for the consumption of data that has been approved within the framework of Authorities recognised by DASA. In this instance the repair approval requirements of DASR 21 Subpart M (Repairs) are not applicable. Direct consumption of data is subject to a suitability assessment (see AMC and GM to DASR M.A.304(d)) in accordance with the scope, conditions and caveats of the relevant recognition certificate.
7.2.4.2 This section is relevant to data for repairs conforming to DASR M.A.304(a) and (b) and provides:
an overview of the repair approval process in accordance with DASR 21 Subpart M (Repairs)
guidance for design organisations and MTC holders regarding DASA’s expectations for repair design development and approval
more detailed guidance in the form of a number of common repair scenarios.
7.2.4.3 Guidance regarding use of repair data in accordance with DASR M.A.304, including consumption of data using recognition provisions, is provided in the Section 8.2.
7.2.4.4 Note that additional general information about Repair Design authorisations is contained in Section 5.3 Annex R.
DASR 21 Repair Design Privileges
7.2.4.5 DASR 21 Subpart J privileges related to repair designs include the privilege to:
classify repairs (DASR 21.A.263(c)(1)),
approve minor repairs (DASR 21.A.263(c)(2)), and
approve certain1818 major repairs (DASR 21.A.263(c)(5)).
7.2.4.6 These privileges require the design organisation to have procedures agreed to by DASA, usually by issue of a Military Design Organisation Approval (MDOA). These procedures would normally be documented in a Design Organisation Handbook1919.
Repair Process
7.2.4.7 The overall process for development, approval and embodiment of repairs where DASA is the certifying authority is outlined in Table 7.3. Further guidance, in the form of specific scenarios are outlined in Annex D to Section 7.2 Repair Design Approval Scenarios. Note that the scenarios in Annex D are defined as an aid for explanation, rather than as a series of strict processes.
|
Stage |
Description |
Responsibility |
|
Identify and Assess Damage |
Damage identified for which there is no existing pre-approved solution. |
CAMO |
|
Develop Repair Design |
Repair design data is developed. |
Design organisation |
|
Repair Classification |
Repair classified in accordance with the requirements of DASR 21.A.435a. |
DASA or an appropriately approved design organisation under a procedure agreed with DASA |
|
Repair Certification |
Establish Certification Basis (CB). Demonstrate compliance with required CB elements, Compliance Verification, Declare Compliance. Submit application for approval if required. |
Applicant that meets the eligibility criteria2020 |
|
Repair Approval |
Approval of Repair. The assignment of obligations to the repair approval holder (dependent on classification). |
DASA or an appropriately approved design organisation under a procedure agreed with DASA. |
|
Repair Configuration Management |
Manage the accomplishment of repairs and maintain a record of aircraft configuration, which includes repairs. |
CAMO |
|
Production of Repair Parts |
Produce repair parts. |
Appropriately approved production organisation, under DASR 21 Subpart G or Subpart F, or an appropriately approved maintenance organisation under DASR 145 |
|
Repair Embodiment |
Embody repair. |
Appropriately approved maintenance organisation under DASR 145 or appropriately approved production organisation under DASR 21 Subpart G |
|
Ongoing Holder Obligations |
|
Repair design approval holder |
Table 3: Repair Process where DASA is the Certifying Authority
Repair Design Classification
7.2.4.8 As per DASR 21.A.435a – Classification and approval of Repairs – a repair must be classified as either minor or major in accordance with the criteria laid out in DASR 21.A.435a. Classification of repairs guides DASA to apply appropriate assurance oversight and allows for the obligations of the holder of a repair design approval to be identified. Classification does not affect the certification basis, demonstration of compliance, independent checking or declaration of compliance and, as such, whether a repair is classified as major or minor does not affect the engineering rigour applied to the repair. Repair classification may be made by either DASA or by an appropriately privileged design organisation under a procedure agreed to with DASA2121.
7.2.4.9 DASR GM 21.A.435a states that a new repair – a repair that has not previously been approved for the application being considered on the individual aircraft in question – is classified as major if it has an appreciable effect on structural performance, weight, balance, systems, operational characteristics or other characteristics affecting airworthiness. This is elaborated on to highlight that repairs needing extensive static, fatigue or damage tolerance justification or testing, or requiring methods, techniques or practices that are unusual, are to be classified as major. This GM identifies repairs that require permanent changes to Airworthiness Limitations (AwLs) to be classified as major.
7.2.4.10 The paragraphs below give examples of what may need to be considered in developing a repair classification procedure. Each organisation must develop its own procedure which meets the requirements of DASR 21.A.435a, 21.A.239, 21.A.263 and 21.A.243 and is tailored to the organisations scope of work. However, the considerations below, based on the guidance provided in the GM 21.A.435a and GM 21.A.91, are provided to further clarify DASA’s expectations of such a procedure.
7.2.4.11 For clarity, classification may consider the following three characteristics of the repair design:
Severity – the effect of the repair on airworthiness.
Complexity – the complexity of the design and the certification requirements.
Novelty – whether the design has been developed in accordance with established methods and practices for the repair application in question.
7.2.4.12 Generally repairs may be classified as major except when all of the following criteria are met:
Severity is low. Examples of the types of details that would be expected from repairs of low severity include:
Structural performance, in terms of static strength, fatigue performance, damage tolerance performance, flutter and stiffness characteristics, is unaffected by the repair.
Load paths and load sharing in the vicinity of the repair are unaffected by the repair.
Weight and balance change is not greater than that allowed in the weight and balance manual or Original Equipment Manufacturer (OEM) repair guidance for weight and balance. This includes changes in centre of gravity and load distribution. Weight and balance of control surfaces can be particularly affected by even small changes.
Changes do not affect the operation or redundancy of a system, or an adjacent system.
Changes do not affect operational characteristics.
Other characteristics related to airworthiness, or to environmental characteristics of the platform (such as noise, fuel venting and exhaust characteristics), are not affected including, but not limited to, fire protection, propulsion systems integrity and crashworthiness.
The repair design and the certification requirements are not complex. Examples of the types of details that would be expected from repairs of low complexity include:
Repair requires no or minimal re-assessment or re-evaluation of original certification substantiation data
Repair design elements are straightforward.
Original type certification data is available, or if not available appropriate data can be established without complex engineering, and no assumptions are required in the definition of the certification requirements.
There are no new or novel features to the repair. Examples of the types of details that would be expected from a repair that does not have new or novel features include:
Techniques, methods and practices are those employed in the regular management of the platform and type of defect.
Techniques, methods and practices are those accounted for in the platform Type Design.
7.2.4.13 It is recognised that in some cases not all data will be available at the time of initial repair classification, and so, judgement must be exercised. In the case where later data indicates that the initial classification is no longer valid, a repair may be reclassified. In this case, consultation with DASA and, where necessary, reconsideration of the Certification Programme (CP), is expected.
7.2.4.14 These classification considerations are outlined in Figure 2.
Figure 2 : Repair Classification Principles
Eligibility
7.2.4.15 Applicant eligibility requirements exist to control how designs are developed and presented to DASA for review and inspection. These ensure that DASA has visibility of the applicant’s organisation, understands and has confidence in the generation of compliance documents, artefacts and how the declaration of compliance is made. This provides DASA with confidence in the applicant’s ability to fulfil the obligations of the repair approval holder where applicable. As such applicants for repairs must meet eligibility criteria as defined in DASR 21.A.432A.
7.2.4.16 To be eligible as an applicant for a major repair design approval, the applicant is to either hold an approval under DASR 21 Subpart J, or may seek DASA agreement for the use of procedures setting out the specific design practices, resources and sequence of activities necessary to demonstrate capability, or may be a government organisation which has agreements in place with a design organisation with access to the type design data.
7.2.4.17 Any organisation is eligible to apply for approval of a minor repair design. It is recommended that an organisation considering applying for DASA approval of a minor repair design seeks approval through an organisation holding a minor repair approval privilege under DASR 21 Subpart J, as DASA priorities will likely lead to delays in the approval of minor repairs.
Approval
7.2.4.18 Repair design approvals may be issued by DASA or an appropriately privileged design organisation, in accordance with DASR 21.A.435b.
7.2.4.19 In the case where DASA is issuing a major repair design approval, DASA receipt of a DASR Form 31B should signify the completion of a period of engagement between the applicant and DASA during which the certification activities agreed within the CP have been undertaken2222, including satisfactory DASA inspection of compliance documents. Upon receipt of the application, DASA assures itself that agreed CP activities have been completed, and if assured, DASA issues to the designated major repair design approval holder a signed DASR Form 31B for major repairs under DASR 21 Subpart M.
7.2.4.20 Design organisations approved under DASR 21 Subpart J can approve designs for minor repairs and certain major repairs, subject to the scope and privileges recorded in their terms of approval, and subject to their internal procedures agreed to by DASA. Further guidance based on repair classification is as follows:
Minor Repairs. Most MDOA holders approved by DASA will have the privilege to approve minor repairs that are within the scope of their terms of approval (privilege DASR 21.A.263(c)(2)).
Major Repairs. Some MDOA holders approved by DASA may also have the privilege to approve certain major repair designs that are within the scope of their terms of approval (privilege DASR AMC1 21.A.263(c)(5). The definition of ‘certain major repairs’ is provided in DASR AMC1 21.A.263(c)(5), (8) and (9), and depends upon whether or not the MDOA holder holds the relevant MTC, MSTC or Australian Military Technical Standard Order Authorisation (AUSMTSOA). In all cases, the ability to exercise the major repair approval privilege is subject to additional criteria and limits based on the characteristics of each individual repair design. For MDOA holders who do not hold the MTC, MSTC or AUSMTSOA, each new major repair design should be assessed against the ‘List associated with the privilege’ and the relevant ‘Justification document’ to determine whether the privilege can be exercised. Refer to AMC1 and AMC2 to DASR 21.A.263(c)(5), (8) and (9) for further information on award of, and exercising, the privilege to approve certain major changes.
Holder Obligations
7.2.4.20 Following approval of the repair design, the obligations for the repair are assigned to the holder of the repair design approval in accordance with DASR 21.A.451. For both minor and major repairs these obligations include:
DASR 21.A.4 – Coordination between Design and Production.
DASR 21.A.447 – Record Keeping.
DASR 21.A.449 – Instructions for Continuing Airworthiness.
DASR 21.A.451(a)2 – Specify the markings in accordance within accordance with DASR 21.A.804(a).
7.2.4.21 For major repairs additional obligations of the holder of the repair design approval include:
DASR 21.A.3A – Failures, Malfunctions and Defects.
DASR 21.A.3B – Airworthiness Directives.
DASR 21.A.439 – Production of Repair Parts.
DASR 21.A.441 – Repair Embodiment.
DASR 21.A.443 – Limitations.
DASR 21.A.433(b) – Substantiation Data.
Basic Principles of ICA
7.2.5.1 ICA and maintenance data. ICA is only a subset of all maintenance data that must be complied with in the conduct of maintenance2323. Other sources of maintenance data include Airworthiness Directives (or other applicable requirements or operational directives issued by DASA), modification and repair implementation instructions and applicable maintenance standard practices. ICA should not be used as a collective term for all maintenance data as other sources of maintenance data are derived from different sources and subject to different regulation. This section deals only with ICA, not all forms of maintenance data.
7.2.5.2 Airworthiness requirement. The applicant for an MTC must develop ICA as required by the Type Certification Basis (TCB). Civil primary certification codes used for military products contain clauses (e.g. FAR/CS 23/25/27/29.1529 (aircraft), FAR 33.4 and CS-E 25 (engines), and FAR 35.4 and CS-P 40 (propellers)) that prescribe the content and format of ICA. Products with a military-derived TCB (e.g. from MIL-HDBK-516) have equivalent requirements for the development of maintenance instructions that achieve a similar intent to the civil airworthiness requirements above.
7.2.5.3 Content and scope of ICA. To meet the ICA requirements of a civil airworthiness code (or equivalent requirements of a military-derived TCB), the applicant for an MTC must provide:
Scheduling information for all recommended maintenance tasks. This information is normally contained in a Maintenance Review Board Report (MRBR) (or equivalent document).
Maintenance instructions including those required for servicing, troubleshooting, the methods of removing and replacing items, system testing, ground running, symmetry checks, weighing, towing, jacking, storage limitations etc. This will typically be provided in the form of an Aircraft Maintenance Manual(s), Structural Repair Manual, Fault Isolation Manual, Illustrated Parts Catalogue etc. This information can be amended by the MTC holder (broad scope to amend the master copy) or maintenance organisations approved under DASR 145 (very narrow scope to modify).
Mandatory maintenance requirements in a segregated and clearly distinguishable section of the ICA, typically called the Airworthiness Limitation Section (ALS). The ALS contains the mandatory maintenance tasks and intervals, identified in the type certification process. Specific terminology and requirements for the ALS content will vary depending upon the PCC, however, the ALS will generally include mandatory requirements such as:
Airworthiness Limitations (AwLs). AwLs encompass mandatory retirement / replacement intervals and mandatory inspection requirements (including inspection interval(s) and the inspection method). The term AwLs is most often associated with structural life limits and structural inspections that result from FAR/CS 2x.571 or the equivalent fatigue/damage tolerance requirements in military certification standards. However, the term AwL may also be used for other aircraft systems, such as mandatory replacement times for Electrical Wiring and Interconnect System (EWIS) components. As noted within AMC 21.A.41, the definition of an AwL ‘interval’ includes the interval metric (e.g. flight hours, landings, Equivalent Flight Hours (EFH), Fatigue Index (FI) / Fatigue Life Expended Index (FLEI), engine cycles, etc), and any algorithm, equation, factor(s) or other engineering data which must be used to calculate life accrual against the interval.
Critical Design Configuration Control Limitations (CDCCLs). CDCCLs identify the critical design features such as proper wire separation, proper installation of a panel gasket, minimum bonding jumper resistance levels, etc., that must be maintained in exactly the same manner throughout the life of the aircraft in order to comply with the type certificate and maintain airworthiness. The purpose of CDCCLs is to provide instructions to ensure these critical features are present throughout the life of the aircraft and are inspected and verified when alterations, repairs, or maintenance actions occur in the area. Design features that are CDCCLs are defined and controlled by FAA Special Federal Aviation Regulation (SFAR) 88 and preserves critical features of the aircraft needed for the Flammability Reduction Means to perform their intended function and prevent the occurrence of an unsafe condition.
Certification Maintenance Requirements (CMRs)2424. CMRs are required inspections or maintenance tasks, and associated intervals, developed to achieve compliance with safety analysis requirements (e.g. FAR/CS 25.1309/29.1309, other discrete safety analyses requirements such as FAR/CS 25.671, 25.783, 25.901, and 25.933, and FAR/CS 29 equivalents). A CMR is intended to detect safety-significant latent failures (failures not known to the flight or ground crew) that would, in combination with one or more other specific failures or events, result in a hazardous or catastrophic failure condition. A CMR can also be used to establish a required task to detect an impending wear-out of an item whose failure is associated with a hazardous or catastrophic failure condition.
7.2.5.4 ICA and the MTC. Even though a complete set of ICA is required to obtain an MTC, only the ALS of the ICA (or equivalent terminology including CDCCLs and CMRs) forms part of the type design2525 however, they do form part of the Type Certificate. Stand-alone amendments to ICA, other than the ALS, are allowed to be changed by the MTC holder using a procedure agreed with DASA. Note: when completing a stand-alone change to ICA other than the ALS, the MTC holder is not exercising a privilege, but is instead fulfilling their obligation to keep the ICA current2626. Changes to the ALS of the ICA must be processed as a change to the MTC, and should be classified as a major change2727.
7.2.5.5 Identification of ICA. The complete set of ICA for any product should be identified on the TCDS. Other information or instructions required for continuing airworthiness or safe operation of the aircraft, e.g. the approved Aircraft Maintenance Programme (AMP) or a Minimum Equipment List (MEL), is not ICA and is not subject to regulation applicable to ICA.
7.2.5.6 ICA supplements. Some major changes to an MTC, MSTCs, minor changes or minor/major repair designs may require variations to the product’s ICA2828. Variations to ICA arising from these design changes or repairs stand-alone from the product’s master ICA and are published as an ICA supplement2929. This gives the aircraft operating organisation the flexibility in managing the ICA applicable to their aircraft, depending on which approved changes and repairs they have chosen to embody. The approval of ICA supplements (including any changed or additional mandatory maintenance requirements) are encapsulated in the approval of the design change or repair. ICA supplements should be identified on the Supplemental Type Certificate Data Sheet, or on the minor change or repair design approval.
7.2.5.7 ICA and the AMP. The approved AMP in and of itself is not ICA for the simple reason the ICA requirements of the TCB do not mandate an AMP to be developed by the applicant for an MTC. The recommended maintenance tasks and intervals in the MRBR and the mandatory maintenance requirements identified in the ALS, combined with other requirements unique to each operator’s role and usage (including data from a reliability programme) forms the basis for approval of each operator’s AMP.
7.2.5.8 The maintenance instructions provided by the MTC holder (or ICA supplements provided by other design approval holders) will provide detail on how to carry out the tasks and inspections in the AMP and should only be amended by the MTC holder (or other relevant design/repair approval holder for ICA supplements) – see paragraph 7.2.5.4 above. Mandatory maintenance requirements must be clearly identified as mandatory in the AMP and cannot be extended without a corresponding approval of a major change to the MTC, or issue of an MSTC. Other ICA must be changed by the MTC holder using DASA agreed procedures. Changes to other recommended task and inspection intervals in the AMP can be approved by a CAMO using a procedure agreed with DASA, without requiring approval of a change to the MTC3030.
Responsibilities for ICA
7.2.5.9 MTC holders. The MTC holder is Defence’s custodian of the product’s ICA regardless of its original author. The MTC holder is responsible for the ICA’s content, amendment and distribution to all organisations that operate the aircraft. The MTC holder can amend the ICA (in accordance with approval processes) and must distribute amendments to those organisations affected. If a change to a mandatory maintenance requirement is required, the change must be approved by DASA before distribution of the amendment. The MTC holder’s processes for discharging its responsibilities for ICA (even if exercised through external organisations) must be included in the MTC holder’s Type Continued Airworthiness Exposition (TCAE). Regardless of a product’s TCB, the MTC holder should be able to identify all ICA and have that documented in the TCDS.
7.2.5.10 Other design/repair approval holders. Holders of an MSTC, minor change approval or repair design approval have the same responsibilities for their ICA supplements as the MTC holder has for the product’s master ICA.
7.2.5.11 Aircraft operating organisations. Continuing Airworthiness Management Organisations (CAMOs) are required to ensure all their maintenance service providers have access to ICA (and ICA supplements) to the extent necessary for the scope of maintenance services being provided.
7.2.5.12 Maintenance organisations. Maintenance organisations conducting aircraft, engine, propeller or component maintenance are required to comply with all applicable ICA and relevant ICA supplements. Maintenance organisations may locally modify ICA or ICA supplements using an approved procedure specified in their Maintenance Organisation Exposition (MOE) only for the purposes of efficiency, achieving the intent of the ICA when the instructions are deficient, or for the use of alternative tools/equipment3131. A maintenance organisation must notify the MTC holder (or relevant design approval holder in the case of ICA supplements) when it has locally modified ICA, so consideration can be given to amending the master copy for wider distribution. A maintenance organisation modifying ICA for the purposes stated above does not constitute approving an amendment to the ICA (i.e. the source document) held by the MTC holder (or ICA supplement held by another design approval holder). Only the MTC holder or holder of the ICA supplement can approve amendments to ICA, noting the need to also seek approval of a major change to the type certificate if the amendment alters any mandatory maintenance requirements.
Non-Destructive Testing (NDT) ICA
7.2.5.13 NDT ICA are applied to ensure the airworthiness of aircraft through the inspection of aircraft structure and components. NDT ICA is often used as part of damage tolerance inspection regimes to ensure structural integrity. Consequently, it is critical to ensure that NDT ICA is developed by competent staff and provides sufficient information to enable NDT staff to perform inspections effectively.
7.2.5.14 NDT ICA provided to a DASR 145 Maintenance Organisation should include the following minimum information:
the inspection procedure to be used
the inspection area
the material type of the inspection area
the type of discontinuities to be detected.
7.2.5.15 Those organisations responsible for developing NDT ICA (DASR 21J Design Organisations, MTC holder) should consider using NDT Level 3 staff (as defined in EN4179) to verify that inspections are achievable, repeatable and meet the expected detection requirements of the design or repair. This is especially important where NDT ICA is used to support an AwL.
7.2.5.16 The procedure for approving or modifying NDT ICA should be documented in the relevant organisation exposition. DASA recommends that personnel certified to NDT Level 3 in the relevant method be employed to approve and/or modify existing NDT ICA for application in specific circumstances. This accords with the requirements of European Standard EN4179.
Master Minimum Equipment List (MMEL)
7.2.5.17 An MMEL is a document created specifically to permit the continued operation of an aircraft type with unserviceable equipment. It is a list of items of equipment that may be temporarily unserviceable / inoperative under certain conditions and limitations, while still maintaining the level of safety intended in the design standards. The MMEL cannot, in itself, be regarded as providing operational permission. It, however, can be the basis for the development of an individual Operator’s Minimum Equipment List (MEL).
7.2.5.18 An MMEL forms part of the MTC. Approval of new MMEL or an MMEL amendment should be undertaken in accordance with the relevant DASR 21 Subpart3232. Further guidance on MMEL development and approval in contained in Chapter 8.2.2, including information on:
typical characteristics and contents of an MMEL
options for developing an MMEL
suitable certification specifications for an MMEL
classification (major/minor) for changes to an MMEL
the DASA MMEL approval process.
7.2.5.19 Note that DASA is currently evaluating EMAR 21 version 2.0 changes that introduce the Operational Suitability Data (OSD) concept and requirements. MMELs are considered a category of OSD, and therefore, this section will be updated in the future once the relevant DASR 21 updates have been incorporated.
Basic Principles for Manuals
7.2.6.1 Types of Manuals. As per DASR 21.A.57, the holder of a type‐certificate shall produce, maintain and update master copies of all manuals required by the applicable TCB.
7.2.6.2 Manuals (for the purpose of DASR 21.A.57) will fall into one of two broad categories:
Aircraft Flight Manual (AFM). The AFM is an authoritative source of information necessary for the safe operation of an aircraft. It contains the aircraft’s operating limitations, operating procedures, performance information and other information and instructions necessary to operate the aircraft safely. Note that this information may be contained in several documents that contain limitations, information and instructions to ensure safe aircraft operation. Examples of other documents/publications (in addition to the AFM) may include a Flight Crew Operating Manual, Mission Crew Operating Manuals and Pilot Handling Notes.
Manuals Containing ICA. Certification codes require that the ICA must be published in the form of a manual or manuals3333. The relevant certification code requirements will dictate the specific ICA content that must be published. Due to the broad and varied type of information that must be published, ICA for a particular aircraft type will usually be distributed through a variety of manuals, such as Aircraft / Engine / Propeller Maintenance Manual, Structural Repair Manual, Engine / Propeller Installation Manual. As noted above at paragraph 7.2.5.5, the MTC holder should be able to identify the publications and manuals that meet the intent of ICA requirements.
7.2.6.3 AFM Guidance. DASA AC 008/2020 contains detailed information on AFM content and approval, amending AFM content and use of AFM supplements. Further information specific to changes to type certificates which affect AFMs include:
DASR GM 21.A.91 which contains guidance for the classification of changes to AFMs
DASR AMC3 21.A.263(c)(2) which contains information on approval of minor changes to the type certificate which affect the AFM.
7.2.6.4 Approval of Manuals. Even though particular manuals are required by the TCB and therefore required to obtain an MTC, only certain contents of manuals will form part of the enduring MTC and / or require DASA approval. Contents of manuals that requires DASA approval includes:
The ALS of the ICA3434 (i.e. as published within a maintenance manual). Refer Section 7.2.5 for further guidance.
Mandatory AFM content (Operating Limitations, Operating Procedures and Performance Information). Refer DASA AC 008/2020 for further guidance.
7.2.6.5 Consequently, amendments to other manual contents is not a change to the MTC and can be undertaken by the MTC holder using a procedure agreed with DASA. Furthermore, as noted by AMC1 21.A.57, the process to update a manual may be separate from the process to approve or authorise the content of the manual3535.
7.2.6.5 Manuals in the Context of Defence Aviation Orders, Instructions and Procedures (OIP) Management. Manuals (for the purpose DASR 21.A.57) are part of the Defence Aviation OIP for the platform type. Lifecycle management of Defence Aviation OIP is discussed further in Section 6.7. A key message of Section 6.7 is that in addition to accuracy and completeness of OIP (a well-established principle in DASR 21), the usability / readability of OIP can cause or contribute to aviation safety hazards. Therefore, aviation safety hazards related to Defence Aviation OIP should be managed through an organisation’s SMS. Note that this principle is consistent with DASR GM1 21.A.239(a) paragraph 3.1.5 which states that design organisations should “establish a system to collect in-service experience to be used for the improvement of the [maintenance and operating] instructions”.
Responsibilities for Manuals
7.2.6.6 MTC Holder. In order to meet their obligation under DASR 21.A.57, the MTC holder should establish a system to produce, maintain and update manuals. As per DASR AMC 21.A.57, this system should ensure:
manuals are complete, current, and uniquely identified;
manuals contain their authority for use, document name, date of issue, and document/amendment status details;
manuals are provided in a medium compatible with user requirements;
new issues, re-issues and/or amendments are approved and/or endorsed by appropriate appointments prior to their release, noting that the process to update a manual may be separate from the process to approve or authorise the content of the manual, eg approve AwL in ICA;
manual management records are accurately maintained, controlled, traceable and are accessible; and
manuals can be reproduced to any previous amendment status.
7.2.6.7 Other design/repair approval holders. Holders of an MSTC, minor change approval or repair design approval have the same responsibilities for their manuals or manual supplements as the MTC holder has for the product’s master set of manuals.
7.2.6.8 Aircraft operating organisations. The operating organisations must manage and distribute the AFM and all other relevant manuals as part of their OIP Management System3636. Continuing Airworthiness Management Organisations (CAMOs) are required to ensure all their maintenance service providers have access to all relevant manuals to the extent necessary for the scope of maintenance services being provided. The operating organisation should manage any aviation OIP related hazards through their SMS, and coordinate with the MTC holder, or applicable design organisation, as required to effect any necessary updates or improvements to manuals.
7.2.6.9 Maintenance organisations. Maintenance organisations conducting aircraft, engine, propeller or component maintenance are required to comply with all applicable manuals. Maintenance organisations shall establish procedures to ensure that if found, any inaccurate, incomplete or ambiguous procedure, practice, information or maintenance instruction contained in the maintenance data used by maintenance personnel is recorded and notified to the author of the maintenance data3737.
7.3 Production and Military Certificates of Airworthiness
Aim
7.3.1.1 This chapter details how the production of aircraft components is assured in the Defence Aviation Safety Program (DASP). This includes what release documentation is acceptable under DASRs, and the means through which that documentation is obtained. This chapter only covers aircraft components and does not include whole aircraft. For whole aircraft see MCoA - Chapter 5.3 Annex O and MPO – Chapter 7.6.
Introduction
7.3.1.2 Production of Defence registered aircraft is assured by DASA through the issue of Certificates of Airworthiness. For Certificates of Airworthiness to remain valid through the life of the aircraft, only components accompanied by acceptable release documentation may be installed on the aircraft. Acceptable release documentation can take various forms, depending on the means through which production is assured.
Acceptable release documentation
7.3.1.3 The purpose of release documentation is to provide evidence that the manufactured component conforms to approved design data. Aircraft components to be installed on Defence registered aircraft must be accompanied by one of the following release documents:
DASR Form 1—Authorised Release Certificate.
A native or alternate component Certificate of Release to Service (CRS) issued within a recognised airworthiness framework (refer to Chapter 6.5 —Recognition of other Aviation Authorities for identification of a native and alternate component CRS).
For standard parts or items designated as specific equipment under DASR 21.A.303, a Certificate of Conformity from the item’s manufacturer (refer AMC to DASR 145.A.42(a)(4)).
For components fabricated under DASR 145.A.42(c), certificates of conformity produced by the fabricating maintenance organisation that are acceptable to DASA.
7.3.1.4 Release documentation under (a), (b) or (c) above enables that component to cross organisational (and possibly national) boundaries between its manufacture and installation. Manufactured components that do not need to cross organisational boundaries can be installed with locally produced certificates of conformity that contain all of the technical information found on a DASR Form 1 per item (d) above.
DASA production assurance
7.3.1.5 DASA assures production of all Defence aircraft components using one of three mechanisms depending on the release documents required by continuing airworthiness regulations. This is depicted below in Figure 3.
Assurance through Recognition Frameworks
7.3.1.6 The majority of aircraft and aircraft component manufacture for Defence occurs outside Australia and is assured through DASA’s recognition framework. To be installed on a Defence registered aircraft, these components must be accompanied by a recognised native (Form 1 equivalent) or alternate release certificate. Each DASA Recognition Certificate provides details on the unique conditions and caveats to be applied to validate the native or alternate release certificates. Production of components assured through recognition do not require a DASR Form 1 as it provides no additional safety assurance above what is inherent under the recognition framework.
Assurance through DASR 21 – production by Military Production Organisation Approval (MPOA) or letter of agreement holder
7.3.1.7 Components manufactured outside of a recognised airworthiness framework (other than standard parts, specific equipment or components fabricated under DASR 145.A.42(c)) require a DASR Form 1 for installation. To issue a DASR Form 1 an organisation must hold a Military Production Organisation Approval (MPOA) under DASR 21 Subpart G, or a letter of agreement to manufacture under DASR 21 Subpart F . In this instance, the award and oversight of MPOA is DASA’s assurance mechanism for the production of such components.
7.3.1.8 The only organisations that DASA will consider for award of MPOA are those that do not hold a recognised approval that enables release of the manufactured components under a native or alternate artefact (see Chapter 6.5 —Recognition of other Aviation Authorities). That is, the requirements of DASR 21 Subparts G will be imposed on an organisation for the sole purpose of issuing a DASR Form 1 for the manufactured components.
Assurance through DASR 145 – fabrication by maintenance organisations
7.3.1.9 DASR Form 1 must not be used for components fabricated by maintenance organisations under their DASR 145 approval. A locally produced certificate of conformity must be used instead. DASA’s assurance of this production is via the issue and oversight of the organisation’s DASR 145 approval. A DASR 145 MO will only have this activity included in the scope of their DASR 145 approval if they can sufficiently demonstrate their capability to perform such fabrication. Note that unless otherwise approved by DASA, only the DASR 145 MO who fabricated the component can install this component.
Figure 3: Production Assurance and Release Documentation under DASP
Manufacture and release of test articles
7.3.1.10 If a test article is manufactured to gather certification evidence, the responsibility to control the manufacture of that article and ensure it accurately reflects the proposed design data rests entirely with the organisation seeking certification of the design. For test article manufacture required to achieve certification of a major change, the Certification Programme should describe the production control processes that will be used by the applicant in producing the test articles. If DASR Form 1 is used to release a test article for trial installation in an aircraft, Block 12 of the DASR Form 1 must clearly state that the article is in conformity with non-approved design data. The manufacture of test articles for certification does not require MPOA under DASR 21 Subparts G or a letter of agreement under DASR 21 Subpart F. These principles also apply for minor changes being approved under MDOA privilege.
Manufacture of modification kits
7.3.1.11 Maintenance organisations approved under DASR 145 may fabricate modification kits and issue certificates of conformity provided (a) the scope of their DASR 145 approval allows it, and (b) the completed modification kit will be installed by the same maintenance organisation (and under the same DASR 145 approval) issuing the certificate of conformity. Modification kits meeting both criteria above must not be released using DASR Form 1, but must still be manufactured to the approved design data and have locally produced certificates of conformity attesting to that fact. Fabrication of modification kits for onward supply cannot be performed under a DASR 145 approval and constitutes series production that must be assured by either recognition or through DASR 21. Modification kits manufactured external to the installing maintenance organisation must be accompanied by a DASR Form 1, or release documentation acceptable to DASA through recognition.
Further information
7.3.1.12 Chapter 6.5 —Recognition of other Aviation Authorities
7.3.1.13 Chapter 8.3.4 —Acceptance of Aircraft Components
7.3.1.14 GM to DASR 21.A.303(c) – Officially Recognised Standards
7.3.1.15 AMC to DASR 145.A.42(c) – Acceptance of components
7.3.1.16 DASR 21 Subpart G – Military Production Organisation Approval
Introduction
7.3.2.1 This section supplements the DASP policy and provides guidance in support of DASR 21, Subpart H relating to MCoAs, their purpose, and their issue. The guidance included in this section discusses the MCoA concept and application from both an Australian Defence context, and where appropriate for the purposes of description, a civil aviation context.
7.3.2.2 Restricted MCoAs are also discussed where appropriate; however, such MCoAs are of limited utility in the Australian Defence context, and unlikely to be issued.
Purpose
7.3.2.3 A MCoA is an aircraft operating authorisation issued against an airframe tail that has the purpose to validate that the airframe conforms to the type design as specified on the Military Type Certificate (MTC). It serves as the final assurance artefact that the airframe is in a state of airworthiness per the inherent level of safety afforded by the type design and the underlying MTC basis. It is enabled by an organisation or operator, who has registered the airframe on the Australian Defence register, and has ensured conformity through meeting various requirements.
7.3.2.4 A restricted MCoA will follow the same rules albeit that the airframe shall conform to a restricted MTC and to specific airworthiness requirements ensuring adequate safety.
Application
7.3.2.5 MCoAs in the Australian Defence context can only be issued by the DASA or a Delegate of the Safety Authority (DoSA). The release document is via a DASR Form 25 Military Certificate Of Airworthiness and applies only to aircraft that are registered on the Defence register in Australia.
7.3.2.6 An application for a MCoA shall be made by an eligible organisation via DASR Form 25a - Application for Certificate Of Airworthiness. In the Australian Defence context, the MAO and/or their CAMO are eligible to be applicants for a MCoA as holders of a MAOC. Aircraft that are Non-Defence Registered (NDR) are not subject to Airworthiness DASRs, and are subject to a separate airworthiness requirements, typically under the applicable airworthiness Civil Aviation Safety Regulations. See further DASP Vol 3 guidance on NDR at Chapter 6.1.3.
7.3.2.7 A MCoA application shall be made in a form and manner established by the Authority (DASA in Australia) of the State of Registry3838, per DASR.21.A.174(a). When considering a MCoA application, the Authority will consider all documentation in support of the state of the airframe at application. This has particular significance for used aircraft, where records of usage, maintenance, modifications and repairs may not be to the standard normally required by Defence.
7.3.2.8 The MCoA application presents documentation that the aircraft conforms to the type design approved under the relevant MTC. The required documentation, artefacts, reports and historical evidence (if applicable) to support the application shall be in accordance with DASR.21.A.174(b). Any deviations from the certified type design must be approved by an appropriately authorised design organisation.
7.3.2.9 For used aircraft, DASA will require a Military Airworthiness Review Certificate (MARC) conducted in accordance with DASR Part M regulations before issuing an MCoA. The MARC review is a physical survey of the aircraft and supports issue of the MCoA to satisfy DASA that the submitted documentation is reflective of the physical aircraft. The MARC process is further discussed as part of paragraphs 7.3.2.15 and 7.3.2.16 of this section.
Issue of a MCoA
7.3.2.10 A MCoA can only be approved and issued if all modifications, repairs and/or production deviations implemented on the airframe are approved under DASR 21, or under a recognised national civil or military airworthiness framework.
7.3.2.11 For new civil or commercial derivative aircraft (CDA) delivered to Defence, the acquisition project should seek a civil export CoA from the Civil Aviation Authority (CAA), via the prime aircraft OEM, where a civil Type Certificate (TC) is in place. This export CoA needs to be obtained prior to transfer to the Defence register, and forms the foundation for the issue of an Australian MCoA. Failure to obtain an export CoA for a civil or CDA may limit DASA’s ability to issue an evidence based MCoA.
7.3.2.12 For instances where a civil Type Certificate (TC) is not in force or Defence is leasing an aircraft that has been in civilian use, the requirement for a CAA CoA can be demonstrated if a CAA authorised delegate provides a document that attests the aircraft would be eligible for issue of a Standard or Export CoA, if the aircraft was to be registered by a Civil Aviation Authority. Defence will accept only a Standard CoA under DASR 21.A.172, DASR 21.A.173 and DASR 21.A.174. DASA-DIA staff should be consulted for specific advice.
Validity and Amendment
7.3.2.13 The MCoA Holder (typically the MAO) is responsible for the continuing validity of an MCoA. A MCoA may be amended or modified only by the Authority (DASA in Australia) of the State of registry3939. A MCoA may be issued for an unlimited duration, and remains valid subject to the conditions described in DASR.21.A.181.
7.3.2.14 Additionally, the ongoing validity of a MCoA requires that damage be assessed, and all applicable modifications and repairs carried out, using as appropriate the data requirements of DASR.M.A.304.
7.3.2.15 The validity of a MCoA is periodically renewed via the MARC process, as per DASR.M.A.901. This involves an airworthiness review of the aircraft and its continuing airworthiness records. The initial airworthiness review is due within 12 months of the issue date of the aircraft's initial MCoA. The validity of MARCs issued by a CAMO may be extended twice for a period of one year each time if the aircraft has been in a controlled environment.
7.3.2.16 The MAO is accountable for the continuing airworthiness of an aircraft and shall ensure that no flight takes place unless the MCoA and the MARC remain valid, as per DASR.M.A.201. If a MCoA becomes invalid, the MAO must return the aircraft to an airworthy condition before operating the aircraft or seek an alternate flying authorisation. A new MCoA is only required if the aircraft is being returned to the Defence register after removal, or the certificate is revoked by the Authority (DASA in Australia) of the State of registry4040
Useful Readings
DASA Website (Content relating to MCoAs)
DASR Form 25a – Application for Certificate Of Airworthiness
DASR 21 – Aircraft Design, Production and Certification
DASR M – Continuing Airworthiness Management
Introduction
7.4.1.1 A Military Type Certificate Holder within the DASR framework provides Defence a suitable entity to ‘hold’ the Type Certificate. Holding the type certificate involves undertaking certain obligations that ensure the type certificate is managed and that the inherent safety that the platform type certification basis affords is maintained.
7.4.1.2 Unlike civil TC obligations, Defence MTC obligations are not enforceable via national legislation, meaning there is no enduring obligation under law for foreign organisations to manage the basis of certification through the product’s life cycle. Therefore, in the application of DASRs, the Defence MTCH is a government organisation, most likely the organisation that acquired the product under contract.
Application of DASR provisions for the MTCH
7.4.1.3 The following principles guide the application of the above regulatory provisions:
Principle 1. DASA issues an MTC for Defence registered aircraft types. Unlike the civil context, a separate TC for the aircraft power plant and/or propeller has not been issued thus far and is nominally included as part of the platform TC.
Principle 2. DASA shall only issue MTCs to suitable Commonwealth government organisations (the holding organisation) to hold the MTC. The holder is responsible for ensuring that holder functions/obligations are executed. In the Defence context, the MTCH is able to achieve the regulatory intent via a direct or indirect arrangement with the aircraft/engine OEM.
Principle 3. Military Supplemental Type Certificates (MSTCs) will also be held by the MTCH or holding organisation, with the MTCH responsible for carrying out all MSTC functions/obligations. An MSTC in the Defence context can supplement the MTC for managing sub-fleets, significant changes to the TCB, large and complex changes. They are not used to achieve a commercial outcome such as in the civil design domain.
MTCH Safety Objectives
7.4.1.4 The MTCH has two aviation safety objectives:
To support the safe operation of the aircraft type by command units. Achieving Defence strategic objectives requires continuous capability enhancement, and at times, the conduct of operations at markedly elevated levels of risk. In addition, operators of aircraft will require explanatory information, advice and data to operate the type safely. The MTCH must have access to type design data, or support arrangements with the aircraft/engine OEM for the provision of designs and advice to support safe operation of the type.
To continuously monitor the type in service and ensure the ongoing validity of the Type Certificate, by investigating issues and providing corrective actions where required. The initial certification of a type establishes the known and understood level of safety inherent in the standards against which it was certified. Through the life of the type, latent hazards within the certified design, not identified during initial certification, may emerge requiring some action to address. Similarly, the use of the aircraft may vary and new designs be incorporated. Regardless, the MTCH has the high level objective to maintain the level of safety intended during initial certification.
Australian Context
7.4.1.5 The MTCH must account for the unique Defence context where the MTCH is not the OEM of the type and noting that the DASR are an amplification of the broader Work Health and Safety4141 obligations for the Defence aviation environment. In this context, the MTCH is the steward of the Defence type in service. To fulfil this role:
The MTCH should be broadly aware of all historic and emerging hazards relevant to their type4242. This awareness requires:
The collection of relevant aviation safety information (occurrences etc.) from within the Defence aviation system;
The collection of relevant aviation safety information (occurrences, service bulletins, airworthiness directives etc.) from operators and authorities of similar types; and
Consideration and conduct of additional verification activities(such as test programs) to generate further data independently and as necessary.
The MTCH is to lead the risk management of the type for the life of type, from initial certification to withdrawal from service. This leadership includes:
Ensuring operators are made, and remain, aware of the hazards extant in their type;
Ensuring that essential risk controls (both technical and operational) pertaining to the safety of the type are, and remain, effective;
Leading local efforts to eliminate or further minimise known hazards;
Influencing external organisations (such as OEMs, joint user groups, co-operative partnerships etc.) to eliminate or further minimise known hazards.
MTCH Structure
7.4.1.6 To support these safety objectives, the MTCH organisation is broadly structured around two key systems, as detailed in Figure 4. These systems are responsible for the interactions regulated by DASA and are required elements of the MTCH supporting organisation.4343 They are:
The Safety Management System (SMS). This system ensures that the MTCH will collect operational data, analyse that data, investigate potential safety concerns and provide corrective actions.
The Design Assurance System (DAS). This system provides products (for example Service Bulletins correcting deficiencies, publication updates etc.) to operators of the Type.
Figure 4: Safety Structure pyramid
7.4.1.7 Note that the safety management and design assurance systems are generic and are broadly applicable to all MTCH structures and implementations noting their varying constructs. It is likely that in implementing the systems, each MTCH through their partner organisation will employ business processes specific to their context. For example, the MTCH may rely upon long standing Defence engineering processes such as Technical Information Review, System Safety Working Groups and Configuration Control Boards to achieve the SMS intent. Similarly, the DAS of a foreign design organisation may not be entirely aligned with the requirements described in DASR 21.A.239 invoking the need to utilise Authority recognition arrangements.
7.4.1.8 Each organisation that holds a Type Certificate will be different and the model outlined in Figure 4 will not be a one-size fits all construct. It is appropriate that each organisation will implement these functions with different size, scale, or complexity, dependent on their need. For example, a CDA may rely on a large portion of sub-contractor products from civil aircraft OEMs operating under legislated civil safety constructs, and thus will not require a large compliance verification element.
MTCH Responsibilities
7.4.1.9 In the Australian Defence context, the government organisation holding the MTC is usually relatively small and is supported by one or more other organisations (contractors, foreign Defence organisation, OEMs etc.). As a result, responsibility for the conduct of MTCH obligations is often vested with these support organisations. This has led to confusion regarding accountabilities. To clarify:
Regardless of the organisational construct, the government organisation is the MTCH, and is accountable for all activities undertaken by its partners with respect to the obligations of the MTCH.
As such, it is unlikely that a passive compliance assurance relationship between the government organisation and its partners will suffice. DASA needs to be assured that the MTCH is able to meet its obligations – this may require the government organisation to lead key MTCH activities and be active in resourcing, prioritising, and implementing MTCH activities to ensure continued airworthiness and supporting safe operation of the type by the operator.
Eligibility to hold an MTC
7.4.1.10 A government organisation can be eligible to hold an MTCH under one of three regulatory provisions when applying for an MTC:
DASR 21.A.14(a). This provision is applicable where the government organisation has demonstrated its capability by holding a Military Design Organisation Approval (MDOA), and thus meets the requirements of DASR Subpart J and is capable of performing design activities (including the finding and declaration of compliance) across the key design disciplines relevant to their platform using internal or organic resources.
DASR 21.A.14(b). This provision is an exception to subpart (a) where the organisation has no demonstrated capability, but may be able to obtain an MDOA in the future, and thus alternative procedures can be used in the starting phase as an organisation moves toward an MDOA or where there are limited duration design activities that may be required (such as initial certification of a platform).
DASR 21.A.14(c). This provision is an exception to subparts (a) and (b) where the government organisation is not capable of meeting the requirements of Subpart J and/or performing design activities (including the finding and declaration of compliance) across the key design disciplines relevant to their platform using internal or organic resources. In this instance, the government organisation is entirely reliant upon partners to meet the requirements of Subpart J.
Initial Assessment of MTCH capability
7.4.1.11 In the Defence context, assessment of the capability of the MTCH occurs in parallel to certification of the aircraft type, but must be completed before a Type Certificate can be awarded to the MTCH. DASA assessment of MTCH capability will include:
An initial assessment of the organisation’s personnel, processes, resources and support arrangements to establish that the MTCH will be able to perform/carry out the MTCH obligations outlined in DASR 21 and that the processes are present and suitable.
Supplementary on-site activities such as observing System Safety Working Groups, or reviewing Failure, Malfunction, and Defect data collected, in order to establish that the organisation is operating and effective.
An assessment of the MTCH Type Continued Airworthiness Exposition (TCAE). The TCAE describes all MTCH arrangements in order to execute the holder obligations and maintain the integrity of the type certificate. The broad content of the TCAE shall include, but is not limited to the description of the MTCH framework, design support arrangements, processes, procedures, governance, resources, and MAO/CAMO interfaces in place to meet the regulatory intent for the platform. In addition, the TCAE should include a detailed compliance matrix explicitly describing their arrangements in place to execute each MTCH obligation. The TCAE is the appropriate document where nuances particular to the platform and/or MTCH arrangements shall be described for Authority awareness and/or proposed alternative means of compliance.
MTCH Oversight & Enforcement
7.4.1.12 Oversight and Enforcement on the MTCH will be conducted by DASA as assurance activities in either a routine or a targeted format. The activities will have the objective to assess a MTCH organisation in their execution of MTCH obligations and functions. The scope of the assessment may involve any of the explicit and/or implicit obligations and may be a result of feedback received to warrant an assurance activity. Findings will be issued for non-compliances; however, the DASA team carrying out the assessment also looks to provide outcomes aiming to improve the overall effectiveness of the MTCH organisation. Oversight and enforcement on the MTCH arrangement will be based on the MTCH executing their obligations in accordance with the regulatory intent and their TCAE.
7.4.1.13 Further guidance on the DASA oversight and enforcement framework is provided in DASP Vol 3, section 4-1-5
MTCH Obligations
7.4.1.14 Within the DASRs the MTCH have the following obligations.
DASR 21.A.3A – Failures Malfunctions and Defects
7.4.1.15 This has three aspects which must be undertaken:
DASR 21.A.3A(a). Have a system for the collection, investigation and analysis of data relating to failures, malfunctions, defects or other occurrences, which cause or might cause adverse effects on the airworthiness of the product.
DASR 21.A.3A(b). Report to DASA occurrences, which may result in an unsafe condition.
DASR 21.A.3A(c). Investigate the root cause of occurrences and implement actions to eliminate or otherwise minimize any resulting hazards and their associated risks SFARP. If DASA finds action is required to correct the deficiency, the MTCH shall submit the relevant data to DASA.
7.4.1.16 Reporting to DASA. Where the MTCH assesses that an occurrence of a failure, malfunction or defect “may result in an unsafe condition4444” that occurrence must be reported to DASA. Note this is a more limited and very specific subset of all occurrences that must be collected and considered by the MTCH. For these ‘reportable occurrences’ the MTCH must also report the results of MTCH investigations and any proposed action by the MTCH to DASA.
7.4.1.17 Investigate and implement actions. In the event that an unsafe condition may exist, the MTCH is obliged to take appropriate actions and be pro-active to eliminate and/or minimise the associated risks so far as reasonably practical. DASR 21.A.3A does not require the MTCH to consult DASA for review or approval prior to initiating any analysis, investigation and/or remediation actions. DASA provides additional, external and independent assurance of the actions of the MTCH but does not lead the MTCH in satisfying DASR 21.A.3A.
7.4.1.18 Further guidance on Occurrence reporting is provided in DASP Vol 3, section 7-4-2 and section 6-3
DASR 21.A.3B Airworthiness Directives
7.4.1.19 Where DASA determines an Airworthiness Directive (AD) is required for mandating actions for remediating an unsafe condition the MTCH must:
propose appropriate corrective actions and/or inspections
provide operators of the type all data required to comply with the AD
provide solutions/data to DASA to correct the deficiency and restore aircraft safety. This may include additional data to that provided under DASR 21.A.3A, specifically to support the release of an AD.
7.4.1.20 DASA’s decision to release an AD may occur immediately following an occurrence or many weeks, months, or even years later. Per paragraph 7.4.1.17, the MTCH is to proceed with actions to eliminate the hazard or minimise the risks independently of DASA. This provision exists to support DASA mandating action proposed by the MTCH, not to direct the MTCH in the execution of their role.
7.4.1.21 Further guidance on Airworthiness Directives in the ADF context is provided in DASP Vol 3, section 7-4-3
DASR 21.A.4 Coordination between Design and production.
7.4.1.22 The MTCH shall coordinate between design and production organisations, to provide production data, as well as receive failure/malfunction/defect data from production organisations.
7.4.1.23 Where whole aircraft, parts and/or modification kits etc. are being produced, the MTCH arrangements are to ensure that the design and produced article align. For example, if the design is changing (materials/dimensions/finishing etc.) then that information will be provided to the organisation producing the item. Similarly, there cannot be changes to the item being produced without the knowledge of the MTCH and/or the responsible design organisation supporting the platform. Finally, this agreement must ensure the communication of occurrences, especially from the production organisation to the MTCH and/or their design organisation.
DASR 21.A.42 Integration
7.4.1.24 The MTCH shall be responsible for the integration of Products, Weapons and other Systems onto the aircraft type.
7.4.1.25 This requirement places the obligation on the MTCH to consider the impact to airworthiness on integrating products, weapons or other systems, onto the aircraft. As the MTCH is also the only organisation eligible to apply for a major change to the type, the DAS of the MTCH (in cooperation with their partner organisations) must be sufficient to enable this. This obligation is not limited to aircraft components, but as expanded upon in Paragraph 7.4.1.49 for role equipment as well.
DASR 21.A.55 Record Keeping
7.4.1.26 The MTCH shall hold all relevant design information necessary to ensure the continued airworthiness of the type and make this available to DASA as required.
7.4.1.27 In the Defence context, the MTCH will not be the OEM, and the regulations cannot assume the MTCH created the type design data. Thus, this regulation ensures that the MTCH can access all data necessary to support the type design and ensure that major changes to the type continue to meet the appropriate airworthiness requirements.
DASR 21.A.57 Manuals
7.4.1.28 The MTCH shall produce, maintain and update master copies of all manuals required by the TCB and provide copies, on request, to DASA.
7.4.1.29 A manual under this regulation is part of the type design considered during type certification. It follows that any manual assessed during certification is therefore required by the TCB under this regulation. Such manuals contain content critical to keep the type airworthy or to operate the type safely within its designed limits. An example of a manual is the Aircraft flight manual, an engine manual4545 or a propeller manual4646 .
7.4.1.30 For the purpose of initial certification, the MTCH is to provide manuals applicable to the ADF type. Thus, manuals produced for aircraft/products certified under other airworthiness authorities must be evaluated prior to releasing under the DASR. For the purpose of maintaining initial airworthiness in line with OEM issued updates, the MTCH must maintain and update master copies by enabling changes to be evaluated. Prior to promulgation, such change proposals will;
consider applicability to any unique ADF aspects or environment.
classify the content being considered.
7.4.1.31 The regulation implies that the MTCH will execute the obligation in a timely manner commensurate to the (safety) criticality of the update and any OEM advice.
7.4.1.32 Further guidance on the Aircraft Flight manual in the ADF context can be found in AC 008/2020
DASR 21.A.61 Instructions for Continuing Airworthiness
7.4.1.33 The MTCH shall provide the Instructions for Continuing Airworthiness (ICA) required by the TCB to operators. Changes to that ICA will also be provided to all operators.
7.4.1.34 ICA detail the methods, inspections, processes, and procedures necessary to maintain the aircraft and/or products in an airworthy condition and within the usage parameters of the aircraft design. ICA are an airworthiness requirement of the TCB and are prepared at initial certification by the appropriate manufacturer for each product, part or appliance. The regulation requires the MTCH to furnish the complete set of ICA to the Operator and to maintain the currency of the ICA for the ADF Type.
7.4.1.35 In the Defence context, this has particular relevance for the MTCH as often type design data will be produced under other regulatory systems and ICA will not be clearly identified. Part of the responsibility of the MTCH under this regulation is to identify and manage the ICA for a type where the OEM documentation has not explicitly referenced which instructions are ICA. This is usually where the aircraft is largely of military design, and in these cases, the MTCH will require an established relationship with the OEMs to enable clarification of maintenance documentation, when it cannot be determined from inspection what maintenance data is ICA.
DASR 21.A.44(b) - Identification of Products, parts and Appliances (DASR 21 Subpart Q)
7.4.1.36 Identification of products, parts and appliances. The MTCH shall:
specify how parts are to be identified.
specify how identification data (plates/etchings etc.) are to be handled.
identify critical parts.
7.4.1.37 In the context of EMAR, this obligation leverages a responsibility onto the MTCH to specify part marking schemes to their production organisations, who in the European context could be located in multiple countries. However in the Defence context the MTCH will in most cases rely on existing design organisation/production organisation arrangements in foreign countries with part identification already in place. To achieve the intent, the MTCH will appropriately leverage the OEMs part identification systems/schemes and only if applicable, specify the manner in which locally produced products, parts and appliances are identified.
7.4.1.38 Further guidance on Production in the ADF context is provided in DASP Vol 3, section 7-3-1.
DASR 21.A.44(c) - Continued Integrity of the Aircraft Structure and Propulsion System
7.4.1.39 DASR 21.A.44(c) requires that the MTCH shall ensure the continued integrity of the aircraft structure and propulsion system through ongoing monitoring and periodic assessment. Acceptable means of compliance for this regulation is provided in AMC 21.A.44(c). Chapter 6.6.3 provides extensive guidance to support application of AMC 21.A.44(c).
MTCH Obligations– Implicit Obligations
What is an implicit obligation?
7.4.1.40 In addition to the eligibility criteria listed at DASR 21.A.14(c) and the obligations listed at DASR 21.A.44(c), the regulations also include implicit obligations and expectations for the MTCH. That is, while an obligation has not been expressed, as “the MTCH must….” the operation of a regulation (or the AMC to that regulation) clearly depends upon the MTCH performing a function to ensure the continued airworthiness of the type or the safe operation of that type.
DASR 21.A.113 and 115
7.4.1.41 An applicant for a Supplemental Type Certificate (STC) shall prepare data to support the application independently or as part of an arrangement with the MTCH. In the defence context, the MTCH will hold all STCs and is therefore pivotal to enable an STC application through a ‘no technical objection’ assessment and to provide the necessary design data. The advice provided by the MTCH shall enable for the safe integration by multiple design organisations of STCs onto the platform.
DASR 21.A.445 Subpart M Repairs
7.4.1.42 The MTCH is to support organisations performing major and minor repairs including unrepaired damage assessments by providing adequate information to enable their evaluation.
7.4.1.43 The MTCH may commission/initiate the activities through their supporting design organisation with appropriate approvals in place to design structural repairs. The MTCH will enable the provision of sufficient technical data where necessary.
AMC 21.A.709(b)(3) Approval of Flight Conditions
7.4.1.44 Flight Conditions underpin the issue of MPTFs as alternate authorisations assuring operations outside the strict requirements of the TCB and DASR M requirements and often at elevated levels of risk.
7.4.1.45 To make sure all reasonable knowledge is considered in the risk assessment supporting Flight Conditions and MPTF, the MTCH should be consulted to provide technical assessment inputs given access arrangements to type design data. In the Defence environment and noting other regulatory guidance, the MTCH organisation shall support/facilitate these assessments.
7.4.1.46 While not specifically identified, the reference to ‘a design or engineering organisation suitably knowledgeable of the certified Type Design and with access to Type Design information’ is usually read to mean the MTCH or OEM.
GM M.A.301(a)(2).2 Credible Data
7.4.1.47 Where operations are not at elevated levels of risk, but a defect remains preventing the release of the aircraft back to service, an operator may use ‘credible data’ for the deferral of defects in accordance with DASR M.A.301. Since the list of credible data includes type certification data, the MTCH would be a likely source of such information and be expected to provide it to operators as required. In the Defence environment and noting other regulatory guidance, the MTCH organisation shall support these assessments.
GM ORO.75 Use of Role Equipment
7.4.1.48 The MTCH is expected to support operators in the determination as to whether a piece of equipment is considered role equipment or a certified part.
7.4.1.49 Whilst the MAO has direct responsibility for integrating role equipment onto their aircraft, it is expected that they utilise technical assessments when appropriate. As the MTCH has access arrangements for assessments using type design data, the MTCH shall support the operator to ensure the part or equipment is integrated onto the type with appropriate consideration.
DASR AO.GEN.05(c) Management of Orders Instructions & Publications (OIP)
7.4.1.50 The MAO is required to have a documented agreement with the MTCH and seek MTCH support for control of air operational OIP and the use of Foreign Source Data (FSD).
7.4.1.51 This introduces an implicit requirement upon the MTCH to collaborate with the MAO via an agreement for review and appropriate approval of aviation operational OIP and FSD prior to use. This has particular relevance to the Aircraft Flight Manual (AFM). In the Defence context, the management of the AFM is complex with the one document having multiple uses and regulatory requirements. As a result, the MTCH shall be pivotal to ensure aviation operational OIP and FSD activities do not inadvertently alter content critical to compliance with the type certification basis.
7.4.1.52 Chapter 6.7 of the DASP Manual Volume 3 provides further guidance for OIP.
Introduction
7.4.2.1 This section provides guidance to Occurrence reporting (OR) in the continued airworthiness domain (for design and production). This section is subordinate to the wider OR guidance provided as part of DASP Vol 3, chapter 6.3 which describes the wider OR framework.
7.4.2.2 Under DASR Part 21, organisations holding an approval have a requirement levied onto them to collect data on, conduct investigations of and provide analysis on any Failures, Malfunctions, Defects (FMD) or other occurrences, which creates or has the potential to create an unsafe condition. An unsafe condition is a state where an adverse effect on airworthiness exists being the result of a compromised or potentially compromised type design. Any occurrence that is assessed to have resulted in, or may result in, an unsafe condition4747,4848must be reported to DASA and other organisations required by the implementing regulations.
7.4.2.3 Occurrence reporting by DASR 21 approval holder(s) is an essential continued airworthiness activity and enables risks and hazards associated with the type design to be identified and addressed in accordance with DASR 21.A.3A(a). All organisations that hold a DASR Part 21 approval including (but not limited to) the platform Military Type Certificate Holder (MTCH), Subpart J design organisations, Subpart F/G production organisations are obligated to have systems in place to achieve the regulatory intent of occurrence reporting.
Collecting FMD Data
7.4.2.4 The holder organisations operating under the DASR Part 21 regulations are expected to have arrangements in place that collects technical information from a spectrum of local and international sources/networks (civil and military) relevant to their platform. This has the primary purpose to access real time (critical) design related safety information for the product/part or appliance. The technical data may be directly applicable to types operated by the ADF or may require some applicability assessment before being considered for further consumption.
7.4.2.5 Collection of FMD data either directly from the ADF fleet or indirectly from other operators also has the purpose to provide the Holders with ongoing data that can be evaluated for patterns and/or reoccurrences. Such evaluation may identify failure issues that present as disparate, but may be linked. This level of analysis has the objective to identify latent design or manufacturing defects before they are realised during operation.
Occurrence Investigations in the DASR Part 21 Domain
7.4.2.6 In the Defence context, investigations involving FMD directly attributable to the type design and/or manufacturing are conducted by the platform MTCH under obligations in DASR 21.A.3A. Under this regulation, the MTCH must with all reasonable practicality initiate appropriate levels of investigation within their design support network to determine the root cause. This may take the form of reaching back into the OEM to evaluate the circumstances and determine the likely cause. Similarly, the production organisation or the part/component OEM may be consulted where a manufacturing issue needs analysis.
What constitutes a reportable Occurrence?
7.4.2.7 A FMD occurrence may originate from an issue identified on the ADF type or from a foreign fleet that is closely related to the ADF type. However, the immediate type design/airworthiness impacts from an FMD occurrence in the Part 21 domain are not always apparent and often requires detailed investigation to be completed. An occurrence may not be identifiable until investigation results are reported.
7.4.2.8 Similarly, there are instances where a failure, malfunction or defect, or analysis of failures, malfunctions or defects represents some level of shortfall to the type design but may not result in a reportable occurrence in accordance with DASR 21.A.3A(b) based on an assessment of the available information at that time. In these situations, the holder ought to make a judgement as to whether the shortfall constitutes a risk or not and what actions/advice is required to manage the risk (perceived or real). The Authority always encourages the community to be conservative in their judgements and provide an occurrence report - voluntary occurrence reports are an option.
7.4.2.9 In the Defence construct, the MTCH organisation is expected to receive relevant technical information (TI) from a range of sources including other operators (military or civilian, where relevant). In assessing the external TI, the MTCH must verify applicability to the ADF type and consider the ADF CRE. Once verified as applicable, a reportable occurrence is warranted satisfying any of the following conditions where the incoming technical information;
describes a design issue (real or potential) that leads to an unsafe condition; or
describes a safety concern that has a real or perceived airworthiness impact and requires some time compliance action; or
originates from the type OEM or Civil Aviation Authority (CAA) /Military Aviation Authority (MAA) regulator mandating an action with an accompanying risk assessment.
7.4.2.10 An occurrence on an ADF aircraft may require the outcome of an investigation before a determination can be made to report under DASR 21.A.3A. However, once the locally sourced TI is received, the same conditions of sub-paras 9a and 9b apply to determine if a reportable occurrence is warranted.
When and how to Report
7.4.2.11 Reporting occurrences to the Authority has the intent to make the Authority aware of an event that has caused or has potential to cause an unsafe condition in the current timeframe. This enables the Authority to begin their assurance function in real time and allow for intervention (where necessary) without undue delay. The reporting time period for the MTCH community is 72 hours for an occurrence once deemed reportable. It is acknowledged that the time between the actual occurrence and the MTCH being fully informed of an unsafe condition existing on their type can vary depending on many factors. Therefore, the 72 hour timeframe begins at the point where the MTCH organisation has enough information to make an informed determination of the airworthiness impact, based on the root cause (if known), type applicability, CRE considerations, etc.
7.4.2.12 The form and manner of which reportable occurrences are provided to the Authority from a MTCH organisation is via a DASR Form 44. The report shall contain (where practicable) all available information on the manufacturing or design deficiency, the results of any investigation to date, any actions they are taking or propose to take in order to correct the deficiency along with the submission of relevant data to support the actions.
MTCH Actions to address an unsafe condition resulting from FMD
7.4.2.13 The immediate actions that the MTCH organisation may take to eliminate and/or minimise the risks associated with the type design hazard will vary on a number of factors. However, the likelihood/consequence risk assessment will ultimately dictate the level of attention, timeliness, advice and resources that are attributed to the actions. Actions taken by the MTCH to address an unsafe condition should never rely on an Authority decision gate to implement.
7.4.2.14 The Authority will review the occurrence details and MTCH actions to gauge that the risk to aviation safety has been eliminated or otherwise minimised So Far As is Reasonably Practicable (SFARP) by the MTCH. This is not a one-off assessment; rather the unsafe condition determination by the MTCH organisation is an ongoing safety assurance activity conducted by DASA. It commences upon receipt of the occurrence and closes upon DASA’s decision that the risk no longer warrants on-going monitoring by DASA.
7.4.2.15 Where the Authority does not have confidence that the design hazard has been eliminated or otherwise minimised SFARP, or if addressing the hazard requires development of a modification and subsequent fleetwide incorporation, then the DASA Airworthiness Directive (AD) process under DASR 21.A.3B may be invoked.
Structures and Propulsion Systems Guidance.
7.4.2.16 Structures and propulsion system specific considerations for the collection, investigation and analysis of failure, malfunctions, defects and other occurrences are addressed in AMC1 21.A.3A(a). Supporting guidance can be found in Chapter 6.6.3.
7.4.2.17 Specific guidance regarding risk analysis for propulsion systems (as could be used to develop the proposed corrective action(s) for a design- or manufacturing-related unsafe condition) is contained in Annex E to Chapter 7.2.
Introduction
7.4.3.1 An Airworthiness Directive (AD) is ‘a document issued (or adopted) by the Authority which mandates actions to be performed on an aircraft to restore an acceptable level of safety, when evidence shows that the safety level of this aircraft may otherwise be compromised’ 5050. Therefore, an AD is a key mechanism available to DASA to communicate mandatory action, in instances when an unsafe condition is determined to exist in an aircraft (and is likely to exist or develop in other aircraft) as a result of a deficiency in an aircraft’s type design or conformance thereto.
7.4.3.2 This chapter sets out guidance for the use of ADs in the DASP. The guidance leverages civil practice, and expands on the regulatory criteria for the issue of an AD and key elements to execute the policy for the Defence aviation context.
Occurrence Reporting and Airworthiness Directives
7.4.3.3 Whilst Defence-registered State aircraft are type-certified within the DASP (via the issue of a Military Type-Certificate (MTC)), and individual aircraft that conform to that type are awarded a Military Certificate of Airworthiness (MCoA), this is not a guarantee of enduring safety from a continued (and continuing) airworthiness perspective. This therefore necessitates that the potential for any unsafe condition (that may arise in-service) must be carefully monitored and managed.
7.4.3.4 Further to Chapter 7.4.2 (Continued Airworthiness Occurrence Reporting), respective Approval Holders5151 under the DASP have certain obligations5252 to DASA for the identification, communication and rectification of safety-related issues. DASA’s role is to independently assure that the actions of the regulated community, in response to reportable/reported in-service occurrences affecting Defence-registered aircraft, are commensurate with the safety risk, and credible and defensible. This directly supports continued assessment of the validity of DASA-issued MTCs (/MSTCs) and/or MCoAs, and in certain instances, DASA’s oversight of safety-related occurrences will need to consider if a DASA-issued AD is necessary to assure the safety of Defence aircraft (by explicitly approving and mandating the required corrective action to address an unsafe condition).
7.4.3.5 The nature of these occurrences, and the attendant severity and risk, vary considerably. In a practical sense, not every reported occurrence will (or should) result in an AD. In certain situations, it is entirely appropriate that lower-level safety-related issues reported to DASA by a sustainment enterprise (under DASR 21.A.3A) are just monitored (until defined closure criteria is met), if they do not actually constitute an unsafe condition perse.
Unsafe Condition Assessments (UCAs)
7.4.3.6 During the conduct of DASA’s ‘spectrum of assurance’ for reported occurrences, the airworthiness impact to either the type, or individual aircraft of that type, must be considered. In every instance, what is unequivocally required is the determination of whether an unsafe condition exists (or not). Therefore, investigations and assessments conducted by Approval Holders within the regulated community must consider whether an unsafe condition exists; for this is not only DASA’s function, but a shared responsibility. DASA’s role is to be engaged with Approval Holders and determine/confirm5353 whether (or not) an unsafe condition exists (based on reports, investigations and assessments by, and engagement with, the regulated community5454). DASA should generally not be conducting the UCA itself; for this is best-placed with respective Approval Holders5555 under DASRs (based upon type knowledge and understanding). That said, DASA always reserves the right to do so (if required).
Unsafe Conditions
7.4.3.7 Whilst DASR 21.A.3B(b) provides AMC and GM for what constitutes an unsafe condition, practical application is not always straight-forward in every instance, for discerning (and agreeing) which conditions are truly unsafe requires the exercise of professional judgement (by both Approval Holders and DASA). Moreover, the determination of what is truly an unsafe condition cannot be defined for every situation and scenario, for each platform (and DASA’s assurance thereof). Generic aspects that will need to be considered are the:
nature of the deficiency/condition (and the associated consequence/likelihood of hazards)
elevated level of risk attributed to the deficiency (above that inherent in the type-certified design)
urgency for required mitigations, inspections and/or corrective action
corresponding risk exposure period of (and any complexity within) required terminating action to resolve the deficiency.
7.4.3.8 It is important to understand that DASA (as the independent regulator) is not, and should never be, on the critical path to manage the day-to-day safety of aircraft. Under the DASRs (and the WHS Act 2011), regulated entities have obligations to ensure safety is not compromised and to alert DASA as the situations warrants. Therefore, regulated entities should not wait for DASA to provide a position before taking any appropriate action in response to an identified unsafe condition.
Criteria for issue of an AD
7.4.3.9 During the conduct of DASA’s assurance of reported occurrences, and regardless of whether the actions of the Approval Holder are deemed to be credible and defensible, DASA will consider (on a case-by-case basis) the issue of an AD5656 when:
an unsafe condition has been determined by the Authority to exist in an aircraft, as a result of a deficiency in the aircraft, or an engine, propeller, part or appliance installed on this aircraft.
that condition is likely to exist or develop in other aircraft, including engine, propeller, part or appliance installed on those aircraft that may be affected by this unsafe condition.
7.4.3.10 In these instances, the ‘safety benchmark’ for the type or individual aircraft has (or potentially has) been compromised, and the continued validity of an aircraft’s MCoA (and/or MTC) may be brought into question (via the presence of an unsafe condition). Therefore, DASA-approved inspection and/or remediation is necessary to restore an acceptable level of safety, via the issue of an AD.
7.4.3.11 Given an AD may be applicable to either all aircraft of a certified Defence type, or only certain individual aircraft of that type, ADs are by definition either type- or tail-related, issued to address identified in-service deficiencies pertaining to continued or continuing airworthiness (and potentially a hybrid thereof).
Purpose of an AD
7.4.3.12 The fundamental purpose of an AD is to:
approve corrective action and/or required inspections (proposed by the relevant Approval Holder under the DASRs)
communicate the presence of an unsafe condition affecting a Defence type and/or individual aircraft (that endangers flight safety) to the MAO/CAMO
mandate required action by the MAO/CAMO5757.
7.4.3.13 Regulated community compliance with DASA-issued ADs (to restore an acceptable level of safety) is mandatory within the DASP5858, which invokes the implementation of required action from a continuing airworthiness perspective under DASR Parts M and 145 (including military aircraft airworthiness review activities under DASR M Subpart I)5959.
Defence aviation context and considerations
7.4.3.14 Since (EMAR-based) DASRs have a civil lineage – albeit adapted for the military context – fundamental aspects underpinning the intended application of DASR 21.A.3A and .3B are derived from ICAO-based concepts and civil regulations. That said, whilst DASA’s assurance functions for reported unsafe conditions and the corresponding use of ADs within the DASP are prima facie the same, the combination of a number of inter-related features of the Defence aviation context requires additional policy considerations. In particular, how to pragmatically deal with the reality of:
sovereign government MTC Holder arrangements, that typically only coordinate the execution of holder obligations6060 and almost entirely leverage and recognise a much-broader (initial/) continued and continuing airworthiness management framework in place for a foreign type the same as, or similar to, the Defence type.
the general lack of centrality of the OEMs (as the original ‘Approval Holders’ for design and production that are not directly regulated under DASRs).
the nature of DASA as a relatively-small ‘validating’ Authority when issuing sovereign MTCs for Defence-registered aircraft (and most major changes to type-certificate (TC) thereafter).
7.4.3.15 Therefore, there is a strong reliance on the sustainment support arrangements established by CASG SPOs for the ongoing execution of sovereign MTC Holder functions required by DASR 21.A.3A and .3B 6161, either with the actual OEM(s) and/or by leveraging the framework and actions of a foreign Civil/Military Aviation Authority (C/MAA), to support the identification and management of unsafe conditions applicable to Defence aircraft.
Sovereign MTC Holder support arrangements
7.4.3.16 The various in-service sustainment support arrangements implemented by CASG SPOs to support respective MTC Holder obligations, have differing degrees of OEM and/or foreign C/MAA involvement. Therefore, the extent to which sovereign MTC Holders leverage the initial, continued and continuing airworthiness management framework of a DASA-recognised foreign C/MAA, in direct support to the management of Defence types, will strongly influence the extent of sovereign decision-making required by MTC Holders (in the determination of required sovereign action to address an unsafe condition). In particular, those support arrangements that include a foreign C/MAA that acted as the primary certifying authority for an aircraft type similar to, or the same as, that operated by Defence.
7.4.3.17 Moreover, given the much-larger global fleets being oversighted and assured by respective foreign C/MAAs, the reality is that the vast majority of FMD/occurrences, assessments of any associated unsafe conditions, and the corresponding mandatory actions (to restore the safety benchmark) will be determined overseas (generally without sovereign MTC Holder and DASA involvement). However, FMD/occurrences for Defence aircraft do still arise, which may not be addressed by foreign type management arrangements. In particular, any design or part production deficiency that may be attributable to a military design or production organisation (MDO/MPO) approved by DASA under the DASP6262. In these instances, the full intent of DASR 21.A.3A and .3B is required by respective Approval Holders and DASA.
7.4.3.18 Therefore, the degree of ‘type management sovereignty’ for Defence-registered aircraft – and therefore the extent to which sovereign decisions are required – will commensurately govern DASA’s assurance of unsafe conditions affecting Defence-registered types (and the oversight of corresponding actions). That is, when more airworthiness-related ‘type management’ activity and decision-making is conducted in Australia, the greater DASA’s involvement will be in the application of DASR 21.A.3A and .3B.
Sovereign Approval Holders propose required action to support the issue of an AD
7.4.3.19 When DASA decides that an AD needs to be issued within the DASP6363, the MTC Holder organisation (and/or other relevant Approval Holders under DASRs) should propose6464 appropriate corrective action and/or required inspections to DASA. Given sovereign MTC Holder organisations are primarily a coordinating (and not a design) organisation, OEM input should be considered mandatory, as well as C/MAA oversight and involvement (as appropriate)6565. This therefore connects the original ‘applicant’ and the ‘holder’ of the design, as well as the primary certifying authority (that established the safety benchmark with the original ‘OEM applicant’ within their airworthiness management framework), which therefore executes the actual intent of DASR 21.A.3A and .3B.
7.4.3.20 Upon receipt, DASA’s independent safety assurance function is to approve the holder’s proposal, including required inspection(s) and/or rectification interval(s), and the associated risk exposure. DASA will engage with the Approval Holder and amend the proposal, if and as required. When satisfied that the AD’s content (as proposed by the holder) provides appropriate terminating action to eliminate the unsafe condition (and to restore the ‘safety benchmark’), and the associated risk during the exposure period will be otherwise minimised SFARP, DASA will issue an AD accordingly6666. In doing so, DASA is explicitly approving the corrective action to address the unsafe condition and the corresponding exposure period.
Foreign ADs (or equivalent)
7.4.3.21 When sovereign MTC Holders receive relevant foreign ADs (or equivalent6767) for assessment, and report this to DASA6868, the DASP is the beneficiary of relevant C/MAA assurance of the same/similar type to that operated by Defence. This broadly meets the intent of DASR 21.A.3A and .3B; for the ‘problem’ and the ‘solution’ is provided, that usually leverages the inputs of the actual OEM and recognises what the relevant C/MAA deemed mandatory. Therefore, a sovereign MTC Holder will need to consider the following:
the applicability of a foreign AD (or equivalent) to a Defence-registered type.
the availability and suitability of controls and corrective actions provided by a relevant foreign C/MAA that can be ‘adopted’ (including whether full (or partial) compliance and implementation is intended).
the extent to which a Defence type’s Configuration, Role and Environment (CRE) considerations require necessary/appropriate variations to adapt the content of a foreign AD (or equivalent); and in particular, necessary/appropriate variations to risk controls, terminating action(s) and/or implementation timeframes/risk exposure periods.
the need to amplify other foreign-source safety advice for required actions and timeframes to rectify an unsafe condition6969.
7.4.3.22 Given the ‘sovereignty’ of DASA-issued MTCs (/MSTCs) and MCoAs for Defence-registered aircraft, the assessment of unsafe (or potentially unsafe) conditions identified for foreign aircraft that may affect Defence aircraft is fundamental to support the ongoing validity of these DASA-issued authorisations. However, it is important to note that these foreign ADs (or equivalent) are not automatically applicable and mandatory under the DASP, and despite the AD definition cited within DASR 21.A.3B(a), there is no regulatory mechanism within DASR 21 to ‘adopt’ foreign ADs (or equivalent)7070. Therefore, whilst the regulated community may indeed decide to implement the required actions of a foreign AD (or equivalent) as a ‘credible and defensible’ means to address an unsafe condition for a Defence-registered aircraft, DASA nonetheless requires that applicable critical foreign safety-related information (and in particular, that issued by the primary certifying authority) is formally ‘brought into the DASP’ and actioned accordingly. The only way for this to occuris for DASA to issue an AD in the DASP7171, to mandate the same/similar action for Defence-registered aircraft.
Foreign ADs (or equivalent) issued by the primary certifying authority are mandatory when applicable to Defence-registered aircraft
7.4.3.23 DASA functions largely and almost exclusively as a ‘validating authority’, when issuing a sovereign MTC to establish the initial airworthiness of Defence types (and approving most major changes to TC thereafter), based upon recognition and leverage of the previous type-certification efforts of foreign C/MAAs. Similarly, the DASP should also recognise and leverage the type knowledge and understanding of the relevant C/MAA’s management of continued and continuing airworthiness, for aircraft the same as/similar to Defence types.
7.4.3.24 Therefore, DASA’s default policy position is that compliance with the technical content of foreign ADs (or equivalent) – issued by the primary certifying authority that DASA leveraged to underpin the award of a DASA MTC – is mandatory (when applicable to Defence-registered aircraft). If the primary certifying authority deemed a condition unsafe, then in near-all instances, their required mandatory action to address compromised airworthiness should be equally-applicable to Defence aircraft (notwithstanding any unique CRE considerations in certain situations).
7.4.3.25 The act of ‘validating’ the applicability and corresponding mandatory action within a foreign AD (or equivalent) for a Defence type is pragmatic and efficient. DASA issue of an AD when ‘validating’ a foreign AD (or equivalent) will in most instances be as simple as placing a DASA AD cover page on the foreign artefact(s) (if no changes are required), which may also include any minor adaption (that does not change the intent7272), and promulgating this to the relevant MAO/CAMO for implementation.
7.4.3.26 Whilst this policy consideration would likely cater for many foreign ADs (or equivalent), DASA acknowledges there may be exceptions and complexities in certain situations, that require professional judgement. In particular, there may be compelling reasons why applicable foreign ADs are not intended for compliance (or only partial compliance), or there are substantial required and/or proposed variations on account of Defence CRE considerations (or otherwise) that will alter the intent and/or attendant risk. This will therefore require a much-greater degree of engagement between the relevant Approval Holder and DASA, to agree the content of the DASA AD (if issued).
Traceability with required mandatory action issued by the primary certifying authority
7.4.3.27 DASA’s expectation is that sovereign MTC Holder arrangements implemented for each Defence type will monitor safety-related information from respective OEMs and C/MAAs (including other operators), to support required obligations under DASR 21.A.3A and .3B) (and DASR 21.A.44). In particular, this should include the documented methods and means to record the traceability of all actions mandated by the primary certifying authority7373, and the alignment with that implemented within the DASP.
7.4.3.28 For civil-derivative military aircraft, certified by a foreign MAA yet underpinned substantially by a foreign CAA’s certification of the ‘green aircraft’, the applicability of foreign civil ADs would ideally be assessed and actioned by the relevant foreign MAA (that oversights the overseas fleet the same as/similar to a Defence type), but this may not always occur as expected. Therefore, due consideration should also be given to record the traceability (or otherwise) to Emergency or Alert Service Bulletins (issued by civil OEMs) and ADs (issued by the relevant CAA) that may not be mandated by the relevant MAA.
Platform DoSAs may issue ADs (for validated foreign ADs (or equivalent))
7.4.3.29 When a DASA AD needs to be issued within the DASP, and in instances where the relevant Platform Delegate of the Safety Authority (DoSA) is not developing the technical content therein – but rather only validating that a foreign AD (or equivalent) is applicable to, and should be mandatory for, Defence-registered aircraft – the Platform DoSA is the most-appropriate release authority (for, and on behalf of, DASA7474). This is pragmatic and efficient, and is the most-responsive and agile arrangement (particularly for exigent circumstances), which is also aligned with a Platform DoSA’s safety-related role and functions.
7.4.3.30 Moreover, this also fully aligns with the distributed model established for each Defence type to monitor, review and assess foreign safety-related data that may impact Defence aircraft, and should be invoked to the greatest extent possible7575. The only caveat is that if the risk exposure is DHRM MEDIUM (or higher) until terminating action is accomplished, this should default to DASA (yet supported and staffed by the Platform DoSA).
AD issue in the absence of a foreign AD (or equivalent)
7.4.3.31 For the Defence aviation context, and in addition to the aforementioned, DASA will also consider (on a case-by-case basis) the issue of an AD in the DASP, in advance of a primary certifying authority’s release of a foreign AD (or equivalent). DASA’s expectation is that whenever continued operations are intended with protracted exposure to a (post-mitigation) residual risk to airworthiness – on account of an unsafe condition associated with catastrophic and hazardous consequences that cannot be eliminated or fully-controlled immediately by design – an AD in the DASP should be issued. This will usually manifest in situations where foreign MAAs have conducted a risk assessment and recommended initial treatment/controls for continued operations (due to the presence of an unsafe condition), yet the design solution and the attendant foreign AD (or equivalent) does not (and will not) exist for a significant period of time (to detail required terminating action and compliance timeframe to restore an acceptable level of safety).
7.4.3.32 This therefore sets a default position for compromised airworthiness associated with long-standing exposure to an elevated level of residual risk (whilst design solutions are being devised). In this instance, a DASA-issued AD therefore provides a means to formally communicate instances of elevated levels of risk within the DASP (bounded by a date for terminating action and compliance to be implemented), which will also provide improved Command awareness, visibility and traceability of required actions.
DASA-issued ADs associated with elevated risk should be underpinned by 7-Step Risk Management
7.4.3.33 By definition, continued (post-mitigation) operations with an unsafe condition that cannot be eliminated immediately constitutes an elevated level of risk to airworthiness during the exposure period, until terminating action detailed within an AD restores an acceptable level of safety.
7.4.3.34 Therefore, consistent with a MAO’s DASR and WHS obligations, the elevated level of risk attributed to a deficiency (above that inherent in the certified design) and the corresponding residual risk exposure period should be underpinned by a MAO’s Risk-Decision Brief (RDB). In particular, for instances that:
deviate significantly from compliance requirements with ‘validated and adopted’ foreign ADs (or equivalent).
where there is markedly-elevated risk being retained, and the corresponding design solution required to address the deficiency will not be available for an extended period of time7676.
7.4.3.35 This policy position will primarily affect military aircraft (and likely not affect Defence-registered aircraft that are ostensibly civil). The need for an RDB for lower-level risks should be considered on a case-by-case basis (aligned with a MAO’s Safety Management System (SMS)), and may not be required at all – particularly for instances where DASA leverages and ‘adopts’ foreign CAA ADs with no variations to risk controls and exposure periods.
7.4.3.36 MAO RDBs (that underpin DASA-issued ADs) will need to consider and disposition all available and suitable technical and operational risk controls, to support appropriate operating conditions and/or limitations. This therefore ensures and requires that MAO Hazard Tracking Authorities (HTAs) and Risk Management Authorities (RMAs) are suitably-engaged for airworthiness issues, and the corresponding DASA AD is a mechanism to communicate and document DASA’s independent safety assurance for an agreed risk management strategy.
7.4.4.1 This section addresses other design approval holders under the DASR framework. This primarily covers any Australian Military Technical Standard Order Authorisations (AUSMTSO) under DASR 21 Subpart O. AUSMTSO Authorisations are not expected to be widely used in the Defence regulatory framework and will only be issued by exception. The Authorisation is common in the civil domain under the term Technical Standard Order (TSO) and TSO Authorisations and encourages competition across the industry through novel design which does readily translate across into the military domain.
7.4.4.2 An AUSMTSO under DASR is considered equal in concept to the civil use where a TSO is defined as a minimum performance standard for specified materials, parts, and appliances used on civil aircraft. An AUSMTSO Authorisation enables the holder to manufacture a material, part, or appliances to a TSO standard. Receiving an AUSMTSO Authorisation is both a design and production approval, but importantly does not extend to installing and using the article in the aircraft.
7.4.4.3 In the civil domain, a TSO Authorisation enables the manufacture of articles that may be installed on an aircraft only after showing that the article meets the specific airworthiness requirements (certification basis) of a particular aircraft model. Receiving a TSO Authorisation verifies that an article meets a minimum performance requirement independent of the article's intended installation on an aircraft. Under the DASR, using the AUSMTSO Authorisation will be more nuanced and will not be issued on a competitive basis.
7.4.4.4 Common articles on modern day aircraft including Military aircraft that have their genesis through the civil TSO provisions include Embedded GPS and INS Units (EGIs), Auxiliary Power Units, Tires, seat belts, crew oxygen masks, seat assemblies, brake assemblies, antennae, various instrumentation, cargo containers along with many more. Under the DASR framework, the use of AUSMTSO has been very limited.
7.4.4.5 Under DASR 21, Subpart O, the holder of an AUSMTSO has obligations to ensure that the article continually conforms to its design and is manufactured accordingly per regulations detailed under production (Subpart G). The holder is also subject to a number of other initial airworthiness regulations such as occurrence reporting and part marking with respect to their article. Although the Defence MTC construct results in a nuanced use, the AUSMTSO holder is required to engage with the aircraft Type certificate holder to integrate their article into the aircraft type or where design changes impact the integration.
7.5.1.1 A Military Permit to Fly (MPTF) is a ‘product authorisation’ issued by DASA to aircraft that do not meet, or have not been shown to meet, the requirements of the Type-Certification Basis (TCB) and/or Military Air Operator Certificate (MAOC), but are nonetheless capable of safe flight under defined conditions and for specified purposes. An MPTF is always associated with a set of flight conditions that may be approved prior to, or in conjunction with, the MPTF application.
7.5.1.2 An MPTF is a risk-based authorisation, within the suite of Defence aviation flexibility provisions provided under DASR GR.80, to facilitate military flexibility in support of a capability imperative, which is valid for a defined period of time, underpinned by a seven-step risk assessment with both technical and operational input.
7.5.1.3 Further to the overview of the Flight Conditions and MPTF authorisations provided at Chapter 5.3 Annex N, this chapter details DASR implementation of applications for, and approval of, Flight Conditions and MPTF (and the associated risk management aspects).
Audience
7.5.1.4 This chapter applies to DASR-regulated entities exercising roles or responsibilities when applying for an MPTF under DASR 21 Subpart P Military Permit To Fly. Whilst this will primarily be Military Air Operators (MAOs) – including Continuing Airworthiness Management Organisations (CAMOs) and service providers – it also extends to any organisation engaged to assist with the preparation of the application, such as: Military Type-Certificate (MTC) holders; design organisations (DASR Military Design Organisations (MDOs) and equivalents) and organisations involved in managing the configuration of Defence aircraft (CASG Systems Program Offices (SPOs) and Through-Life Support (TLS) contractors).
7.5.1.5 While cognisant of the above, the application for (and holding of) an MPTF within the DASR environment will almost exclusively be a MAO requirement for the subject aircraft defined within the MAOC Operations Specification (OpSpec)7777. The MAO should therefore establish in-service procedures to implement attendant MPTF regulation and Acceptable Means of Compliance (AMC) that reflects the central role of the MAO Accountable Manager (AM) and authorised staff within the MPTF process.
Purpose
7.5.1.6 This chapter provides guidance in relation to Initial Airworthiness requirements under DASR 21 Subpart P, for developing MPTF applications, inclusive of: collating substantiation documentation; gaining operational endorsement; signing the declaration of safety; engaging with the Authority (inclusive of the Delegate of the Safety Authority (DoSA)) for approval and issue of the MPTF; and meeting MPTF holder obligations. Moreover, this chapter explains how applications for approval of flight conditions and an MPTF should follow the seven-step risk management process detailed in DASA AC 003-2018—Risk Management in the Defence Aviation Safety Program, and describes the key elements of safety risk management that must be implemented by organisations to ensure compliance with the Work Health and Safety Act 2011 (WHS Act).
Background
7.5.1.7 Within civilian aviation regulations, a permit to fly is predominately used to support development, certification, production and delivery of new aircraft and major modifications, and to support in-service operation outside the bounds of the Certificate of Airworthiness (CoA); such as ferry flights to a suitable maintenance venue for defect rectification or the conduct of an overdue scheduled servicing.
7.5.1.8 The use of MPTFs within the DASR context is subtly different. Design, certification and production of a new aircraft solely within a DASR MDO/MPO has not yet occurred, and flight test for development of major modifications will likely occur for Defence-registered aircraft operated by a MAO (rather than a DASR MDO/MPO at this stage). Furthermore, as recognised and afforded by DASR GR.80 Flexibility Provisions, Defence aviation requires flexibility to support capability imperatives for certain operational circumstances that would not be allowed within the civilian aviation domain.
7.5.1.9 Under normal circumstances, all Defence-registered aircraft should only be operated with a valid Military CoA (MCoA) issued by DASA. An MCoA is issued when the aircraft was shown, at the time of issue, to conform to its MTC awarded post-certification. Whilst in-service, the validity of the aircraft’s MCoA is maintained by meeting the continuing airworthiness requirements of DASR M7878. A valid MCoA represents a baseline level of airworthiness, aligning to both civil and military global conventions. Importantly, in the Defence context, an MPTF authorisation supplements, rather than replaces, the MCoA.
7.5.1.10 However, as stated, military aviation requires flexibility for Commanders to operate aircraft in certain circumstances without having met all the prescribed initial, continued or continuing airworthiness or aviation safety requirements, but are nonetheless capable of safe flight under defined conditions. In these circumstances, and without the necessary flexibility provisions in DASRs, the MAO would be unable to operate under the regulations. To accommodate Defence aviation flexibility, DASRs include provisions for issue of either of the following, to facilitate operation when the prescribed airworthiness or aviation safety requirements are not met:
MPTF under DASR 21 Subpart P Military Permit To Fly, which is augmented with AUS-unique AMC and Guidance Material (GM), which stipulate specific application requirements and include additional expectations for the holders of an MPTF, or
Command Clearance (CC) under DASR Specific Purpose Approval – SPA.10 Command Clearance 7979.
7.5.2.1 The DASR SPA.10 CC provides for a similar outcome to that of an MPTF, in so far as the CC may also be used to authorise flight(s) where the MCoA’s Instructions for Continuing Airworthiness (ICA) conditions are unable to be met. However, the key difference between the MPTF and CC is that the MPTF is an initial airworthiness authorisation subject to DASA approval and issue, whereas a CC is an operational authorisation via the command chain. In ideal circumstances, conditions that require an MPTF would be managed via an MPTF; however, in the event of compelling time-critical capability imperatives or emergencies, and where there is insufficient time to process an MPTF application, a DASR SPA.10 CC may be exercised.
7.5.2.2 Regardless of whether MPTF or CC provisions are used, the operating organisation remains responsible for meeting WHS obligations to eliminate or otherwise minimise risk to aviation safety, so far as reasonably practicable (SFARP). Therefore, both the MPTF application process and issue of a CC require the MAO to exercise the seven-step risk management process detailed in DASA AC 003/2018—Risk Management in the Defence Aviation Safety Program. However, an MPTF provides the MAO with independent assurance over the discharge of their obligations and should be sought whenever reasonably practicable. Should the requirement for operation of an aircraft under DASR SPA.10 be for an extended period, an MPTF or other appropriate authorisation must replace the CC.
7.5.3.1 Whilst DASR 21.A.701(a) provides a non-exhaustive list of examples illustrating situations when an MPTF should be used, the majority of those examples are EASA/EMAR-based, and focused more on development of aircraft design, production, delivery and initial training within an OEM organisation (operating under privilege), as opposed to in-service scenarios that are typical for Defence aviation. For the Defence context, and as outlined within GM to DASR GR.80(c), aircraft operation in the following circumstances potentially entails flight at an elevated level of risk that may require an MPTF:
Prior to initial issue of an MTC and MCoA. DASR 21 precludes the issue of an MCoA if an MTC has not yet been issued. This will typically be due to the requirement to operate new aircraft prior to completion of the type-certification programme.
Aircraft operation while continuing airworthiness requirements are not satisfied. The aircraft has been issued an MCoA and is required for operational tasking; however, any of the following continuing airworthiness requirements have not been met:
a defect that cannot be deferred as it has been assessed to endanger flight safety
scheduled maintenance in the Aircraft Maintenance Programme (AMP) has not been carried out
an Airworthiness Limitation (AwL) or Certification Maintenance Requirement (CMR) has been reached
an Airworthiness Directive (AD) has not been incorporated.
Aircraft not conforming to an approved design configuration for the purpose of flight test. Installation of a yet-to-be-approved modification for flight test, in order to gather compliance demonstration evidence to support approval of a change to type-certificate (or subsequent flights prior to the design change approval being issued).
Aircraft operation outside approved limitations. The aircraft has been issued an MCoA but is intended to be flown beyond the approved operating limitations in the Aircraft Flight Manual (AFM), or outside the approved role and/or environment detailed within the MAOC OpSpec. These circumstances can arise from either operational tasking or for the purpose of flight test (to support role expansion activities).
7.5.4.1 The following organisations have specific responsibilities with respect to the application for, and issue of, MPTFs:
MAOs. MAOs are responsible for applying to DASA for the approval of flight conditions and the issue of an MPTF. They must fulfil the responsibilities of the applicant, including the conduct of a risk assessment that fully integrates all technical and operational considerations. MAOs should engage relevant external organisations in the course of preparing the application in order to effectively conduct an integrated risk assessment. These organisations may include the product’s MTC holder, design organisations, CAMOs (and service providers), flight test organisations, and/or relevant maintenance organisations. All MPTFs are issued to MAOs who are then responsible for discharging the obligations of the holder of a MPTF.
DASA. Upon receipt of an application(s), DASA will provide independent assurance that there is evidence that the MAO met their obligations and has eliminated or otherwise minimised all risks SFARP. DASA assurance will focus on credible and defensible risk management, which provides advice to Commanders if the capability imperative has been sufficiently described and would support a decision-to-proceed with the identified Elevated Level of Risk (ELOR); however the decision-to-proceed always remains with the applicant.
7.5.5.1 The application process to obtain an MPTF is relatively straightforward, but does require clear identification of the participants and an understanding of the associated responsibilities. Whilst two separate applications are required, DASRs do not prohibit both being submitted to DASA concurrently. Relevant DASR Forms are as follows:
DASR Form 18b. Application for, and approval of, flight conditions that enable the aircraft to operate safely. This form is raised and submitted by an applicant to DASA. DASA approves the application and returns the approved form to the applicant.
DASR Form 21. Application for issue of an MPTF. Raised by the applicant and submitted to DASA. This may reference pre-existing and approved flight conditions within DASR Form 18b.
DASR Form 20a. Issue of an MPTF in response to a DASR Form 21 application. Raised by DASA and issued to the applicant; that is, the organisation responsible for conducting the associated flight(s) and ensuring the flight conditions are adhered to.
7.5.5.2 Further to GM to DASR 21 Subpart P, Annex A provides a ‘swim-lane’ flowchart illustrating the application process within organisational responsibilities. Reiterating, the approval of flight conditions is separate from the issue of an MPTF to give the applicant flexibility. Reasons include:
One set of flight conditions may underpin a number of MPTFs.
The approval of flight conditions and the issue of an MPTF may be separated in time.
The issue of an MPTF by a local DoSA, in instances where DASA has previously approved flight conditions that are beyond the DoSA’s delegation, may improve flexibility and timeliness.
The approval of flight conditions and issue of an MPTF represent different steps in the seven-step risk management process, and therefore address different WHS Act requirements.
7.5.6.1 GM to DASR SMS.A.25(b)(2)(2.2) outlines Defence’s seven-step risk management process (depicted in Figure 5), with further aviation-specific guidance detailed in DASA AC 003/2018—Risk Management in the Defence Aviation Safety Program. AC 003/2018 describes the key elements of safety risk management that must be implemented by organisations to ensure compliance with the WHS Act.
Figure 5: Safety Risk Management Process
7.5.6.1.2 DASR application forms for the approval of flight conditions and the issue of an MPTF collectively cover all of the required steps in the safety risk management process. DASR Forms 18b and 21 should summarise key information arising from the seven-step risk management process. Additional detail may be included in separate documents.
7.5.7.1 An approved set of flight conditions underpins every MPTF, which are the risk controls required to eliminate or otherwise minimise the risk SFARP. In applying for the approval of flight conditions, the applicant should execute and document Steps 1–5 of the seven-step risk management process. A single set of approved flight conditions may be applied to several MPTFs.
7.5.7.2 The specific application of these steps in applying for the approval of flight conditions are as follows:
Step 1 – Establishing the risk context. The applicant must define the task objective(s) including a clear strategic, operational or tactical imperative for the task and why it is necessary to fly with an ELOR. In defining task objective(s), the applicant should consider whether the task is new or existing, the discretionary/non-discretionary nature of the task and its urgency. The applicant should also identify and engage relevant stakeholders to ensure the risk assessment fully integrates all technical and operational factors. The risk context establishes the depth of risk assessment required and informs all reasonably practicable judgements. Establishing the context, also includes the duration of the activity. Retention of ELOR must be for the minimum possible duration to remain defensible within the WHS obligations and DASRs. As such, long-term MPTFs are unlikely to be defensible8080.
Step 2.a – Being reasonably informed of the risks. The applicant must proactively take steps to gain reasonable knowledge of the exact nature of all hazards and risks (both technical and operational). This may include use of existing OIP, the AFM, ICA or the provision of specialist advice from appropriate support organisations. This could include design organisations, technology or operational specialists, flight test specialists or the aircraft’s OEM. There is no fixed list of who must be consulted for each application; instead, the applicant must always take those steps (including consultation with other organisations) that are reasonably practicable in their context.
Step 2.b – Being reasonably informed of all possible controls. The applicant must take steps to gain reasonable knowledge of all possible controls (both technical and operational) in order to identify which ones are available and potentially suitable. Per Step 2.a, the applicant must seek relevant specialist advice where appropriate. Again, there is no fixed list of who must be consulted for each application. The applicant must always take those steps (including consultation with other organisations) that are reasonably practicable in their context. The applicant must not discard any controls at this stage, as all identified controls should be used as inputs to Steps 3 and 4 in the risk management process.
Steps 3 and 4 – Eliminate or otherwise minimise risk SFARP. There is an explicit requirement to eliminate risk SFARP in the first instance and only if not reasonably practicable to do so (informed by the risk context established at Step 1), implement risk controls to minimise the risk SFARP. The applicant should systematically work through every control identified in Step 2 to determine if they are reasonably practicable to implement. The applicant must also address any additional hazards introduced by the risk controls. The integrated set of technical and operational risk controls that are reasonably practicable to implement, form the proposed flight conditions that will underpin the MPTF.
Step 5 – Characterising and communicating residual risk. The applicant must characterise the residual risk using their safety risk management system (Note: DASA anticipates the residual risk will be characterised using the Defence Harmonised Risk Matrix (DHRM) in the Defence Aviation Safety Manual (DASM), but does not mandate its use). This step must include a declaration from the applicant that the flight conditions are a set of risk controls, integrated from a technical and operational perspective, which eliminates or otherwise minimises the risk SFARP.
7.5.7.3 Specific detail of the information and supporting documentation required to complete DASR Form 18b- Application for Approval of Flight Conditions is provided in the instruction sheets covering the form. See also DASR 21.A.708 and 21.A.709.
7.5.7.4 Flight Test. When an MPTF relates to flight test activity, DASRs require that flight conditions and operational endorsement must be provided by a competent MAO staff member, as determined by a DoSA-Flight Test (DoSA-FT)8181. MAOs may apply to a DoSA-FT for a determination of competence for nominated MAO staff.
7.5.8.1 Only DASA (including DoSAs, within the scope of their delegation) or an organisation with the appropriate privilege can approve flight conditions. DASA will approve flight conditions if it has sufficient confidence that:
The applicant has given due consideration to the risk context, including the objectives and significance of the flying activity.
Elimination of the risk by restoring the aircraft to an airworthy condition IAW existing approved data, or deferring a defect, is not reasonably practicable.
Proposed flight conditions represent a set of risk controls that provide a credible and defensible level of safety for the flights/duration requested.
The applicant has appropriately characterised and communicated the residual risk.
The applicant has made an explicit declaration that the flight conditions, when implemented effectively, will eliminate or otherwise minimise the risk SFARP. The risk context of the application must support the depth of risk assessment undertaken and reasonably practicable judgements made by the applicant.
7.5.8.2 In assessing the application, DASA reviews the information supplied by the applicant and independently assures that it demonstrates the risk has been eliminated or minimised SFARP, and has been characterised accurately. While DASA does not seek to interfere in the decision-making that properly belongs to the Command Chain, or substitute its judgment for that of the Commander, DASA supports the Commander via the independent assessment that those decisions are credible and defensible.
7.5.9.1 Applications to DASA for the issue of an MPTF are made for specific aircraft and tasking using DASR Form 21 - Application for a Military Permit to Fly. All applications must reference an approved set of flight conditions, or an accompanying application for their approval. DASR Form 21 supports and records the applicant’s ‘decision-to-proceed’ at Step 6 in the seven-step risk management process.
7.5.9.2 Note, in submitting an application for an MPTF and making the decision-to-proceed, the applicant also revisits Step 1 – Establishing the Risk Context, for that application. The test of SFARP is contextual and temporal; so this return to the risk context for the MPTF application is necessary to ensure that the applicant has made the decision-to-proceed based on the characterisation of risk in the flight conditions and in the context defined by the MPTF application, at the time of that application.
7.5.9.3 For example, the risk context of the flight conditions may be broad and enduring, covering activities such as ‘deployed or directed operations’. However, the context of an application for an MPTF referencing those flight conditions must justify proceeding with the risk characterised in those flight conditions in its own right. As a result, an MPTF for a flight which itself is discretionary with little or no military capability imperative, relying upon flight conditions with a broad context such as ‘deployed operations’, may not be credible or defensible with the risk characterised in the referenced flight conditions, despite occurring while ‘deployed’.
7.5.9.4 The key information required to support this step in the risk management process is the applicant’s justification that:
The purpose of flight for this application is within the risk context of the referenced flight conditions and the specific task in this application warrants proceeding with the residual risk at the time of application.
The specific aircraft to be tasked meet(s) the configuration required by the approved flight conditions.
The conditions and restrictions (risk controls) in the approved flight conditions will be implemented on the subject aircraft for the subject flight(s).
7.5.9.5 The applicant must identify a suitable delegate within their organisation who has capacity to make the decision-to-proceed with the flight(s) (i.e. retain the risk). In making the decision-to-proceed, the applicant must act within their safety risk management system. Specific details of the information and supporting documentation required to complete DASR Form 21 - Application for a Military Permit to Fly is provided in the instruction sheets covering the form. See also DASR 21.A.707.
7.5.9.6 Flight Test. Within specialist Service Flight Test Organisations (FTOs), procedures exist to streamline MPTF applications and approvals for a range of flight test activities, such as:
Flight test activities on any Defence aircraft type to be conducted by, or under the direct supervision of, a Defence Aviation Authority (DAA)-approved FTO (all CAT 1 and 2 flight test and some CAT 4 tests)
Where Flight Test Instrumentation (FTI) or modifications are to be used, or
Where flight test operational substantiation and/or endorsement is required.
7.5.9.7 MAOs considering flight test activities are encouraged to engage their respective Service FTO or a DoSA-FT, who will advise on the process to use. See also DASR FT–Flight Test.
7.5.10.1 Only DASA (including DoSAs, within the scope of their delegation) or an organisation with the appropriate privilege can issue an MPTF. DASA will issue an MPTF (via DASR Form 20a) if it has sufficient confidence that:
The decision-to-proceed has been made by an appropriate person within the applicant’s organisation, given the characterisation of the residual risk (Note: DASA does not prescribe what this level is, nor what organisational authorisations they must hold).
The assignment of the responsibilities to implement and monitor risk controls (i.e. adherence to the approved flight conditions) is clear.
If applicable, there has been consideration that the flight conditions are compatible with any other MPTFs currently in effect for that aircraft (Note: The applicant is responsible for managing the implementation of multiple or concurrent MPTFs).
The risk context of the MPTF application is within that of the referenced flight conditions and supports the decision-to-proceed with the risk characterised by those flight conditions.
7.5.10.2 In assessing the application for an MPTF, DASA reviews the information supplied by the applicant and independently assures that it supports flying with an aircraft that does not meet the prescribed airworthiness or aviation safety requirements and may be operating at an ELOR. This will include whether the period of risk retention (the context) is defensible. While DASA does not seek to interfere in the decision-making that properly belongs to the Command Chain, or substitute its judgment for that of the Commander, DASA supports the Commander via the independent assessment that those decisions are credible and defensible.
7.5.10.3 Flight Test. When the MPTF relates to a flight test activity categorised IAW DASR.FT.05, flight conditions must be endorsed by competent staff of a MAO (as per para 22), and for a CAT 1 or 2 activity, Authority approval of flight conditions and issuing of the MPTF must be conducted by a DoSA-FT.
7.5.11.1 As the holder of an MPTF, the MAO is responsible for ensuring the flight conditions are implemented and remain effective for the duration of the MPTF. This satisfies Step 7 of the seven-step risk management process and includes ensuring the risk context supporting the approved flight conditions remains applicable for the duration of the MPTF. See also DASR 21.A.727 and DASR 21.A.708.
7.5.11.2 Configuration management. An MPTF may introduce specific aircraft configuration management requirements, especially if an MPTF covers a yet-to-be-approved modification for operational use or flight test activity. MPTF conditions may include information such as: incorporation and maintenance instructions for new modifications; periodic inspections for non-standard damage; or increased usage data recording requirements. The CAMO must be aware of MPTFs that are applicable to a given aircraft to ensure overlapping continuing airworthiness requirements are resolved or coordinated, to ensure no loss of configuration management and the appropriate aircraft technical log and maintenance documentation remains accurate.
7.5.11.3 Operation by another MAO. The holder of an MPTF is responsible for ensuring the DASR 21.A.708 flight conditions are met. However, in instances where aircraft may be transferred between MAOs, this situation requires the holder to establish suitable arrangements for the transfer of holder obligations for an aircraft (that is subject to one or more MPTFs) when operated by another MAO.
7.5.12.1 Annex B provides a non-exhaustive list of examples intended to illustrate the conduct of the MPTF process within the DASR environment. Where uncertainty exists, contact a DASA Desk Officer (DIA-TC or DAVENG), the platform DoSA, or a DoSA-FT (for MPTFs related to flight test). In addition, Annex C provides a comprehensive guide to good practice and common issues pertaining to applications for flight conditions and MPTFs.
Application for MPTF: Swim-lane flowchart
MPTF Examples within DASR Context
Successful Applications for Approval of Flight Conditions and MPTFs
DASR Form 18b - Application for Approval of Flight Conditions
DASR Form 21 - Application for a Military Permit to Fly
DASR Form 20a - Military Permit to Fly
DASA AC 003-2018 - Risk Management in the Defence Aviation Safety Program
DASA AC 002-2022 - Management of Aviation Risks to People who are not Members of the ADF
DASP Manual Chapter 7 Annex D - Repair Design Approval Scenarios
DASP Manual Chapter 7 Annex E - Propulsion System-Related Risk Analysis
DASA Intranet Site Content relating to Flight Conditions and MPTFs (Available via Intranet Only)
DASR 21 - Aircraft Design, Production and Certification
DASR 21 Subpart P - Military Permit to Fly
DASR M - Continuing Airworthiness Management
Aim
7.6.1.1 This chapter details the approval and ongoing oversight of a Military Design Organisation (MDO). A MDO is approved under DASR Part21J and can only undertake design work related to the privileges granted under that approval and within the scope of that approval. Often the scope restricts what platforms a design can be applied to and can impose further limitations to aspects of their design work if required.
Introduction
7.6.1.2 Design organisation means an organisation responsible for the design of aircraft, aircraft engines, propellers, auxiliary power units, or related parts and appliances, and holding, or applying for, type-certificates, supplemental type-certificates, changes or repair design approvals. These design organisations that design aircraft, make changes to aircraft or design repairs of aircraft, and parts and appliances, need to fulfil the requirements as defined in DASR Part 21. Such organisations need to demonstrate that they have the right organisation, procedures, competencies and resources to effectively produce the design.
Obligations
7.6.1.3 DASA impose regulatory obligations on Design Organisations as part of the approval to ensure the airworthiness of aircraft and aviation products being designed within Defence. These obligations are intended to maintain high standards of design, engineering, and manufacturing processes throughout the defence aviation industry.
7.6.4 By placing obligations on design organisations, DASA aims to assure that the design, modification, and production of aircraft, components, and systems meet appropriate airworthiness standards.
Privileges
7.6.1.5 Under the DASR construct, the authority is the controlling signatory for all product released related to the type certificate. To reduce the burden on DASA, approved organisations are typically awarded privileges that allow work to be approved on behalf of the authority. For example, a design organisation may be privileged to approve minor changes to type design as well as minor and major repairs.
7.6.1.6 Granted privileges are documented on a Form 83. The Form 83 outlines the Terms of Approval for the organisation and lists the privileges for which the organisation can utilise the approval.
Approval documentation
7.6.1.7 An organisation attains a DASR 21 MDO Approval by submitting a Form 80 Application for Military Design Organisation Approval (MDOA) for DASA consideration, or a Form 82 Application for Significant Changes to Design Organisation Approval where a MDOA is already held but scope change is needed. Along with the application, the organisation must furnish a handbook (formerly an exposition) whereby all the processes utilised under the established Design Assurance System (DAS) are detailed. The Design Organisation Handbook Requirements are outlined in Appendix 1 of Chapter 5.3 of DASP Manual Volume 3.
DASA Design organisation assurance
7.6.1.8 Once a design organisation has gained an approval to conduct design activity, DASA will schedule oversight activities in order to assure that the MDO has maintained / is maintaining their approval to the standard as governed by the DASR Pt21 regulations. For organisations maintaining a Part21 approval, DASA will look at the Organisational Structure, Responsibilities Assigned, Procedures, and Resources as detailed in the approved Design organisation handbook, as well as consideration of the quality of design products.
7.6.1.9 The DAS is effectively the Quality Management System (QMS) specific to the output of designs against the scope issued under the Form 83. The DAS can utilise elements of the organisation QMS to satisfy requirements of the DAS. The DAS and the QMS are not the same and oversight of the DAS will be conducted specifically to design products produced.
Further information
DASP Manual Vol 3 Chapter 5.3 Annex E
DASR 21 Subpart J – Military Design Organisation Approval
Aim
7.6.2.1 This chapter details the approval and ongoing oversight of a Military Production Organisation (MPO). A MPO is approved under DASR Part21 G and can only undertake production work related to the privileges granted under that approval. This includes what release documentation is acceptable under DASRs.
Introduction
7.6.2.2 Production for Defence registered aircraft is assured by DASA through the issue of Certificates of Airworthiness. For Certificates of Airworthiness to remain valid through the life of the aircraft, only components accompanied by acceptable release documentation may be installed on the aircraft. Acceptable release documentation can take various forms, depending on the means through which production is assured. Acceptable release documentation is outlined at Chapter 7.3.2.
Obligations
7.6.2.3 With a Production Organisation Approval, DASA impose a set of obligations as part of the approval and as part of its regulatory framework to ensure the safety and airworthiness of aircraft and aviation products being utilised within Defence. By placing obligations on production organisations, DASA aims to assure that the production of aircraft, components, and systems meet rigorous safety and airworthiness standards.
Privileges
7.6.2.4 Under the DASR construct, an approved MPO will be granted privileges to conduct design work to support changes to the type certificate for which the MTCH manages. Granted privileges are documented on a Form 55. The Form 55 is the certificate outlining the Terms of Approval for the organisation and lists the privileges for which the organisation can utilise the approval.
Approval documentation
7.6.2.5 An organisation attains a DASR 21 MPO Approval by submitting a Form 55 Application for Military Production Organisation Approval (MDOA) for DASA consideration, or a Form 51 Application for Significant Changes to Production Organisation Approval where an MPOA is already held but scope change is needed. Along with the application, the organisation must furnish an exposition, whereby all the processes utilised to produce the category items under the ToA are documented.
7.6.2.6 Currently, DASA will not accept applications for production without a Military Production Organisation Approval as the authority is not resourced adequately to oversight this type of approval.
DASA production organisation assurance
7.6.2.7 Once a production organisation has gained an approval to produce category items, DASA will schedule oversight activities in order to assure the MPO has maintained/is maintaining their approval to the standard as governed by the DASR 21 regulations. DASA will look at the Organisational Structure, Responsibilities Assigned, Procedures, Resources which is detailed in the approved Production Organisation Exposition.
Further information
DASA AC 004/2018—Airworthiness Recognition in the DASP
DASR 21 Subpart G – Military Production Organisation Approval
DASP Manual Vol 3 Section 5.3 Annex F
(Reserved)
(Reserved)
Introduction
7.6.5.1 This section provides guidance for the design and production of aviation software under DASR 21. This guidance does not apply to software designed or produced under recognition as defined in DASP Vol 3 Chapter 7.3.1 Production
7.6.5.2 Aviation software is classified as a ‘part or appliance’ and subject to the same rules applicable to all ‘tangible’ parts and appliances.
7.6.5.3 Aviation software refers only to software installed in an aircraft used for operating and controlling the aircraft and does not include mission system software, condition monitoring software, aeronautical information or ground-based aircraft diagnostic systems.
7.6.5.4 For the context of aviation software, the following definitions apply:
Manufacturing – is the development of aviation software, including compiling of source code into executable object code.
Production – is the process of preparing aviation software for distribution, including packaging the executable object code and associated engineering and technical data on distribution media.
Replication – is the process of copying aviation software (executable object code) that has been authorised through a production process.
Certification of Aviation Software
7.6.5.5 Organisations manufacturing software for installation on Defence registered aircraft must hold a Military Design Organisation Approval (MDOA) under DASR 21 Subpart J. The development of new (or the modification of existing) aviation software is a change to a product’s type design and must be approved under DASR 21 Subpart D or E. For changes to aviation software classified as minor, a minor change approval can be issued by an organisation holding an MDOA in accordance with its Terms of Approval. For changes to aviation software classified as major, the approval must be issued by DASA as either an amended Military Type Certificate (MTC) or a Military Supplemental Type Certificate (MSTC).
Production of Aviation Software
7.6.5.6 The production of software is the responsibility of an organisation holding an appropriate Military Production Organisation Approval (MPOA) and the release of aviation software for installation on a Defence registered aircraft is via a DASR Form 1. The software’s ‘part’ number (version) should be marked on the media hosting the software for installation, in accordance with the requirements of DASR 21 Subpart Q.
7.6.5.7 DASR 21 does not allow the production of aviation software under an organisation’s MDOA Terms of Approval. Organisations producing aviation software for installation in Defence registered aircraft must meet the requirements of DASR 21 Subpart G—Military Production Organisation Approval in order to obtain privileges to release the software for installation.
Replication of Aviation Software
7.6.5.8 Software authorised for installation on a Defence registered aircraft via a DASR Form 1 and provided to the Continuing Airworthiness Maintenance Organisation (CAMO) may be replicated by an Approved Maintenance Organisation (AMO) in accordance with OEM or DASR 21 MDO approved procedures. It is the responsibility of the CAMO or AMO to ensure that their quality systems have processes in place to manage and verify the integrity of the replicated software. This is typically done using a checksum value that is generated during production of software and provided to the CAMO or AMO alongside the produced software.
7.6.5.9 Any software replication process should also include a step to ensure the software’s ‘part’ number (version) is marked on the media hosting the software for installation, in accordance with the requirements of DASR 21 Subpart Q.
Organisation Approval Requirements
7.6.5.10 Development and production of software are often done by the same organisation. In this case, the organisation must hold both a MDOA under DASR 21 Subpart J and a MPOA under DASR 21 Subpart G in order to obtain the necessary privileges to approve the development and production of aviation software. Typically, there are no organisations with an MPOA with software scope without a corresponding MDOA with software scope.
7.6.5.11 Underpinning these organisation approvals and privileges are a Design Assurance System documented in a Handbook (Design Organisation Exposition/DOE), and a Production Quality System documented in a Production Organisation Exposition (POE). For a software development and production organisation, it is not necessary to have discrete and dedicated stand-alone procedures manuals entitled ‘DOE’ or ‘POE’ to meet both sets of organisation approval requirements. A single manual, document (irrespective of its title) or set of procedures that covers the development and production of software may simultaneously meet the requirements of both a DOE and POE.
7.6.5.12 The regulatory requirements of a DOE (DASR 21.A.243) and a POE (DASR 21.A.143) are the minimum required of such a manual or document to be awarded the relevant organisation approval and privileges. Any manual or document(s) identified as a DOE/POE (or both simultaneously) should be a working level document(s) published for use by personnel working in the organisation. The DOE/POE should not be written purely to satisfy regulatory requirements, although this aspect will be assessed by DASA when reviewing the working level documentation and the organisation’s staff’s understanding of it.
Further Reading
DASR 21 Subpart G – Military Production Organisation approval
DASR 21 Subpart F – Production without Military Production Organisation approval
DASR 21 Subpart K – Parts and Appliances
Introduction
7.6.6.1 This DASPMAN section explains what Military Design Organisations (MDO) and Military Type Certification Holders (MTCH) must consider when performing design activities on aircraft systems containing explosives and integrating air-launched stores containing explosives onto aircraft8282. Such design activities include physical design changes to systems and equipment containing explosives, assessments that unrelated design changes do not adversely impact explosive safety, changes to Airworthiness Limitations (AwL), changes to explosives-related Instructions for Continuing Airworthiness (ICA), monitoring for new explosive-related hazards within safety management systems (SMS), and aircraft stores compatibility engineering activities.
What is an explosive?
7.6.6.2 An explosive is ‘… a substance manufactured with a view to producing an explosion or pyrotechnic effect8383.'Many Defence aircraft contain explosives, either forming part of an aircraft system (such as ejection seats) and within air-launched stores such as bombs, missiles and gun ammunition8484.
Explosives requirements within Type Certification Basis
7.6.6.3 In deciding what type of explosive requirements should be included in an aircraft’s Type Certification Basis (TCB) the key document is the European Military Airworthiness Certification Criteria (EMACC) published by the European Defence Agency. The EMACC indicates that all explosives forming part of an aircraft system should be considered when developing TCB requirements. Accordingly, the TCB should include explosive-related requirements during initial certification and when MDOs develop major or minor changes to the type design.
7.6.6.4 For aircraft stores containing explosives the EMACC implies that the TCB should only consider requirements relevant to the installation, integration and interface of the aircraft and stores. That is, the TCB should only include explosive-related design requirements to the extent they affect the store’s installation, integration and interface. Any subsequent major or minor changes to the type design should also only consider the installation, integration and interface of the store.
Legislative requirements
7.6.6.5 The legislation relevant to the safe design, maintenance and operation of Defence aircraft containing explosives is the Work Health and Safety Act (Cth) 2011 (the WHS Act), the Explosives Act (Cth) 1961, and their subordinate regulations.
Explosive Safety Regulatory Framework
7.6.6.6 To comply with their explosive-related obligations under all this legislation, MDOs and MTCHs must understand Defence’s Explosive Safety Regulatory Framework (ESRF), which amplifies this legislation for the explosives context. The ESRF purpose is to provide a Defence-wide explosive safety risk management framework which ensures explosives safety risks are effectively managed. Explosives safety aims to ‘… prevent premature, unintentional, or unauthorised initiation of explosives and devices containing explosives; and with minimising the effects of explosions, combustion, toxicity, and any other deleterious effects’8585.Within the ESRF, Director General Explosive Ordnance (DGEO) is the Explosive Ordnance Safety Regulator (EOSR), supported by the Director of Ordnance Safety (DOS).
7.6.6.7 Under the ESRF, the safe conduct of activities involving explosives (including design) requires adherence to the following three fundamental concepts:
Explosives must be designed and manufactured to design requirements so as to eliminate or minimise explosives safety hazards so far as is reasonably practicable. This concept is referred to as ‘safety and suitability for service’ (S3).
Activities involving explosives must be conducted at locations where the consequence of an explosives safety mishap is understood, and risks are minimised (referred to as a ‘safe location’).
Activities involving explosives must be conducted through safe work practices, conducted by trained and competent personnel, which will minimise both the likelihood and consequences of an explosives safety mishap (referred to as ‘safe work practices’).
7.6.6.8 In applying these three concepts, the ESRF provides requirements (12 principles and 28 regulations) and guidance relevant to the design, production, operation, maintenance, handling, storage and transport of explosives throughout its lifecycle.
7.6.6.9 The ESRF is documented within the following Defence Explosive Ordnance Publications (DEOP):
DEOP 100 comprises three volumes of which only Volume 2 Defence Explosives Safety Regulatory Framework has been issued. Volume 2 describes the 12 mandatory principles of the ESRF, not all of which are relevant to aviation design activities. For each principle, information is provided on its rationale, the expected outcome, the constraints, obligations, external requirements and controls. DEOP 100 Volume 2 also describes the ESRF risk management and assurance processes. The ESRF relies on organisational compliance with its mandatory requirements but does not provide organisational certifications.
DEOP 101 provides the 28 ESRF regulations with not all applying to aviation design activities. The regulations are not in a standard format, but most comprise a general overview, the requirements, responsibilities and any accompanying procedures. Each of the 28 regulations contain some mandatory requirements.
DEOP 102 provides information relevant to assessing the ‘Safety and Suitability for Service of Defence Explosive Ordnance’. The publication mentions the 12 principles and the 28 regulations, while providing no further requirements relevant to aviation design activities. This DEOP also discusses several explosive-related hazards8686.
7.6.6.10 Within the ESRF, the EOSR releases Defence Explosives Safety Advisory Circulars (ESAC) to promulgate important safety information. ESACs do not mandate any actions, but provide informed, well-considered safety advice and guidance. ESACs can be accessed at: drnet/JCG/JLC/ExplosiveOrdnance/DOS/Pages/ESRF.aspx (Available on DPN Only)
Relationship between the DASF and ESRF
7.6.6.11 The ESRF is specifically intended to integrate with and support other Defence regulatory frameworks that aim to achieve safety outcomes, including aviation safety. Comparison of the DASF and ESRF demonstrates that regulated organisations within the DASF can comply with both the Defence Aviation Safety Regulations (DASR) and relevant ESRF requirements, with no inconsistencies between the two safety frameworks. Importantly, both safety frameworks are subject to the WHS Act’s concept of shared duty holders (s16), who must consult, co-operate and co-ordinate their activities (s46) to ensure explosive-related risks are eliminated or otherwise minimised so far as is reasonably practicable (s17).
7.6.6.12 DASA regulates the design of aircraft systems and the integration of all air-launched stores onto a type. Complementing these regulations, DGEO provides mandatory explosive-related requirements (both principles and regulations) for the design of aircraft systems containing explosives and air-launched stores containing explosives.
7.6.6.13 The S3 construct within the ESRF requires consideration of the hazards posed to explosives safety by carriage environments. Accordingly, the ESRF requires designers to consider whether the failure or partial performance of the non-explosive components of aircraft stores adversely affects the safety of the explosives within the store. Forms of component failure or partial performance that do not affect explosive safety are outside the ESRF scope, but are considered by Guided Weapons and Explosive Ordnance Group (GWEO) as part of its broader safety responsibilities.
ESRF applicability to DASR 21 scope
7.6.6.14 Several ESRF principles and regulations fall within the scope of DASR 21. Specifically:
ten of the 12 ESRF principles (Principles 1-10) impose obligations on aircraft designers within MDOs and MTCH organisations
all of these ten principles fall within the scope of DASR 21
compliance with DASR 21 provides total compliance with one principle (Principle 1), partial compliance with eight principles (Principles 2, 3, 5, 6, 7, 8, 9 and 10) and no compliance with one principle (Principle 4)
only four of the 28 ESRF regulations (1.1, 1.2, 1.5 and 2.5) within DEOP 101 impose obligations on aviation designers within MDOs and MTCH organisations
of these four regulations, three fall within the scope of DASR 21 (1.1, 1.5 and 2.5)
compliance with DASR 21 provides only partial compliance with these three regulations.
7.6.6.15 These principles and regulations within the scope of DASR 21 provide no limits or constraints on which individuals or organisations within Defence may perform design activities for aircraft systems and aircraft stores containing explosives.
Satisfying applicable ESRF requirements
7.6.6.16 Compliance with DASR 21 provides total or partial compliance with several mandatory ESRF principles and regulations. To achieve full compliance, MDOs and MTCHs must:
obtain explosives safety hazard and risk management advice from personnel and organisations competent in explosives safety management (refer paragraph 7.6.6.18)
when complying with DASR SMS, ensure that consideration is given to explosive-specific hazards and risks
ensure that explosives safety hazards and residual risks of explosives are identified and communicated to affected Services, Groups and others (including non-Defence entities)
aim to reduce the consequences of on-aircraft explosive hazards through careful design of where explosives are located in the aircraft and the quantity of explosives used
ensure that personnel performing design activities on aircraft systems and air-launched stores containing explosives receive explosive-related training compliant with ESRF Regulation 1.1 (eDEOP 101)8787
when creating Instructions for Continuing Airworthiness (ICA) for aircraft systems and air-launched stores containing explosives, be aware of the inspection requirements in ESRF Regulation 1.5 (eDEOP 101)
when engaged in the process for the initial certification of explosives installed in aircraft systems and amendments to their life limits, comply with the process described in Annex B.
7.6.6.17 While outside the scope of DASR 21, where MDOs handle explosives as part of the design process, they should ensure their sites, platforms and facilities have the necessary facility certifications, and that the minimum number of people are exposed and are aware of the risks.
Explosives safety hazard and risk management advice
7.6.6.18 MDOs and MTCHs can obtain explosives safety hazard and risk management advice from the following organisations competent in explosives safety management:
the Directorate of Ordnance Safety within Joint Logistics Command
Joint Proof and Experimental Unit within Joint Logistics Command
Aerospace Explosive Ordnance Systems Program Office within GWEO
Directorate of Engineering and Technical within GWEO’s Systems Division.
7.6.6.19 MDOs and MTCHs should have confidence in the explosives safety hazard and risk management advice provided by these organisations because they:
have roles (either regulatory or in-practice) that require them to comprehensively understand explosive safety hazards and risks
are subject to the requirements of the well-established ESRF and will provide advice compliant with all relevant ESRF principles and regulations
have an extensive demonstrated history of providing safe explosives advice across Defence, including to the aviation community
work within well-developed engineering frameworks that have evolved over several years.
7.6.6.20 MDOs and MTCHs can consume explosives safety hazard and risk management advice from these specified organisations, without the need to invoke DASR 21.A.239. That is, they do not need to consider these organisations as a ‘… partner or subcontractor’ and are not obliged to specify the manner in which the MDO/MTCH design assurance system accounts for the acceptability of the advice provided by these external organisations or specialist personnel within them.
7.6.6.21 Some forms of advice may not need be obtained case-by-case but could be obtained as a ‘standing’ advice relevant to a particular type of design change whenever it occurred (for example a proposed change to a component throwaway life or maintenance interval). The relevance of specific ‘standing’ advice to a new circumstance would depend on the aircraft type, the form of explosives, the aircraft’s operating environment and its specific sustainment arrangements.
7.6.6.22 The relationships that MDOs establish with specialist explosives organisations should be documented in the Handbook (Design Organisation Exposition), required by DASR 21.A.243. Similarly, MTCHs should documents their relationships in the Type Continued Airworthiness Exposition required by GM 21.A.14(c) and discussed at DASPMAN Chapter 5.3 Annex J Appendix 1.
Other guidance
7.6.6.23 A variety of other Defence stakeholders can contribute to the safe design of aircraft systems containing explosives and the safe integration of air-launched stores containing explosives. Such organisations include:
Maintenance organisations - to understand the maintenance implications of design decisions and the utility of proposed ICA relating to explosives
CAMOs - to understand the continuing airworthiness implications of explosive-related design decisions, such as the potential need for pre-flight inspections and the effect of explosive-related component lives on the aircraft maintenance program
MAOs - to understand the operational implications of explosives-related design decisions, such as preferred aircrew actions for stores release
DASA - to understand the scope of the ability to approve minor explosives-related design changes
Organisations who transport and store explosives. Organisations within various Defence Groups and Services, whose primary roles is transporting and storing explosives, would not usually be a source of explosives design safety advice. Nevertheless, there may be occasions when MDOs should seek information from them that provides necessary context for design activities.
Design activities for aircraft systems containing explosives
7.6.6.24 An aircraft system may contain explosives, usually to separate an air-launched store from the aircraft, but sometimes to separate parts of the aircraft such as ejection seats and cockpit canopies. Specific guidance on the design activities for aircraft systems containing explosives is provided in Annex A.
Design activities for ALSE/role equipment containing explosives but not part of the aircraft’s type design
7.6.6.25 ALSE/Role equipment containing explosives, but not part of the aircraft type design, are outside the scope of this chapter. Nevertheless, the ESRF requirements at 7.6.6.16 a/c/d/e still apply to organisations performing relevant design activities.
Design activities for air-launched stores containing explosives
7.6.6.26 An air-launched store is an aircraft store that is intended to be separated from an aircraft in flight. Some air-launched stores contain explosives:
to separate the store from the aircraft (such as some chaff, some flares, some sonobuoys and gun ammunition)8888
to create an explosive effect post separation (such as bombs, missiles and flares)
for both purposes.
7.6.6.27 Design activities on the explosives within air-launched stores are outside an MDO’s scope, performed within the scope of GWEO organisations.
7.6.6.28 Specific guidance on the integration of air-launched stores containing explosives, which is within the MDO/MTCH scopes, is provided in Annex B.
Annexes
Design activities for aircraft systems containing explosives